Dormant Last read · last published · next check
Read 2 days ago and current, but nothing has been published for 14 months.
Files deleted via the Wire interface are not actually removed from the server. Moreover, anyone who knows an asset's UUID can retrieve the encrypted file, even if they aren't part of the original conversation.
A case study in using AFL++, afl-cov and basic custom harnesses to find a bug in libsoup for a public bug bounty program.
This article describes the F5 BIG-IP CVE-2024-45844 root cause.
This article describes in details how the F5 Secure Vault works. Security weaknesses were found during this analysis.
This article describes multiple post-exploitation techniques specific for F5 BIG-IP. It includes capabilities like intercepting/decrypting TLS traffic or decrypting secrets in the Secure Vault. Detection methods are provided for Blue Teams.
Understanding the different types of LDAP authentication methods is fundamental to apprehend subjects such as relay attacks or countermeasures. This post introduces them through the lens of Python libraries.
The Windows Installer accesses the MSI files in C:\Windows\Installer while impersonating the user (and using the impersonated user's device map), and trusts these files to perform elevated/privileged operations such as registry key creation. This can be abused by an unprivileged user to obtain SYSTEM privileges.
This write-up details how CVE-2023-28879 - an RCE in Ghostscript - was found and exploited. Due to the prevalence of Ghostscript in PostScript processing, this vulnerability may be reachable in many applications that process images or PDF files (think ImageMagick, PIL, etc.), making this an important one to patch and look out for.
Yannick's write-up for the 2022 SANS Christmas Challenge .
A certificate obtained through Active Directory Certificate Services is usually used to get a TGT or recover the NT hash using PKINIT. But what can we do when it's not possible?