Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more - GitHub - aquasecurity/trivy: Find vulnerabilities, misconfigurations, secrets,...

The Schneider Electric electric car charging stations product line "EVlink" is affected by two vulnerabilities that allow a remote attacker to execute arbitrary commands on the system. Attackers can change the charging station configuration arbitrarily, charge…

AIL Framework released version 3.6

AIL Framework version 3.6 released with new features (such as YARA retrohunt), significant performance improvements, refactoring of the modules and many bugs wer...

Assorted writings. Contribute to vtriolet/writings development by creating an account on GitHub.

This project hosts security advisories and their accompanying proof-of-concepts related to research conducted at Google which impact non-Google owned code.

With the rise of internet and increasing risks of getting hacked, it's more than necessary nowadays that we have an extra layer of security on our accounts, since password alone is not enough. Thus, using Phone numbers for 2FA sounds much more secure, but…

NCC Group’s Exploit Development Group look at exploiting CVE-2021-31956 – the Windows Kernel (NTFS with WNF)

Lacework Labs identified an XMRigCC binary being used in conjunction with an opportunistic Cryptojacking (T1496) campaign. We examine for vulnerabilities to identify additional risks to victims.

Anatomy of a phishing attack

Use SQL to instantly query file, domain, URL and IP scanning results from VirusTotal. - GitHub - turbot/steampipe-plugin-virustotal: Use SQL to instantly query file, domain, URL and IP scanning res...

Today I wanted to write a blog post to answer the questions to the Noabar scenario located here: A little background on what Noabar is, this is a Windows machine in my home lab that I attacked to c…

Preface (日本語版も公開されています。) Cloudflare, which runs cdnjs, is running a “Vulnerability Disclosure Program” on HackerOne, which allows hackers to perform vulnerability assessments. This article describes vulnerabilities reported through this program and published…

Introduction

Posted in r/netsec by u/BIOS4breakfast • 29 points and 1 comment

A fast tool to scan client-side prototype pollution vulnerability written in Rust. 🦀 - GitHub - dwisiswant0/ppfuzz: A fast tool to scan client-side prototype pollution vulnerability written in Rust. 🦀

Posted in r/netsec by u/giuliomagnifico • 116 points and 9 comments

It’s easy to set up an IDS or other infrastructure to drop packets that match rules. There are many tools for real-time inspection of connections that can handle higher level protocols like HTTP or TLS.