Published a new writeup: "HackTheBox - White Rabbit" hg8.sh/posts/whiter... #hackthebox #ctf #writeup
πππΎ
@hg8.sh
Security Researcher & Privacy Activist. DM are welcome for any questions. -- Website: https://hg8.sh Post history on Twitter: @_hg8_
"CVE-2025-32463: sudo local privilege escalation via chroot option" An attacker can leverage sudo's -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file. Sudo versions 1.9.14 to 1.9.17 affected. www.openwall.com/lists/oss-se... #infosec #cve
oss-security - CVE-2025-32463: sudo local privilege escalation via chroot option
openwall.com
"TensorFlow Remote Code Execution with Malicious Model" Old technique but good writeup splint.gitbook.io/cyberblog/se... #ctf #tensorflow #ai #infosec
TensorFlow Remote Code Execution with Malicious Model | CyberBlog
The purpose of this article is to show how to get RCE when a crafted malicious Tensorflow model is loaded. Remember all of this is for educational purposes only! Don't be mean!
splint.gitbook.io
"Funky chunks: abusing ambiguous chunk line terminators for request smuggling" w4ke.info/2025/06/18/f... #infosec
"Getting RCE on Monero forums with wrapwrap" Cool finding. This would make a cool CTF challenge π swap.gs/posts/monero... #rce #ctf
Getting RCE on Monero forums with wrapwrap
breakpoint of no return
swap.gs
"Riding The Time Machine: Journey Through An Old vBulletin PHP Object Injection" Another good potential for a CTF challenge! π karmainsecurity.com/riding-the-t... #infosec #rce #ctf
Riding The Time Machine: Journey Through An Old vBulletin PHP Object Injection | Karma(In)Security
This is the personal website of Egidio Romano, a very curious guy from Sicily, Italy. He's a computer security enthusiast, particularly addicted to webapp security.
karmainsecurity.com
"Weaponizing Dependabot: Pwn Request at its finest" TL;DR: Through "Confused Deputy" attacks Dependabot (and other GitHub bots), can be tricked into merging malicious code. It can escalate to full command injection via crafted branch names. boostsecurity.io/blog/weaponi... #infosec
Weaponizing Dependabot: Pwn Request at its finest
Learn how Dependabot can be co-opted to exploit some sensitive workflows, through the Confused Deputy Problem and branch name injections.
boostsecurity.io
"Root Shell on Credit Card Terminal" stefan-gloor.ch/yomani-hack #infosec #re #reverseengineering
Root Shell on Credit Card Terminal
stefan-gloor.ch
"From Reverse Engineering to Cheat Development: Internal Game Hacks with AssaultCube" Bit outdated (DirectX9) but still some very valuable info and a great writeup π adminions.ca/books/articl... #infosec #re
Part 2 - From Reverse ... | ADMinions
Introduction In this guide, weβll walk step-by-step through building a fully functional internal che...
adminions.ca
"Authenticated Remote Code Execution in Netwrix Password Secure (CVE-2025-26817)" That will make a nice CTF challenge ^ www.8com.de/cyber-securi... #infosec #cve #rce
cve-2025-26817 netwrix rce
Authenticated Remote Code Execution Vulnerability in Netwrix Password Secure
8com.de
"GitHub MCP Exploited: Accessing private repositories via Model Context Protocol" invariantlabs.ai/blog/mcp-git...
GitHub MCP Exploited: Accessing private repositories via MCP
We showcase a critical vulnerability with the official GitHub MCP server, allowing attackers to access private repository data. The vulnerability is among the first discovered by Invariant's security ...
invariantlabs.ai
"Uncovering a crazy privilege escalation from Chrome extensions - CVE-2023-4369" (2023) 0x44.xyz/blog/cve-202... #infosec #cve #privesc
Uncovering a crazy privilege escalation from Chrome extensions
What's the worst thing a Chrome extension could do to you?
0x44.xyz
"Fixing Security Vulnerabilities with AI in OSS-Fuzz" arxiv.org/abs/2411.03346 #infosec #ai #fuzzing #oss-fuzz
Fixing Security Vulnerabilities with AI in OSS-Fuzz
Critical open source software systems undergo significant validation in the form of lengthy fuzz campaigns. The fuzz campaigns typically conduct a biased random search over the domain of program input...
arxiv.org
"One-Click RCE in ASUSβs Preinstalled Driver Software" mrbruh.com/asusdriverhub/ #infosec #re
One-Click RCE in ASUS's Preinstalled Driver Software
One-Click RCE in ASUSβs Preinstalled Driver Software Part Two of this series on ASUS will be dropping within a week, yes it somehow manages to get worse Introduction This story begins with a conversat...
mrbruh.com
"Don't Call That "Protected" Method: Dissecting an N-Day vBulletin RCE" karmainsecurity.com/dont-call-th... #infosec #rce #vbulletin
Don't Call That "Protected" Method: Dissecting an N-Day vBulletin RCE | Karma(In)Security
This is the personal website of Egidio Romano, a very curious guy from Sicily, Italy. He's a computer security enthusiast, particularly addicted to webapp security.
karmainsecurity.com
ZathuraDbg: An emulation based tool for learning and debugging assembly. github.com/ZathuraDbg/Z... #infosec
GitHub - ZathuraDbg/ZathuraDbg: An emulation based tool for learning and debugging assembly.
An emulation based tool for learning and debugging assembly. - ZathuraDbg/ZathuraDbg
github.com
"Compromising Real-WorldLLM-Integrated Applications with Indirect Prompt Injection" arxiv.org/pdf/2302.12173
arxiv.org
"An Introduction to Google's Approach for Secure AI Agents" research.google/pubs/an-intr... #infosec
Google's Approach for Secure AI Agents
research.google
"What a Binance CAPTCHA solver tells us about todayβs bot threats" blog.castle.io/what-a-binan... #infosec #captcha
What a Binance CAPTCHA solver tells us about todayβs bot threats
In this post, we analyze an open-source CAPTCHA solver designed to bypass a custom challenge deployed on Binance, one of the most popular crypto platforms. While the solver is publicly available, weβv...
blog.castle.io
Three Trail of Bits engineers audited core Go cryptography for a month and found only one low-sev security issue... in unsupported Go+BoringCrypto! πΎ Years of efforts on testing, limiting complexity, safe APIs, and readability have paid off! β¨ Yes I am taking a victory lap. No I am not sorry. π
Go Cryptography Security Audit
Go's cryptography libraries underwent an audit by Trail of Bits. Read more about the scope and results.
go.dev
"DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage's archive server" micahflee.com/ddosecrets-p...
DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage's archive server
This morning, Distributed Denial of Secrets published 410 GB of data hacked from TeleMessage, the Israeli firm that makes modified versions of Signal, WhatsApp, Telegram, and WeChat that centrally arc...
micahflee.com
"Dolla dolla bill, y'all" - Reverse engineering a banknote validator. something.fromnothing.blog/posts/dolla-... #infosec #reverseengineering
"Statistical Analysis to Detect Uncommon Code (2023)" synthesis.to/2023/01/26/u...
Statistical Analysis to Detect Uncommon CodeStatistical Analysis to Detect Uncommon Code
synthesis.to
"Skitnet(Bossnet) Malware Analysis" catalyst.prodaft.com/public/repor... #infosec #malware
Prodaft CATALYST
catalyst.prodaft.com
"Commit Stomping: Manipulating Git Histories to Obscure the Truth" blog.zsec.uk/commit-stomp... #infosec #redteam
Commit Stomping
Manipulating Git Histories to Obscure the Truth
blog.zsec.uk
"Stateful Connection With Spoofed Source IP β NetImpostor" Tl;Dr: Writeup reviews the technique for establishing a full stateful TCP connection with a spoofed source IP address from the same subnet using ARP poisoning. tastypepperoni.medium.com/stateful-con... #infosec
Stateful Connection With Spoofed Source IPβββNetImpostor
Overview
tastypepperoni.medium.com
7-Zip ZSTD Buffer Overflow Vulnerability (CVE-2024-11477) www.crowdfense.com/cve-2024-114... #infosec #cve Full write-up: github.com/TheN00bBuild...
CVE-2024-11477- 7-Zip ZSTD Buffer Overflow Vulnerability - Crowdfense
CVE-2024-11477, a buffer overflow vulnerability in 7-Zip's ZSTD decompression algorithm; explore the technical details.
crowdfense.com
"One-Click RCE in ASUSβs Preinstalled Driver Software" mrbruh.com/asusdriverhub/ #infosec #rce
MrBruh's Epic Blog
One-Click RCE in ASUSβs Preinstalled Driver Software Part Two of this series on ASUS will be dropping within a week, yes it somehow manages to get worse Introduction This story begins with a conversat...
mrbruh.com
DarkWidow: Indirect Dynamic Syscall, SSN + Syscall address sorting via Modified TartarusGate approach + Remote Process Injection via APC Early Bird + Spawns a sacrificial Process as target process + (ACG+BlockDll) mitigation policy on spawned process github.com/reveng007/Da... #infosec
GitHub - reveng007/DarkWidow: Indirect Dynamic Syscall, SSN + Syscall address sorting via Modified TartarusGate approach + Remote Process Injection via APC Early Bird + Spawns a sacrificial Process as...
Indirect Dynamic Syscall, SSN + Syscall address sorting via Modified TartarusGate approach + Remote Process Injection via APC Early Bird + Spawns a sacrificial Process as target process + (ACG+Bloc...
github.com
