Aggregator

ChatGPT Plugins: Data Exfiltration via Images & Cross Plugin Request Forgery

Embrace The Red
2 years 8 months ago

This post shows how a malicious website can take control of a ChatGPT chat session and exfiltrate the history of the conversation.

Plugins, Tools and Integrations

With plugins, data exfiltration can happen by sending too much data into the plugin in the first place. More security controls and insights on what is being sent to the plugin are required to empower users.

However, this post is not about sending too much data to a plugin, but about a malicious actor who controls the data a plugin retrieves.

CPY JMP

ThinkDFIR
2 years 8 months ago
I’m teaching FOR500 Windows Forensic Analysis in Singapore this week and something that was recently added to the class relates to a new(ish) discovery into the operation of Jumplists on Windows 10. During an update to the class it was discovered that when a folder is copied, the AutomaticDestination Jumplist file associated with Windows Explorer […]
Phill Moore

批量运营CodeQL Cli扫描结果(简易版)

0xmuhe
2 years 8 months ago
背景&目标

​ CodeQL Cli适合批量做扫描，但是扫描结果并不适合直接做批量的运营，仅适合一些实锤的问题，对于一些还需要人工处理判断的结果就不太适合了(要看源码、调用上下文)；如果使用VSCode插件来做，也只是单条规则扫单个/多个数据库，结果倒是很友好，点点点就能读代码来分析了，所以这种用法不适合批量的query扫描。

​ 如果付费的话自然是可以解决了，可以在CI/CD中集成，就方便多了 -。- 但是对于个人使用者来说不太现实，所以我就想用一个简单的办法来实现这个目的

CodeQL cli批量扫描结束后，导入数据库+历史query结果，直接在vscode里运营结果，流程为：

1
CI/CD 扫描 ---> 结果(数据库+扫描结果) ---> 导入VSCode运营
muhe

Managed ad