[ Browser ]  How to bypass CSP nonces with DOM XSS ? http://sirdarckcat.blogspot.com/2016/12/how-to-bypass-csp-nonces-with-dom-xss.html

[ Conference ]  Great talks about UEFI security from #33c3: "Bootstraping a slightly more secure laptop" and "Tapping into the core" https://media.ccc.de/c/33c3

[ Hardware ]  Slides from "How Do I Crack Satellite and Cable Pay TV?" at #33c3: https://fahrplan.events.ccc.de/congress/2016/Fahrplan/system/event_attachments/attachments/000/003/101/original/33C3_-_How_Do_I_Crack_Satellite_and_Cable_Pay_TV_slides.pdf (29MB PDF) https://t.co/BN2jsEf2zI

[ Hardware ]  Here's an interesting older vulnerable signed driver. https://github.com/subTee/DriveCrypt Allows you to load Unsigned Drivers.… https://twitter.com/i/web/status/814127098159919104

[ Industry News ]  Good news for governments around the world: Firefox for XP will continue to receive updates until September 2017. https://t.co/Djav2n7Trd

[ Malware ]  #Android Trojan #Switcher infects routers via DNS hijacking - http://bit.ly/2ih5gR3 https://t.co/7yVUKbYwQH

[ MalwareAnalysis ]  Shortcuts : Another neat phishing trick : https://d.uijn.nl/2016/12/28/shortcuts-another-neat-phishing-trick/

[ Others ]  Detailed write up about three vulnerabilities I found in PHP (5&7) unserialize (PDF) http://blog.checkpoint.com/wp-content/uploads/2016/12/PHP_Technical_Report.pdf

[ ReverseEngineering ]  Awesome presentation @ derrekr6 @ naehrwert @ NedWilliamson! :) Putting up my old wiiu notes https://github.com/plutooo/wiiu

[ SecurityReport ]  A series of unexpected incidents made 2016 an interesting year for #cybersecurity. Recap: http://bit.ly/2gWkCWB https://t.co/bO2nbESQ6H

[ Tools ]  New version of PenTesters Framework (PTF) v1.11 New: InSpy, GoBuster, WSO, bug fixes, and more. http://github.com/trustedsec/ptf #TrustedSec

[ Tools ]  I open sourced my Enhanced Meta File (Partial EMF+ & EMFSPOOL) Fuzzer based on Peach Fuzzing Framework https://github.com/payatu/EMFFuzzer

[ Web Security ]  Covert persistence in Express.js applications https://medium.com/@ micaksica/covert-persistence-in-express-js-applications-1054f8e55e61

[ Web Security ]  SQL Attack (Constraint-based) : https://dhavalkapil.com/blogs/SQL-Attack-Constraint-Based/

[ Windows ]  Windows X86 System Call Table (NT/2000/XP/2003/Vista/2008/7/8/10) : http://j00ru.vexillium.org/ntapi/ cc @ j00ru

[ WirelessSecurity ]  Slides of my #33c3 talk "Predicting and Abusing WPA2/802.11 Group Keys" http://www.slideshare.net/vanhoefm/predicting-and-abusing-wpa280211-group-keys PDF slides at https://t.co/Wtn3XVyCBB