Techniques de hacking 2022

Voici quelques liens utiles pour se mettre à jour sur les techniques de hacking 2022. A utiliser dans un but bienveillant ou sous contrat de pentesting en bonne et due forme.

• Disclosing information with a side-channel in Django
• PHP filters chain: What is it and how to use it
• Worldwide Server-side Cache Poisoning on All Akamai Edge Nodes
• Caching the Un-cacheables - Abusing URL Parser Confusions
• Browser-Powered Desync Attacks: A New Frontier in HTTP Request Smuggling
• Discovering Domains via a Time-Correlation Attack on Certificate Transparency
• FRAMESHIFTER: Security Implications of HTTP/2-to-HTTP/1 Conversion Anomalies
• {JS-ON: Security-OFF}: Abusing JSON-Based SQL to Bypass WAF
• Let's Dance in the Cache - Destabilizing Hash Table on Microsoft IIS!
• A story of leaking uninitialized memory from Fastly
• Hacking Salesforce-backed WebApps
• Practical client-side path-traversal attacks
• Making HTTP header injection critical via response queue poisoning
• Exploiting Inter-Process Communication in SAP's HTTP Server
• Melting the DNS Iceberg: Taking over your infrastructure Kaminsky style
• Account hijacking using "dirty dancing" in sign-in OAuth-flows
• The great SameSite confusion
• The Underrated Bugs, Clickjacking, CSS Injection, Drag-Drop XSS, Cookie Bomb...
• Persistent PHP payloads in PNGs: How to inject PHP code in an image
• Till REcollapse: : Fuzzing the web for mysterious bugs
• Exploiting Java's XML Signature Verification
• Jetty Features for Hacking Web Apps
• SSRF vulnerabilities caused by SNI proxy misconfigurations
• CSRF Resurrections Starring the Unholy Trinity
• Psychic Signatures in Java
• Deep understand ASPX file handling and some related attack vectors
• Arbitrary File Upload Tricks In Java
• Hacking the Cloud with SAML
• Apache Pinot SQLi and RCE Cheat Sheet
• The Danger of Falling to System Role in AWS SDK Client
• ElectroVolt - Pwning Popular Desktop Apps
• Hijacking service workers via DOM Clobbering
• WAF bypasses via 0days
• Exploring the World of ESI Injection
• A Magic Way of XSS in HTTP/2
• Miracle - One Vulnerability To Rule Them All
• Exploiting Arbitrary Object Instantiations in PHP without Custom Classes
• Zimbra Email - Stealing Clear-Text Credentials via Memcache injection
• SpEL Casting and Evil Beans
• Bypassing .NET Serialization Binders
• The OWASSRF + TabShell exploit chain
• Exploiting Static Site Generators: When Static Is Not Actually Static
• What is prototype poisoning? Prototype bugs explained
• In GUID We Trust
• Exploiting Web3’s Hidden Attack Surface: Universal XSS on Netlify’s Next.js Library

Source portswigger