Posted in r/netsec by u/1winway • 86 points and 7 comments

You've probably heard about salting passwords, but a further technique, peppering, makes them even more secure. Here's how.

During a recent incident response engagement, the Profero IR team observed a sample of Hello Kitty ransomware. This version of ransomware…

This post walks through exploiting serverless environments and AWS Lambda functions via the CloudGoat vulnerable_lambda scenario.

KrbRelayUp - a universal no-fix local privilege escalation in windows domain environments where LDAP signing is not enforced (the default settings). - Dec0ne/KrbRelayUp

Doyensec's Blog :: Doyensec is an independent security research and development company focused on vulnerability discovery and remediation.

Hi all,

Posted by u/Late_Ice_9288 - 5 votes and 4 comments

Team Nautilus found a flaw in npm that allows attackers to perform package planting and masquerade a malicious package as legitimate to trick developers

Application security issues found by Assetnote

Psychic Signature vulnerability lies in the crypto for ECDSA signatures, which protects systems for critical tasks like authentication. Hackers can bypass any signature check with this vulnerability. We will explain what it is and how to mitigate it in this…

494K subscribers in the netsec community. /r/netsec is a community-curated aggregator of technical information security content. Our mission is to…

stealth userland kit that doesn't use sys_clone/sys_execve call - GitHub - io-tl/degu-lib: stealth userland kit that doesn't use sys_clone/sys_execve call

It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could resul…

Microsoft has discovered several vulnerabilities, collectively referred to as Nimbuspwn, that could be chained together, allowing an attacker to elevate privileges to root on many Linux desktop endpoints. Leveraging Nimbuspwn as a vector for root access could…

FindFunc is an IDA Pro plugin to find code functions that contain a certain assembly or byte pattern, reference a certain name or string, or conform to various other constraints. - GitHub - FelixBe...

Contribute to jfrog/nimbuspwn-tools development by creating an account on GitHub.

Wiz Research discovers a chain of critical vulnerabilities in the widely used Azure Database for PostgreSQL Flexible Server.