NULL Pointer Dereference in mruby/mruby

NULL Pointer Dereference in Homebrew mruby prior to 3.2...

Mariana Trench - Security Focused Static Analysis Tool For Android And Java Applications

Mariana Trench is a security focused static analysis platform targeting Android. This guide will walk you through setting up Mariana Trench on your machine and get you to find your first remote code execution vulnerability in a small sample app. These instructions are also available at our websit...

Playstation 5 hacked—twice!

Over the weekend, hackers revealed that the Playstation 5 PS5, Sony’s latest darling, has been broken into—not just once but twice. Fail0verflow, the hacking group notorious for breaking Playstation consoles, and Andy "TheFlow" Nguyen, a security engineer at Google and widely known in the...

Ddosify - High-performance Load Testing Tool

Features Protocol Agnostic - Currently supporting HTTP, HTTPS, HTTP/2. Other protocols are on the way. Scenario-Based - Create your flow in a JSON file. Without a line of code! Different Load Types - Test your system's limits across different load types. Installation ddosify is available via...

Cloudquery - Transforms Your Cloud Infrastructure Into SQL Database For Easy Monitoring, Governance And Security

CloudQuery transforms your cloud infrastructure into queryable SQL for easy monitoring, governance and security. What is CloudQuery and why use it? CloudQuery pulls, normalize, expose and monitor your cloud infrastructure and SaaS apps as SQL database. This abstracts various scattered APIs enabli...

Homebrew: clickjacking at brew.sh

hello , While performing security testing of your website i have found the vulnerability called Clickjacking. URL is in scope and vulnerable to Clickjacking. What is Clickjacking ? Clickjacking User Interface redress attack, UI redress attack, UI redressing is a malicious technique of tricking a...

Homebrew Formulae libgetdata 缓冲区错误漏洞

Homebrew Formulae libgetdata is a Homebrew Formulae open source application. A reference implementation of the Dirfile standard , the Dirfile standard is a file system based column-oriented database format for chronological binary data . A buffer error vulnerability exists in libgetdata version...

Exploit for Use After Free in Debian Debian_Linux

This is a PoC exploit for CVE-2013-2857, a use-after-free vulnerability in the 3DS browser. The exploit is implemented in JavaScript and uses the UaF3 function to create a use-after-free condition, leading to a crash. The exploit is designed to be used on the 3DS browser, specifically on firmware...

Critical RCE Bug Found in Homebrew Package Manager for macOS and Linux

A recently identified security vulnerability in the official Homebrew Cask repository could have been exploited by an attacker to execute arbitrary code on users' machines that have Homebrew installed. The issue, which was reported to the maintainers on April 18 by a Japanese security researcher...

Homebrew: Broken parsing of Git diff allows an attacker to inject arbitrary Ruby scripts to Casks on official taps

Description Due to improper parsing of Git diff in Homebrew/actions/review-cask-pr, it's possible to confuse parser to ignore additional lines. Which leads injection of malicious Ruby scripts. Root cause review-cask-pr uses the git diff file to check if the pull request is "simple" enough to...

Homebrew: Brew bootstrap process is insecure

The process described in this page is not secure - no checksum / PGP signature is published and there is no way to check the download is legit: https://brew.sh/ "/bin/bash -c "$curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh"" This can lead to supply chain attacks su...

Critical Libgcrypt Crypto Bug Opens Machines to Arbitrary Code

The Libgcrypt project has rushed out a fix for a critical bug in version 1.9.0 of the free-source cryptographic library. An exploit would allow an attacker to write arbitrary data to a target machine and execute code. The security vulnerability is a heap-buffer overflow bug in Libgcrypt 1.9.0...

Gping - Ping, But With A Graph

Ping, but with a graph. Install FYI: The old Python version can be found under the python tag. Homebrew MacOS + Linux brew tap orf/brew brew install gping Binaries Windows Download the latest release from the github releases page. Extract it and move it to a directory on your PATH. Cargo cargo...

MZAP - Multiple Target ZAP Scanning

Multiple target ZAP Scanning / mzap is a tool for scanning NN in ZAP. Concept Installation go-get $ go get -u github.com/hahwul/mzap snapcraft $ sudo snap install mzap --devmode homebrew $ brew tap hahwul/mzap $ brew install mzap Usage Usage: mzap command Available Commands: ajaxspider Add...

Install Go tools from modules with brew-gomod

As of Go 1.14, modules are ready for production. Compared to GOPATH, they make it much easier to keep workspaces clean by managing dependencies out of sight, and by letting you clone projects anywhere. However, there is no good way to simply install a Go binary from source, yet. The core reason f...

Trivy - A Simple And Comprehensive Vulnerability Scanner For Containers, Suitable For CI

A Simple and Comprehensive Vulnerability Scanner for Containers, Suitable for CI. Abstract Trivy tri pronounced like tri gger, vy pronounced like envy is a simple and comprehensive vulnerability scanner for containers. A software vulnerability is a glitch, flaw, or weakness present in the softwar...

Homebrew: Homebrew privilege escalation vulnerability

Additional symlinks/directories that were not chownd by brew services needed to be added to avoid the replacement of the opt prefix link. Homebrew has a privilege escalation vulnerability which can cause an attacker easily gain root permission...

Homebrew: Homebrew installed LaunchDaemons create simple root esclations

Many programs installed via Homebrew require services to function as expected - most of the time these are LaunchAgents but sometimes they need to run as root via LaunchDaemons to function properly. While Homebrew attempts to secure the executables run by the LaunchDaemons that it installs, any...

Lazygit - Simple Terminal UI For Git Commands

A simple terminal UI for git commands, written in Go with the gocui library. Are YOU tired of typing every git command directly into the terminal, but you're too stubborn to use Sourcetree because you'll never forgive Atlassian for making Jira? This is the app for you! Installation Homebrew brew...

Masc - A Web Malware Scanner

A malware web scanner developed during CyperCamp Hackathon 2017. Features At the moment, there are some features avaiable for any type of website custom or CMS and some of them only available for specific platforms: Scan any website for malware using OWASP WebMalwareScanner checksum, YARA rules...