Pinned
Find the GitHub Security Lab now on LinkedIn, Mastodon and Bluesky! 👇
GitHub Security Lab
1,453 posts
GitHub Security Lab
@GHSecurityLab
GitHub Security Lab’s mission is to inspire and enable the community to secure the open source software we all depend on.
Joined October 2019
- Kill -9 your way to root on most modern Linux using @kevin_backhouse's latest polkit finding (CVE-2021-3560)
- Do you want to learn how to find vulnerabilities in Google Chrome? @Nosoynadiemas just released the last exercise of Fuzzing101! github.co/3s8m12H
- Hi 👋 we are the GitHub Security Lab. Find more information about us here:
- Learn how to fuzz Adobe Reader and finding bugs in closed-source applications in exercise 8 of Fuzzing 101 : github.co/fuzzing101
- Do you want to learn how to fuzz an interactive application like GIMP using Persistent Fuzzing? Our wizard of fuzz @Nosoynadiemas just published exercize 6 of Fuzzing101! github.com/antonio-morale…
- Go on an RCE hunting journey with @pwntester as he demonstrates how he used CodeQL to find multiple RCE vulnerabilities in Apache Dubbo: "All roads lead to RCE" github.co/3hUDB5V
- "Exploits are really the closest thing to magic spells we have in this world" according to Halvar Flake. @kevin_backhouse demystifies an exploit of a double-free vulnerability in Ubuntu github.co/3pVse0G
- Continuing our series analyzing recent CVEs, with a remote code execution on Exchange servers. Read @pwntester 's "CVE-2020-0688 Losing the keys to your kingdom"
- The first CodeQL online course is now available for free on GitHub Learning Lab! This course invites CodeQL beginners to follow in the footsteps of our security research team and find real vulns in Das-UBoot (patched since). Join other CodeQL learners: lab.github.com/githubtraining…
- Learn all about how to fuzz network services in this practical case study by @nosoynadiemas in which he fuzzes 3 of the most popular Open Source FTP servers! securitylab.github.com/research/fuzzi…
- Go dumpster diving for arbitrary code execution in v8's garbage collector with @mmolgtm in his Chrome vulnerability RCA for CVE-2021-37975 github.co/3pjp3RY
- Looking for a vulnerability hunting challenge? Then this Java CTF challenge is for you! You will hone your bug finding skills to find a pre-auth RCE and also learn all about CodeQL's taint tracking features. securitylab.github.com/ctf/codeql-and…
GIF - Bugfix and chill! @pwntester reported 2 Server-Side Template Injections in Netflix open source libraries, enabling attackers to inject arbitrary Java EL expressions, leading to a pre-auth Remote Code Execution (RCE) vuln: First one in Netflix Conductor
