Securethy: Attack Scenarios & Audit Guides

I found a way to crash Google's AI compiler with a single malformed line of text - by handing it a description that contradicts itself. Instead of noticing, it believed both halves at once, then fell over. Let me explain in plain English. What is XLA? When you run a modern AI model - in TensorFlow, JAX, or the giant models behind today's chatbots - something has to turn that model into fast code for GPUs and TPUs. That something is XLA , Google's AI compiler. To do its job it reads an internal text format called HLO - think of it as the compiler's notebook. Engineers and tools pass HLO around as text all the time: to reproduce bugs, run tests, and feed the compiler work. And reading text from somewhere else is exactly where software tends to trip. The bug: two numbers that were allowed to disagree Big models don't fit on one chip, so XLA splits the work across many devices. The HLO text describes this using two separate pieces : a shape (say “2 by 2”...

Here's a fun one. I found a way to make a tiny file - just 13 bytes , smaller than this sentence - completely freeze one of Google's most widely used engineering tools. Not crash it with a bang. Freeze it. Pin a CPU core at 100% and make it spin forever, going nowhere, until you kill it. The tool is called Perfetto , and once you understand where it lives, this stops being a curiosity and starts being a genuinely useful lesson about how software breaks - one that's worth reading whether you write code, run a security team, or sign the budget. Let me walk you through it in plain English. First, what is Perfetto - and why should you care? Most people have never heard of Perfetto, yet it quietly runs near a staggering number of devices. Perfetto is Google's open-source system tracing toolkit. Think of it as a flight recorder for software: it captures a detailed, timestamped record of everything a device is doing - which app woke up, which function ran, where t...

Content Spoofing is an injection in which user input is reflected as it is in the application response which can be used in phishing attacks. During the recon phase, I found itunesconnect.apple.com , a subdomain of apple and after digging into it, I had observed that the content of the error key parameter was reflecting back to the page as shown below

Microsoft Bot Unvalidated File Upload:  The security issue allows a malicious actor to upload any file without validating the extension or content type of the file. Acknowledgment : Microsoft Online Service Acknowledgements for July 2019 ( https://portal.msrc.microsoft.com/en-us/security-guidance/researcher-acknowledgments-online-services?rtc=1 )

The security issue allows a malicious actor to bypass the naive security implementation of rate limiters. This allows an attacker to abuse the functionality of profile view count and increases them indefinitely. The following are the steps to reproduce wherein I have used my own blogger account ( https://www.blogger.com/profile/09844396241453600561 )

As cyber security professional, I come across many various vulnerabilities from critical to low and sometimes informational(How to categorize- CVSS v3 ). Sometime back I was doing as usual my security assessment activity for a Bank(Confidential) for their HRMS web application which was 3rd party software whose vendor was "Adrenalin". CVE ID: CVE-2018-12653 Vulnerability Name: Reflected Cross Site Scripting(XSS) Product: Adrenalin HRMS Affected Version: 5.4.0 Credits: Rishu Ranjan

As cyber security professional, I come across many various vulnerabilities from critical to low and sometimes informational(How to categorize- CVSS v3 ). Sometime back I was doing as usual my security assessment activity for a Bank(Confidential) for their HRMS web application which was 3rd party software whose vendor was "Adrenalin". CVE ID: CVE-2018-12652 Vulnerability Name: Reflected Cross Site Scripting(XSS) Product: Adrenalin HRMS Affected Version: 5.4.0 Credits:    Rishu Ranjan  

As cyber security professional, I come across many various vulnerabilities from critical to low and sometimes informational(How to categorize- CVSS v3 ). Sometime back, I was doing as usual my security assessment activity for a Client (Confidential) for their HRMS web application which was 3rd party software whose vendor was "Adrenalin". CVE ID: CVE-2018-12651 Vulnerability Name: Reflected Cross Site Scripting(XSS) Product: Adrenalin HRMS Affected Version: 5.4 Source: MITRE Credits:    Rishu Ranjan  

As cyber security professional, I come across many various vulnerabilities from critical to low and sometimes informational(How to categorize- CVSS v3 ). Sometime back I was doing as usual my security assessment activity for a Client (Confidential) for their HRMS web application which was 3rd party software whose vendor was "Adrenalin". CVE ID: CVE-2018-12650 Vulnerability Name: Reflected Cross Site Scripting(XSS) Product: Adrenalin HRMS Affected Version: 5.4.0 Credits: Rishu Ranjan

As a cybersecurity expert, I come across a wide variety of vulnerabilities, ranging from critical severity to low severity and sometimes informative (Classification - CVSS v3). Some time ago, I was performing my security assessment as usual for a (confidential) customer for their HRMS web application, a third-party software whose vendor is " Adrenaline". CVE ID: CVE-2018-12234 Vulnerability Name: Reflected Cross Site Scripting(XSS) Product: Adrenalin HRMS Affected Version: 5.4.0 Source: MITRE Credits:    Rishu Ranjan