Marshal madness: A brief history of Ruby deserialization exploits

Breaking the Sorting Barrier for Directed Single-Source Shortest Paths

New Method to Leverage Unsafe Reflection and Deserialisation to RCE on Rails

Escaping Ruby's Gem:SafeMarshal Sandbox

Escaping Ruby's Gem:SafeMarshal Sandbox

RubyGem's Gem:SafeMarshal buffer overrun with length larger than fit into a byte

CORS Vulnerabilities in Go: Vulnerable Patterns and Lessons

Shiny Vulnerabilities in R's Most Popular Web Framework

PentesterLab: Web Hacking and Security Code Review 600 exercises and 700 videos

Cross-Site Post Requests Without a Content-Type Header – CSRF Attack

Execute commands by sending JSON? Ruby deserialization vulnerabilities

JWT Libraries Block Algorithm Confusion: Key Lessons for Code Review

Chosen-Prefix Collisions on AES-Like Hashing

Ruby 3.4 Universal RCE Deserialization Gadget Chain

Ruby's String Slice is Broken

Evaluate Markdown code blocks within Vim

SQL Injection Polyglot Payloads

Insecurity Through Censorship: Vulnerabilities Caused by the Great Firewall

Insecurity Through Censorship: Vulnerabilities Caused by the Great Firewall

Fuzz Map – fuzzer for GUIs that automatically builds a visual map

nastystereo.com

A Single File Ruby on Rails Application

Devfile file write vulnerability in Gitlab – walkthrough finding CVE-2024-0402

Judge0 Sandbox Escape – allows obtaining root permissions

Discovering Deserialization Gadget Chains in Rubyland

Blind CSS Exfiltration: exfiltrate unknown web pages

Talkback: Keeping up with the pwnses, a next gen infosec resource aggregator

Talkback – infosec resource aggregator of news and research

PHP filter chains: file read from error-based oracle

PHP Development Server <= 7.4.21 – Remote Source Disclosure

Viewing Secrecy Through “Blank Spots on the Map” (2009)

The search for the “perfect” Advent Calendar (2018)

RCE via SSTI on Spring Boot Error Page with Akamai WAF Bypass

Reverse Branch Target Buffer Poisoning – New ASLR Bypass via CPU Vulns [pdf]

The latest OpenSSL vulns were added fairly recently

Ask HN: How are you, a dev/programmer, preparing for climate change?

It Pays to Be Circomspect

Attacking Firecracker: AWS' MicroVM Monitor Written in Rust

Multiple vulnerabilities in Nuki smart locks

Golang Code Review Notes by Elttam

Notes on OpenSSL remote memory corruption by Guido Vranken

ESP-IDF Setup Guide – Setting up an environment for ESP32 vulnerability research

Round Two: An Updated Universal Deserialisation Gadget for Ruby 2.x-3.x

Git honours embedded bare repos and exploitation via core.fsmonitor

Ruby Deserialization Exploitation – New Gadget Chain for Ruby on Rails

Ask HN: Best Okta Alternative?

Exploitation via Git embedded bare repos and core.fsmonitor, affects IDEs

Impossible color – Claimed evidence of ability to see colors not in color space

Bypass of allowedLdapHost check in Log4j 2.15.0 – Log4Shell (CVE-2021-44228)

The search for the “perfect” Advent Calendar (involves Python and Processing)

Data Exfiltration via CSS and SVG Font

The status of Ruby memory trimming and how you can help with testing (2019)

FormatFuzzer: A framework for efficient and quality generation of binary inputs

Ruby Universal RCE Deserialization Gadget Chain (2018)

Fail2ban – Remote Code Execution

Petrov Day 2021: Mutually Assured Destruction?

Home Assistant Amber

GitHub Actions checkspelling community workflow GitHub_TOKEN leakage via symlink

Domino's iOS App Settings

A hackers perspective on bug bounty triage

DOM Invader: DOM XSS just got a whole lot easier to find

ZeroTier – Global Area Networking

Piecing Together the Dark Legacy of East Germany's Police (2008)

PrintNightmare (CVE-2021-1675): Remote code execution in Windows Spooler Service

BlockFi issued BTC instead of USD, a 45,000x mistake

I Hacked Google App Engine: Anatomy of a Java Bytecode Exploit

The ‘artisanal genius’ of creating iPhone-breaking hacks

Fuzzing Sockets: Apache HTTP, Part 2: Custom Interceptors

Sd: My Script Directory

You might want to update your F5 Big IP appliances

Ask HN: Do you create digital art? let's see it

A Journey Combining Web Hacking and Binary Exploitation in Real World

Sudoedit Heap Overflow

Stop Using Libgcrypt 1.9.0

Rysolv – Fix open source issues, get paid

The search for the “perfect” Advent Calendar (2018)

Tuya IoT and EZ Mode Pairing

Cross-site leaks (XS-Leaks) Wiki

iOS 1-day hunting: uncovering and exploiting CVE-2020-27950 kernel memory leak

Simple bugs with complex exploits – an analysis of a V8 vulnerability from P0

Ghostscript Safer Sandbox Breakout (CVE-2020-15900)

Lua SUID Shells – How to make SUID Lua scripts not drop privileges