Blogs

Others

• Orange - Taiwan's talented web penetrator.
• leavesongs - China's talented web penetrator.
• James Kettle - Head of Research at PortSwigger Web Security.
• Broken Browser - Fun with Browser Vulnerabilities.
• Scrutiny - Internet Security through Web Browsers by Dhiraj Mishra.
• BRETT BUERHAUS - Vulnerability disclosures and rambles on application security.
• n0tr00t - ~# n0tr00t Security Team.
• OpnSec - Open Mind Security!
• 0Day Labs - Awesome bug-bounty and challenges writeups.
• Blog of Osanda - Security Researching and Reverse Engineering.
• n0tr00t - ~# n0tr00t Security Team.

Browser Exploitation

Backend (core of Browser implementation, and often refers to C or C++ part)

• Breaking UC Browser - Written by Доктор Веб.
• Attacking JavaScript Engines - A case study of JavaScriptCore and CVE-2016-4622 - Written by phrack@saelo.net.
• Three roads lead to Rome - Written by @holynop.
• Exploiting a V8 OOB write. - Written by @halbecaf.
• Look Mom, I don't use Shellcode - Browser Exploitation Case Study for Internet Explorer 11 - Written by @moritzj.
• PUSHING WEBKIT'S BUTTONS WITH A MOBILE PWN2OWN EXPLOIT - Written by @wanderingglitch.
• A Methodical Approach to Browser Exploitation - Written by @PatrickBiernat, @gaasedelen and @itszn13.
• CVE-2017-2446 or JSC::JSGlobalObject::isHavingABadTime. - Written by Diary of a reverse-engineer.
• CLEANLY ESCAPING THE CHROME SANDBOX - Written by @tjbecker_.
• How I got my first big bounty payout with Tesla - Written by @cj.fairhead.
• Exploiting a V8 OOB write. - Written by @halbecaf.
• Exploiting a V8 OOB write. - Written by @halbecaf.
• Exploiting a V8 OOB write. - Written by @halbecaf.
• Exploiting a V8 OOB write. - Written by @halbecaf.
• Exploiting a V8 OOB write. - Written by @halbecaf.
• Exploiting a V8 OOB write. - Written by @halbecaf.
• Exploiting a V8 OOB write. - Written by @halbecaf.
• Exploiting a V8 OOB write. - Written by @halbecaf.
• Exploiting a V8 OOB write. - Written by @halbecaf.
• Exploiting a V8 OOB write. - Written by @halbecaf.
• Exploiting a V8 OOB write. - Written by @halbecaf.
• Exploiting a V8 OOB write. - Written by @halbecaf.
• Exploiting a V8 OOB write. - Written by @halbecaf.
• Exploiting a V8 OOB write. - Written by @halbecaf.
• Exploiting a V8 OOB write. - Written by @halbecaf.
• Exploiting a V8 OOB write. - Written by @halbecaf.
• Exploiting a V8 OOB write. - Written by @halbecaf.
• Exploiting a V8 OOB write. - Written by @halbecaf.
• Exploiting a V8 OOB write. - Written by @halbecaf.
• Exploiting a V8 OOB write. - Written by @halbecaf.
• Exploiting a V8 OOB write. - Written by @halbecaf.
• Exploiting a V8 OOB write. - Written by @halbecaf.
• Exploiting a V8 OOB write. - Written by @halbecaf.
• Exploiting a V8 OOB write. - Written by @halbecaf.
• Exploiting a V8 OOB write. - Written by @halbecaf.
• Exploiting a V8 OOB write. - Written by @halbecaf.
• Exploiting a V8 OOB write. - Written by @halbecaf.
• Exploiting a V8 OOB write. - Written by @halbecaf.
• Exploiting a V8 OOB write. - Written by @halbecaf.
• Exploiting a V8 OOB write. - Written by @halbecaf.
• Exploiting a V8 OOB write. - Written by @halbecaf.
• Exploiting a V8 OOB write. - Written by @halbecaf.
• Exploiting a V8 OOB write. - Written by @halbecaf.
• SSD Advisory – Chrome Turbofan Remote Code Execution - Written by SecuriTeam Secure Disclosure (SSD).
• Breaking UC Browser - Written by Доктор Веб.

Frontend (like SOP bypass, URL spoofing, and something like that)

• The world of Site Isolation and compromised renderer - Written by @shhnjk.
• The Cookie Monster in Your Browsers - Written by @filedescriptor.
• Bypassing Mobile Browser Security For Fun And Profit - Written by @rafaybaloch.
• The inception bar: a new phishing method - Written by jameshfisher.
• JSON hijacking for the modern web - Written by portswigger.
• IE11 Information disclosure - local file detection - Written by James Lee.
• SOP bypass / UXSS – Stealing Credentials Pretty Fast (Edge) - Written by Manuel.
• ブラウザの脆弱性とそのインパクト - Written by Muneaki Nishimura and Masato Kinugawa.
• Особенности Safari в client-side атаках - Written by Bo0oM.
• How do we Stop Spilling the Beans Across Origins? - Written by aaj at google.com and mkwst at google.com.
• Setting arbitrary request headers in Chromium via CRLF injection - Written by Michał Bentkowski.
• Sending arbitrary IPC messages via overriding Function.prototype.apply - Written by @kinugawamasato.
• Take Advantage of Out-of-Scope Domains in Bug Bounty Programs - Written by @Abdulahhusam.
• I’m harvesting credit card numbers and passwords from your site. Here’s how. - Written by David Gilbertson.
• IE11 Information disclosure - local file detection - Written by James Lee.

Cheetsheets

Database

• XSS Cheat Sheet - 2018 Edition - Written by @brutelogic.
• Capture the Flag CheatSheet - Written by @uppusaikiran.

Community

ModSecurity / OWASP ModSecurity Core Rule Set

• Reddit
• Stack Overflow

Digests

• Hacker101 - Written by hackerone.
• The Daily Swig - Web security digest - Written by PortSwigger.
• Web Application Security Zone by Netsparker - Written by Netsparker.
• Infosec Newbie - Written by Mark Robinson.
• The Magic of Learning - Written by @bitvijays.
• tl;dr sec - Weekly summary of top security tools, blog posts, and security research.
• CTF Field Guide - Written by Trail of Bits.
• Web Application Security Zone by Netsparker - Written by Netsparker.
• PayloadsAllTheThings - Written by @swisskyrepo.
• Infosec Newbie - Written by Mark Robinson.

Evasions

Authentication

• Trend Micro Threat Discovery Appliance - Session Generation Authentication Bypass (CVE-2016-8584) - Written by @malerisch and @steventseeley.
• Trend Micro Threat Discovery Appliance - Session Generation Authentication Bypass (CVE-2016-8584) - Written by @malerisch and @steventseeley.

CSP

• Any protection against dynamic module import? - Written by @shhnjk.
• CSP: bypassing form-action with reflected XSS - Written by Detectify Labs.
• TWITTER XSS + CSP BYPASS - Written by Paulos Yibelo.
• Neatly bypassing CSP - Written by Wallarm.
• Evading CSP with DOM-based dangling markup - Written by portswigger.
• GitHub's CSP journey - Written by @ptoomey3.
• GitHub's post-CSP journey - Written by @ptoomey3.
• GitHub's CSP journey - Written by @ptoomey3.
• GitHub's post-CSP journey - Written by @ptoomey3.

JSMVC

• JavaScript MVC and Templating Frameworks - Written by Mario Heiderich.
• JavaScript MVC and Templating Frameworks - Written by Mario Heiderich.

WAF

• Web Application Firewall (WAF) Evasion Techniques - Written by @secjuice.
• Web Application Firewall (WAF) Evasion Techniques #2 - Written by @secjuice.
• Airbnb – When Bypassing JSON Encoding, XSS Filter, WAF, CSP, and Auditor turns into Eight Vulnerabilities - Written by @Brett Buerhaus.
• How to bypass libinjection in many WAF/NGWAF - Written by @d0znpp.
• Web Application Firewall (WAF) Evasion Techniques - Written by @secjuice.
• Web Application Firewall (WAF) Evasion Techniques #2 - Written by @secjuice.
• How to bypass libinjection in many WAF/NGWAF - Written by @d0znpp.

XXE

• Bypass Fix of OOB XXE Using Different encoding - Written by @SpiderSec.
• Automating local DTD discovery for XXE exploitation - Written by Philippe Arteau.

Forums

• Phrack Magazine - Ezine written by and for hackers.
• The Hacker News - Security in a serious way.
• HackDig - Dig high-quality web security articles for hacker.
• Dark Reading - Connecting The Information Security Community.
• HackDig - Dig high-quality web security articles for hacker.

Introduction

AngularJS

• XSS without HTML: Client-Side Template Injection with AngularJS - Written by Gareth Heyes.
• DOM based Angular sandbox escapes - Written by @garethheyes

AWS

• PENETRATION TESTING AWS STORAGE: KICKING THE S3 BUCKET - Written by Dwight Hohnstein from Rhino Security Labs.
• AWS PENETRATION TESTING PART 1. S3 BUCKETS - Written by VirtueSecurity.
• AWS PENETRATION TESTING PART 2. S3, IAM, EC2 - Written by VirtueSecurity.

Azure

• Common Azure Security Vulnerabilities and Misconfigurations - Written by @rhinobenjamin.
• Cloud Security Risks (Part 1): Azure CSV Injection Vulnerability - Written by @spengietz.

Clickjacking

• Clickjacking - Written by Imperva.
• X-Frame-Options: All about Clickjacking? - Written by Mario Heiderich.
• X-Frame-Options: All about Clickjacking? - Written by Mario Heiderich.
• X-Frame-Options: All about Clickjacking? - Written by Mario Heiderich.

Command Injection

• rubyでopenコマンドを使用するときに気をつけること - Written by 金子 将範.
• Potential command injection in resolv.rb - Written by @drigg3r.
• PayloadsAllTheThings - Command Injection - Written by @swisskyrepo.
• payloadbox/command-injection-payload-list - Written by @payloadbox.

Crypto

• Applied Crypto Hardening - Written by The bettercrypto.org Team.
• What is a Side-Channel Attack ? - Written by J.M Porup.
• What is a Side-Channel Attack ? - Written by J.M Porup.

CSRF - Cross-Site Request Forgery

• Wiping Out CSRF - Written by @jrozner.
• PayloadsAllTheThings - CSRF Injection - Written by @swisskyrepo.
• PayloadsAllTheThings - CSRF Injection - Written by @swisskyrepo.

CSV Injection

• CSV Injection -> Meterpreter on Pornhub - Written by Andy.
• The Absurdly Underestimated Dangers of CSV Injection - Written by George Mauer.
• PayloadsAllTheThings - CSV Injection - Written by @swisskyrepo.

Deserialization

• Attacking .NET deserialization - Written by @pwntester.
• .NET Roulette: Exploiting Insecure Deserialization in Telerik UI - Written by @noperator.
• How to exploit the DotNetNuke Cookie Deserialization - Written by CRISTIAN CORNEA.
• HOW TO EXPLOIT LIFERAY CVE-2020-7961 : QUICK JOURNEY TO POC - Written by @synacktiv.
• How to exploit the DotNetNuke Cookie Deserialization - Written by CRISTIAN CORNEA.

DNS Rebinding

• Attacking Private Networks from the Internet with DNS Rebinding - Written by @brannondorsey
• Hacking home routers from the Internet - Written by @radekk

FTP Injection

• SMTP over XXE − how to send emails using Java's XML parser - Written by Alexander Klink.
• Advisory: Java/Python FTP Injections Allow for Firewall Bypass - Written by Timothy Morgan.

JWT

• Hardcoded secrets, unverified tokens, and other common JWT mistakes - Written by @ermil0v.

NFS

• NFS | PENETRATION TESTING ACADEMY - Written by PENETRATION ACADEMY.
• NFS | PENETRATION TESTING ACADEMY - Written by PENETRATION ACADEMY.

OAuth

• Introduction to OAuth 2.0 and OpenID Connect - Written by @PhilippeDeRyck.
• What is going on with OAuth 2.0? And why you should not use it for authentication. - Written by @damianrusinek.

Open Redirect

• Open Redirect Vulnerability - Written by s0cket7.
• PayloadsAllTheThings - Open Redirect - Written by @swisskyrepo.

ORM Injection

• HQL for pentesters - Written by @h3xstream.
• HQL : Hyperinsane Query Language (or how to access the whole SQL API within a HQL injection ?) - Written by @_m0bius.
• ORM2Pwn: Exploiting injections in Hibernate ORM - Written by Mikhail Egorov.
• ORM Injection - Written by Simone Onofri.
• HQL for pentesters - Written by @h3xstream.
• ORM2Pwn: Exploiting injections in Hibernate ORM - Written by Mikhail Egorov.
• ORM Injection - Written by Simone Onofri.

OSINT

• Hacking Cryptocurrency Miners with OSINT Techniques - Written by @s3yfullah.
• OSINT x UCCU Workshop on Open Source Intelligence - Written by Philippe Lin.
• 102 Deep Dive in the Dark Web OSINT Style Kirby Plessas - Presented by @kirbstr.
• The most complete guide to finding anyone’s email - Written by Timur Daudpota.
• The most complete guide to finding anyone’s email - Written by Timur Daudpota.
• Hacking Cryptocurrency Miners with OSINT Techniques - Written by @s3yfullah.
• The most complete guide to finding anyone’s email - Written by Timur Daudpota.
• The most complete guide to finding anyone’s email - Written by Timur Daudpota.
• The most complete guide to finding anyone’s email - Written by Timur Daudpota.
• The most complete guide to finding anyone’s email - Written by Timur Daudpota.
• The most complete guide to finding anyone’s email - Written by Timur Daudpota.
• The most complete guide to finding anyone’s email - Written by Timur Daudpota.
• The most complete guide to finding anyone’s email - Written by Timur Daudpota.
• The most complete guide to finding anyone’s email - Written by Timur Daudpota.
• OSINT x UCCU Workshop on Open Source Intelligence - Written by Philippe Lin.

Prototype Pollution

• Prototype pollution attack in NodeJS application - Written by @HoLyVieR.
• Exploiting prototype pollution – RCE in Kibana (CVE-2019-7609) - Written by @securitymb.
• Real-world JS - 1 - Written by @po6ix.
• Real-world JS - 1 - Written by @po6ix.

Rails

• Rails Security - First part - Written by @qazbnm456.
• Zen Rails Security Checklist - Written by @brunofacca.
• Rails Security - First part - Written by @qazbnm456.
• Official Rails Security Guide - Written by Rails team.
• Rails SQL Injection - Written by @presidentbeef.

ReactJS

• XSS via a spoofed React element - Written by Daniel LeCheminant.
• XSS via a spoofed React element - Written by Daniel LeCheminant.

Relative Path Overwrite

• Large-scale analysis of style injection by relative path overwrite - Written by The Morning Paper.
• MBSD Technical Whitepaper - A few RPO exploitation techniques - Written by Mitsui Bussan Secure Directions, Inc..

Security Assertion Markup Language (SAML)

• How to Hunt Bugs in SAML; a Methodology - Part I - Written by epi.
• How to Hunt Bugs in SAML; a Methodology - Part II - Written by epi.
• How to Hunt Bugs in SAML; a Methodology - Part III - Written by epi.
• PayloadsAllTheThings - SAML Injection - Written by @swisskyrepo.

SQL Injection

• SQL Injection Wiki - Written by NETSPI.
• SQL Injection Pocket Reference - Written by @LightOS.
• PayloadsAllTheThings - SQL Injection - Written by @swisskyrepo.
• SQL Injection Cheat Sheet - Written by @netsparker.
• payloadbox/sql-injection-payload-list - Written by @payloadbox.
• GitHub Enterprise SQL Injection - Written by Orange.
• GitHub Enterprise SQL Injection - Written by Orange.

SSL/TLS

• SSL & TLS Penetration Testing - Written by APTIVE.
• Practical introduction to SSL/TLS - Written by @Hakky54.