Last active
August 8, 2020 16:07
-
-
Save n1c4n0n/0558fe3ece9daaf58aa8a7154eec3cbb to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| http://yasserali.com/hacking-paypal-accounts-with-one-click/ | |
| http://yifan.lu/2011/12/10/kindle-touch-5-0-jailbreakroot-and-ssh/ | |
| https://0x09al.github.io/waf/bypass/ssl/2018/07/02/web-application-firewall-bypass.html | |
| https://aboulton.blogspot.com/2011/11/new-type-of-vulnerability-lotus-notes.html | |
| https://agrrrdog.blogspot.com/2017/03/autobinding-vulns-and-spring-mvc.html | |
| https://amolnaik4.blogspot.com/2011/03/exploitation-of-self-only-cross-site.html | |
| https://andresriancho.com/recaptcha-bypass-via-http-parameter-pollution/ | |
| https://appsecusa2015.sched.org/speaker/mostafa_siraj.1tssijvd | |
| https://blog.bentkowski.info/2018/07/vulnerability-in-hangouts-chat-aka-how.html | |
| https://blog.chromium.org/2011/07/using-cross-domain-images-in-webgl-and.html | |
| https://blog.doyensec.com/2017/08/03/electron-framework-security.html | |
| https://blog.harshjaiswal.com/rce-due-to-showexceptions | |
| https://blog.innerht.ml/vpn-extensions-are-not-for-privacy/ | |
| https://blog.isec.pl/all-is-xss-that-comes-to-the-net/ | |
| https://blog.mozilla.org/security/2015/03/23/revoking-trust-in-one-cnnic-intermediate-certificate/ | |
| https://blog.orange.tw/2019/02/abusing-meta-programming-for-unauthenticated-rce.html | |
| https://blog.orange.tw/2019/10/an-analysis-and-thought-about-recently.html | |
| https://blog.rapid7.com/2017/12/25/haxmas-the-true-meaning-s-of-metasploit/ | |
| https://blog.ripstech.com/2017/shopware-php-object-instantiation-to-blind-xxe/ | |
| https://blog.sheddow.xyz/css-timing-attack/ | |
| https://blog.teddykatz.com/2019/11/23/json-padding-oracles.html | |
| https://blog.whitehatsec.com/how-to-own-every-user-on-a-social-networking-site/ | |
| https://blog.wired.com/27bstroke6/2008/05/man-allegedly-b.html | |
| https://blogs.adobe.com/psirt/2008/09/clipboard_attack_update.html | |
| https://blogs.securiteam.com/index.php/archives/166 | |
| https://blogs.securiteam.com/index.php/archives/604 | |
| https://blogs.securiteam.com/index.php/archives/746 | |
| https://buer.haus/2019/10/18/a-tale-of-exploitation-in-spreadsheet-file-conversions/ | |
| https://bugs.chromium.org/p/project-zero/issues/detail?id=1139 | |
| https://bugzilla.mozilla.org/show_bug.cgi?id=369814 | |
| https://bugzilla.mozilla.org/show_bug.cgi?id=369814) | |
| https://carnal0wnage.blogspot.com/2008/08/owning-client-without-and-exploit.html | |
| https://code.google.com/p/dominator/ | |
| https://code.google.com/p/puzzlemall/downloads/list | |
| https://communities.coverity.com/blogs/security/2013/05/29/struts2-remote-code-execution-via-ognl-injection | |
| https://cpdos.org/ | |
| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224 | |
| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271 | |
| https://cwiki.apache.org/confluence/display/WW/S2-020 | |
| https://dbellucci.blogspot.com/2009/12/blind-sql-injection-inference-through.html | |
| https://docs.google.com/document/d/1dc1xxO8UMFaGLOwgkykYdghGWm_2Gn0iCrxFsympqcE/edit?hl=en_US&pli=1 | |
| https://docs.google.com/gview?url=http://gregorkopf.de/slides_berlinsides_pdf?pli%3D0&pli=1 | |
| https://docs.google.com/View?docid=ajfxntc4dmsq_14dt57ssdw&pli=1 | |
| https://docs.google.com/viewer?url=http%3A%2F%2Fwww.securatary.com%2FPortals%2F0%2FVulnerabilities%2FPayPal%2FPaypal%2520Manager%2520Account%2520Hijack.pdf | |
| https://dsecrg.blogspot.com/2011/12/excel-formula-injection-in-google-docs.html | |
| https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations | |
| https://edoverflow.com/2018/logic-flaws-in-wot-services/ | |
| https://edoverflow.com/2019/ci-knew-there-would-be-bugs-here/ | |
| https://elie.im/blog/security/tracking-users-that-block-cookies-with-a-http-redirect/ | |
| https://elie.im/publication/text-based-captcha-strengths-and-weaknesses | |
| https://elie.im/publication/the-failure-of-noise-based-non-continuous-audio-captchas | |
| https://extraexploit.blogspot.com/2010/10/dollars-javascript-code-yet-another.html | |
| https://files.ripstech.com/slides/OWASP_AppSec_EU18_WordPress.pdf | |
| https://footstep.ninja/posts/password-reset/ | |
| https://github.com/cryptocat/cryptocat/issues/690 | |
| https://github.com/cure53/browser-sec-whitepaper/blob/master/browser-security-whitepaper.pdf | |
| https://github.com/FireFart/WordpressPingbackPortScanner | |
| https://github.com/HoLyVieR/prototype-pollution-nsec18 | |
| https://github.com/OpenSecurityResearch/clipcaptcha | |
| https://github.com/veracode-research/solr-injection | |
| https://github.com/x41sec/browser-security-whitepaper-2017/blob/master/X41-Browser-Security-White-Paper.pdf | |
| https://githubengineering.com/githubs-post-csp-journey/ | |
| https://gosecure.net/2016/04/27/binary-webshell-through-opcache-in-php-7/ | |
| https://gosecure.net/2018/04/03/beyond-xss-edge-side-include-injection/ | |
| https://grepular.com/Abusing_HTTP_Status_Codes_to_Expose_Private_Information | |
| https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/KtmwSbEpzrU | |
| https://gursevkalra.blogspot.com/2011/11/captcha-hax-with-tessercap.html | |
| https://hackademix.net/2007/08/07/java-evil-popups/ | |
| https://hackademix.net/2007/09/26/cross-browser-proxy-unmasking/ | |
| https://hackademix.net/2010/08/17/lost-in-translation-asps-homoxssuality/ | |
| https://hackerone.com/reports/307670 | |
| https://hackerone.com/reports/309531 | |
| https://hackerone.com/reports/317476 | |
| https://hackerone.com/reports/32825 | |
| https://hackerone.com/reports/33935 | |
| https://hackerone.com/reports/341876 | |
| https://i.blackhat.com/us-18/Wed-August-8/us-18-Orange-Tsai-Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out-2.pdf | |
| https://i.blackhat.com/USA-19/Thursday/us-19-Birch-HostSplit-Exploitable-Antipatterns-In-Unicode-Normalization-wp.pdf | |
| https://i.blackhat.com/USA-19/Wednesday/us-19-Munoz-SSO-Wars-The-Token-Menace-wp.pdf | |
| https://insert-script.blogspot.com/2018/05/adobe-reader-pdf-client-side-request.html | |
| https://irsdlwordpress.com/2010/07/01/iis5-1-directory-authentication-bypass-by-using-i30index_allocation/ | |
| https://isecpartners.com/news-events/news/2012/december/an-attack-on-ssl-client-certificates.aspx | |
| https://jankopecky.net/index.php/2017/04/18/0day-textplain-considered-harmful/ | |
| https://know.bishopfox.com/research/cve-2019-18935-remote-code-execution-in-telerik-ui | |
| https://kuza55.blogspot.com/2007/01/more-user-login-detection-via.html | |
| https://kuza55.blogspot.com/2007/03/non-persistent-untraceable-xss-attacks.html | |
| https://kuzablogspot.com/2008/02/exploiting-csrf-protected-xss.html | |
| https://kuzablogspot.com/2008/02/exploiting-logged-out-xss.html | |
| https://kuzablogspot.com/2008/02/racing-to-downgrade-users-to-cookie.html | |
| https://kuzablogspot.com/2008/07/cookie-path-traversal.html | |
| https://lab.wallarm.com/how-to-trick-csp-in-letting-you-run-whatever-you-want-73cb5ff428aa | |
| https://lab.wallarm.com/the-good-the-bad-and-the-ugly-of-safari-in-client-side-attacks-56d0cb61275a | |
| https://labs.detectify.com/2017/02/28/hacking-slack-using-postmessage-and-websocket-reconnect-to-steal-your-precious-token/ | |
| https://labs.detectify.com/2017/07/13/a-deep-dive-into-aws-s3-access-controls-taking-full-control-over-your-assets/ | |
| https://labs.detectify.com/2018/01/12/how-i-exploited-acme-tls-sni-01-issuing-lets-encrypt-ssl-certs-for-any-domain-using-shared-hosting/ | |
| https://labs.detectify.com/2018/04/04/host-headers-safari/ | |
| https://labs.integrity.pt/articles/from-0-day-to-exploit-buffer-overflow-in-belkin-n750-cve-2014-1635/ | |
| https://labs.mwrinfosecurity.com/blog/from-http-referer-to-aws-security-credentials/ | |
| https://lcamtuf.blogspot.com/2010/06/curse-of-inverse-strokejacking.html | |
| https://leucosite.com/Edge-Chromium-EoP-RCE/ | |
| https://leucosite.com/Firefox-uXSS-and-CSS-XSS/ | |
| https://lightningsecurity.io/blog/password-not-provided/ | |
| https://mazinahmed.net/blog/backchannel-leaks-on-strict-csp-policy/ | |
| https://mazinahmed.net/uploads/Evading%20All%20Web-Application%20Firewalls%20XSS%20Filters.pdf | |
| https://media.blackhat.com/bh-us-11/Johansen/BH_US_11_JohnasenOsborn_Hacking_Google_WP.pdf | |
| https://media.blackhat.com/eu-13/briefings/Osipov/bh-eu-13-XML-data-osipov-slides.pdf | |
| https://medium.com/@da/need-a-last-minute-flight-45af88ec8df3 | |
| https://medium.com/@marin_m/how-i-found-a-5-000-google-maps-xss-by-fiddling-with-protobuf-963ee0d9caff | |
| https://medium.com/@ricardoiramar/reusing-cookies-23ed4691122b | |
| https://medium.com/@terjanq/xss-auditor-the-protector-of-unprotected-f900a5e15b7b | |
| https://medium.com/@tomnomnom/crlf-injection-into-phps-curl-options-e2e0d7cfe545 | |
| https://medium.com/bugbountywriteup/piercing-the-veil-server-side-request-forgery-to-niprnet-access-c358fd5e249a | |
| https://medium.com/intigriti/abusing-autoresponders-and-email-bounces-9b1995eb53c2 | |
| https://medium.com/intigriti/how-i-hacked-hundreds-of-companies-through-their-helpdesk-b7680ddc2d4c | |
| https://mksben.l0.cm/2018/05/cve-2018-5175-firefox-csp-strict-dynamic-bypass.html | |
| https://mohemiv.com/all/exploiting-xxe-with-local-dtd-files/ | |
| https://nakedsecurity.sophos.com/2011/09/07/crowd-sourcing-mischief-on-google-maps-leads-customers-astray/ | |
| https://nathandavison.com/blog/abusing-http-hop-by-hop-request-headers | |
| https://nealpoole.com/blog/2011/10/java-applet-same-origin-policy-bypass-via-http-redirect/ | |
| https://omergil.blogspot.com/2017/02/web-cache-deception-attack.html | |
| https://opnsec.com/category/flash/ | |
| https://pastebin.com/f7ac1cced | |
| https://payatu.com/blog/nikhil-mittal/firefox-ios-qr-code-reader-xss-(cve-2019-17003 | |
| https://phra.gs/blob/2014-06-04-linksys-e4200-auth-bypass.html | |
| https://poc-server.com/blog/2018/05/22/rce-by-uploading-a-web-config/ | |
| https://portswigger-labs.net/fmnt.php?x=acunetix.com/blog/web-security-zone/bypassing-sop-using-the-browser-cache/ | |
| https://portswigger.net/blog/evading-csp-with-dom-based-dangling-markup | |
| https://portswigger.net/blog/exposing-intranets-with-reliable-browser-based-port-scanning | |
| https://portswigger.net/blog/http-desync-attacks-request-smuggling-reborn | |
| https://portswigger.net/blog/practical-web-cache-poisoning | |
| https://portswigger.net/research/top-10-web-hacking-techniques-of-2017-nominations-open | |
| https://r00tin.blogspot.com/2008/04/utorrent-pwn3d.html | |
| https://regilero.github.io/security/english/2018/07/03/security_pound_http_smuggling/ | |
| https://research.securitum.com/dompurify-bypass-using-mxss/ | |
| https://research.securitum.com/prototype-pollution-rce-kibana-cve-2019-7609/ | |
| https://research.securitum.com/security-analysis-of-portal-element/ | |
| https://research.securitum.com/xss-in-amp4email-dom-clobbering/ | |
| https://sajjadium.github.io/files/usenixsec2020wcd_paper.pdf | |
| https://sajjadium.github.io/files/www2018rpo_paper.pdf | |
| https://samcurry.net/filling-in-the-blanks-exploiting-null-byte-buffer-overflow-for-a-40000-bounty/ | |
| https://scarybeastsecurity.blogspot.com/2008/08/cross-domain-leaks-of-site-logins.html | |
| https://scarybeastsecurity.blogspot.com/2009/05/more-plausible-e4x-attack.html | |
| https://scarybeastsecurity.blogspot.com/2009/06/apples-safari-4-also-fixes-cross-domain.html | |
| https://scarybeastsecurity.blogspot.com/2009/06/apples-safari-4-fixes-local-file-theft.html | |
| https://scarybeastsecurity.blogspot.com/2009/06/bonus-safari-xxe-only-affecting-safari.html | |
| https://scarybeastsecurity.blogspot.com/2009/12/cross-domain-search-timing.html | |
| https://scarybeastsecurity.blogspot.com/2009/12/generic-cross-browser-cross-domain.html | |
| https://scarybeastsecurity.blogspot.com/2010/01/posting-raw-xml-cross-domain.html | |
| https://schmoil.blogspot.com/2008/03/smuggling-smtp-through-open-http.html | |
| https://schmoil.blogspot.com/2008/03/stealing-basic-auth-with-persistent-xss.html | |
| https://schmoil.blogspot.com/2009/01/brief-description-of-how-to-become-ca.html | |
| https://secniche.blogspot.com/2010/11/malware-paradox-cia-aavar-html | |
| https://secunia.com/advisories/22477/ | |
| https://securehomes.esat.kuleuven.be/~gacar/persistent/the_web_never_forgets.pdf | |
| https://security.linkedin.com/blog-archive#11232015 | |
| https://shreeraj.blogspot.com/2011/11/csrf-with-json-leveraging-xhr-and-cors_28.html | |
| https://shreeraj.blogspot.com/2011/12/double-eval-for-dom-based-xss.html | |
| https://sirdarckcat.blogspot.com/2008/01/exploiting-xss-vulnerabilities-on.html | |
| https://sirdarckcat.blogspot.com/2008/05/browsers-ghost-busters.html | |
| https://sirdarckcat.blogspot.com/2008/10/about-css-attacks.html | |
| https://sirdarckcat.blogspot.com/2009/04/how-to-use-google-analytics-to-dos.html | |
| https://sirdarckcat.blogspot.com/2009/08/our-favorite-xss-filters-and-how-to.html | |
| https://sirdarckcat.blogspot.com/2019/03/http-cache-cross-site-leaks.html | |
| https://sites.google.com/site/tentacoloviola/ | |
| https://sites.google.com/site/testsitehacking/-36k-google-app-engine-rce | |
| https://sites.google.com/site/testsitehacking/10k-host-header | |
| https://skeletonscribe.blogspot.com/2010/12/chronofeit-phishing.html | |
| https://soroush.secproject.com/blog/2010/05/cross-site-url-hijacking-by-using-error-object-in-mozilla-firefox/ | |
| https://soroush.secproject.com/blog/2011/12/drag-and-drop-xss-in-firefox-by-html5-cross-domain-in-frames/ | |
| https://soroush.secproject.com/blog/2018/12/story-of-two-published-rces-in-sharepoint-workflows/ | |
| https://soroush.secproject.com/blog/2019/04/exploiting-deserialisation-in-asp-net-via-viewstate/ | |
| https://soroush.secproject.com/blog/2019/05/x-up-devcap-post-charset-header-in-aspnet-to-bypass-wafs-again/) | |
| https://soroush.secproject.com/blog/2019/07/iis-application-vs-folder-detection-during-blackbox-testing/ | |
| https://soroush.secproject.com/blog/2019/08/uploading-web-config-for-fun-and-profit-2/ | |
| https://speakerdeck.com/0ang3el/hunting-for-security-bugs-in-aem-webapps | |
| https://speakerdeck.com/0ang3el/whats-wrong-with-websocket-apis-unveiling-vulnerabilities-in-websocket-apis | |
| https://speakerdeck.com/bo0om/at-home-among-strangers?slide=9 | |
| https://speakerdeck.com/filedescriptor/exploiting-the-unexploitable-with-lesser-known-browser-tricks | |
| https://speakerdeck.com/filedescriptor/the-cookie-monster-in-your-browsers | |
| https://speakerdeck.com/fransrosen/a-story-of-the-passive-aggressive-sysadmin-of-aem | |
| https://speakerdeck.com/icchy/lets-make-windows-defender-angry-antivirus-can-be-an-oracle | |
| https://speakerdeck.com/shhnjk/logically-bypassing-browser-security-boundaries | |
| https://spl0it.wordpress.com/2010/12/02/internal-port-scanning-via-crystal-reports/ | |
| https://spyclub.tech/2018/08/14/2018-08-14-blog-on-gopherus/ | |
| https://statuscode.ch/2017/11/from-markdown-to-rce-in-atom/ | |
| https://stephensclafani.com/2017/03/21/stealing-messenger-com-login-nonces/ | |
| https://superevr.com/blog/2011/xss-in-skype-for-ios/ | |
| https://superevr.com/blog/2012/blended-threats-and-javascript/ | |
| https://superevr.com/blog/2012/exploiting-xss-in-ajax-web-applications/ | |
| https://superevr.com/blog/2012/top-level-universal-xss/ | |
| https://superevr.com/blog/2013/dont-use-linksys-routers/ | |
| https://thehackerblog.com/kicking-the-rims-a-guide-for-securely-writing-and-auditing-chrome-extensions/ | |
| https://thehackerblog.com/reading-your-emails-with-a-readwrite-chrome-extension-same-origin-policy-bypass-8-million-users-affected/index.html | |
| https://thehackerblog.com/the-io-error-taking-control-of-all-io-domains-with-a-targeted-registration/index.html | |
| https://threatpost.com/en_us/blogs/padding-oracle-crypto-attack-affects-millions-aspnet-apps-091310 | |
| https://tinyurl.com/5w6koqj | |
| https://twitter.com/mslavco/status/1019332176846950400 | |
| https://vimeo.com/ondemand/44conlondon2015/142249673 | |
| https://vnhacker.blogspot.com/2011/09/beast.html | |
| https://vttynotes.blogspot.com/2011/10/cve-2011-3230-launch-any-file-path-from.html | |
| https://web-in-security.blogspot.com/2018/07/save-your-cloud-dos-on-vms-in.html | |
| https://websec.wordpress.com/2010/12/04/sqli-filter-evasion-cheat-sheet-mysql/ | |
| https://websec.wordpress.com/2012/01/04/multiple-vulnerabilities-in-apache-struts2-and-property-oriented-programming-with-java/ | |
| https://www.aspectsecurity.com/documents/Aspect_File_Download_Injection.pdf | |
| https://www.aspectsecurity.com/documents/Bypassing_VBAAC_with_HTTP_Verb_Tampering.pdf | |
| https://www.aspectsecurity.com/tools/javasnoop/ | |
| https://www.bishopfox.com/blog/2018/06/server-side-spreadsheet-injections/ | |
| https://www.blackhat.com/docs/us-15/materials/us-15-Yason-Understanding-The-Attack-Surface-And-Attack-Resilience-Of-Project-Spartans-New-EdgeHTML-Rendering-Engine-wp.pdf | |
| https://www.blackhat.com/docs/us-17/thursday/us-17-Munoz-Friday-The-13th-JSON-Attacks-wp.pdf | |
| https://www.blackhat.com/docs/us-17/thursday/us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages.pdf | |
| https://www.blackhat.com/presentations/bh-europe-09/Guimaraes/Blackhat-europe-09-Damele-SQLInjection-slides.pdf | |
| https://www.blackhat.com/presentations/bh-europe-09/Guimaraes/Blackhat-europe-09-Damele-SQLInjection-whitepaper.pdf | |
| https://www.blackhat.com/us-14/briefings.html#call-to-arms-a-tale-of-the-weaknesses-of-current-client-side-xss-filtering | |
| https://www.brokenbrowser.com/zombie-alert/ | |
| https://www.drupal.org/SA-CORE-2014-005 | |
| https://www.duosecurity.com/blog/the-paypal-2fa-bypass-how-legacy-infrastructure-impacts-modern-security | |
| https://www.feross.org/webcam-spy/ | |
| https://www.gosecure.net/blog/2019/05/02/esi-injection-part-2-abusing-specific-implementations | |
| https://www.hackinparis.com/talk-mario-heiderich | |
| https://www.inputzero.io/2018/08/kaspersky-vpn-leaks-dns-address.html | |
| https://www.inputzero.io/2018/09/bug-bounty-telegram-cve-2018-17780.html | |
| https://www.inputzero.io/2018/09/buggy-skype.html | |
| https://www.lanmaster53.com/2018/03/15/report-spam-get-owned/ | |
| https://www.linkedin.com/pulse/how-i-used-google-dorks-find-0-days-suraj-khetani/ | |
| https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2017/august/request-encoding-to-bypass-web-application-firewalls/ | |
| https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2017/september/rare-aspnet-request-validation-bypass-using-request-encoding/ | |
| https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/august/aspnet-resource-files-resx-and-deserialisation-issues/ | |
| https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/december/beware-of-deserialisation-in-.net-methods-and-classes-code-execution-via-paste/ | |
| https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2019/august/getting-shell-with-xamlx-files/ | |
| https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2019/march/finding-and-exploiting-.net-remoting-over-http-using-deserialisation/ | |
| https://www.nccgroup.trust/uk/our-research/common-security-issues-in-financially-orientated-web-applications/ | |
| https://www.notsosecure.com/data-exfiltration-formula-injection/ | |
| https://www.notsosecure.com/exploiting-ssrf-in-aws-elastic-beanstalk/ | |
| https://www.openssl.org/~bodo/ssl-poodle.pdf | |
| https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-3445/ | |
| https://www.schneier.com/blog/archives/2015/05/the_logjam_and_.html | |
| https://www.securityevaluators.com/sl/ | |
| https://www.sensepost.com/blog/1303.html | |
| https://www.sensepost.com/blog/html | |
| https://www.sensepost.com/research/reDuh/ | |
| https://www.sensepost.com/research/reDuh/SensePost_tgz | |
| https://www.shielder.it/blog/dont-open-that-xml-xxe-to-rce-in-xml-plugins-for-vs-code-eclipse-theia/ | |
| https://www.silentrobots.com/blog/2019/02/06/ssrf-protocol-smuggling-in-plaintext-credential-handlers-ldap/ | |
| https://www.slideshare.net/fransrosen/attacking-modern-web-technologies?from_action=save | |
| https://www.slideshare.net/GreenD0g/mitm-attacks-on-https-another-perspective/ | |
| https://www.techdirt.com/articles/20060911/193625.shtml | |
| https://www.us-cert.gov/ncas/alerts/TA14-318A | |
| https://www.usenix.org/events/woot10/tech/full_papers/Rizzo.pdf | |
| https://www.usenix.org/system/files/conference/usenixsecurity15/sec15-paper-lekies.pdf | |
| https://www.veracode.com/blog/research/exploiting-jndi-injections-java | |
| https://www.veracode.com/blog/research/exploiting-spring-boot-actuators | |
| https://www.vulnano.com/2019/03/facebook-messenger-server-random-memory.html | |
| https://www.whitehatsec.com/blog/gravatar-email-enumeration-in-javascript/ | |
| https://www.whitehatsec.com/blog/hackerkast-11-bonus-round/ | |
| https://www.whitehatsec.com/blog/hackerkast-13-bonus-round/ | |
| https://www.whitehatsec.com/blog/hackerkast-14-bonus-round/ | |
| https://www.whitehatsec.com/blog/internet-explorer-xss-filter | |
| https://www.whitehatsec.com/blog/introducing-the-i-know-series/ | |
| https://www.whitehatsec.com/blog/the-case-of-an-unconventional-csrf-attack-in-firefox/ | |
| https://www.whitehatsec.com/blog/top-3-proxy-issues-that-no-one-ever-told-you/ | |
| https://www.whitehatsec.com/blog/tor-hidden-service-passive-de-cloaking/ | |
| https://www.whitehatsec.com/blog/x-frame-options-xfo-detection-from-javascript/ | |
| https://www.whitehatsec.com/home/resources/presentations/files/javascript_malware.pdf | |
| https://www.youtube.com/TheKn0ck#p/a/u/1/r-kgKNspqjQ | |
| https://www.youtube.com/watch?v=-DackF8HsIE | |
| https://www.youtube.com/watch?v=-feE0twnCsw | |
| https://www.youtube.com/watch?v=1IoythC_pIY | |
| https://www.youtube.com/watch?v=3k_eJ1bcCro | |
| https://www.youtube.com/watch?v=7y3K83sOnG8 | |
| https://www.youtube.com/watch?v=8GC7lqjJU6s | |
| https://www.youtube.com/watch?v=bt0Qh9c59_c | |
| https://www.youtube.com/watch?v=bUcd-yibTCE | |
| https://www.youtube.com/watch?v=eHSNT8vWLfc | |
| https://www.youtube.com/watch?v=ekUQIVUzDX4 | |
| https://www.youtube.com/watch?v=ERJmkLxGRC0 | |
| https://www.youtube.com/watch?v=G539NwvpL3I&list=PLpr-xdpM8wG93dG_L9QKs0W1cD-esQEzU&index=23 | |
| https://www.youtube.com/watch?v=gVrdE6g_fa8 | |
| https://www.youtube.com/watch?v=HeP54b52IeQ | |
| https://www.youtube.com/watch?v=ikIyInm0wAg | |
| https://www.youtube.com/watch?v=iTcOooHbgog | |
| https://www.youtube.com/watch?v=kedmtrIEW1k | |
| https://www.youtube.com/watch?v=KirTCSAvt9M | |
| https://www.youtube.com/watch?v=mroq9eHFOIU | |
| https://www.youtube.com/watch?v=o-tL9ULF0KI | |
| https://www.youtube.com/watch?v=ouBwRZJHmmo | |
| https://www.youtube.com/watch?v=ppW_soCb6wM | |
| https://www.youtube.com/watch?v=RxpMPrqnxC0 | |
| https://www.youtube.com/watch?v=T7_DX9lSjlk | |
| https://www.youtube.com/watch?v=woWECWwrsSk | |
| https://www.youtube.com/watch?v=X8Scc2nmSh8 | |
| https://www.youtube.com/watch?v=YBu0ZB9xIgw | |
| https://www.youtube.com/watch?v=yEjPIagrB0M | |
| https://www.youtube.com/watch?v=yghiC_U2RaM | |
| https://www.youtube.com/watch?v=ZfKuOdbQt2c | |
| https://www.youtube.com/watch?v=ZnsFhGYqI3g | |
| https://www.youtube.com/watch?v=ZW2TVOPAbTE | |
| https://yoast.com/research/autocompletetype.php | |
| https://youtu.be/aeevfVXPIqo | |
| https://youtu.be/p07acPBi-qw | |
| https://zeroknock.blogspot.com/2009/12/google-chrome-webkit-msword-scripting.html | |
| https://zeroknock.blogspot.com/2009/12/google-translate-google-user-content.html | |
| https://zeroknock.blogspot.com/2009/12/yahoo-babelfish-possible-inline-iframe.html | |
| https://zeroknock.blogspot.com/2010/08/google-chrome-http-auth-dialog-through.html |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment