Smashing the State Machine

/The Bee's Knees 🐝

The headline picks from this issue. The full issue has more.

1. /01

   Phishing the anti-phishers: Exploiting anti-phishing tools for internal access

   Anti-phishing tools and products are used widely at various enterprises to prevent malicious emails from landing in employees’ inboxes.

   Read : Phishing the anti-phishers: Exploiting anti-phishing tools for internal access
2. /02

   Recordings of Security BSides Las Vegas 2023 with talks by Leif Dreizler, Phyllip Wylie, Christina Liu, and many more.

   Watch : pick 2
3. /03

   Black Hat USA 2023 slides, including STÖK’s Weaponizing Plain Text ANSI Escape Sequences as a Forensic Nightmare talk.

   Read : pick 3
4. /04

   Smashing the state machine: the true potential of web race conditions

   For too long, web race condition attacks have focused on a tiny handful of scenarios. Their true potential has been masked thanks to tricky workflows, missing tooling, and simple network jitter hiding all but the most trivial, obvious examples.

   Read : Smashing the state machine: the true potential of web race conditions
5. /05

   Cookieless DuoDrop: IIS Auth Bypass & App Pool Privesc in ASP.NET Framework (CVE-2023-36899)

   In modern web development, while cookies are the go-to method for transmitting session IDs, the .NET Framework also provides an alternative: encoding the session ID directly in the URL.

   Read : Cookieless DuoDrop: IIS Auth Bypass & App Pool Privesc in ASP.NET Framework (CVE-2023-36899)