blog-header

The Lab

Dive deeper. Look harder. And then, share your findings.

April 22, 2024

CVE-2023-26465 - Breaking Through XSS Filters in Pega Platform

Take a look at how we managed to break through XSS filters using Markdown-nesting and user mentioning functionalities in Pega Platform

See more
June 6, 2023

Size matters! When capital letters introduce vulnerabilities

Microsoft Dynamics 365 Rich Text Editor XSS

See more
Jan. 19, 2023

AWS Cognito pitfalls: Default settings attackers love (and you should know about)

Diving into some common, but sometimes overlooked, AWS Cognito misconfigurations.

See more
Dec. 13, 2022

CVE-2022-20942: It's not old functionality, it's vintage

Cisco information disclosure vulnerability leveraging supposedly removed legacy functionality

See more
June 12, 2022

New technique of stealing data using CSS and Scroll-to-Text Fragment feature.

Method to leak matching Scroll-to-Text Fragments that will power the xsleaks collection as well as CSS exfiltration techniques.

See more
May 24, 2022

SharpASM / SharpWhispers

Stealthier code execution and direct system calls

See more