Whitepaper that discusses the functionality of EDR (Endpoing Protection and Response), how it compares to antivirus, and how it can be manipulated.
ece8d73b3f5b494064886d578b32c0f9fcd8723057d66ff7d4e4b551ab1d242d
Whitepaper that discusses deserialization of untrusted data in jsoniter.
0ca417e1ce7adae9c50ca05cb6775b57ac7716c04884972cfd2a9cbbb6b0a4a4
This is the OWASP TimeGap Theory handbook that discusses TOC/TOU vulnerabilities.
3fa653fadddee02d336d318a62bba714ded87e3ad0707724dc715175cf443fc2
This is a brief whitepaper discussing the securing of authentication and authorization.
ec474e596a9d9ba2ab9781f4af02b1dee9f12e35a15b86af9d6a4566b3045d04
BSides SF is soliciting papers and presentations for the 2022 annual BSidesSF conference. It will be located at City View at the Metreon in downtown San Francisco February 5th through the 6th, 2022.
116913a94e74b59af467e5522f2a4c08f2434469de79a58f7d2653633b1bb6cb
This paper demonstrates how to insert a backdoor in WordPress to get cleartext passwords anytime that a user logs in.
86a58a7a0e7f76d5a10b4c0f076df6f7acd2ba7b44bb9ce85aa4c428f169ff91
This whitepaper discusses BRAKTOOTH, a family of new security vulnerabilities in commercial BT stacks that range from denial of service (DoS) via firmware crashes and deadlocks in commodity hardware to arbitrary code execution (ACE) in certain IoTs.
ec29de4f145eee5ced7ab6a0c5389c72ee16a987352a4373d9ef5da684cef2ac
Whitepaper called Cracking WiFi WPA2 Handshake. Written in Turkish.
c6cc513244a2fff1794b3639ad360894a6c93b9dabc29cbf0e9739ed4e9ff7a9
Whitepaper called HiveNightmare AKA SeriousSAM. It details an overview of CVE-2021-36934 and provides exploitation details.
6b2f808ea234ce7630f8d7f1e9174e0e3c62ad056188b18315bbf76d42c8c731
This is a whitepaper that discusses additional vectors of attack that can be used against Razer products.
d896ee68726d14957e7b9ef3ead4ea6080977a3951b1f9246dab51ea5e04be7c
Whitepaper discussing JavaScript static analysis. Written in Arabic.
0c4b9e81a57d57072c3bbf3c49892a9de6b7ea347238264d3d6ce9e7068c1996
Dancho Danchev wrote a personal 100 page memoir.
8768965b892b82131fe72867147c1aa8f5bde8ae1c52f43f5116c6cb6e7afd3f
This is a whitepaper that gives an overview of the PIP vulnerability in Android 11.
de30f374a906fe8d9c0d8bb8b7dfebcf0db353f3671a5b1d8f515460f9e6c36d
Whitepaper called Attacking Optical Character Recognition System.
27d4178ceb7a28e6651e0994b57cf6748e06a11feff3bb4601978c419df69e91
This article focuses on using the NT hash to execute commands successfully on the target server which includes ESET Server Security and File Security even if the packet inspection settings restrict communication with a few services.
73f932909f758032767a6c41c634328ff69c7b2451dec44e6313edfddc0e6afa
This paper contains a step by step detailed walk-through of different nmap scanning techniques and how the nmap traffic looks like in wireshark for each scan. The objective of documenting the paper is to get a better understanding of packets while initiating any nmap scan so that it can help in bypassing firewalls or debugging what went wrong between the source and destination. It can also help in writing basic firewall rules.
e98eb4f64e115f6a22e5fb658a650a8f88305b65ab9f8584011c81fe80099560
This whitepaper discusses chain session upload progress to remote code execution when taking advantage of local file inclusion.
3c9df4f24a784d6c632f742ca3902c18462336b6f1ee4031041e932d800f8a5d
The call for papers for hardwear.io 2021 in the Netherlands is now open. It will take place October 28th through the 29th, 2021 at NH Hotel Den Haag, The Netherlands.
68c8cf7a45d193d9d0d1360a6d987ce1ee4b0018bcef8b1a265a29c1fb7d7a14
Whitepaper called Smart Contract Automated Testing Guidelines that provides guidance on automation.
2637d58d1c7c59b0e8b57db8f391f84b9a001dcc6d498f48455236de4f4f2d0a
Whitepaper discussing BIZARRELOVETRIANGLE and FULLCLIP - JNLP parameter injection attacks to remote, persistent, multi-os code execution.
0544f59a1e884ac5e4753711797fde21b5db764b310bbdc41f2106aa58ffdef4
Brief whitepaper that goes through proxy, ssh, and vpn pivoting during an attack. Written in Arabic.
a1e855c508e17641d2eb114eced9cbb69be22f676f04484aaf30c490b078784e
Whitepaper called 'node-serialize' Remote Code Execution - Web Shell. Written in Turkish.
5258591e002e919f55d52d14edd0cf8d6b32488ebf99fbf4b7583e1a674d53bb
Whitepaper called Penetration Testing Web Storage (User Experience). Written in Arabic.
ac64e028c271cb652e3c0e80ad58084627611674cb22fcd6bb4a831a7c2fced8
This whitepaper illustrates exploitation of an insufficient data validation vulnerability in the Chromium framework.
b518b651332d5b50eee9efb4b357a5e396fada0eba42899f6a54932aabdff483
This research paper explains how to take advantage of windows services, how to mimic display names to deploy malicious beacons or even Meterpreter sessions.
e1a4a62a90edd81fc9429eb3e16e8be7198bf5bc28a6abec8b729d347a942b26