Alfred Berg

Alfred Berg

@berg.hf.ax

security enthusiast | space | F1 | bikes

964 followers287 following14 posts

Alfred Berg reposted

Katie Mack
@astrokatie.com

Had a lot of fun talking with @hankgreen.bsky.social back in April for his podcast, Humans. You can check out the conversation (which was just posted this week) here: art19.com/shows/humans... or wherever you listen to podcasts!

art19.comKatie Mack: The Death of the UniverseKatie Mack is an astrophysicist who studies the end of the universe. Hank and Katie talk about the value of the Artemis II mission, how we can see the beginning of time, and when the universe may end....

Alfred Berg reposted

Catalin Cimpanu
@campuscodi.risky.biz

After Hunt found an open directory hosting APT28's Roundcube exploit kit, Ctrl-Alt-Intel also found a 2nd open directory on the same server, this one with the "C2 source code, additional payloads, telemetry logs, exfiltrated data and evidence of further campaigns." ctrlaltintel.com/threat%20res...

ctrlaltintel.comFancyBear Exposed: Major OPSEC Blunder Inside Russian Espionage OpsFancyBear’s OPSEC failure gives Ctrl-Alt-Intel rare visibility inside Russian espionage operations
Alfred Berg
@berg.hf.ax

Just saw the EFF has a lot of interesting things in their webshop. Easy way to get some nice things and support a good cause

Electronic Frontier Foundation@eff.org

Level up your next campaign and share the word about digital rights with your friends! EFF's dice set will look great doing both. shop.eff.org/products/li...

shop.eff.orgLiquid Core EFF DiceThese bright red resin dice are sharp-edged, featuring a stunning liquid-core glitter interior and white numbering. The metal clear-view EFF display tin contains a set of sharp-edge dice including 7 pieces: a D20 featuring the EFF logo, D4, D6, D8, D10, D12, and D% dice. Perfect for tabletop games! Warning: These are s

Alfred Berg reposted

v
@handle.invalid

i'm building a web browser for reverse engineers! * identify calls to common fingerprinting APIs * decode/decrypt known data collector payloads * Hook things without leaving a trace * detect obfuscated scripts & deobfuscate + more I wrote about it! nullpt.rs/reverse-engineering-browser

Alfred Berg reposted

Jorian
@jorianwoltjer.com

The legendary @joaxcar.bsky.social made a really interesting XSS challenge this month for Intigriti. My solution involved winning a race condition with 100 <iframe>s to utilize a DOM Clobbering gadget after bypassing a RegEx. Check out the writeup below: jorianwoltjer.com/blog/p/hacki...

jorianwoltjer.comIntigriti May XSS Challenge (0525) | Jorian WoltjerA challenge by @joaxcar with a small but complex XSS chain, hitting DOM Clobbering with a race condition and abusing a cool URL parsing quirk in JavaScript.

Alfred Berg reposted

Alfred Berg
@berg.hf.ax

Here is a docker trick I use a lot: It is easy to access the file system of the docker containers through /proc/[pid]/root/, this makes it easy to run tools not available in the container, copy and edit files etc. This is especially useful for hardened containers

Alfred Berg
@berg.hf.ax

Here is a docker trick I use a lot: It is easy to access the file system of the docker containers through /proc/[pid]/root/, this makes it easy to run tools not available in the container, copy and edit files etc. This is especially useful for hardened containers

Alfred Berg reposted

Paul Chaignon
@pchaigno.bsky.social

I've made an interactive list of #eBPF research papers. Only papers from the top academic conferences, including lots of papers on eBPF verification, kernel offloads, security analysis, etc. pchaigno.github.io/bpf/2025/01/... I plan to keep the list up-to-date.

pchaigno.github.ioeBPF Research PapersWhen I started reading on BPF there weren’t many academic papers to describe how it worked, how it didn’t, or how it is used. There are many blog posts and informal articles out there, but it’s harder...

Alfred Berg reposted

RyotaK
@ryotak.net

Replying to @ryotak.net

If you're interested in the technical details, I wrote the blog post here: flatt.tech/research/pos... For the further details, please check out the announcement from the OpenWrt team: lists.openwrt.org/pipermail/op... (2/2)

flatt.techCompromising OpenWrt Supply Chain via Truncated SHA-256 Collision and Command InjectionIntroduction Hello, I’m RyotaK (@ryotkak ), a security engineer at Flatt Security Inc. A few days ago, I was upgrading my home lab network, and I decided to upgrade the OpenWrt on my router.1 After ac...
Alfred Berg
@berg.hf.ax

I recently discovered eBPF and been playing around a bit with it Essentially it is small hot-swappable programs that run in the linux kernel, making it possible to e.g. log arguments to syscall and userland functions. It is also possible to change the behaviour of syscalls (some limits apply)

Alfred Berg
@berg.hf.ax

eBPF could be a great tool to identify data reaching sinks when doing gray-box security assessments e.g. find if the input is passed to some bash command, sql-query, what files does the applications try to open, get the plain text of all https requests going through openssl on the system etc.

Alfred Berg reposted

Jorian
@jorianwoltjer.com

To summarize what I have learned about Mutation XSS, my CVE, and the solution to my challenge, I wrote a post going through it all. If you like regular XSS, this is a whole new world of crazy techniques and many sanitizer bypasses. You too can learn this! jorianwoltjer.com/blog/p/hacki...

jorianwoltjer.comPost: Mutation XSS: Explained, CVE and Challenge | Jorian WoltjerLearn how to bypass HTML sanitizers by abusing the intricate parsing rules and mutations. Including my CVE-2024-52595 (lxml_html_clean bypass) and the solution to a hard challenge I shared online

Alfred Berg reposted

shubs
@shubs.io

Earlier this year, Assetnote's Security Research team discovered a vulnerability in Sitecore XP (CVE-2024-46938) that can lead to pre-authentication RCE. Order of operations bugs are one of my favorite types of bugs :) Write up and exploit script here: assetnote.io/resources/re...

Alfred Berg reposted

Volexity
@volexity.com

@volexity.com’s latest blog post describes in detail how a Russian APT used a new attack technique, the “Nearest Neighbor Attack”, to leverage Wi-Fi networks in close proximity to the intended target while the attacker was halfway around the world.    Read more here: www.volexity.com/blog/2024/11...

volexity.comThe Nearest Neighbor Attack: How A Russian APT Weaponized Nearby Wi-Fi Networks for Covert AccessIn early February 2022, notably just ahead of the Russian invasion of Ukraine, Volexity made a discovery that led to one of the most fascinating and complex incident investigations Volexity had ever w...
Alfred Berg
@berg.hf.ax

Needed to find both really common apex domains and uncommon apex domains in a recent project of mine. Created a small tool to just this by looking up each apex domain against the Tranco list (list of the 4.7m most common domains) and showing the rank. It is available at github.com/AlfredBerg/d...

You are up to date.