Beginners Guide to 0day/CVE AppSec Research

A collection of useful links for Pentesters

NSA Codebreaker Challenge

The cybersecurity skills gap is a people problem, but it's not just about finding enough people to operate tools, the tools won't fix it.

A Razer Synapse zero-day vulnerability has been disclosed on Twitter, allowing you to gain Windows admin privileges simply by plugging in a Razer mouse or keyboard.

Microsoft ramps up warnings about an apparent low-tech attacker that's adopting more sophisticated techniques.

Threat actors actively exploit a critical authentication bypass vulnerability impacting home routers with Arcadyan firmware to take them over and deploy Mirai botnet malicious payloads.

Intrusions have become even more costly to the enterprise due to double-extortion tactics.

New web targets for the discerning hacker

High speed/Low cost CommonCrawl RegExp in Node.js. Contribute to c6fc/warcannon development by creating an account on GitHub.

Read about the latest hacking tools in The Daily Swig.

Security researcher James Kettle digs deep into the web stack to reveal some shiny new attack surface

Importance of communication brought into focus at Black Hat USA this week

German researchers circumvent key web security mechanism

Security researchers warned that at least 8,800 vulnerable systems are open to compromise.

A place for me to store my notes/tricks for Bug Bounty Hunting - Big Work in Progress.

Security researchers found they could snoop on dynamic DNS traffic

Two critical warnings have suddenly hit Apple's billion-plus iMessage users...

UK National Cyber Security Centre recommends approach for improved combination of usability and safety

They are focused on exploiting pain points in code analysis and reverse-engineering.

Uptycs Threat Research outline how malicious Linux shell scripts are used to cloak attacks and how defenders can detect and mitigate against them.

Take control of your security career - become a Burp Suite Certified Practitioner to demonstrate and prove your web security testing skills.

Nine tools we’ve found useful for our post-exploitation efforts including GhostPack, Metasploit, PowerHub, LOLBAS, Mimikatz, PHPSploit, and more.

The Red Team Village Capture the Flag at DEF CON 29 is going to be an epic event! Come join the carnage Aug 6th-8th!

MICROSOFT has issued a stark warning to Windows 10 users about a new zero-day flaw, which could allow hackers to delete or steal your personal data, create new accounts on your PC, and much more.

Advanced persistent threats pose a significant challenge for blue teams as they apply various attacks over prolonged periods, impeding event correlation and their detection. In this work, we leverage various diverse attack scenarios to assess the efficacy of EDRs against … Continue reading

Researchers warn about a new malware that hides among Windows Defender's exclusions to evade detection by the antivirus program.

In another vast software supply-chain attack, the password-stealer is filching credentials from Chrome on Windows systems via ChromePass.

The fallout continues. Here is everything we know so far.

MITRE tested products using the Triton malware, which was used to attack the industrial systems of companies in Saudi Arabia.

We take a look at the latest additions to security researchers’ armoury

Sum may be awarded in cryptocurrency to help protect whistleblowers’ anonymity

HelloKitty joins the growing list of ransomware bigwigs going after the juicy target of VMware ESXi, where one hit gets scads of VMs.

The security researchers used infrared photos and third-party hardware to best Microsoft’s facial-recognition tech.

The secretive Israeli firm was allegedly storing 50,000+ mobile phone numbers for activists, journalists, business executives and politicians — possible targets of iPhone and Android hacking.

Threat actors are planting Cobalt Strike backdoors by malspamming a bogus Microsoft update along with a SecurityUpdates.exe.

An affiliate of the notorious REvil gang infected thousands of victims in at least 17 countries.

As news breaks about the huge supply-chain ransomware attack against Kaseya's IT management software, here’s what we know so far.

An apparent supply chain attack exploited Kaseya's IT management software to encrypt a "monumental" number of victims all at once.

Researcher digs deeper into technique that uncovered flaws in popular WYSIWYG HTML text editors

Cryptographic expertise not needed to enable computations on encrypted data, says tech giant

Private posts, stories, video reels, and IGTVs were accessible

“I am totally screwed,” one user wailed after finding years of data nuked. Western Digital advised yanking the NAS storage devices offline ASAP: There's an exploit.

In-the-wild XSS attacks have commenced against the security appliance (CVE-2020-3580), as researchers publish exploit code on Twitter.

A researcher has found several vulnerabilities, including ones rated high severity, in Cisco Small Business 220 series smart switches.

Avanan researchers have uncovered an attack that takes advantage of an exploit in Google Docs

Ransomware gangs are increasingly buying their way into corporate networks, purchasing access from 'vendors' that have previously installed backdoors on targets.