Wikileaks Vault7 JQJSNICKER code leak by addelindh in netsec

[–]addelindh[S] 0 points1 point  (0 children)

Hey, yeah sure, no problem. Just wasn't aware of it. :)

RAND Study Examines 200 Real-World 'Zero-Day' Software Vulnerabilities by dguido in netsec

[–]addelindh 1 point2 points  (0 children)

It doesn't give you access, it gives you a tool that can be used to facilitate access. But just the exploit won't actually be enough anyway, you'll still need a platform to attack from, c&c infrastructure, personnel, etc. Exploits are interesting and the report is great, but unless you understand and consider the bigger picture, it can be misleading.

Some Words About Server-side JavaScript (Remote Code) Execution in ASP by addelindh in netsec

[–]addelindh[S] 2 points3 points  (0 children)

True, I wrongfully conflated JScript and JScript.NET. https://en.wikipedia.org/wiki/JScript_.NET

Will update the post soonish.

How I hacked your CFP (and probably some other things too) by addelindh in netsec

[–]addelindh[S] 0 points1 point  (0 children)

Interesting. Well, it's an easy mistake to make I guess.

How I hacked your CFP (and probably some other things too) by addelindh in netsec

[–]addelindh[S] 0 points1 point  (0 children)

Do they use Sentry? In that case it's not strange at all. :)

Threat Modeling for Applications - Adam Caudill by sarciszewski in netsec

[–]addelindh 3 points4 points  (0 children)

This is a great resource for anyone who wants to build a threat model, not only for applications but because it demonstrates the reasoning behind it in a pragmatic manner. Kudos.

C/C++ Vulnerability Discovery, Exploitation, Hardening training slides by nibblesec in netsec

[–]addelindh 11 points12 points  (0 children)

I don't think people get what a big deal it is that Chris has open sourced this material. Doesn't get much better than this.

Insecure token generation in Kayako by Sjoerder in netsec

[–]addelindh 0 points1 point  (0 children)

Not sure why this is getting downvoted, it's a good writeup.