High frequency security bug hunting: 120 days, 120 bugs July 29, 20161) Intro & Motivations 2) Findings 3) Analysis 4) Methodology 5) Advice... 2016-07-30 00:36:28 | 阅读: 78 | 收藏 | shubs.io subdomain subtitles dupe u003eprompt u003cscript

High frequency security bug hunting: 120 days, 120 bugs June 30 20161) Intro & MotivationsAt the start of of this year, I set myself a personal... 2016-6-29 15:36:0 | 阅读: 6 | 收藏 | Shubham Shah - shubs.io subdomain subtitles dupe u003eprompt u003e

Using ngrok to proxy internal servers in restrictive environments When gaining shell access to a machine on a network, a promising attack vector is to check... 2015-11-18 15:03:27 | 阅读: 49 | 收藏 | shubs.io ngrok attacker proxy client rootca

Using ngrok to proxy internal servers in restrictive environments When gaining shell access to a machine on a network, a promising attack vector is to ch... 2015-11-18 06:3:0 | 阅读: 6 | 收藏 | Shubham Shah - shubs.io ngrok attacker client proxy rootca

Abusing URL Shortners to discover sensitive resources or assets September 22, 2015 · websec bruteforceAs of late, a fair few companies and startups have b... 2015-09-23 03:27:15 | 阅读: 58 | 收藏 | shubs.io shortner bitly bruteforce dirs3arch shortners

Abusing URL Shortners to discover sensitive resources or assets September 23 2015 · websec bruteforceAs of late, a fair few companies and startups have... 2015-9-22 18:27:0 | 阅读: 4 | 收藏 | Shubham Shah - shubs.io shortner bitly utm shortners dirs3arch

Enumerating IPs in X-Forwarded-Headers to bypass 403 restrictions July 16, 2015 · websec security toolAs of late, I have been pentesting more and more appli... 2015-07-16 17:56:53 | 阅读: 41 | 收藏 | shubs.io burp wp python3 comma represent

Enumerating IPs in X-Forwarded-Headers to bypass 403 restrictions As of late, I have been pentesting more and more applications that use some sort of mec... 2015-6-15 08:56:0 | 阅读: 6 | 收藏 | Shubham Shah - shubs.io burp wp python3 github delimited

Security for young people in Australia Security for young people is something I care about. We need to make an investment whether... 2015-05-14 00:07:31 | 阅读: 55 | 收藏 | shubs.io security degrees sydney comp stress

Security for young people in Australia Security for young people is something I care about. We need to make an investment whet... 2015-5-13 15:7:0 | 阅读: 7 | 收藏 | Shubham Shah - shubs.io security degrees sydney teach

Exploiting Markdown Syntax and Telescope Persistent XSS through Markdown (CVE-2014-5144) Exploiting Markdown SyntaxMarkdown is wonderful. In fact, this blog post itself is writt... 2015-02-07 16:44:33 | 阅读: 62 | 收藏 | shubs.io telescope x27 0aprompt x72

Exploiting Markdown Syntax and Telescope Persistent XSS through Markdown (CVE-2014-5144) Exploiting Markdown SyntaxMarkdown is wonderful. In fact, this blog post itself is writ... 2015-2-7 07:44:0 | 阅读: 5 | 收藏 | Shubham Shah - shubs.io telescope 0aprompt x27 x72

Introducing Websec Weekly Earlier this week, I released Websec Weekly into the wild. This blog post is about my moti... 2015-01-06 13:40:40 | 阅读: 44 | 收藏 | shubs.io security weekly websec gathered enthusiasts

Breaking International Voicemail Security via VVM Exploitation A few days ago, I gave a presentation at Ruxcon about breaking international voicema... 2014-10-19 17:50:16 | 阅读: 54 | 收藏 | shubs.io voicemail vvm username pw

Guide to building the Tastic RFID Thief The Tastic RFID Thief has been around since late 2013, and since I've had a tremendous amo... 2014-06-23 02:26:41 | 阅读: 81 | 收藏 | shubs.io pcb tastic rfid arduino pins

The deterioration of unmanaged bug bounties May 30, 2014 · bugbounty rantBeing a developer is hard. Taking care of a security related... 2014-05-31 00:46:51 | 阅读: 49 | 收藏 | shubs.io security bounties hunters developer extreme

How I bypassed 2-Factor-Authentication on Google, Facebook, Yahoo, LinkedIn, and many others I remember fondly two years ago, when 2-Factor-Authentication (2FA) became popular and wel... 2014-05-03 20:30:53 | 阅读: 53 | 收藏 | shubs.io voicemail security optus telco facebook

Full Disclosure: Coinbase design allows for mass, targeted phishing of its users. March 31, 2014 · websec logicflawI'd like to start by saying that, I have tried my best to... 2014-04-01 01:50:56 | 阅读: 41 | 收藏 | shubs.io coinbase mar security reminder citizen

Accessing PayPal’s internal network - the critical nature of SSRF January 14, 2014 · research websec ssrfServer Side Request Forgery (SSRF) is a relatively... 2014-01-14 10:00:00 | 阅读: 49 | 收藏 | shubs.io ssrf billmelater merchant bed req2

I found Prezi’s source code Edit: Prezi have decided to pay me for my findings, I have included a brief update at the... 2013-12-02 22:00:00 | 阅读: 44 | 收藏 | shubs.io prezi nexus apology beneficiary security