#Blue_Team
Attack Surface Monitoring using Open-Source Intelligence
https://infosecwriteups.com/attack-surface-monitoring-using-open-source-intelligence-90415e863e93
@BlueRedTeam
Attack Surface Monitoring using Open-Source Intelligence
https://infosecwriteups.com/attack-surface-monitoring-using-open-source-intelligence-90415e863e93
@BlueRedTeam
Medium
Attack Surface Monitoring using Open-Source Intelligence
The paper introduces the case study for attack surface analysis and monitoring with practical application of open-source intelligence…
#exploit
#Red_Team
1. Nightmare: One Byte to ROP // Deep Dive Edition
https://hackmd.io/@pepsipu/ry-SK44pt
2. A multi exploit instagram exploitation framework
https://github.com/TheBirdSecurity/Instagram-Exploitation-Framework
@BlueRedTeam
#Red_Team
1. Nightmare: One Byte to ROP // Deep Dive Edition
https://hackmd.io/@pepsipu/ry-SK44pt
2. A multi exploit instagram exploitation framework
https://github.com/TheBirdSecurity/Instagram-Exploitation-Framework
@BlueRedTeam
HackMD
Nightmare: One Byte to ROP // Deep Dive Edition - HackMD
# Nightmare: One Byte to ROP // Deep Dive Edition ## Introduction In this write-up, we'll discuss ho
#exploit
Exploiting CVE-2019-2215:
Brief introduction to binder, eventpoll subsystem and Vectored I/O
https://cutesmilee.github.io/kernel/linux/android/2022/02/17/cve-2019-2215_writeup.html
]-> PoC: https://github.com/cutesmilee/cutesmilee.github.io/blob/main/code/cve-2019-2215-exploit.c
@BlueRedTeam
Exploiting CVE-2019-2215:
Brief introduction to binder, eventpoll subsystem and Vectored I/O
https://cutesmilee.github.io/kernel/linux/android/2022/02/17/cve-2019-2215_writeup.html
]-> PoC: https://github.com/cutesmilee/cutesmilee.github.io/blob/main/code/cve-2019-2215-exploit.c
@BlueRedTeam
cutesmilee’s blog
exploiting CVE-2019-2215
Brief introduction to binder, eventpoll subsystem and Vectored I/O
#Malware_analysis
1. Kraken: A New Golang Botnet in Development
https://www.zerofox.com/blog/meet-kraken-a-new-golang-botnet-in-development
2. TargetCompany Ransomware
https://decoded.avast.io/threatresearch/decrypted-targetcompany-ransomware
@BlueRedTeam
1. Kraken: A New Golang Botnet in Development
https://www.zerofox.com/blog/meet-kraken-a-new-golang-botnet-in-development
2. TargetCompany Ransomware
https://decoded.avast.io/threatresearch/decrypted-targetcompany-ransomware
@BlueRedTeam
ZeroFox
Meet Kraken: A New Golang Botnet in Development
Stay up-to-date on the latest industry news with ZeroFox's Intelligence Hub. Access timely flash reports and expert analysis to stay informed and prepared.
#Red_Team
1. Bypassing Cloudflare’s WAF
https://medium.com/@friendly_/bypassing-cloudflares-waf-b1b83a50fb2f
2. Tool to audit and attack LAPS environments
https://github.com/leoloobeek/LAPSToolkit
@BlueRedTeam
1. Bypassing Cloudflare’s WAF
https://medium.com/@friendly_/bypassing-cloudflares-waf-b1b83a50fb2f
2. Tool to audit and attack LAPS environments
https://github.com/leoloobeek/LAPSToolkit
@BlueRedTeam
Medium
Bypassing Cloudflare’s WAF!
Before skipping through this write up and look for the final payload — be sure you understand what you read. Lots of you just copy and…
#AD
Active Directory Certificate Services enumeration and abuse
https://github.com/ly4k/Certipy
@BlueRedTeam
Active Directory Certificate Services enumeration and abuse
https://github.com/ly4k/Certipy
@BlueRedTeam
GitHub
GitHub - ly4k/Certipy: Tool for Active Directory Certificate Services enumeration and abuse
Tool for Active Directory Certificate Services enumeration and abuse - ly4k/Certipy
👍1
#Red_Team
1. Steal Credentials & Bypass 2FA Using noVNC
https://mrd0x.com/bypass-2fa-using-novnc
2. Queries user sessions for the entire domain
(Interactive/RDP etc)
https://github.com/YossiSassi/Get-UserSession
@BlueRedTeam
1. Steal Credentials & Bypass 2FA Using noVNC
https://mrd0x.com/bypass-2fa-using-novnc
2. Queries user sessions for the entire domain
(Interactive/RDP etc)
https://github.com/YossiSassi/Get-UserSession
@BlueRedTeam
Mrd0X
Security Research | mr.d0x
Providing security research and red team techniques
👍1
#Blue_Team
1. PolarProxy in Windows Sandbox
https://www.netresec.com/?page=Blog&month=2022-01&post=PolarProxy-in-Windows-Sandbox
2. A command-line tool to quickly analyze all IPs in a file and see which ones have open ports/vulnerabilities
https://gitlab.com/shodan-public/nrich
@BlueRedTeam
1. PolarProxy in Windows Sandbox
https://www.netresec.com/?page=Blog&month=2022-01&post=PolarProxy-in-Windows-Sandbox
2. A command-line tool to quickly analyze all IPs in a file and see which ones have open ports/vulnerabilities
https://gitlab.com/shodan-public/nrich
@BlueRedTeam
Netresec
PolarProxy in Windows Sandbox
In this video I demonstrate how PolarProxy can be run in a Windows Sandbox to intercept and decrypt outgoing TLS communication. This setup can be used to inspect otherwise encrypted traffic from malware or suspicious Windows applications, which communicate…
👍1
#Red_Team
1. Vulhub is an open-source collection of pre-built vulnerable docker environments
https://github.com/vulhub/vulhub
2. linWinPwn is a bash noscript that automates a number of AD Enumeration and Vulnerability checks
https://github.com/lefayjey/linWinPwn
@BlueRedTeam
1. Vulhub is an open-source collection of pre-built vulnerable docker environments
https://github.com/vulhub/vulhub
2. linWinPwn is a bash noscript that automates a number of AD Enumeration and Vulnerability checks
https://github.com/lefayjey/linWinPwn
@BlueRedTeam
GitHub
GitHub - vulhub/vulhub: Pre-Built Vulnerable Environments Based on Docker-Compose
Pre-Built Vulnerable Environments Based on Docker-Compose - vulhub/vulhub
👍1
#Cobalt_Strike
The idea is to collect all the C# projects that are Sharp{Word} that can be used in Cobalt Strike as execute assembly command.
https://github.com/N7WEra/SharpAllTheThings
@BlueRedTeam
The idea is to collect all the C# projects that are Sharp{Word} that can be used in Cobalt Strike as execute assembly command.
https://github.com/N7WEra/SharpAllTheThings
@BlueRedTeam
GitHub
GitHub - N7WEra/SharpAllTheThings: The idea is to collect all the C# projects that are Sharp{Word} that can be used in Cobalt Strike…
The idea is to collect all the C# projects that are Sharp{Word} that can be used in Cobalt Strike as execute assembly command. - N7WEra/SharpAllTheThings
#Red_Team
Red Team vs. Blue Team scenario in which you I played the role of both pentester and SOC analyst.
https://github.com/Ogichka/Red-Vs.-Blue-Team-Project
@BlueRedTeam
Red Team vs. Blue Team scenario in which you I played the role of both pentester and SOC analyst.
https://github.com/Ogichka/Red-Vs.-Blue-Team-Project
@BlueRedTeam
GitHub
GitHub - Ogichka/Red-Vs.-Blue-Team-Project: Red Team vs. Blue Team scenario in which I played the role of both pentester and SOC…
Red Team vs. Blue Team scenario in which I played the role of both pentester and SOC analyst. - GitHub - Ogichka/Red-Vs.-Blue-Team-Project: Red Team vs. Blue Team scenario in which I played the rol...
#Red_Team
Red Team Suite Key Management & Utility Software
https://github.com/Tech-Slayers/RTS-Encryption-Manager
@BlueRedTeam
Red Team Suite Key Management & Utility Software
https://github.com/Tech-Slayers/RTS-Encryption-Manager
@BlueRedTeam
GitHub
GitHub - Tech-Slayers/RTS-Encryption-Manager: Red Team Suite Key Management & Utility Software
Red Team Suite Key Management & Utility Software. Contribute to Tech-Slayers/RTS-Encryption-Manager development by creating an account on GitHub.
#exploit
1. CVE-2022-25375:
Demo exploit of RNDIS USB Gadget
https://github.com/szymonh/rndis-co
2. CVE-2022-24112:
Apache APISIX apisix/batch-requests RCE
https://github.com/Mr-xn/CVE-2022-24112
]-> https://github.com/shakeman8/CVE-2022-24112
@BlueRedTeam
1. CVE-2022-25375:
Demo exploit of RNDIS USB Gadget
https://github.com/szymonh/rndis-co
2. CVE-2022-24112:
Apache APISIX apisix/batch-requests RCE
https://github.com/Mr-xn/CVE-2022-24112
]-> https://github.com/shakeman8/CVE-2022-24112
@BlueRedTeam
GitHub
GitHub - szymonh/rndis-co: CVE-2022-25375 - Demo exploit of RNDIS USB Gadget
CVE-2022-25375 - Demo exploit of RNDIS USB Gadget. Contribute to szymonh/rndis-co development by creating an account on GitHub.
#Red_Team
Bash Tricks for Command Execution and Data Extraction over HTTP/S
https://medium.com/maverislabs/bash-tricks-for-command-execution-and-data-extraction-over-http-s-ca76e9c80933
@BlueRedTeam
Bash Tricks for Command Execution and Data Extraction over HTTP/S
https://medium.com/maverislabs/bash-tricks-for-command-execution-and-data-extraction-over-http-s-ca76e9c80933
@BlueRedTeam
Medium
Bash Tricks for Command Execution and Data Extraction over HTTP/S
This post is part of a series on data extraction techniques on Linux Systems, if you like what you read here, be sure to stay tuned for…
#Malware
New Sandworm malware Cyclops Blink replaces VPNFilter
https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter
@BlueRedTeam
New Sandworm malware Cyclops Blink replaces VPNFilter
https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter
@BlueRedTeam
www.ncsc.gov.uk
New Sandworm malware Cyclops Blink replaces VPNFilter
The Sandworm actor has replaced the exposed VPNFilter malware with a new more advanced framework.
Anti_backdoor.pdf
12.6 MB
#Blue_Team
"Anti-Backdoor Learning:
Training Clean Models on Poisoned Data", 2021.
]-> Repo: https://github.com/bboylyg/ABL
@BlueRedTeam
"Anti-Backdoor Learning:
Training Clean Models on Poisoned Data", 2021.
]-> Repo: https://github.com/bboylyg/ABL
@BlueRedTeam
#exploit
1. Exploit Development:
ASLR - Coming To A KUSER_SHARED_DATA Structure
https://connormcgarr.github.io/kuser-shared-data-changes-win-11
2. LPE based on Sunflower RCE without specifying ports
https://github.com/Ryze-T/CNVD-2022-10270-LPE
@BlueRedTeam
1. Exploit Development:
ASLR - Coming To A KUSER_SHARED_DATA Structure
https://connormcgarr.github.io/kuser-shared-data-changes-win-11
2. LPE based on Sunflower RCE without specifying ports
https://github.com/Ryze-T/CNVD-2022-10270-LPE
@BlueRedTeam
Connor McGarr’s Blog
Exploit Development: ASLR - Coming To A KUSER_SHARED_DATA Structure Near You!
Examining recent changes to a highly-abused static structure, KUSER_SHARED_DATA, and its exploitation impact.
#Cobalt_Strike
Cobalt Strike External C2 Integration With Azure Servicebus, C2 traffic via Azure Servicebus
https://github.com/Cobalt-Strike/community_kit
@BlueRedTeam
Cobalt Strike External C2 Integration With Azure Servicebus, C2 traffic via Azure Servicebus
https://github.com/Cobalt-Strike/community_kit
@BlueRedTeam
GitHub
GitHub - Cobalt-Strike/community_kit: Cobalt Strike is a post-exploitation framework designed to be extended and customized by…
Cobalt Strike is a post-exploitation framework designed to be extended and customized by the user community. Several excellent tools and noscripts have been written and published, but they can be cha...