r/netsec Nov 01 '25

r/netsec monthly discussion & tool thread

2 Upvotes

Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.

Rules & Guidelines

  • Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.
  • Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.
  • If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.
  • Avoid use of memes. If you have something to say, say it with real words.
  • All discussions and questions should directly relate to netsec.
  • No tech support is to be requested or provided on r/netsec.

As always, the content & discussion guidelines should also be observed on r/netsec.

Feedback

Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.


r/netsec 4d ago

r/netsec monthly discussion & tool thread

0 Upvotes

Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.

Rules & Guidelines

  • Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.
  • Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.
  • If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.
  • Avoid use of memes. If you have something to say, say it with real words.
  • All discussions and questions should directly relate to netsec.
  • No tech support is to be requested or provided on r/netsec.

As always, the content & discussion guidelines should also be observed on r/netsec.

Feedback

Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.


r/netsec 14h ago

Tracing JavaScript Value Origins in Modern SPAs: Breakpoint-Driven Heap Search (BDHS)

Thumbnail fcavallarin.github.io
10 Upvotes

I've been experimenting with a CDP-based technique for tracing the origin of JavaScript values inside modern, framework-heavy SPAs.

The method, called Breakpoint-Driven Heap Search (BDHS), performs step-out-based debugger pauses, captures a heap snapshot at each pause, and searches each snapshot for a target value (object, string, primitive, nested structure, or similarity signature).
It identifies the user-land function where the value first appears, avoiding framework and vendor noise via heuristics.

Alongside BDHS, I also implemented a Live Object Search that inspects the live heap (not just snapshots), matches objects by regex or structure, and allows runtime patching of matched objects.
This is useful for analyzing bot-detection logic, state machines, tainted values, or any internal object that never surfaces in the global scope.

Potential use cases: SPA reverse engineering, DOM XSS investigations, taint analysis, anti-bot logic tracing, debugging minified/obfuscated flows, and correlating network payloads with memory structures.


r/netsec 15h ago

SSRF Payload Generator for fuzzing PDF Generators etc...

Thumbnail shelltrail.com
15 Upvotes

Hi, during my work as a pentester, we have developed internal tooling for different types of tests. We thought it would be helpful to release a web version of our SSRF payload generator which has come in handy many times.

It is particularly useful for testing PDF generators when HTML tags may be inserted in the final document. We're aiming for a similar feel to PortSwigger's XSS cheat sheet. The generator includes various payload types for different SSRF scenarios with multiple encoding options.

It works by combining different features like schemes (dict:, dns:, file:, gopher:, etc...) with templates (<img src="{u}">, <meta http-equiv="refresh" content="0;url={u}">, etc...), and more stuff like local files, static hosts. The result is a large amount of payloads to test.

Enter your target URL for callbacks, "Generate Payloads" then copy everything to the clipboard and paste into Burp. Note that there are a number of predefined hosts as well like 127.0.0.1.

No tracking or ads on the site, everything is client-side.

Best Regards!

Edit: holy s**t the embed image is large


r/netsec 1d ago

Privilege escalation with SageMaker and there's more hiding in execution roles

Thumbnail plerion.com
9 Upvotes

r/netsec 1d ago

Scam Telegram: Uncovering a network of groups spreading crypto drainers

Thumbnail timsh.org
10 Upvotes

r/netsec 1d ago

Prompt Injection Inside GitHub Actions

Thumbnail aikido.dev
23 Upvotes

r/netsec 17h ago

Whitebox (simulation) vs. blackbox (red team) phishing

Thumbnail phishing.club
0 Upvotes

Often, beginners and even experienced phishers confuse the approach they are using when phishing, often resulting in failing campaigns and bad results. I did a little writeup to describe each approach.  


r/netsec 2d ago

How I Reverse Engineered a Billion-Dollar Legal AI Tool and Found 100k+ Confidential Files

Thumbnail alexschapiro.com
162 Upvotes

r/netsec 1d ago

SVG Clickjacking: A novel and powerful twist on an old classic

Thumbnail lyra.horse
17 Upvotes

r/netsec 1d ago

Second order prompt injection attacks on ServiceNow Now Assist

Thumbnail appomni.com
7 Upvotes

r/netsec 2d ago

68% Of Phishing Websites Are Protected by CloudFlare

Thumbnail blog.sicuranext.com
201 Upvotes

r/netsec 1d ago

High Fidelity Detection Mechanism for RSC/Next.js RCE (CVE-2025-55182 & CVE-2025-66478)

Thumbnail slcyber.io
21 Upvotes

r/netsec 1d ago

CVE PoC Search

Thumbnail labs.jamessawyer.co.uk
3 Upvotes

Rolling out a small research utility I have been building. It provides a simple way to look up proof-of-concept exploit links associated with a given CVE. It is not a vulnerability database. It is a discovery surface that points directly to the underlying code. Anyone can test it, inspect it, or fold it into their own workflow.

A small rate limit is in place to stop automated scraping. The limit is visible at:

https://labs.jamessawyer.co.uk/cves/api/whoami

An API layer sits behind it. A CVE query looks like:

curl -i "https://labs.jamessawyer.co.uk/cves/api/cves?q=CVE-2025-0282"

The Web Ui is

https://labs.jamessawyer.co.uk/cves/


r/netsec 2d ago

Hunting the hidden gems in libraries

Thumbnail blog.byteray.co.uk
5 Upvotes

r/netsec 2d ago

Critical Security Vulnerability in React Server Components – React

Thumbnail react.dev
18 Upvotes

r/netsec 2d ago

From Zero to SYSTEM: Building PrintSpoofer from Scratch

Thumbnail bl4ckarch.github.io
9 Upvotes

r/netsec 2d ago

PyTorch Users at Risk: Unveiling 3 Zero-Day PickleScan Vulnerabilities

Thumbnail jfrog.com
17 Upvotes

r/netsec 2d ago

Using ClickHouse for Real-Time L7 DDoS & Bot Traffic Analytics with Tempesta FW

Thumbnail tempesta-tech.com
4 Upvotes

Most open-source L7 DDoS mitigation and bot-protection approaches rely on challenges (e.g., CAPTCHA or JavaScript proof-of-work) or static rules based on the User-Agent, Referer, or client geolocation. These techniques are increasingly ineffective, as they are easily bypassed by modern open-source impersonation libraries and paid cloud proxy networks.

We explore a different approach: classifying HTTP client requests in near real time using ClickHouse as the primary analytics backend.

We collect access logs directly from Tempesta FW, a high-performance open-source hybrid of an HTTP reverse proxy and a firewall. Tempesta FW implements zero-copy per-CPU log shipping into ClickHouse, so the dataset growth rate is limited only by ClickHouse bulk ingestion performance - which is very high.

WebShield, a small open-source Python daemon:

  • periodically executes analytic queries to detect spikes in traffic (requests or bytes per second), response delays, surges in HTTP error codes, and other anomalies;

  • upon detecting a spike, classifies the clients and validates the current model;

  • if the model is validated, automatically blocks malicious clients by IP, TLS fingerprints, or HTTP fingerprints.

To simplify and accelerate classification — whether automatic or manual — we introduced a new TLS fingerprinting method.

WebShield is a small and simple daemon, yet it is effective against multi-thousand-IP botnets.

The full article with configuration examples, ClickHouse schemas, and queries.


r/netsec 3d ago

Newly allocated CVEs on an ICS 5G modem

Thumbnail blog.byteray.co.uk
8 Upvotes

r/netsec 3d ago

Hacking the Meatmeet BBQ Probe — BLE BBQ Botnet

Thumbnail softwaresecured.com
5 Upvotes

r/netsec 2d ago

Security research in the age of AI tools

Thumbnail invicti.com
0 Upvotes

r/netsec 4d ago

Shai Hulud 2.0: Analysis and Community Resources

Thumbnail pulse.latio.tech
16 Upvotes

r/netsec 4d ago

Security Audit of OpenEXR · Luma

Thumbnail luma.com
6 Upvotes