Reposted by parzelmodzero @modzero.bsky.social · 14/08/2025PSA update your INSTAR cameras. Our teammate Michael Imfeld identified a critical RCE (CVE-2025-8760) on 2k+ and 4K devices. Find the advisory here: modzero.com/en/advisorie...modzero.com[MZ-25-03] INSTAR 2K+ and 4K Series 094
parzel @parzel.bsky.social · 27/06/2025A colleague of mine found exposed credentials potentially granting access to Synology Teams backups. Check the full analysis and scan your tenants for IOCs. #cybersecurity #infosec #disclosure modzero.com/en/blog/when...modzero.comWhen Backups Open Backdoors: Accessing Sensitive Cloud Data via 011
Reposted by parzelFragDenStaat @fragdenstaat.de · 23/05/2025Innenminister Dobrindt meint: Die Einstufung der AfD als „gesichert rechtsextrem” reicht nicht für ein Parteiverbot? Kein Problem – wir legen nach: Mit unserer Belegsammlung schaffen wir die Grundlage für ein umfassendes Gutachten zum AfD-Verbotsverfahren. Mehr dazu: fragdenstaat.de/aktionen/afd...fragdenstaat.deBelegsammlung für ein AfD-VerbotsverfahrenDer Verfassungsschutz stuft die AfD in seinem Gutachten als gesichert rechtsextrem ein. Das reicht nicht für ein Parteiverbot, sagt Innenminister Alexander Dobrindt. Darum übernehmen wir nun den Job u... 361214481
Reposted by parzelDominic White @singe.bsky.social · 11/02/2025Both defenders and red teamers will be interested in this tool drop and deep dive into psexec from Aurélien. He, Michael, and Reino built susinternals that makes use of the Microsoft signed psexec service binary on the host instead of the more easily flagged RemCom. sensepost.com/blog/2025/ps...sensepost.comSensePost | Psexec’ing the right way and why zero trust is mandatoryLeaders in Information Security 195
Reposted by parzelmodzero @modzero.bsky.social · 07/02/2025ROPing our way to “Yay, RCE” - and a lesson in the importance of a good nights sleep! Follow our Colleague Michaels journey of developing an ARM ROP chain to exploit a buffer overflow in uc-http modzero.com/en/blog/ropi...modzero.comROPing our way to RCE 274
Reposted by parzelDaniel Drepper @danieldrepper.bsky.social · 03/02/2025NEU: Hier ist das geheime Verfassungsschutz-Gutachten zur AfD in voller Länge. Fast 5000 Quellen hat die Behörde in den vergangenen Jahren ausgewertet, jetzt hat @netzpolitik.org das Gutachten veröffentlicht.netzpolitik.orgVerdachtsfall Rechtsextremismus: Wir veröffentlichen das 1.000-seitige Verfassungsschutz-Gutachten zur AfDDie Alternative für Deutschland steht im Verdacht, rechtsextrem und verfassungsfeindlich zu sein. Der Verfassungsschutz beobachtet die Partei und hat ein ausführliches Gutachten erstellt. Wir veröffen... 141424584
Reposted by parzelAlex Chapman @ajxchapman.bsky.social · 27/01/2025In Chrome: Object.values(this)[165].bind(this)() 4227
Reposted by parzelLiveOverflow 🔴 @liveoverflow.bsky.social · 24/01/2025This is a great post on bug bounty reddit! OP reported an IDOR, gets paid $2,000, and then realizes it never was IDOR. It's just a cached response... 3515
Reposted by parzelPaged Out! @pagedout.bsky.social · 14/01/2025Issue #2 joined the 'over 100K downloads' club. All thanks to you! Now Issue #4 is applying for a membership there, and it's not far from getting in :) Want to help? Tell your friends about us! pagedout.institutepagedout.institute Paged Out! 052
parzel @parzel.bsky.social · 11/01/2025I wrote a blog post about SSTI in Thymelaf - hopefully it helps some people pentesting up-to-date Spring Boot applications :) 141
Reposted by parzelGynvael Coldwind @gynvael.bsky.social · 07/01/2025(please re-post for reach - thank you!) Learned a cool new Linux trick? Know an interesting quirk in a network protocol? Or have something else to share? Write a 1-page article for the #6 issue of Paged Out! :) pagedout.institute?page=cfp.php Soft deadline is Feb 1st. 03033
Reposted by parzelcts @gf256.bsky.social · 25/12/2024My videos for Flare-On 2024 are live! Watch me reverse engineer all the challenges from start to end. 🎉🥳 + Commentary video featuring SuperFashi, where we review the chals together. * 45 hours of content * 400+ GB of raw footage Merry Christmas! Link: www.youtube.com/watch?v=vwW9...youtube.comFlare-On 2024 Solutions and CommentaryYouTube video by BasteG0d69 04911
Reposted by parzeldmnk @dmnk.bsky.social · 24/12/2024Re-sharing to keep bluesky rolling go.bsky.app/EhGFSVj 04513
Reposted by parzelVisual Studio Code @vscode.dev · 18/12/2024Announcing GitHub Copilot Free! A new free tier for GitHub Copilot, available for everyone today in VS Code. No trial. No subscription. No credit card required. Learn more in our blog: aka.ms/copilot-free 13363138
Reposted by parzelϻг_ϻε @steven.srcincite.io · 26/11/2024I just wrote a new blog post! This is how I (ab)used a jailed file write bug in Tomcat/Spring. Enjoy! Remote Code Execution with Spring Properties :: srcincite.io/blog/2024/11...srcincite.ioRemote Code Execution with Spring PropertiesRecently a past student came to me with a very interesting unauthenticated vulnerability in a Spring application that they were having a hard time exploiting... 17636
parzel @parzel.bsky.social · 27/11/2024I can highly recommend Shazzer from @garethheyes.co.uk, such a great tool for XSS research!youtube.comDigging for XSS Gold: Unearthing Browser Quirks with ShazzerYouTube video by PortSwigger 0224
Reposted by parzelAndrea P @decoder-it.bsky.social · 25/11/2024I'm glad to release the tool I have been working hard on the last month: #KrbRelayEx A Kerberos relay & forwarder for MiTM attacks! >Relays Kerberos AP-REQ tickets >Manages multiple SMB consoles >Works on Win& Linux with .NET 8.0 >... GitHub: github.com/decoder-it/K... 36343
Reposted by parzelmodzero @modzero.bsky.social · 21/11/2024Hello Bluesky 👋 We are an IT security company. Our team consists of like-minded hackers located in Germany and Switzerland. Our core areas of expertise are comprehensive technical security analyses, penetration tests and red teaming services. Want to learn more about us? Check: modzero.com/en/modzero.comIn-depth IT Security 052
parzel @parzel.bsky.social · 17/11/2024During a #redteam at @modzero.bsky.social we discovered a limited but neat bypass for #printnightmare. I talked to @itm4n about it and he had an indepth look. Read about it here: itm4n.github.io/printnightma... #itsecitm4n.github.ioThe PrintNightmare is not Over YetFollowing the publication of my blog post A Practical Guide to PrintNightmare in 2024, a few people brought to my attention that there was a way to bypass the Point and Print (PnP) restrictions recomm... 030
