PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Preventing Downloads from Unmanaged Devices in O365

projectblack.io | research | #cloud | #data-exfiltration | #office-365 | #defender-for-cloud-apps | #user-agent | #bypass
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Defender for Cloud Apps' download blocking is bypassable with magic user-agent strings; the post demonstrates the bypass and recommends native download restrictions in Outlook and SharePoint.
Published
Collected

Related coverage

blog · netspi.com
Bypassing External Mail Forwarding Restrictions with Power Automate
When Exchange blocks external forwarding rules, attackers can abuse Power Automate: an Outlook-connected flow silently forwards mail out of the tenant, evading anti-exfiltration controls.
research · projectblack.io
Security Risks of Setting Access Control Allow Origin: *
When wildcard CORS turns dangerous: with cookie auth, SameSite=None, credentials enabled, and a reflected origin, malicious sites can read authenticated responses. Fixes include SameSite Lax/Strict.
research · portswigger.net
Portable Data exFiltration: XSS for PDFs
Gareth Heyes shows how a single injected hyperlink can compromise PDFs: injecting PDF code to execute JavaScript, exfiltrate contents in Acrobat and PDFium, and trigger SSRF on server-side renders.
research · portswigger.net
Using form hijacking to bypass CSP
Form hijacking bypasses CSP via injected forms or formaction attributes while password managers auto-fill credentials. Seen on Infosec Mastodon and PortSwigger's site; Burp added passive scan checks.
research · portswigger.net
Cracking reCAPTCHA, Turbo Intruder style
James Kettle uses Turbo Intruder's last-byte synchronization to trigger a race condition that partially bypasses Google reCAPTCHA, demonstrated against Reddit after Google declined to fix it.
research · portswigger.net
Abusing JavaScript frameworks to bypass XSS mitigations
Gareth Heyes abuses the Mavo JavaScript framework's $url object to build DOM-based XSS that bypasses NoScript's XSS filter, and shows risks from attacker-controlled data sources.
Back