A Comprehensive Guide to Learning Smart Contract Security: From Scratch to AdvancedIntroduction Welcome to your journey into the world of smart contract security! This guide will take you through all the necessary steps to understand and master the art of building secure decentralized applications (dApps). We will explore various r...Apr 28, 2024·7 min read
Analyzing the Google Chrome V8 CVE-2024-0517 Out-of-Bounds Code Execution VulnerabilityFeb 24, 2024·46 min read
Analysis of Glibc privilege escalation vulnerability "Looney Tunables" (CVE-2023-4911)Recently, the Threat Research Unit of Qualys Company disclosed a Glibc vulnerability. The Glibc library has a buffer overflow vulnerability when processing environment variables, which can lead to local privilege escalation. This vulnerability affect...Feb 21, 2024·10 min read
Analysis of Microsoft Streaming Agent Privilege Elevation Vulnerability - CVE-2023-36802This article will introduce the implementation process of the outdoor cases analyzed by Google Project Zero. Affected versions mskssrv.sys (~10.0.22621.1848) Introduction Before a driver vulnerability can be deeply analyzed to trigger, communicatio...Jan 11, 2024·16 min read
An In-Depth Analysis of Google Chrome Extension Vulnerabilities and Securityhttps://tutorialboy24.blogspot.com/2023/11/an-in-depth-analysis-of-google-chrome.html Introduction Create a directory that has automatically synced and beautified the source code of Google Chrome extensions hosted in the Chrome Web Store. Search f...Nov 28, 2023·22 min read
Unveiling the Unauthenticated Command Execution Vulnerability in Cisco IOS XE System WebUIhttps://tutorialboy24.blogspot.com/2023/11/unveiling-unauthenticated-command.html This article will analyze and summarize the recent critical CVEs (CVE-2023-20198, CVE-2023-20273) in Cisco IOS XE. Environment Setup A Cisco ISR 4300 router for resea...Nov 23, 2023·12 min read
Confluence Vulnerability (CVE-2023-22515): A Deep Dive into Atlassian Bamboo's Chain Security LandscapeOverview Recently, a security team disclosed a vulnerability in Confluence called SafeParameterFilter, which allows an unauthenticated remote attacker to bypass XWork functionality to create new administrative user accounts. We took this opportunity ...Nov 22, 2023·8 min read
Unveiling the Secrets of XSS Bypass: Harnessing JavaScript Symbols for Code ExecutionPreface I have been looking at Intigriti, yeswehack, HackerOne and Bugcrowd bounty platforms recently. It is really uncomfortable to bypass WAF. I will record the bypass scenario. Preliminary testing When I first tried XSS, I found that the user's in...Nov 5, 2023·3 min read
