The Dark Side of JWT: Exploiting Token Vulnerabilities
Many modern applications use JSON Web Tokens (JWTs) to authenticate and authorize users in their functionalities. In this article, we will explore vulnerabilities in
RESEARCH AREA
en
Save money brushing your teeth - unveiling the Threat Modeling - part 1 of 3
Threat modeling is a cyclic process to avoid future problems. Just like brushing your teeth, that prevents decay, tartar or dental calculus, threat modeling
Stealer Logs: An in-depth analysis of over half a billion stolen credentials
Key Findings * We analyzed over 590 million credentials from more than 20 million unique infected computers worldwide. * Brazil is one of the most affected
Malware that detects Wine and infects both Windows and Linux?
If you are a slightly above-average user – and you certainly are; otherwise, you wouldn't be reading this article =D – you'
Avoiding unrestricted file upload - straight to the source
File uploads have become essential for numerous web applications, ranging from social media platforms to cloud storage services. They enable users to easily share
OsCommerce v4 RCE: Unveiling the file upload bypass threat
In my recent research, I identified a critical vulnerability in osCommerce v4, specifically a Remote Code Execution (RCE) vulnerability enabled by bypassing file upload
Windows Admin-to-Kernel Elevation of Privilege (CVE-2024-21338)
Abstract On February 13th, 2024, during the patch Tuesday, Microsoft disclosed the CVE-2024-21338 based on the security report made by Jan Vojtěšek
From a SSRF to the creation of gcp_enum
In this article, we will discuss a case of SSRF in a GCP environment and how exploiting this vulnerability led to the idea and
Error 404: Your Security Not Found – Tales of Web Vulnerabilities
Greetings to all, This article aims to provide insights and stories about vulnerabilities in web applications and their impacts. Throughout this text, I will