Application Security This Week for January 31

Using Machine Learning to perfect SQL Injection

https://portswigger.net/daily-swig/machine-learning-offers-fresh-approach-to-tackling-sql-injection-vulnerabilities

And some practical application of that idea

https://research.nccgroup.com/2019/06/05/project-ava-on-the-matter-of-using-machine-learning-for-web-application-security-testing-part-1-understanding-the-basics-and-what-platforms-and-frameworks-are-available/

Didier has a new PDF tool out.  I haven't used it yet but I am certain it is awesome.

https://blog.didierstevens.com/2021/01/31/new-tool-pdftool-py/

OK, this is a weird one.  It appears that threat actors are using project files with built-in vulnerabilities to target the vulnerability researchers themselves, apparently to steal their research.  That's some next level stuff.

https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/amp/

Application Security This Week for January 24th

A very Interesting list of exploitable "features" in PDFs.

https://web-in-security.blogspot.com/2021/01/insecure-features-in-pdfs.html?m=1

There have been a lot of attacks on Azure's authentication system recently - some of which were even in this newsletter.  Sparrow helps you smoke out vulnerable instances.

https://github.com/cisagov/Sparrow/

Didier has been a regular in this newsletter, and he has updated his Strings.py tool to support more encoding. Very cool stuff.

https://blog.didierstevens.com/2021/01/24/update-strings-py-version-0-0-7/

Have your kids test your apps.

https://github.com/linuxmint/cinnamon-screensaver/issues/354

Stay safe out there.

Application Security This Week for January 17

Breakdown of a malicious app that man-in-the-middled the Google Signin.

https://blog.usejournal.com/how-i-stole-the-data-in-millions-of-peoples-google-accounts-aa1b72dcc075

Good Wired article about tools the fibby uses to get around smartphone encryption.

https://www.wired.com/story/smartphone-encryption-law-enforcement-tools/

Oh man, cross-origin images and data leakage.  Certainly adding this to my manual testing.

https://blog.mozilla.org/attack-and-defense/2021/01/11/leaking-silhouettes-of-cross-origin-images/

This has been patched, but a really good explainer on how the RCE in Office 365 was discovered.

https://srcincite.io/blog/2021/01/12/making-clouds-rain-rce-in-office-365.html

Using game hacking to explain the danger of unsigned code.

https://secret.club/2021/01/12/callout.html

Have a great week folks!

Application Security This Week for January 10

Hey, welcome back from holidays.  Quite a week it has been.

Portswigger has a really good writeup of OAUTH 2 vulnerabilities.

https://portswigger.net/web-security/oauth

This isn't so much appsec, but it is really interesting code that hacks a game - Cyberpunk 2077 minigame resolver.

https://github.com/nicolas-siplis/cyberpwned

SolarWinds just keeps on giving.

https://kb.cert.org/vuls/id/843464

Keep on keeping on, folks.