Intro In our research, we expose adversarial Tactics, Techniques and Procedures (TTPs) as well as the tools they use to execute their mission objectives. In most of our cases, we see the threat act…

BSidesSF 2024 CFP is Closed! Thanks to all who submitted.We received a total of 334 reviewable submissions (up 59.8% from 209 in 2023), but could only accept 60. This means we had an unusual...

A deep dive into specifics around cobalt strike malleable c2 profiles and key information that is new in cobalt strike 4.4.

Application security issues found by Assetnote

Since my last post, I had the pleasure to participate in a lot of CTFs.

"Unoriginal-Rice-Patty" is my personal noscript for the Replay-based attack on Honda and Acura vehicles - GitHub - HackingIntoYourHeart/Unoriginal-Rice-Patty: "Unoriginal-Ri...

Posted in r/netsec by u/alain_proviste • 18 points and 0 comments

A collection of nftables, multi routing noscripts, port knocked, and iptables files. To get inspiration to make your own firewalls. - GitHub - philippecrowdsec/iptables-nftables-multiroute-firewall: ...

What’s dumber than an open redirect? This.

Posted in r/netsec by u/gquere • 27 points and 1 comment

In this blog post we explain how hardware security modules (HSM) help protect sensitive data and how Teleport 7.2 uses HSM to make remote access more secure.

This post is a short notice about vulnerabilities in VMware products I found earlier this year. During a penetration test of a freshly built environment, I took a closer look at VMware Unified Access …

Posted in r/netsec by u/thinkst • 2 points and 0 comments

Frida's finally getting Swifty. Contribute to frida/frida-swift-bridge development by creating an account on GitHub.

sgCheckup generates nmap output based on scanning your AWS Security Groups for unexpected open ports. - goldfiglabs/sgCheckup

packet captures of real-world ddos attacks. Contribute to StopDDoS/packet-captures development by creating an account on GitHub.

In part two of our series on securing SQL server applications, we explore a scenario in which you do not want to incur the overhead of encryption for every application. See the solution here.

SSH lateral movement cheat sheet, a collection of lateral movement techniques to move deeper through the network.