TheNote
reddit | Technical Information... Note
GooglePlay AppStore

reddit | Technical Information Security Content & Discussion

The Reddit community r/netsec is dedicated to discussions around network security, cybersecurity, and related fields. It serves as a platform for professionals, enthusiasts, and learners to share news, updates, tools, and insights about the latest in security. Members post about various topics including vulnerabilities, hacking techniques, data breaches, and security best practices. The subreddit is also a place where users can ask questions, seek advice, or share resources like tutorials and research papers. It's an active forum where discussions can range from technical deep-dives to general industry news. Contributors often include security experts who provide in-depth analysis and advice. The community is strict about keeping discussions on-topic, focusing solely on network security issues. It's also a space where ethical hacking and penetration testing are frequently discussed, with an emphasis on responsible disclosure and legal compliance. The subreddit has a wealth of archived posts and links, making it a valuable resource for anyone interested in cybersecurity. Members are encouraged to stay informed about the latest security trends and threats. Overall, r/netsec is a vital hub for those in the cybersecurity field to stay updated, exchange knowledge, and engage with others who share their interests. The community also promotes career advice and job postings related to cybersecurity.
Technical Information Security Content & Discussion reddit.com
RSS reddit.com
RSS Hunter RSS Hunter • Aug 19, 2024

Thread Of Notes

The finding said RCE. The second tester asked one question and the ticket died.

An automated security scan flagged a critical RCE vulnerability due to a significant response delay. The payload included a command to pause execution, which incorrectly indicated command injection. This delay was observed to be inconsistent across repeated tests, highlighting its unreliability as proof of vulnerability.The issue stemmed from the Web Application Firewall (WAF) taking longer to process requests containing suspicious characters. This is a known failure mode where delays are misinterpreted as command execution when they are actually caused by other factors like WAF inspection or application load. Many automated tools and even experienced security professionals can fall into this trap by solely relying on time-based responses.The text emphasizes a better approach: instead of just looking for delays, one should confirm if the server evaluated input in a way that produces a unique, unforgeable value. This involves sending a benign control request to establish a baseline. Then, asking the server to compute something novel, like the sum of random numbers, and verifying if that specific sum appears in the response.If there's no direct output, varying the delay time can help differentiate between true vulnerabilities and external factors. DNS callbacks by themselves are insufficient evidence of RCE, as they can be triggered by link previews or other benign functions.False positives are common, especially when scanners use shell metacharacters in environments that don't execute them. The author advocates for repeatable, verifiable results rather than relying on single, inconsistent observations. The ultimate goal is to confirm if a value could only exist due to server-side execution of input, not just a delayed response.
https://www.reddit.com/r/netsec/comments/1wn84lz/the_finding_said_rce_the_second_tester_asked_one/ reddit.com
RSS Hunter RSS Hunter • Yesterday

ZTE SmartHome Account Takeover: Password Reset Without Verification Code. 4 CVEs, 100K+ Android Downloads - CVE-2026-86553

This report details four vulnerabilities (CVE-2026-86552 to CVE-2026-86555) discovered in ZTE SmartLife. The most critical flaw, CVE-2026-86553, involved a password reset vulnerability in the SmartLife account backend. The reset endpoint allowed setting a new password for any account by providing only the target accountId and the new password. Crucially, it lacked validation for a reset code, the old password, or confirmation of a legitimate reset transaction. Another vulnerability involved an endpoint that would reveal if an email was registered and, if so, return the associated backend account ID. This allowed an attacker to enumerate valid user accounts. By chaining these two vulnerabilities, an attacker could: first, identify a target email, then obtain its corresponding accountId, and finally, initiate a password reset to an attacker-chosen new password. The researcher confirmed the success of this attack by verifying that the old password no longer worked and the newly set password successfully granted access to the account. Additional research encompassed the authentication mechanism employed by the Android client and the email ownership verification process during registration. The broader attack surface of the SmartLife/Homecare SDK, accessible post-login, was also investigated. ZTE has since patched these reported issues and assigned the respective CVEs.
https://www.reddit.com/r/netsec/comments/1wmhror/zte_smarthome_account_takeover_password_reset/ reddit.com
RSS Hunter RSS Hunter • Sep 21

Three memory-safety bugs in Godot's untrusted-file parsers

Author here. The post describes three memory-safety bugs which have been in Godot since v1.0 and v3.0. All three are still present in current releases. The bugs can affect exported games that load community-authored data files. Godot allows attackers using maliciously crafted files to trigger reads or writes past the end of a buffer, inside the process running the game. The post includes the response from Godot maintainers who deny this is a security issue, and my reply to them. Happy to give more information about the bugs or the audit if there are questions. submitted by /u/bitbutter
https://www.reddit.com/r/netsec/comments/1wm7krn/three_memorysafety_bugs_in_godots_untrustedfile/ reddit.com
RSS Hunter RSS Hunter • Sep 21

Silent packet loss in PcapSplitter: a file collision bug on TCP session reuse

The author encountered file corruption issues while processing large PCAP files with a tshark-wrapped tool. Initial problems involved tshark errors indicating "Total Block Length" issues with large files. After parallelizing PCAP processing, file corruption became more apparent. A reproduction revealed that PcapSplitter reported more files and packets than actually existed on disk, despite exiting successfully. Two incorrect theories, file descriptor exhaustion and a hardcoded limit in PcapSplitter's concurrent file handling, were investigated and ruled out. The true cause was identified in PcapSplitter's FiveTupleSplitter, specifically concerning TCP session reuse. When a new SYN packet arrived for an already tracked five-tuple, the splitter incorrectly assigned a new file number but generated the same filename using only IP and port. This led to either file truncation or a race condition between two writer handlers. A fix was developed that only suffixes filenames upon actual collision. This fix has been tested and merged into the PcapSplitter library.
https://www.reddit.com/r/netsec/comments/1wlzrut/silent_packet_loss_in_pcapsplitter_a_file/ reddit.com
RSS Hunter RSS Hunter • Sep 21

BragJack - $20K in bounty rewards from Anthropic, Perplexity, Google, Microsoft and Opera Using 1 Extension

Hi folks, my name is Gal Weizman, I do browser security research. Excited to finally share my recent work, where I managed to hack Chrome, Comet, Edge, Opera and Claude in Chrome using one single browser extension 2 CVEs & $20,000 in bounties 🙂 Hope you like it! submitted by /u/Content-Winter5328
https://www.reddit.com/r/netsec/comments/1wkrcgz/bragjack_20k_in_bounty_rewards_from_anthropic/ reddit.com
RSS Hunter RSS Hunter • Sep 19

If you've seen EchelonGraphBot in your logs, here's exactly what it does and how to block it

A crawler monitors public website configurations, examining aspects like HTTPS enforcement, certificate expiry, TLS versions, security headers, cookie flags, and redirect destinations. This crawler's activity might appear in server logs, so the service has provided a dedicated page explaining its operations. The bot's behavior regarding visit frequency, robots.txt, Retry-After headers, and its originating IP address is detailed online. There are options to opt out of the crawler's checks, including a DNS TXT record method and the standard robots.txt file. No account or signup is required for these opt-out mechanisms. The data collected by the crawler is publicly accessible through a radar interface. Some features, such as the precise check frequency and continuous operation after tab closure, are still under development. The service aims to be transparent and responsive to user inquiries or issues. Feedback is encouraged to improve the crawler or its documentation. The bot will not perform actions that could compromise website security.
https://www.reddit.com/r/netsec/comments/1wfo4pc/if_youve_seen_echelongraphbot_in_your_logs_heres/ reddit.com
RSS Hunter RSS Hunter • Sep 14

CSA Zero Trust Microsegmentation Guidance - formalizes topology-defined vs. connection-defined segmentation models

The Cloud Security Alliance (CSA) has released new guidance on Zero Trust Microsegmentation. This guidance offers precise framing for the topic, distinct from much vendor material. It proposes a useful model that separates two key segmentation approaches: topology-defined and connection-defined. Topology-defined segmentation relies on network position, controlling where traffic can flow using elements like zones and firewalls. Connection-defined segmentation, however, focuses on session establishment, using identity, device posture, and context to permit or deny access to services. The CSA advocates for these two models as complementary, asserting that connection-defined controls reduce the attack surface before a session begins. Conversely, topology-defined controls provide containment once a session or system is compromised. This new guidance expands the scope beyond traditional data center east-west traffic to include IT, OT, IoT, cloud, edge, and agentic AI workloads. It also distinguishes between macro, micro, and nano-segmentation granularities. The paper details various enforcement plane choices, governed egress control, control-plane resilience, and policy drift detection. The operational model outlined is a continuous cycle: visibility, policy derivation, simulation, enforcement, drift monitoring, and exception retirement. The guidance emphasizes this process as ongoing, not a one-time deployment.
https://www.reddit.com/r/netsec/comments/1wdaeny/csa_zero_trust_microsegmentation_guidance/ reddit.com
RSS Hunter RSS Hunter • Sep 11

🕵️‍♂️ SonicWall SMA1000 (CVE-2026-15409): SSRF to Erlang RCE chained into automated DCSync from the appliance

CVE-2026-15409 is an unauthenticated Server-Side Request Forgery vulnerability affecting the SMA1000 WorkPlace interface. Attackers can exploit the /wsproxy WebSocket endpoint to access a locally bound Erlang distribution node. This node, identified as couchdb, runs on 127.0.0.1:1050. The Erlang handshake is completed using a hardcoded cookie. Subsequently, the os:cmd() function allows for remote command execution with the privileges of the couchdb user. From this point, attackers can read the policy_file.xml to obtain decrypted LDAP bind passwords. This decryption is made possible by a static 32-byte AES key found within the ASAPPasswordUtil.class bytecode. Attackers then deploy a Linux build of Impacket's secretsdump tool to the appliance's /tmp directory. Using the recovered LDAP credentials and domain-controller machine account hashes, secretsdump performs DCSync against internal domain controllers. The exploit chain is a refactored version of a public proof-of-concept aimed at unattended bulk exploitation.
https://www.reddit.com/r/netsec/comments/1wcqbvq/sonicwall_sma1000_cve202615409_ssrf_to_erlang_rce/ reddit.com
RSS Hunter RSS Hunter • Sep 10