Bypassing Rockwell Automation Logix Controllers’ Local Chassis Security Protection
https://ift.tt/Ma7ZYxH
Submitted August 01, 2024 at 10:37PM by sh0n1z
via reddit https://ift.tt/gVrP1BO
https://ift.tt/Ma7ZYxH
Submitted August 01, 2024 at 10:37PM by sh0n1z
via reddit https://ift.tt/gVrP1BO
Claroty
Bypassing Rockwell Automation Logix Controllers’ Local Chassis Security Protection
Team82 has uncovered a security bypass vulnerability in a Rockwell Automation ControlLogix 1756 local chassis security feature called the trusted slot, which is designed to deny untrusted communication from untrusted network cards on the chassis plane.
Auditing Atlassian Plugins, 53 0-Days Later| Atlassian Research Part 1
https://ift.tt/m08BZHL
Submitted August 02, 2024 at 03:16PM by _cydave
via reddit https://ift.tt/gZqO9C4
https://ift.tt/m08BZHL
Submitted August 02, 2024 at 03:16PM by _cydave
via reddit https://ift.tt/gZqO9C4
Cyllective
Auditing Atlassian Plugins, 53 0-Days Later
Explaining the process and tooling behind our way of auditing Atlassian plugins, 53 0Days later.
GitHub - mlcsec/huntsman: Email enumerator, username generator, and context validator for hunter.io, snov.io, and skrapp.io
https://ift.tt/13qxZEW
Submitted July 31, 2024 at 10:43PM by Frequent_Passenger82
via reddit https://ift.tt/o71qZcV
https://ift.tt/13qxZEW
Submitted July 31, 2024 at 10:43PM by Frequent_Passenger82
via reddit https://ift.tt/o71qZcV
GitHub
GitHub - mlcsec/huntsman: Email enumerator, username generator, and context validator for hunter.io, snov.io, and skrapp.io
Email enumerator, username generator, and context validator for hunter.io, snov.io, and skrapp.io - mlcsec/huntsman
Beyond the Limit: Expanding single-packet race condition with a first sequence sync for breaking the 65,535 byte limit
https://ift.tt/rdn2FKV
Submitted August 02, 2024 at 08:33PM by toyojuni
via reddit https://ift.tt/5J2K6xc
https://ift.tt/rdn2FKV
Submitted August 02, 2024 at 08:33PM by toyojuni
via reddit https://ift.tt/5J2K6xc
GMO Flatt Security Research
Beyond the Limit: Expanding single-packet race condition with a first sequence sync for breaking the 65,535 byte limit
Introduction
Hello, I’m RyotaK (@ryotkak
), a security engineer at Flatt Security Inc.
In 2023, James Kettle
of PortSwigger published an excellent paper
noscriptd Smashing the state machine: the true potential of web race conditions.
In the paper, he introduced…
Hello, I’m RyotaK (@ryotkak
), a security engineer at Flatt Security Inc.
In 2023, James Kettle
of PortSwigger published an excellent paper
noscriptd Smashing the state machine: the true potential of web race conditions.
In the paper, he introduced…
Why You Should Treat Large Language Models as Potential Attackers
https://ift.tt/wW9NQj3
Submitted August 02, 2024 at 11:51PM by jat0369
via reddit https://ift.tt/2ocyAgk
https://ift.tt/wW9NQj3
Submitted August 02, 2024 at 11:51PM by jat0369
via reddit https://ift.tt/2ocyAgk
Cyberark
AI Treason: The Enemy Within
tl;dr: Large language models (LLMs) are highly susceptible to manipulation, and, as such, they must be treated as potential attackers in the system. LLMs have become extremely popular and serve...
Polyfill Supply Chain Attack
https://ift.tt/nJ7dT4P
Submitted August 04, 2024 at 08:57PM by FreshConversation639
via reddit https://ift.tt/xjwmHTk
https://ift.tt/nJ7dT4P
Submitted August 04, 2024 at 08:57PM by FreshConversation639
via reddit https://ift.tt/xjwmHTk
SecureLayer7 - Offensive Security, API Scanner & Attack Surface Management
Polyfill Supply Chain Attack
A supply chain attack via Polyfill, a common open-source library written in JavaScript, used in web development to provide modern functionality on older browsers like IE7 that did not support it...
Kerberos OPSEC: Offense & Detection Strategies for Red and Blue Team - Part 2 : AS REP Roasting
https://ift.tt/NQVpXxy
Submitted August 05, 2024 at 02:34PM by -vzh-
via reddit https://ift.tt/zuhT7JX
https://ift.tt/NQVpXxy
Submitted August 05, 2024 at 02:34PM by -vzh-
via reddit https://ift.tt/zuhT7JX
Cybersécurité - INTRINSEC
Kerberos OPSEC: Offense & Detection Strategies for Red and Blue Team – Part 2 : AS_REP Roasting
Explore essential OPSEC practices for Red Teams and advanced detection strategies for Blue Teams, focusing on the Kerberos protocol
CTI Research
https://ift.tt/9ZYAhjc
Submitted August 05, 2024 at 02:17PM by Cyber-Constable-247
via reddit https://ift.tt/bXSVhPJ
https://ift.tt/9ZYAhjc
Submitted August 05, 2024 at 02:17PM by Cyber-Constable-247
via reddit https://ift.tt/bXSVhPJ
Qualtrics
Non-technical methods of sharing Cyber Threat Intelligence: The Professional's view
I'm inviting you to participate in a brief (approx. 10 minutes) online survey to explore how trust in a consortium influences information sharing behaviour.
Supply Chain Security Harm Reduction with 3TOFU
https://ift.tt/LDA8CHQ
Submitted August 05, 2024 at 08:41PM by maltfield
via reddit https://ift.tt/iKLZ86v
https://ift.tt/LDA8CHQ
Submitted August 05, 2024 at 08:41PM by maltfield
via reddit https://ift.tt/iKLZ86v
Michael Altfield's Tech Blog
3TOFU: Verifying Unsigned Releases - Michael Altfield's Tech Blog
Introducing 3TOFU -- a Harm-Reduction process to Supply Chain Security when downloading software that cannot be verified cryptographically
Scaling Variant Analysis
https://ift.tt/vou5g6T
Submitted August 05, 2024 at 09:45PM by jrozner
via reddit https://ift.tt/RJzQi39
https://ift.tt/vou5g6T
Submitted August 05, 2024 at 09:45PM by jrozner
via reddit https://ift.tt/RJzQi39
Goingbeyondgrep
Scaling Variant Analysis
The past handful of years I’ve been really interested in static analysis but not from the traditional appsec program perspective of shifting left and catching bugs before they get merged. Instead I use it for code exploration, vulnerability discovery, and…
CVE-2024-39877: Apache Airflow Arbitrary Code Execution
https://ift.tt/dLYNJiD
Submitted August 06, 2024 at 02:27AM by appsec1337
via reddit https://ift.tt/aAUv7TF
https://ift.tt/dLYNJiD
Submitted August 06, 2024 at 02:27AM by appsec1337
via reddit https://ift.tt/aAUv7TF
SecureLayer7 - Offensive Security, API Scanner & Attack Surface Management
CVE-2024-39877: Apache Airflow Arbitrary Code Execution
Apache Airflow is an open-source platform for programmatically authoring, scheduling, and monitoring workflows. While it offers robust features for managing complex workflows, it has experienced...
Cracking Wi-Fi password using combinatorics
https://ift.tt/oIzu3tO
Submitted August 06, 2024 at 06:03PM by yurichev
via reddit https://ift.tt/3kQzIaj
https://ift.tt/oIzu3tO
Submitted August 06, 2024 at 06:03PM by yurichev
via reddit https://ift.tt/3kQzIaj
Homebrew Security Audit 2023
https://ift.tt/lhoZMvR
Submitted August 06, 2024 at 05:37PM by ChemicalImaginary319
via reddit https://ift.tt/ndWwyIq
https://ift.tt/lhoZMvR
Submitted August 06, 2024 at 05:37PM by ChemicalImaginary319
via reddit https://ift.tt/ndWwyIq
Homebrew
2023 Security Audit
Homebrew had a security audit performed in 2023. This audit was funded by the Open Technology Fund and conducted by Trail of Bits. Trail of Bits’ report contained 25 items, of which 16 were fixed, 3 are in progress, and 6 are acknowledged by Homebrew’s maintainers.…
Unveiling the Power Duo: osquery and osctrl
https://ift.tt/DFNwz9x
Submitted August 06, 2024 at 09:25PM by javuto
via reddit https://ift.tt/noQmhpM
https://ift.tt/DFNwz9x
Submitted August 06, 2024 at 09:25PM by javuto
via reddit https://ift.tt/noQmhpM
Medium
Unveiling the Power Duo: osquery and osctrl
Get ready to discover the power of osquery and osctrl, your dynamic duo for advanced system monitoring and security.
Vestaboard: Exploring Broken Access Controls and Privilege Escalation
https://ift.tt/cSQqZ9N
Submitted August 06, 2024 at 10:41PM by hackers_and_builders
via reddit https://ift.tt/osqd4zN
https://ift.tt/cSQqZ9N
Submitted August 06, 2024 at 10:41PM by hackers_and_builders
via reddit https://ift.tt/osqd4zN
Rhino Security Labs
Vestaboard: Exploring Broken Access Controls and Privilege Escalation - Rhino Security Labs
During research on the Vestaboard web platform, the Rhino Security Labs research team identified three vulnerable instances of Broken Access Controls.
Cracking Wi-Fi password using combinatorics
https://ift.tt/oIzu3tO
Submitted August 06, 2024 at 10:53PM by yurichev
via reddit https://ift.tt/0FhGfLp
https://ift.tt/oIzu3tO
Submitted August 06, 2024 at 10:53PM by yurichev
via reddit https://ift.tt/0FhGfLp
Reddit
[deleted by user] : r/netsec
515K subscribers in the netsec community. /r/netsec is a community-curated aggregator of technical information security content. Our mission is to…
Announcing the Vulnerability Management program pack 1.0
https://ift.tt/C4eNYlS
Submitted August 07, 2024 at 02:40AM by SecTemplates
via reddit https://ift.tt/grDE8AY
https://ift.tt/C4eNYlS
Submitted August 07, 2024 at 02:40AM by SecTemplates
via reddit https://ift.tt/grDE8AY
SecTemplates.com
Announcing the Vulnerability Management program pack 1.0
Introduction Several times in my enterprise security career I experienced challenges when it came to security defect/vulnerability handling and management. When I joined eBay in 2006, the security team was fairly small and I recall filing a cross-site noscripting…
Master Your Craft - Tavis Ormandy Analysis on The CrowdStrike Incident
https://ift.tt/pkwRB4d
Submitted August 07, 2024 at 02:57AM by tahaid
via reddit https://ift.tt/VExvziy
https://ift.tt/pkwRB4d
Submitted August 07, 2024 at 02:57AM by tahaid
via reddit https://ift.tt/VExvziy
My keyboard was misbehaving so I had to exploit my NAS
https://ift.tt/9nwkJud
Submitted August 07, 2024 at 08:12PM by himazawa
via reddit https://ift.tt/RoZraSM
https://ift.tt/9nwkJud
Submitted August 07, 2024 at 08:12PM by himazawa
via reddit https://ift.tt/RoZraSM
appsec & stuff
My keyboard was misbehaving so I had to exploit my NAS
I recently received my ZimaCube: a NAS from IceWhale, the same company behind the ZimaBlade, ZimaBoard and most notably CasaOS, a UI to manage docker applications.
“Zovek” , My Offensive IoT Redteam Implant v1.0
https://ift.tt/Sv1o5Nk
Submitted August 07, 2024 at 10:04PM by alt3kx
via reddit https://ift.tt/ps95cVo
https://ift.tt/Sv1o5Nk
Submitted August 07, 2024 at 10:04PM by alt3kx
via reddit https://ift.tt/ps95cVo
Medium
“Zovek” , My Offensive IoT Redteam Implant v1.0
Why write this?
0.0.0.0 Day: Exploiting Localhost APIs From the Browser
https://ift.tt/qirSPpG
Submitted August 07, 2024 at 11:34PM by cov_id19
via reddit https://ift.tt/WnXdmJH
https://ift.tt/qirSPpG
Submitted August 07, 2024 at 11:34PM by cov_id19
via reddit https://ift.tt/WnXdmJH
www.oligo.security
0.0.0.0 Day: Exploiting Localhost APIs From the Browser | Oligo Security
Oligo Security's research team recently disclosed the “0.0.0.0 Day” vulnerability. This vulnerability allows malicious websites to bypass browser security and interact with services running on an organization’s local network