Understanding the PE+ File Format
credit :allthingsida
[ 01 ] The Headers
[ 02 ] Imports
[ 03 ] Exports
[ 04 ] Entry Points and TLS Callbacks
———
@islemolecule_source
credit :allthingsida
[ 01 ] The Headers
[ 02 ] Imports
[ 03 ] Exports
[ 04 ] Entry Points and TLS Callbacks
———
@islemolecule_source
👍3🥰3❤1
Forwarded from SoheilSec (Soheil Hashemi)
Year_in_Review_of_ZeroDays.pdf
953.4 KB
A review of zero-day in-the-wild exploits in 2023 [ TAG + Mandiant ]
In 2023, Google observed 97 zero-day vulnerabilities exploited in-the-wild. That’s over 50 percent more than in 2022, but still shy of 2021’s record of 106. Today, Google published its fifth annual review of zero-days exploited in-the-wild, marking the first time Google’s Threat Analysis Group (TAG) and Mandiant teamed up on the report.
https://blog.google/technology/safety-security/a-review-of-zero-day-in-the-wild-exploits-in-2023
In 2023, Google observed 97 zero-day vulnerabilities exploited in-the-wild. That’s over 50 percent more than in 2022, but still shy of 2021’s record of 106. Today, Google published its fifth annual review of zero-days exploited in-the-wild, marking the first time Google’s Threat Analysis Group (TAG) and Mandiant teamed up on the report.
https://blog.google/technology/safety-security/a-review-of-zero-day-in-the-wild-exploits-in-2023
❤4👍3
Windows Defender Killer | C++ Code Disabling Permanently Windows Defender using Registry Keys
https://github.com/S12cybersecurity/WinDefenderKiller
https://github.com/S12cybersecurity/WinDefenderKiller
👍5😁3🤣1
Forwarded from 1N73LL1G3NC3
Malware development: persistence - part 23. LNK files. Simple Powershell example.
Malware development: persistence - part 24. StartupApproved. Simple C example.
Malware and cryptography 22: encrypt/decrypt payload via XTEA. Simple C++ example.
Malware and cryptography 23: encrypt/decrypt file via TEA. Simple C/C++ example.
Malware and cryptography 24: encrypt/decrypt file via Madryga. Simple C/C++ example.
Malware and cryptography 25: encrypt/decrypt payload via RC6. Simple C/C++ example.
Malware development: persistence - part 24. StartupApproved. Simple C example.
Malware and cryptography 22: encrypt/decrypt payload via XTEA. Simple C++ example.
Malware and cryptography 23: encrypt/decrypt file via TEA. Simple C/C++ example.
Malware and cryptography 24: encrypt/decrypt file via Madryga. Simple C/C++ example.
Malware and cryptography 25: encrypt/decrypt payload via RC6. Simple C/C++ example.
cocomelonc
Malware development: persistence - part 23. LNK files. Simple Powershell example.
﷽
👍5🔥4🤔1
👍6🤔1
c2_obf.zip
4.2 MB
A basic concept of obfuscating command and control (C2) servers securely with Redirectors.
👍5🥰3
Go 101
an up-to-date knowledge base for Go programming self learning
https://go101.org/
———
@islemolecule_source
an up-to-date knowledge base for Go programming self learning
https://go101.org/
-= Go (Fundamentals) 101 =-
-= Go Generics 101 =-
-= Go Optimizations 101 =-
-= Go Details & Tips 101 =-
-= Go Quizzes 101 =-
-= Go 101 Apps & Libs =-
-= Go 101 Blog =-
———
@islemolecule_source
👍4
AWE Prep
OffSec EXP-401 Advanced Windows Exploitation (AWE)
credit : talson
https://talson.notion.site/AWE-Prep-c820706e05be43cf9fb434625914c171
OffSec EXP-401 Advanced Windows Exploitation (AWE)
credit : talson
Windows Kernel Exploitation
Ghidra Setup & Tips
Browser Exploitation
Hypervisor Exploitation
https://talson.notion.site/AWE-Prep-c820706e05be43cf9fb434625914c171
❤6👍1💔1
Low-Level x86-64 Architecture, Linking & Loading, Memory Management, etc...
from SANS sec660.4 (Exploiting Linux for Penetration Testers)
credit: Stephen Sims
https://www.youtube.com/watch?v=I37AJebKh2Y
———
@islemolecule_source
from SANS sec660.4 (Exploiting Linux for Penetration Testers)
credit: Stephen Sims
https://www.youtube.com/watch?v=I37AJebKh2Y
———
@islemolecule_source
👍7❤🔥5❤1
Structure-Aware linux kernel Fuzzing with libFuzzer
credit: Meysam
https://r00tkitsmm.github.io/fuzzing/2024/03/27/libffuzzerkernel.html
I decided to experiment with KCOV and see how I can hook it into libfuzzer and boot the kernel without spending too much on building a root file system.
credit: Meysam
https://r00tkitsmm.github.io/fuzzing/2024/03/27/libffuzzerkernel.html
❤🔥5👍2
Forwarded from APT
This media is not supported in your browser
VIEW IN TELEGRAM
A little lifehack if you, like me, come across paid articles from Medium. These sites allow you to read paid Medium articles for free:
🔗 https://freedium.cfd/<URL>
🔗 https://medium-forall.vercel.app/
#medium #premium #bypass
Please open Telegram to view this post
VIEW IN TELEGRAM
👍10
Forwarded from SoheilSec (Soheil Hashemi)
first set of YARA rules to detect the backdoored XZ packages
report:
https://www.openwall.com/lists/oss-security/2024/03/29/4
rules:
https://github.com/Neo23x0/signature-base/blob/master/yara/bkdr_xz_util_cve_2024_3094.yar
report:
https://www.openwall.com/lists/oss-security/2024/03/29/4
rules:
https://github.com/Neo23x0/signature-base/blob/master/yara/bkdr_xz_util_cve_2024_3094.yar
GitHub
signature-base/yara/bkdr_xz_util_cve_2024_3094.yar at master · Neo23x0/signature-base
YARA signature and IOC database for my scanners and tools - Neo23x0/signature-base
👍5
Urgent security alert for Fedora Linux 40 and Fedora Rawhide users
The xz package tar's were backdoored.
https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users
https://twitter.com/badsectorlabs/status/1773759444486177023
The xz package tar's were backdoored.
https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users
https://twitter.com/badsectorlabs/status/1773759444486177023
👍4🤡2
👍4
Media is too big
VIEW IN TELEGRAM
📹 CppCon 2017: James McNellis “Everything You Ever Wanted to Know about DLLs”
👤 CppCon
👤 CppCon
❤6🔥2👍1
Nim_Programming_Lang.rar
739.5 MB
Nim programming which malware developers like that
Nim's cross-compilation features empower attackers to write a single malware variant, which can then be cross-compiled to target different platforms
a good candidate for writing software in a wide variety of application domains, ranging from web applications to kernels
Nim's cross-compilation features empower attackers to write a single malware variant, which can then be cross-compiled to target different platforms
a good candidate for writing software in a wide variety of application domains, ranging from web applications to kernels
👍6
Windows Session Hijacking via CcmExec
https://cloud.google.com/blog/topics/threat-intelligence/windows-session-hijacking-via-ccmexec
https://cloud.google.com/blog/topics/threat-intelligence/windows-session-hijacking-via-ccmexec
👍4
Forwarded from Hattori Hanzo
👍8🤔1🤩1