Privilege escalation with SageMaker and there's more hiding in execution roles
https://ift.tt/FZ8jJiz
Submitted December 05, 2025 at 09:51AM by alt69785
via reddit https://ift.tt/j09bnsO
https://ift.tt/FZ8jJiz
Submitted December 05, 2025 at 09:51AM by alt69785
via reddit https://ift.tt/j09bnsO
Plerion
Privilege escalation with SageMaker and there's more hiding in execution roles
A subtle AWS privesc hiding in SageMaker lifecycle configs, and what it reveals about execution roles.
Whitebox (simulation) vs. blackbox (red team) phishing
https://phishing.club/blog/white-box-vs-black-box-phishing/
Submitted December 05, 2025 at 05:25PM by hackeronni
via reddit https://ift.tt/SJqfp2Y
https://phishing.club/blog/white-box-vs-black-box-phishing/
Submitted December 05, 2025 at 05:25PM by hackeronni
via reddit https://ift.tt/SJqfp2Y
Phishing Club
Phishing Club - Professional Self-Hosted Phishing Platform
Professional self-hosted phishing platform built for enterprises, red teams, and security providers. Deploy locally for complete control over campaigns, data, and infrastructure with unlimited simulations and full privacy.
AI/LLM Red Team Handbook and Field Manual
https://cph-sec.gitbook.io/ai-llm-red-team-handbook-and-field-manual
Submitted December 05, 2025 at 06:05PM by esmurf
via reddit https://ift.tt/5hVeFQH
https://cph-sec.gitbook.io/ai-llm-red-team-handbook-and-field-manual
Submitted December 05, 2025 at 06:05PM by esmurf
via reddit https://ift.tt/5hVeFQH
Reddit
[Mature Content] From the netsec community on Reddit: AI/LLM Red Team Handbook and Field Manual
Posted by esmurf - 39 votes and 9 comments
SSRF Payload Generator for fuzzing PDF Generators etc...
https://ift.tt/rQUzgp0
Submitted December 05, 2025 at 06:56PM by robbanrobbin
via reddit https://ift.tt/duJWM20
https://ift.tt/rQUzgp0
Submitted December 05, 2025 at 06:56PM by robbanrobbin
via reddit https://ift.tt/duJWM20
Shelltrail
SSRF Payload Generator | Shelltrail - Swedish Experts in Pentesting
Generate HTML/SVG payloads for testing Server-Side Request Forgery vulnerabilities.
Tracing JavaScript Value Origins in Modern SPAs: Breakpoint-Driven Heap Search (BDHS)
https://fcavallarin.github.io/wirebrowser/BDHS-Origin-Trace
Submitted December 05, 2025 at 08:18PM by filippo_cavallarin
via reddit https://ift.tt/izkBmFt
https://fcavallarin.github.io/wirebrowser/BDHS-Origin-Trace
Submitted December 05, 2025 at 08:18PM by filippo_cavallarin
via reddit https://ift.tt/izkBmFt
Reddit
From the netsec community on Reddit: Tracing JavaScript Value Origins in Modern SPAs: Breakpoint-Driven Heap Search (BDHS)
Posted by filippo_cavallarin - 17 votes and 0 comments
Stillepost - Or: How to Proxy your C2s HTTP-Traffic through Chromium | mischief
https://ift.tt/aHb4Tsd
Submitted December 07, 2025 at 01:02PM by S3cur3Th1sSh1t
via reddit https://ift.tt/wXH94RD
https://ift.tt/aHb4Tsd
Submitted December 07, 2025 at 01:02PM by S3cur3Th1sSh1t
via reddit https://ift.tt/wXH94RD
mischief
Stillepost - Or: How to Proxy your C2s HTTP-Traffic through Chromium
Utilizing the Chrome DevTools Protocol to delegate C2 HTTP-traffic.
How (almost) any phone number can be tracked via WhatsApp & Signal – open-source PoC
https://ift.tt/rZSEBHC
Submitted December 07, 2025 at 10:03PM by Economy-Treat-768
via reddit https://ift.tt/iNmsghO
https://ift.tt/rZSEBHC
Submitted December 07, 2025 at 10:03PM by Economy-Treat-768
via reddit https://ift.tt/iNmsghO
arXiv.org
Careless Whisper: Exploiting Silent Delivery Receipts to Monitor...
With over 3 billion users globally, mobile instant messaging apps have become indispensable for both personal and professional communication. Besides plain messaging, many services implement...
Patching Pulse Oximeter Firmware
https://ift.tt/65Gczer
Submitted December 07, 2025 at 10:00PM by alt69785
via reddit https://ift.tt/6gmWlDd
https://ift.tt/65Gczer
Submitted December 07, 2025 at 10:00PM by alt69785
via reddit https://ift.tt/6gmWlDd
Publishing Malicious VS Code Extensions: Bypassing VS Code Marketplace Analysis and the Insecurity of OpenVSX (Cursor AI/Windsurf)
https://ift.tt/7lCegPQ
Submitted December 08, 2025 at 11:31AM by mazen160
via reddit https://ift.tt/XnGCQqA
https://ift.tt/7lCegPQ
Submitted December 08, 2025 at 11:31AM by mazen160
via reddit https://ift.tt/XnGCQqA
Mazin Ahmed
Compromising Developers with Malicious Extensions - VS Code, Cursor AI, and the Backdoor You Didn't See Coming
Compromising Developers with Malicious Extensions - VS Code, Cursor AI, and the Backdoor You Didn't See Coming.
Free Security Canaries (SSH, AWS, Cookies, Email, more..) - Tracebit Community Edition
https://ift.tt/VU4w7zf
Submitted December 08, 2025 at 07:04PM by tracebit
via reddit https://ift.tt/isyDlS4
https://ift.tt/VU4w7zf
Submitted December 08, 2025 at 07:04PM by tracebit
via reddit https://ift.tt/isyDlS4
Tracebit
Announcing Tracebit Community Edition | Tracebit
We're excited to announce Tracebit Community Edition, a completely free-forever platform to deploy security canaries.
New Prompt Injection Attack Vectors Through MCP Sampling
https://unit42.paloaltonetworks.com/model-context-protocol-attack-vectors/
Submitted December 08, 2025 at 08:21PM by alt69785
via reddit https://ift.tt/7uTZARy
https://unit42.paloaltonetworks.com/model-context-protocol-attack-vectors/
Submitted December 08, 2025 at 08:21PM by alt69785
via reddit https://ift.tt/7uTZARy
Unit 42
New Prompt Injection Attack Vectors Through MCP Sampling
Model Context Protocol connects LLM apps to external data sources or tools. We examine its security implications through various attack vectors.
React2shell: Critical vulnerability in react
https://ift.tt/nrEKzat
Submitted December 08, 2025 at 10:30PM by DramaticWerewolf7365
via reddit https://ift.tt/4uOnQFc
https://ift.tt/nrEKzat
Submitted December 08, 2025 at 10:30PM by DramaticWerewolf7365
via reddit https://ift.tt/4uOnQFc
JFrog
CVE-2025-55182 and CVE-2025-66478 ("React2Shell") - All you need to know
Critical React RCE vulnerability (React2Shell CVE-2025-55182) threatens Next.js apps. Learn how to detect with JFrog Xray and patch immediately.
Learning cloud exploits for redteam, alternative to SANS588 GCPN
https://ift.tt/WFgwLVm
Submitted December 09, 2025 at 06:41AM by EnoughAd1957
via reddit https://ift.tt/qPMRzUy
https://ift.tt/WFgwLVm
Submitted December 09, 2025 at 06:41AM by EnoughAd1957
via reddit https://ift.tt/qPMRzUy
SANS Institute
SEC588: Cloud Penetration Testing
Cloud security starts with thinking like the adversary—hack, test, and assess cloud environments built from real-world attacks.
Using Agents to Map SaaS Attack Surface via MITRE ATT&CK
https://ift.tt/J0RpF3D
Submitted December 09, 2025 at 11:06AM by wezham
via reddit https://ift.tt/Dl7T5JL
https://ift.tt/J0RpF3D
Submitted December 09, 2025 at 11:06AM by wezham
via reddit https://ift.tt/Dl7T5JL
Declarative Binary Parsing for Security Research with Kaitai Struct
https://ift.tt/bIBHhLN
Submitted December 09, 2025 at 05:35PM by Beneficial_Cattle_98
via reddit https://ift.tt/gCEiHA3
https://ift.tt/bIBHhLN
Submitted December 09, 2025 at 05:35PM by Beneficial_Cattle_98
via reddit https://ift.tt/gCEiHA3
Husseinmuhaisen
Declarative Binary Parsing for Security Research with Kaitai Struct
Reverse engineering a dummy KAISTDE format and generating parsers with Kaitai Struct.
Syd - Offline AI assistant for air-gapped security environments
https://ift.tt/0mFI9xi
Submitted December 09, 2025 at 05:21PM by Glass-Ant-6041
via reddit https://ift.tt/zWH8h6S
https://ift.tt/0mFI9xi
Submitted December 09, 2025 at 05:21PM by Glass-Ant-6041
via reddit https://ift.tt/zWH8h6S
GitLab
Sydsec / Syd · GitLab
Air-gapped cybersecurity assistant for security professionals. 100% offline AI-powered analysis tool for Nmap, Volatility, BloodHound, Metasploit, YARA, and more. Built for environments where cloud AI isn't available.
Free Honey Tokens for Breach Detection - No Signup
https://ift.tt/pg9mfRJ
Submitted December 10, 2025 at 01:09PM by radkawar
via reddit https://ift.tt/vF0nTNa
https://ift.tt/pg9mfRJ
Submitted December 10, 2025 at 01:09PM by radkawar
via reddit https://ift.tt/vF0nTNa
DeceptIQ Starter
DeceptIQ Starter - Free Honey Tokens
Deploy free honey tokens across your infrastructure in minutes. Real-time alerts when credentials are used. No credit card required.
Extending Burp Suite for fun and profit – The Montoya way – Part 9 - HN Security
https://ift.tt/KO24u3w
Submitted December 10, 2025 at 03:15PM by 0xdea
via reddit https://ift.tt/9Sn64Fd
https://ift.tt/KO24u3w
Submitted December 10, 2025 at 03:15PM by 0xdea
via reddit https://ift.tt/9Sn64Fd
HN Security
Extending Burp Suite for fun and profit – The Montoya way – Part 9 - HN Security
A comprehensive guide on extending Burp Scanner with custom scan checks.
Parrot 7.0 Beta swaps out the MATE desktop for using Plasma by default
https://ift.tt/yhrXIjg
Submitted December 10, 2025 at 04:19PM by Little-Season-3433
via reddit https://ift.tt/XnVAP45
https://ift.tt/yhrXIjg
Submitted December 10, 2025 at 04:19PM by Little-Season-3433
via reddit https://ift.tt/XnVAP45
Infostealer has entered the chat
https://ift.tt/LlGWf8m
Submitted December 10, 2025 at 10:20PM by Fit_Wing3352
via reddit https://ift.tt/IrOj4l8
https://ift.tt/LlGWf8m
Submitted December 10, 2025 at 10:20PM by Fit_Wing3352
via reddit https://ift.tt/IrOj4l8
Kaspersky official blog
The AMOS infostealer is piggybacking ChatGPT's chat-sharing feature
We break down a new infostealer attack that combines the ClickFix technique with a shared chat containing malicious user guides on the official ChatGPT website.
SOAPwn: Pwning .NET Framework Applications Through HTTP Client Proxies And WSDL - watchTowr Labs
https://ift.tt/HLgCqdQ
Submitted December 10, 2025 at 10:42PM by dx7r__
via reddit https://ift.tt/hj39kia
https://ift.tt/HLgCqdQ
Submitted December 10, 2025 at 10:42PM by dx7r__
via reddit https://ift.tt/hj39kia
watchTowr Labs
SOAPwn: Pwning .NET Framework Applications Through HTTP Client Proxies And WSDL
Welcome back! As we near the end of 2025, we are, of course, waiting for the next round of SSLVPN exploitation to occur in January (as it did in 2024 and 2025).
Weeeeeeeee. Before then, we want to clear the decks and see how much research we can publish.…
Weeeeeeeee. Before then, we want to clear the decks and see how much research we can publish.…