Result of my research about current situation with #deserialization vulns in #javascript / #nodejs acunetix.com/blog/web-secur… #hacking #PenTest

ZeroNights 2018. November 20-21, Saint-Petersburg, Russia. CFP is open! Buy tickets! 2018.zeronights.org

🧡🧡🧡

МОЙ ПИТОН ПРОСТО БЕСПОДОБЕН МОЙ ПИТОН ХАСКЕЛЮ ПОДОБЕН МОЙ ПИТОН ЛИБАМИ ОБЛОЖЕН ТВОЙ ЖАВАСКРИПТ ОЧЕНБ ЗАТОРМОЖЕН МОЙ ПИТОН НОМЕР ПЕРВЫЙ В МИРЕ ТВОЙ ЖС ПРОСТО ХАРАКИРИ МОЙ ПИТОН ДЖАНГУ ПОДНИМАЕТ ТВОЙ ЖАВАСКРИПТ ИНДУС ЛИШЬ ПОНИМАЕТ МОЙ ПИТОН ВЕБА ПОБЕДИТЕЛЬ ТВОЙ ЖС БАБЛА РАСХИТИТЕЛЬ

A sort of akamai bypass (might be site specific - god knows): </span><!></div><!></div><!><x onbeforescriptexecute=alert`2`>

Also works for akamai in case of attributes: "onauxclick%3d"alert`1`" As if someone's interested

Lesson learned with Openvas: if Scanner gets stuck - check redis-server logs for `Can't save in background: fork: Cannot allocate memory`. Might be worth doing `echo "vm.overcommit_memory=1" >> /etc/sysctl.conf && sysctl -p /etc/sysctl.conf`

The early bird catches the worm. #ZeroNights 2019 held on 12-13 November in Saint Petersburg Only 50 special price tickets are available with promo code ZN-oouk8Q3V-19. Feel free to use it till the end of July.

Today I've gone crazy. Proudly present to the world - web goose! 😂 Powerful asistent with #bugbounty programs and #pentest . He knows #web at the level of professionals. RT for luck with BB🙃

About the "security issue" on #VLC : VLC is not vulnerable. tl;dr: the issue is in a 3rd party library, called libebml, which was fixed more than 16 months ago. VLC since version 3.0.3 has the correct version shipped, and MITRE did not even check their claim. Thread:

#ZeroNights 2019 CFP is OPEN: Offensive and defensive research (15/30/45min). Submit your talk! 01x.cfp.zeronights.ru/zn2019/ Please RT!

hacktory.ai super promising gamified security training startup. Gonna check it out

Say goodbye to SSRF on AWS EC2 Instances aws.amazon.com/blogs/security…

If you wanna learn security, have a look at hacktory.ai, they just published a complete web security course

I want to say huge thanks to JS0N Haddix for sharing your stories, techniques, and experience! Also, I want to say thanks to shubs. And of course thanks ProjectDiscovery 🙌🏻 medium.com/@valeriyshevch…

Looks like a self-hosted pentest collab/mgmt tool that we finally deserve. Still not perfect but with a huge potential.

A Red Teamer's guide to pivoting #infosec #pentest #pivoting #redteam artkond.com/2017/03/23/piv…

New post: Autobinding vulns and #SpringMVC agrrrdog.blogspot.ru/2017/03/autobi…

You Should Learn Regex : blog.patricktriest.com/you-should-lea…