In our Adrian Denkiewicz's latest post, see how combining AFL++ with GPT-5 Codex sped up triaging the results from fuzzing NASA’s CFITSIO library and uncovered numerous vulnerabilities.
Introducing SafeUpdater by Michael Pastor - A security-first update framework for Electron apps, built around explicit threat models, integrity and authenticity guarantees, and real attack mitigations. Check it out today!
Dennis Goodlett's "Cracking Pickles With r2" presentation from radareorg's r2con2024 is now available online! If you're interested in learning about bypassing malicious pickle detection - check it out today!
CSRF in modern web apps? It's still possible! Our latest research by Maxence Schmitt dives into using Client-Side Path Traversal to perform CSRF. Check out our latest blogpost and brand new Burp extension for finding bugs.
PoIEx, a new Doyensec tool, identifies "Points of Intersection" where code & IaC definitions meet. Visualize & explore IaC, plus create & share real-time notes w/ teammates in VS Code. Try it out today‼
New feature drop! In addition to being able to visually interact with hijacked browsers, our Session Hijacking Visual Exploitation (SHVE) tool now includes the ability to seamlessly inject malicious macros into downloads of common file types.
As a result of research & coordinated disclosure by our Francesco Lacerenza, a new patch was released for the crewjam SAML #golang library. Affected versions (< 0.4.14) are vulnerable to cross-site scripting (XSS) on the IdP.
Announcing the release of ProtoBurp++ (our fork of ProtoBurp)! ProtoBurp++ is a Burpsuite extension that enables security researchers to encode/decode and fuzz custom Protobuf messages. It allows for fuzzing inputs using Burp's Repeater, Intruder tools and Active Scanner, as well as proxying traffic from other tools (e.g., sqlmap). Check it out today!
This open-source tool, now available on our GitHub, offers a novel way to hijack a victim’s browser sessions, utilizing them as a visual proxy after hooking via an XSS or a malicious webpage.
Our latest post details a submission we made to the invite-only Huawei bug bounty program. Learn how we leveraged their custom themes to gain arbitrary code execution.
Just posted! Learn how to achieve privilege escalation via misconfigured #AWS Batch & the solution for our previous lab, in the latest installment of #Doyensec's "Cloudsec Tidbits" series.
In our latest blog post, you can learn more about reversing Python pickles and how it's made easier with r2pickledec, a new decompiler plug-in for Radare2 from our Dennis Goodlett.
Phishing scams targeting crypto wallets are everywhere. Doyensec's Viktor Chuchurski details one such attack and offers suggestions on how wallets can improve their security.
Get all the details on how Adrian Denkiewicz discovered a SYSTEM level privilege escalation vulnerability (CVE-2023-21800), as he walks through his research on the Windows Installer (MSI) technology.
In our latest blog post, our chefs from and have collaborated to bring you a culinary masterpiece! Learn Lorenzo Stella and Maxence Schmitt's recipe for a tasty arbitrary file write to RCE via abusing uWSGI files. Bon appétit!
Based on work recognized in Portswigger's Top 10 Web Hacking Techniques for 2022 - Authentication Bypass In Multi-Tenant Apps using passport-saml for SAML SSO Integrations
Description
A remote attacker may be able to bypass SAML SSO authentication on a platform by exploiting CVE-2022-39299 affecting the passport-saml library.
A public exploit was not available (at the time of writing), and the advisory was published on 10/12/2022 with little/no information. Doyensec developed a working Proof Of Concept (PoC) generator to verify the issue against multi-tenant platforms in which the tenant admin is able to configure SAML SSO with a custom IdP.
Announcing the release of `safeurl` - a library to help #golang devs "Build with Security"! This module provides tested & versatile protection against Server Side Request Forgery (SSRF)! Hurry and check it out or try to break it and win a prize!
See how @lucacarettoni leveraged newly public bugs and techniques, along with (un)fortunate design choices to elevate an XSS discovered by @justinsteven into a full-blown RCE in VSCode, via its support for Jupyter Notebook.