PhishAPI Tool - Rapid Deployment of Fake Sites and Maldocs with Notifications!
https://ift.tt/2ECXddE
Submitted October 24, 2018 at 11:49AM by IndySecMan
via reddit https://ift.tt/2ScoyWS
https://ift.tt/2ECXddE
Submitted October 24, 2018 at 11:49AM by IndySecMan
via reddit https://ift.tt/2ScoyWS
Blogspot
PhishAPI Tool - Rapid Deployment of Fake Sites and Maldocs with Notifications!
Intro / TL;DR Hey InfoSec Community! As the penetration testing lead, I got tired of setting up and tearing down environments each time...
Reverse Engineering ESP8266 Firmware (Part 1)
https://ift.tt/2PgAnNa
Submitted October 24, 2018 at 05:22PM by BoredPentester
via reddit https://ift.tt/2SconLc
https://ift.tt/2PgAnNa
Submitted October 24, 2018 at 05:22PM by BoredPentester
via reddit https://ift.tt/2SconLc
HoneyProcs : Going Beyond Honeyfiles for Deception on Endpoints
https://ift.tt/2R7uAGX
Submitted October 24, 2018 at 09:31PM by anoopsaldanha
via reddit https://ift.tt/2OLVw2p
https://ift.tt/2R7uAGX
Submitted October 24, 2018 at 09:31PM by anoopsaldanha
via reddit https://ift.tt/2OLVw2p
forums.juniper.net
HoneyProcs : Going Beyond Honeyfiles for Deception on Endpoints
Co-Author: Abhijit Mohanta Deploying detection solutions on an endpoint host comes with constraints - limited availability of CPU, memory, disk and other resources, stability constraints, policy adherence and restrictions, the need to be non-intrusive…
WebExec - an authenticated RCE vulnerability in Cisco WebEx client
Hey all,During a pentest a couple months back, me and my coworker (/u/jeffmcjunkin) stumbled upon an 0-day in Cisco WebEx. It's neat because it's a remote code execution vulnerability in a client-side app due to bad ACLs.We wrote a high level doc about it, and also a deep dive into why it works.You can also find Nmap noscripts to check for it (already pushed to svn) as well as Metasploit modules to exploit it (in a metasploit fork) linked from there.I thought you guys would be interested! Please patch!
Submitted October 24, 2018 at 09:56PM by iagox86
via reddit https://ift.tt/2O2m0HJ
Hey all,During a pentest a couple months back, me and my coworker (/u/jeffmcjunkin) stumbled upon an 0-day in Cisco WebEx. It's neat because it's a remote code execution vulnerability in a client-side app due to bad ACLs.We wrote a high level doc about it, and also a deep dive into why it works.You can also find Nmap noscripts to check for it (already pushed to svn) as well as Metasploit modules to exploit it (in a metasploit fork) linked from there.I thought you guys would be interested! Please patch!
Submitted October 24, 2018 at 09:56PM by iagox86
via reddit https://ift.tt/2O2m0HJ
reddit
r/netsec - WebExec - an authenticated RCE vulnerability in Cisco WebEx client
3 votes and 0 comments so far on Reddit
Nessus 8.0 released
https://ift.tt/2yvtgqj
Submitted October 24, 2018 at 11:14PM by Neo-Bubba
via reddit https://ift.tt/2D0gRP6
https://ift.tt/2yvtgqj
Submitted October 24, 2018 at 11:14PM by Neo-Bubba
via reddit https://ift.tt/2D0gRP6
reddit
r/AskNetsec - Nessus 8.0 released
1 vote and 1 comment so far on Reddit
Mac malware intercepts encrypted web traffic for ad injection
https://ift.tt/2EHmNhz
Submitted October 25, 2018 at 01:43AM by EvanConover
via reddit https://ift.tt/2AqgTgM
https://ift.tt/2EHmNhz
Submitted October 25, 2018 at 01:43AM by EvanConover
via reddit https://ift.tt/2AqgTgM
Malwarebytes
Mac malware intercepts encrypted web traffic for ad injection
New Mac malware has been found that intercepts encrypted traffic for the purpose of injecting ads into web pages. But could this adware be used for more devious purposes in the future?
Windows 2000 SP servicing history
https://ift.tt/2EKoHye
Submitted October 25, 2018 at 01:22AM by yuhong
via reddit https://ift.tt/2q9WXJi
https://ift.tt/2EKoHye
Submitted October 25, 2018 at 01:22AM by yuhong
via reddit https://ift.tt/2q9WXJi
Blogspot
Windows 2000 SP servicing history
March 2003: MS03-007 released with only the ntdll.dll file, and there was a problem on Windows 2000 SP2 with certain versions of ntoskrnl.ex...
National Cybersecurity Awareness Month
https://ift.tt/2PTWIgq
Submitted October 25, 2018 at 04:23AM by longevitytech
via reddit https://ift.tt/2PQ2QXe
https://ift.tt/2PTWIgq
Submitted October 25, 2018 at 04:23AM by longevitytech
via reddit https://ift.tt/2PQ2QXe
Longevity Technology
National Cybersecurity Awareness Month
Security compliance is a legal concern for organizations in many industries today. Regulatory standards like PCI DSS, HIPAA, and ISO 27001 prescribe recommendations for protecting data and improving info security management in the enterprise.
HSTS Preload
https://ift.tt/2q63zbw
Submitted October 25, 2018 at 06:03AM by darkhorn
via reddit https://ift.tt/2PfyVuz
https://ift.tt/2q63zbw
Submitted October 25, 2018 at 06:03AM by darkhorn
via reddit https://ift.tt/2PfyVuz
We took 1000 Financial Times FT US 500 & FT Europe 500 companies and performed a large-scale non-intrusive discovery of their external web and mobile applications, SSL certificates, web software and cloud storage. Watch the results of this exhaustive research.
https://ift.tt/2yYv1vL
Submitted October 25, 2018 at 03:44PM by hightechbridge
via reddit https://ift.tt/2PjCIa5
https://ift.tt/2yYv1vL
Submitted October 25, 2018 at 03:44PM by hightechbridge
via reddit https://ift.tt/2PjCIa5
Htbridge
Abandoned Web Applications: Achilles' Heel of FT 500 Companies
Abandoned, shadow and legacy applications undermine cybersecurity and compliance of the largest global companies despite growing security spending.
Playing with the Windows Notification Facility
https://ift.tt/2PTcU1r
Submitted October 25, 2018 at 05:02PM by ranok
via reddit https://ift.tt/2Si9wyM
https://ift.tt/2PTcU1r
Submitted October 25, 2018 at 05:02PM by ranok
via reddit https://ift.tt/2Si9wyM
Weaponizing the Open Graph Protocol for Effective Phishing/Payload delivery
https://ift.tt/2Cycny7
Submitted October 25, 2018 at 08:29PM by dudeimawizard
via reddit https://ift.tt/2D3Q6t8
https://ift.tt/2Cycny7
Submitted October 25, 2018 at 08:29PM by dudeimawizard
via reddit https://ift.tt/2D3Q6t8
ZeroFOX
O Geez - Abusing the Open Graph Protocol | ZeroFOX
Like other technology focused on user experience, we often see attackers leveraging the Open Graph Protocol to support nefarious activities.
Abusing Microsoft Office Online Video
https://ift.tt/2q9pkXJ
Submitted October 25, 2018 at 08:25PM by dorsis
via reddit https://ift.tt/2CELMj2
https://ift.tt/2q9pkXJ
Submitted October 25, 2018 at 08:25PM by dorsis
via reddit https://ift.tt/2CELMj2
Cymulate
Abusing Microsoft Office Online Video
Cymulate’s research team has discovered a way to abuse the Online Video feature on Microsoft Word to execute malicious code. Attackers could use this for malicious purposes such as phishing, as the document will show the embedded online video with a link…
How malicious mobile apps can abuse paired Bluetooth Low Energy peripherals
https://ift.tt/2PZXFUN
Submitted October 26, 2018 at 03:19AM by mmmds
via reddit https://ift.tt/2AsCwgt
https://ift.tt/2PZXFUN
Submitted October 26, 2018 at 03:19AM by mmmds
via reddit https://ift.tt/2AsCwgt
logicaltrust.github.io
[EN] BLE mobile application independent access
Bluetooth Low Energy (BLE) is a wireless standard, widely used to communicate Android and iOS mobile applications with devices of many kinds. These include home security, medical and other which may exchange sensitive data or perform sensitive operations.…
libtiff decodes arbitrarily-sized JBIG into a target buffer - project-zero
https://ift.tt/2Pk1kj5
Submitted October 26, 2018 at 04:11PM by ranok
via reddit https://ift.tt/2OO9YXA
https://ift.tt/2Pk1kj5
Submitted October 26, 2018 at 04:11PM by ranok
via reddit https://ift.tt/2OO9YXA
The Next Chapter: From the Endpoint to the Cloud - QubesOS
https://ift.tt/2z24PAm
Submitted October 26, 2018 at 06:00PM by up-sky-7
via reddit https://ift.tt/2CEa7Wh
https://ift.tt/2z24PAm
Submitted October 26, 2018 at 06:00PM by up-sky-7
via reddit https://ift.tt/2CEa7Wh
Qubes OS
The Next Chapter: From the Endpoint to the Cloud
Earlier this year, I decided to take a sabbatical. I wanted to reflect on my infosec work and decide what I would like to focus on in the coming years. As you probably know, I’ve spent the last nine years mostly fighting the battle to secure the endpoint…
bscan: an extensible service enumeration tool
https://ift.tt/2qd28I9
Submitted October 26, 2018 at 07:26PM by Dr_Rector
via reddit https://ift.tt/2CFBShg
https://ift.tt/2qd28I9
Submitted October 26, 2018 at 07:26PM by Dr_Rector
via reddit https://ift.tt/2CFBShg
GitHub
welchbj/bscan
an asynchronous target enumeration tool. Contribute to welchbj/bscan development by creating an account on GitHub.
Exploitation Training
https://ift.tt/2z3nH21
Submitted October 26, 2018 at 08:31PM by mstfknn
via reddit https://ift.tt/2OMZBTM
https://ift.tt/2z3nH21
Submitted October 26, 2018 at 08:31PM by mstfknn
via reddit https://ift.tt/2OMZBTM
PRISMA CSI
5 - Exploitation • PRISMA CSI
Content of Exploitation, What is an exploit?, Types of exploits, Local remote and 0day exploits, Exploit Databases, Example Exploit Scenarios
Chinese Telecom performing BGP Hijacking
https://ift.tt/2SaenC9
Submitted October 26, 2018 at 08:22PM by alnarra_1
via reddit https://ift.tt/2RjdfLs
https://ift.tt/2SaenC9
Submitted October 26, 2018 at 08:22PM by alnarra_1
via reddit https://ift.tt/2RjdfLs
Signal Desktop Leaves Message Decryption Key in Plain Sight
https://ift.tt/2Sc2Imn
Submitted October 26, 2018 at 11:15PM by cmsimike
via reddit https://ift.tt/2Avjvdl
https://ift.tt/2Sc2Imn
Submitted October 26, 2018 at 11:15PM by cmsimike
via reddit https://ift.tt/2Avjvdl
BleepingComputer
Signal Desktop Leaves Message Decryption Key in Plain Sight
A mistake in the process used by the Signal Desktop application to encrypt locally stored messages leaves them wide open to an attacker.
use nginx auth_request module and Lasso to protect all of your private applications with Google Auth
https://ift.tt/2O73oWU
Submitted October 27, 2018 at 12:50AM by bnfinet
via reddit https://ift.tt/2z51HDT
https://ift.tt/2O73oWU
Submitted October 27, 2018 at 12:50AM by bnfinet
via reddit https://ift.tt/2z51HDT
Medium
Enforce Google Authentication for Any Application with nginx and Lasso
By using the nginx auth_request module and Lasso you can protect any application running behind your nginx reverse proxy with OAuth. Lasso…