sectoolmarket.com

antoanthongtin.wordpress.com

Venom | Km3's security notes

https://antoanthongtin.wordpress.com/author/ktavpro

Km3's security notes. We learn it , we share it. March 25, 2014. WinRAR 0 day (File Extension Spoofing). Lỗ hổng 0 day trên WinRAR cho phép fake tên file được nén dạng .zip. Đây là điểm yếu chuyên gia bảo mật quốc tế phát hiện trong vài ngày qua. Trước tiên, chúng ta cần hiểu một số thuộc tín của dạng nén. Bỏ qua những cái lằng nhằng bên trên, ta có thể thấy tên file được định nghĩa từ offset thứ 30. File nén .zip cũng tương tự như vậy nhưng WinRAR còn đệm thêm một số ký tự đệm vào:. Và đây là kết quả.

blog.jameswebb.me

blog.jameswebb.me: 10 Useful Firefox Plugins For Pen-Testing

http://blog.jameswebb.me/2013/09/10-useful-firefox-plugins-for-pen.html

Security Program Management,Data Forensics, Incident Response, Penetration Testing. Thursday, September 12, 2013. 10 Useful Firefox Plugins For Pen-Testing. Weaponizing Your Web Browser. An ordinary web-browser is already in many ways an extremely versatile security tool. However with the addition of just a few select plugins, you can also easily configure your browser to provide a application security assessment platform. DefendLink - Appsec Addons Collection. Johan Adriaans, Pedro Laguna. Https:/ addon...

binhduong-ug.blogspot.com

tháng một 2013 | Dương-UG Blog's | Nguyễn Bình Dương

http://binhduong-ug.blogspot.com/2013_01_01_archive.html

Cách gửi email mã hóa qua Gmail trên Chrome. Phần mở rộng (extension) miễn phí của Google Chrome cho phép gửi đi email được mã hóa từ Gmail tới các dịch vụ email khác. Bạn cần gửi đi một email chứa thông tin nhạy cảm? Mọi email gửi đi theo cách thông thường đều có nguy cơ bị chặn hoặc bị “hack” trước khi đến tay người nhận. Để đề phòng điều này, bạn có thể sử dụng một phần mở rộng (extension) miễn phí cho Google Chrome có tên SafeGmail. SafeGmail cho phép bạn gửi đi các email đã mã hóa. Nhập một câu hỏi ...

orenh.com

Oren Hafif: February 2014

http://www.orenh.com/2014_02_01_archive.html

Application Security, Web Application Security and Penetration Testing. This is a personal blog which represents only my personal views. Tuesday, February 11, 2014. CVE-2014-0050: Exploit with boundaries, Loops without boundaries. You are more than invited to read the post I wrote on the SpiderLabs blog. The post include analysis of the vulnerability, exploit and recommendations. You can find the post here:. Posted by Oren Hafif. Subscribe to: Posts (Atom). Google Online Security Blog. 169; Oren Hafif.

orenh.com

Oren Hafif: Google Account Recovery Vulnerability

http://www.orenh.com/2013/11/google-account-recovery-vulnerability.html

Application Security, Web Application Security and Penetration Testing. This is a personal blog which represents only my personal views. Thursday, November 21, 2013. Google Account Recovery Vulnerability. Global Main Authentication and Identification Library (GMAIL). So let's say you are using Paypal, Facebook or Twitter, and you forgot your password (shit happens, right? 8211; you are! More about this can be viewed on a video by "security researcher" Don Friesen http:/ www.youtube.com/watch? It's the pa...

orenh.com

Oren Hafif: November 2013

http://www.orenh.com/2013_11_01_archive.html

Application Security, Web Application Security and Penetration Testing. This is a personal blog which represents only my personal views. Thursday, November 21, 2013. Google Account Recovery Vulnerability. Global Main Authentication and Identification Library (GMAIL). So let's say you are using Paypal, Facebook or Twitter, and you forgot your password (shit happens, right? 8211; you are! More about this can be viewed on a video by "security researcher" Don Friesen http:/ www.youtube.com/watch? It's the pa...

orenh.com

Oren Hafif: Publications

http://www.orenh.com/p/publications.html

Application Security, Web Application Security and Penetration Testing. This is a personal blog which represents only my personal views. A new web vulnerability that is applicable for Google, Microsoft, Facebook, Yahoo, Mozila and more (2013 – to be published). IIS Shortname Scanning Tool (2013 – to be published). 3 Paypal XSS - (2013 – to be published). Google XSS enabled by CSRF and Flow-Bypass (2013 – to be published). Google Plus "wormable" Click-Jacking vulnerability (2013 – to be published). Adobe ...

orenh.com

Oren Hafif: One Token to Rule Them All - The Tale of the Leaked Gmail Addresses

http://www.orenh.com/2014/06/one-token-to-rule-them-all-tale-of.html

Application Security, Web Application Security and Penetration Testing. This is a personal blog which represents only my personal views. Tuesday, June 10, 2014. One Token to Rule Them All - The Tale of the Leaked Gmail Addresses. Since I don't really know where to start, let's start at the end. At the very end of this attack, I am going to hold what appears to be every single email address hosted on Google. So what? I mean why is that such a big deal? From a username to full account takeover. Well until ...