Finding Metasploit & Cobalt Strike URLs

Metasploit and Cobalt Strike generate shellcode for http(s) shells. The URLs found in this shellcode have a path that consist of 4 random alphanumeric characters. But they are not completely random: their 8-bit checksum is a member of a small set of constants.

https://isc.sans.edu/diary/Finding+Metasploit+Cobalt+Strike+URLs/27204

#Cobalt_Strike , #Metasploit ,

Cover various security approaches to attack techniques and also provides new discoveries about security breaches.

https://github.com/LearningKijo/SecurityResearcher-Note

#Malware_analysis

#Malware_analysis

GULOADER: deobfuscating the downloader
https://www.elastic.co/security-labs/getting-gooey-with-guloader-downloader


Rhadamanthys v0.5.0 - a deep dive into the stealer’s components
https://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components

2023 march version "Reverse Engineering for Beginners" is the subnoscript

#reverse

How to Make Your Own Keylogger in C++ Programming Language

Offensive Tool Development - The Shellcode Compiler Was Right There All Along

Part 1 :
https://sh3llsp4wn.github.io/Shellcode-With-The-Default-Linux-Toolchain/

Part 2 :
https://sh3llsp4wn.github.io/Shellcode-With-The-Default-Linux-Toolchain-2/

Reverse Engineering for Beginners

Dennis Yurichev

Understanding Assembly Language

Dennis Yurichev

thanks X-L-R-8 for sharing this two books

Rebase the program when we load it to ida

https://malware.news/t/igor-s-tip-of-the-week-168-rebasing/76756

#reverse

How do we write a shellcode to elevate privileges and gracefully return to userland?

mdanilor.github.io/posts/hev…


#shellcode , #privilege_scalation

Windows Functions in Malware Analysis – Cheat Sheet

https://gist.github.com/404NetworkError/a81591849f5b6b5fe09f517efc189c1d#internetwritefile-top

#malware_analysis
#malware_dev

Malware Analysis Resources
(Anything that you want)

https://ryandinho.me/2022/01/27/malware-analysis-resources.html

#malware_analysis

Win32 programming tutorial

https://www.tenouk.com/cnwin32tutorials.html

#win_api

Write Spyware in C/C++

https://0x00sec.org/t/writing-my-first-spyware-for-learning-c-c/32521

https://github.com/ravijotsingh58/polynomial-spylog.git

#malware_dev

Bypassing Windows Defender

0xstarlight.github.io/posts/…

#windows , #Windows_Defender , #AV ,

A set of fully-undetectable process injection techniques abusing Windows Thread Pools

https://github.com/SafeBreach-Labs/PoolParty

#process_injection , #tools