Cracking Randomly Generated Passwords
https://ift.tt/3tWNh6K
Submitted January 25, 2022 at 11:00PM by hyperreality_monero
via reddit https://ift.tt/3H0m4UE
https://ift.tt/3tWNh6K
Submitted January 25, 2022 at 11:00PM by hyperreality_monero
via reddit https://ift.tt/3H0m4UE
TrustedSec
Recovering Randomly Generated Passwords - TrustedSec
TrustedSec's blog is an expert source of information on information security trends and best practices for strategic risk management.
Mind Your Dependencies: Defending against malicious npm packages
https://ift.tt/347p575
Submitted January 26, 2022 at 12:39AM by SRMish3
via reddit https://ift.tt/3KGRP7o
https://ift.tt/347p575
Submitted January 26, 2022 at 12:39AM by SRMish3
via reddit https://ift.tt/3KGRP7o
We purchased a machine from China and it came with malware preinstalled
https://ift.tt/3fS4Blk
Submitted January 26, 2022 at 12:35AM by lormayna
via reddit https://ift.tt/33LgCXo
https://ift.tt/3fS4Blk
Submitted January 26, 2022 at 12:35AM by lormayna
via reddit https://ift.tt/33LgCXo
reddit
We purchased a machine from China and it came with malware...
Posted in r/netsec by u/lormayna • 630 points and 166 comments
pwnkit: Local Privilege Escalation in polkit's pkexec (CVE-2021-4034)
https://ift.tt/3fWIF8M
Submitted January 26, 2022 at 01:55AM by TheSwedishChef24
via reddit https://ift.tt/3IzIZGH
https://ift.tt/3fWIF8M
Submitted January 26, 2022 at 01:55AM by TheSwedishChef24
via reddit https://ift.tt/3IzIZGH
reddit
pwnkit: Local Privilege Escalation in polkit's pkexec (CVE-2021-4034)
Posted in r/netsec by u/TheSwedishChef24 • 1 point and 0 comments
Exploit for CVE-2021-4034 that does not leave syslog entries
https://ift.tt/3H7ssJG
Submitted January 26, 2022 at 03:22PM by hermajordoctor
via reddit https://ift.tt/3tZw6l7
https://ift.tt/3H7ssJG
Submitted January 26, 2022 at 03:22PM by hermajordoctor
via reddit https://ift.tt/3tZw6l7
GitHub
GitHub - Ayrx/CVE-2021-4034: Exploit for CVE-2021-4034
Exploit for CVE-2021-4034. Contribute to Ayrx/CVE-2021-4034 development by creating an account on GitHub.
Self-contained exploit for CVE-2021-4034 (Pkexec 1-day LPE)
https://ift.tt/3G7mVS2
Submitted January 26, 2022 at 07:59PM by ly4k_
via reddit https://ift.tt/3o2AZGq
https://ift.tt/3G7mVS2
Submitted January 26, 2022 at 07:59PM by ly4k_
via reddit https://ift.tt/3o2AZGq
GitHub
GitHub - ly4k/PwnKit: Self-contained exploit for CVE-2021-4034 - Pkexec Local Privilege Escalation
Self-contained exploit for CVE-2021-4034 - Pkexec Local Privilege Escalation - GitHub - ly4k/PwnKit: Self-contained exploit for CVE-2021-4034 - Pkexec Local Privilege Escalation
wholeaked: a file-sharing tool that allows you to find the responsible person in case of a leakage
https://ift.tt/3AAPnL9
Submitted January 26, 2022 at 09:21PM by utku1337
via reddit https://ift.tt/3o1mLFI
https://ift.tt/3AAPnL9
Submitted January 26, 2022 at 09:21PM by utku1337
via reddit https://ift.tt/3o1mLFI
GitHub
GitHub - utkusen/wholeaked: a file-sharing tool that allows you to find the responsible person in case of a leakage
a file-sharing tool that allows you to find the responsible person in case of a leakage - GitHub - utkusen/wholeaked: a file-sharing tool that allows you to find the responsible person in case of a...
AD CS: weaponizing the ESC7 attack - BlackArrow
https://ift.tt/3Axjnr0
Submitted January 26, 2022 at 08:52PM by apanonimo
via reddit https://ift.tt/3G6TyPI
https://ift.tt/3Axjnr0
Submitted January 26, 2022 at 08:52PM by apanonimo
via reddit https://ift.tt/3G6TyPI
Tarlogic Security
AD CS: weaponizing the ESC7 attack
Research and tooling development around the ESC7 attack at Active Directory Certificate Services (AD CS) for Red Team operations
Perfect wordlist to discover directories and files on target size with tools like ffuf.
https://ift.tt/3AyR9w4
Submitted January 26, 2022 at 10:03PM by mexhanical
via reddit https://ift.tt/35gkVtW
https://ift.tt/3AyR9w4
Submitted January 26, 2022 at 10:03PM by mexhanical
via reddit https://ift.tt/35gkVtW
GitHub
GitHub - aels/subdirectories-discover: Perfect wordlist for discovering directories and files on target site
Perfect wordlist for discovering directories and files on target site - GitHub - aels/subdirectories-discover: Perfect wordlist for discovering directories and files on target site
Bypassing Little Snitch Firewall with Empty TCP Packets
https://ift.tt/32xWRBN
Submitted January 26, 2022 at 11:05PM by hackers_and_builders
via reddit https://ift.tt/348fRr2
https://ift.tt/32xWRBN
Submitted January 26, 2022 at 11:05PM by hackers_and_builders
via reddit https://ift.tt/348fRr2
Rhino Security Labs
Bypassing Little Snitch Firewall with Empty TCP Packets - Rhino Security Labs
Little Snitch is a host-based firewall for macOS, used for monitoring and restricting egress network traffic.
Reversing ALPHV (aka BlackCat): Rust-Based Ransomware
https://ift.tt/3rVE8Zy
Submitted January 27, 2022 at 03:05AM by rsobers
via reddit https://ift.tt/3fYf2Uf
https://ift.tt/3rVE8Zy
Submitted January 27, 2022 at 03:05AM by rsobers
via reddit https://ift.tt/3fYf2Uf
Varonis
BlackCat Ransomware (ALPHV) | Varonis
Varonis has observed the ALPHV (BlackCat) ransomware, actively recruiting new affiliates and targeting organizations across multiple sectors worldwide.
Pwnkit: How to exploit and check
https://ift.tt/3IAnBRw
Submitted January 27, 2022 at 04:15AM by DevSec23
via reddit https://ift.tt/3G5peVV
https://ift.tt/3IAnBRw
Submitted January 27, 2022 at 04:15AM by DevSec23
via reddit https://ift.tt/3G5peVV
beny23.github.io
Pwnkit: How to exploit and check
Pwnkit is a vulnerability that uses a bug in polkit to elevate permissions to root. This write-up shows how to reproduce it using Ubuntu and what to do to check whether a system is vulnerable.
What went wrong? Quoting from the original researchers:
This…
What went wrong? Quoting from the original researchers:
This…
How to use FaPro to simulate multiple devices in network
https://ift.tt/3r1yLcb
Submitted January 27, 2022 at 06:57AM by ntestoc3
via reddit https://ift.tt/3H9dPWq
https://ift.tt/3r1yLcb
Submitted January 27, 2022 at 06:57AM by ntestoc3
via reddit https://ift.tt/3H9dPWq
Medium
How to use FaPro to simulate multiple devices in network
With FaPro, you can create a virtual network and simulate several different devices in it with a single command.
Webcam Hacking (again) - Safari UXSS
https://ift.tt/3nYa922
Submitted January 26, 2022 at 05:32AM by Straight_Finding_756
via reddit https://ift.tt/3HddZfu
https://ift.tt/3nYa922
Submitted January 26, 2022 at 05:32AM by Straight_Finding_756
via reddit https://ift.tt/3HddZfu
ryan-pickren
Webcam Hacking (again) - Safari UXSS | Ryan Pickren
$100,500 Apple Bug Bounty for hacking the webcam via a Safari Universal Cross-Site Scripting (UXSS) bug. CVE-2021-30861, CVE-2021-30975
Blockchain-based xx messenger protects message content and metadata with unprecedented quantum resistance
https://ift.tt/3KPFCgu
Submitted January 27, 2022 at 11:53AM by eliapinto
via reddit https://ift.tt/33Q0QdQ
https://ift.tt/3KPFCgu
Submitted January 27, 2022 at 11:53AM by eliapinto
via reddit https://ift.tt/33Q0QdQ
[New] Configuring Linux AuditD for Threat Detection
https://ift.tt/3KLLw2h
Submitted January 27, 2022 at 04:42PM by InH4te
via reddit https://ift.tt/3H6UViV
https://ift.tt/3KLLw2h
Submitted January 27, 2022 at 04:42PM by InH4te
via reddit https://ift.tt/3H6UViV
Medium
Configuring Linux auditd for Threat Detection
A few years ago, I was asked to define an auditd configuration which would serve as the primary detection technology for a large…
PwnKit: How to detect privilege escalation using CrowdSec
https://ift.tt/3GaCAQy
Submitted January 27, 2022 at 07:50PM by klausagnoletti
via reddit https://ift.tt/3IYHz91
https://ift.tt/3GaCAQy
Submitted January 27, 2022 at 07:50PM by klausagnoletti
via reddit https://ift.tt/3IYHz91
The open-source & collaborative IPS
PwnKit: detect privilege escalation with CrowdSec - The open-source & collaborative IPS
PwnKit: CVE-2021-4034 avoid privilege escalation. CrowdSec developed a scenario to give you insight on whether you have been compromised by this vulnerability.
OSS PwnKit Detector (CVE-2021-4034)
https://ift.tt/3g08G6Y
Submitted January 27, 2022 at 10:53PM by SRMish3
via reddit https://ift.tt/3u1QNgp
https://ift.tt/3g08G6Y
Submitted January 27, 2022 at 10:53PM by SRMish3
via reddit https://ift.tt/3u1QNgp
GitHub
polkit-tools/pwnkit_detector at main · jfrog/polkit-tools
Contribute to jfrog/polkit-tools development by creating an account on GitHub.
Technical Analysis of CVE-2022-22583: Bypassing macOS System Integrity Protection (SIP)
https://ift.tt/3r6ZLXS
Submitted January 28, 2022 at 12:45AM by shleimeleh
via reddit https://ift.tt/3r47ohF
https://ift.tt/3r6ZLXS
Submitted January 28, 2022 at 12:45AM by shleimeleh
via reddit https://ift.tt/3r47ohF
Perception Point
Technical Analysis of CVE-2022-22583: Bypassing macOS System Integrity Protection (SIP)
Learn about how we discovered CVE-2022-22583, a vulnerability that allows attackers to bypass macOS SIP and take control of the system.
The Cookies Parasite - Bypassing MFA with cookie theft
https://medium.com/@amirshk/the-cookies-parasite-569d50ee36ad
Submitted January 28, 2022 at 01:25PM by amirshk
via reddit https://www.reddit.com/r/netsec/comments/selhxx/the_cookies_parasite_bypassing_mfa_with_cookie/?utm_source=ifttt
https://medium.com/@amirshk/the-cookies-parasite-569d50ee36ad
Submitted January 28, 2022 at 01:25PM by amirshk
via reddit https://www.reddit.com/r/netsec/comments/selhxx/the_cookies_parasite_bypassing_mfa_with_cookie/?utm_source=ifttt
Medium
The Cookies Parasite
The story of a phishing and malware campagin, overcomming MFA and taking over accounts.
"Stratus Red Team": open-source adversary emulation for AWS
https://ift.tt/3Hew6Bx
Submitted January 28, 2022 at 03:11PM by thorn42
via reddit https://ift.tt/32DmD7M
https://ift.tt/3Hew6Bx
Submitted January 28, 2022 at 03:11PM by thorn42
via reddit https://ift.tt/32DmD7M
GitHub
GitHub - DataDog/stratus-red-team: :cloud: Granular, Actionable Adversary Emulation for the Cloud
:cloud: :zap: Granular, Actionable Adversary Emulation for the Cloud - GitHub - DataDog/stratus-red-team: :cloud: Granular, Actionable Adversary Emulation for the Cloud