47 - Fingerprinting Exploit Devs, BLURtooth and Punking Punkbuster

06 October 2020

Show Notes

47 - Fingerprinting Exploit Devs, BLURtooth and Punking Punkbuster

Google: Android Partner Vulnerability Initiative

Additional Links: https://bugs.chromium.org/p/apvi/issues/list?q=&can=1

Project Zero: Announcing the Fuzzilli Research Grant Program

GitHub: Code scanning is now available

Hunting for exploits by looking for the author's fingerprints

Forcing Firefox to Execute XSS Payloads during 302 Redirects

Exploiting fine-grained AWS IAM permissions for total cloud compromise

Additional Links: https://medium.com/bugbountywriteup/aws-iam-explained-for-red-and-blue-teams-2dda8b20fbf7

BLURtooth (the BLUR attacks)

Arbitrary code execution on Facebook for Android

[stripo] Public and secret api key leaked in JavaScript source

[GitLab] Unvalidated Oauth email results in accounts takeovers on 3rd parties

Hacking Grindr Accounts with Copy and Paste

Exploiting Other Remote Protocols in IBM WebSphere

Additional Links: https://portswigger.net/web-security/deserialization/exploiting

The Anatomy of a Bug Door: Dissecting Two D-Link Router Authentication Bypasses

Hacking Punkbuster.

Race Condition in handling of PID by apport [CVE-2020-15702]

Hardware Hacking Experiments

How I automated McDonalds mobile game to win free iPhones

Voyager - A Hyper-V Hacking Framework For Windows 10 x64 (AMD & Intel)

zznop/sploit: Go package that aids in binary analysis and exploitation