The hacker’s guide to securing your organization

/The Bee's Knees 🐝

The headline picks from this issue. The full issue has more.

1. /01

   Data Exposure and ServiceNow: The Elephant in the ITSM Room

   The purpose of this tutorial is to share their knowledge of how a built-in capability within ServiceNow could potentially be leveraged to extract data from records as an unauthenticated user.

   Read : Data Exposure and ServiceNow: The Elephant in the ITSM Room
2. /02

   CVE-2022-4908: SOP bypass in Chrome using Navigation API

   Last year, Johan discovered a Same-Origin Policy (SOP) bypass in Chrome that allowed an attacker to leak the full URLs of another window’s navigation history.

   Read : CVE-2022-4908: SOP bypass in Chrome using Navigation API
3. /03

   Rails World 2023 Opening Keynote by David Heinemeier Hansson

   Ruby on Rails creator and 37signals CTO David Heinemeier Hansson covered a lot of ground, including introducing 7 major tools: Propshaft, Turbo 8, Strada, Solid Cache, Solid Queue, Mission Control, and Kamal.

   Watch : Rails World 2023 Opening Keynote by David Heinemeier Hansson
4. /04

   Attacking Secondary Contexts in Web Applications by Sam Curry

   This talk from 2020 explores attacking various ‘secondary contexts’ in web applications where data is being passed to an underlying internal HTTP server.

   Watch : Attacking Secondary Contexts in Web Applications by Sam Curry
5. /05

   RCE of Burp Scanner / Crawler via Clickjacking

   Burp Suite utilizes an embedded Chrome browser for crawling and scanning web applications. The Chrome instance is launched in headless mode, with remote debugging enabled via the remote-debugging websocket port instead of remote-debugging-pipe.

   Read : RCE of Burp Scanner / Crawler via Clickjacking