Collaborate Disseminate
Two flaws in Microsoft’s cloud-based Azure App Services could have allowed server-side forgery request (SSFR) and remote code-execution attacks. Continue reading Microsoft Azure Flaws Open Admin Servers to Takeover
I have a server, which receives text mails from students and I plan to automatically collect their message bodys and parse them as markdown so that I can generate a nicely formatted output as pdf. Is there anything I need to be cautious of… Continue reading Is it safe to automatically parse text as markdown?
I uploaded a PHP web shell to a site, and to bypass the file upload restriction, I used a .php.jpg extension.
When I open my shell with a web browser, it doesn’t execute (confirmed with a packet capture) but when I open it with curl, it re… Continue reading Can’t execute shell i uploaded with cURL
I (will) have a binary executable file. It’s only permission is user-execute. It cannot be read by user, group, or world. The owner of the file is the Apache user. I don’t want the apache user to be able to read the file, but I do want the… Continue reading Protect password from apache user by making file executable-only
Adobe has released patches for critical and important-severity flaws in its popular Magento e-commerce platform. Continue reading Critical Magento Flaws Allow Code Execution
The software giant released patches for four critical vulnerabilities and five different platforms. Continue reading Adobe Discloses Critical Code-Execution Bugs in July Update
Exploitation of the bug can allow an attacker to lift sensitive information, delete files, execute code, carry out sabotage and more. Continue reading Critical SAP Bug Allows Full Enterprise System Takeover
I have been learning and implementing Process Hollowing attacks, and even after I got the thing work, I have some questions.
Why aren’t we building the IAT when we load our injected PE? All we do is copy the headers and the sections, fix … Continue reading Process hollowing and the Import Address Table
The Homeplug device, from Tenda, suffers from web server bugs as well as a DoS flaw. Continue reading Unpatched Wi-Fi Extender Opens Home Networks to Remote Control
The Homeplug device, from Tenda, suffers from web server bugs as well as a DoS flaw. Continue reading Unpatched Wi-Fi Extender Opens Home Networks to Remote Control