Newsy

A 0-click exploit chain for the Pixel 9 Part 2: Cracking the Sandbox with a Big Wave

With the advent of a potential Dolby Unified Decoder RCE exploit, it seemed prudent to see what kind of Linux kernel drivers might be accessible from the resulting userland context, the mediacodec context. As per the AOSP documentation, the mediacodec SELinux context is intended to be a constrained (a.k.a sandboxed) context where non-secure software decoders are utilized. Nevertheless, using my DriverCartographer tool, I discovered an interesting device driver, /dev/bigwave that was accessible from the mediacodec SELinux context. BigWave is hardware present on the Pixel SOC that accelerates AV…Czytaj całość ↵Źródło ↗ — otwiera w nowej karcie

Top 10 web hacking techniques of 2025: call for nominations

Update: nominations are now closed, and voting is live! Cast your vote here Over the last year, security researchers have shared a huge amount of work with the community through blog posts, presentatiCzytaj całość ↵Źródło ↗ — otwiera w nowej karcie

The Fragile Lock: Novel Bypasses For SAML Authentication

TLDR This post shows how to achieve a full authentication bypass in the Ruby and PHP SAML ecosystem by exploiting several parser-level inconsistencies: including attribute pollution, namespace confusiCzytaj całość ↵Źródło ↗ — otwiera w nowej karcie

Introducing HTTP Anomaly Rank

HTTP Anomaly Rank If you've ever used Burp Intruder or Turbo Intruder, you'll be familiar with the ritual of manually digging through thousands of responses by repeatedly sorting the table via length,Czytaj całość ↵Źródło ↗ — otwiera w nowej karcie

WebSocket Turbo Intruder: Unearthing the WebSocket Goldmine

Many testers and tools give up the moment a protocol upgrade to WebSocket occurs, or only perform shallow analysis. This is a huge blind spot, leaving many bugs like Broken Access Controls, Race condiCzytaj całość ↵Źródło ↗ — otwiera w nowej karcie

Cookie Chaos: How to bypass __Host and __Secure cookie prefixes

Browsers added cookie prefixes to protect your sessions and stop attackers from setting harmful cookies. In this post, you’ll see how to bypass cookie defenses using discrepancies in browser and serveCzytaj całość ↵Źródło ↗ — otwiera w nowej karcie

Inline Style Exfiltration: leaking data with chained CSS conditionals

I discovered how to use CSS to steal attribute data without selectors and stylesheet imports! This means you can now exploit CSS injection via style attributes! Learn how below: Someone asked if you cCzytaj całość ↵Źródło ↗ — otwiera w nowej karcie

Beware the false false-positive: how to distinguish HTTP pipelining from request smuggling

Sometimes people think they've found HTTP request smuggling, when they're actually just observing HTTP keep-alive or pipelining. This is usually a false positive, but sometimes there's actually a realCzytaj całość ↵Źródło ↗ — otwiera w nowej karcie

HTTP/1.1 must die: the desync endgame

Abstract Upstream HTTP/1.1 is inherently insecure and regularly exposes millions of websites to hostile takeover. Six years of attempted mitigations have hidden the issue, but failed to fix it. This pCzytaj całość ↵Źródło ↗ — otwiera w nowej karcie

Repeater Strike: manual testing, amplified

Manual testing doesn't have to be repetitive. In this post, we're introducing Repeater Strike - a new AI-powered Burp Suite extension designed to automate the hunt for IDOR and similar vulnerabilitiesCzytaj całość ↵Źródło ↗ — otwiera w nowej karcie