tin-z

Index

• #prepreqs

• #roadmap

  • #iot
  • #chrome-and-friends: Chrome, V8, Blink, Mojo, etc.
  • Linux kernel #todo
  • expdev #todo

• fuzzing #todo

msrkp

The criteria I used to rank: 

1. The level of complexity of the research. (How hard for me to do the same research?)
2. The usefulness of the research to other security researchers.
3. Novelty, scale of exploitation and impact

Top candidates

1. Exploiting Hardened .NET Deserialization: New Exploitation Ideas and Abuse of Insecure Serialization 
2. https://github.com/thezdi/presentations/blob/main/2023_Hexacon/whitepaper-net-deser.pdf

0xdevalias

Deobfuscating / Unminifying Obfuscated Web App / JavaScript Code

Table of Contents

• PoC
• Tools
  • Unsorted
• wakaru

SwitHak

Security Advisories / Bulletins / vendors Responses linked to Log4Shell (CVE-2021-44228)

Errors, typos, something to say ?

• If you want to add a link, comment or send it to me
• Feel free to report any mistake directly below in the comment or in DM on Twitter @SwitHak

Other great resources

• Royce Williams list sorted by vendors responses Royce List
• Very detailed list NCSC-NL
• The list maintained by U.S. Cybersecurity and Infrastructure Security Agency: CISA List

AvasDream

Sources

Google spreadsheet

Linux Boxes

Lame

Writeup 0xdf

dwisiswant0

#!/bin/bash

#####
#
# St8out - Extra one-liner for reconnaissance
#
# Usage: ./st8out.sh target.com
#
# Resources:
# - https://github.com/j3ssie/metabigor

pikpikcu

```zshrc
#▄███████▄     ▄████████    ▄█    █▄       ▄████████  ▄████████
#██▀     ▄██   ███    ███   ███    ███     ███    ███ ███    ███
#     ▄███▀   ███    █▀    ███    ███     ███    ███ ███    █▀
#▀█▀▄███▀▄▄   ███         ▄███▄▄▄▄███▄▄  ▄███▄▄▄▄██▀ ███
# ▄███▀   ▀ ▀███████████ ▀▀███▀▀▀▀███▀  ▀▀███▀▀▀▀▀   ███
#▄███▀                ███   ███    ███   ▀███████████ ███    █▄
#███▄     ▄█    ▄█    ███   ███    ███     ███    ███ ███    ███
#▀████████▀  ▄████████▀    ███    █▀      ███    ███ ████████▀
#                                         ███    ███

Edu4rdSHL

[ SecHackLabs ~/Projects/Rust/Development/findomain ] [develop]
└─ ▶ time ./target/release/findomain -t aol.com --query-database -i --threads 100

Target ==> aol.com

Searching subdomains in the Findomain database for the target aol.com 🔍

Performing asynchronous subdomains resolution for 70600 subdomains with 100 threads, it will take a while. 🧐

tomnomnom

/.s3cfg
/phpunit.xml
/nginx.conf
/.vimrc
/LICENSE.md
/yarn.lock
/Gulpfile
/Gulpfile.js
/composer.json
/.npmignore

tehryanx

{
    "flags": "-HnriE",
    "patterns": [
		"(xox[p|b|o|a]-[0-9]{12}-[0-9]{12}-[0-9]{12}-[a-z0-9]{32})",
		"-----BEGIN RSA PRIVATE KEY-----",
		"-----BEGIN DSA PRIVATE KEY-----",
		"-----BEGIN EC PRIVATE KEY-----",
		"-----BEGIN PGP PRIVATE KEY BLOCK-----",
		"AKIA[0-9A-Z]{16}",
		"amzn\\.mws\\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}",