Smoke Loader Drops Whiffy Recon Wi-fi Scanning And Geolocation Malware
— https://www.secureworks.com/blog/smoke-loader-drops-whiffy-recon-wi-fi-scanning-and-geolocation-malware
— https://www.secureworks.com/blog/smoke-loader-drops-whiffy-recon-wi-fi-scanning-and-geolocation-malware
Secureworks
Smoke Loader Drops Whiffy Recon Wi-Fi Scanning and Geolocation Malware
Learn how threat actors could use the geolocation data to track compromised systems.
FBI-CVE-2023-2868.pdf
1.1 MB
Suspected PRC Cyber ActorsContinue to Globally Exploit Barracuda ESG Zero-Day Vulnerability (CVE-2023-2868)
As a part of the FBI investigation into the exploitation of CVE-2023-2868, a zero-day
vulnerability in Barracuda Network’s Email Security Gateway (ESG) appliances
As a part of the FBI investigation into the exploitation of CVE-2023-2868, a zero-day
vulnerability in Barracuda Network’s Email Security Gateway (ESG) appliances
Top-25-Penetration-Testing-Tools-(2023).pdf
203.3 KB
Penetration Testing Tools List with tool name and denoscriptions
PoC exploit for 0-day Windows Error Reporting Service bug (CVE-2023-36874) releases
https://securityonline.info/poc-exploit-for-0-day-windows-error-reporting-service-bug-cve-2023-36874-releases/
https://securityonline.info/poc-exploit-for-0-day-windows-error-reporting-service-bug-cve-2023-36874-releases/
Cybersecurity News
PoC exploit for 0-day Windows Error Reporting Service bug (CVE-2023-36874) releases
PoC exploit code will be released for a zero-day vulnerability (CVE-2023-36874) allowing privilege escalation in Microsoft Windows.
Splunk EASM Worker
he EASM Worker is a REST API wrapper around open-source recon tools..:
https://github.com/gf13579/splunk_easm_worker
he EASM Worker is a REST API wrapper around open-source recon tools..:
https://github.com/gf13579/splunk_easm_worker
GitHub
GitHub - gf13579/splunk_easm_worker
Contribute to gf13579/splunk_easm_worker development by creating an account on GitHub.
AttackSurfaceMapper
AttackSurfaceMapper (ASM) is a reconnaissance tool that uses a mixture of open source intelligence and active techniques to expand the attack surface of your target..:
🔸 https://github.com/superhedgy/AttackSurfaceMapper
AttackSurfaceMapper (ASM) is a reconnaissance tool that uses a mixture of open source intelligence and active techniques to expand the attack surface of your target..:
Please open Telegram to view this post
VIEW IN TELEGRAM
GitHub
GitHub - superhedgy/AttackSurfaceMapper: AttackSurfaceMapper is a tool that aims to automate the reconnaissance process.
AttackSurfaceMapper is a tool that aims to automate the reconnaissance process. - superhedgy/AttackSurfaceMapper
Damn Exploitable Android App - Abusing Info Leaks to bypass ASLR
— https://www.mobilehackinglab.com/blog/damn-exploitable-android-app-abusing-info-leaks-to-bypass-aslr
— https://www.mobilehackinglab.com/blog/damn-exploitable-android-app-abusing-info-leaks-to-bypass-aslr
Mobilehackinglab
Damn Exploitable Android App - Abusing Info Leaks to bypass ASLR
Dive into our latest blog to learn a clever technique for exploiting format string vulnerabilities to bypass ASLR, revealing key memory addresses and targeting the Damn Exploitable Android App.
10 ways to exploit JWT (JSON Web Token)
https://medium.com/@musab_alharany/10-ways-to-exploit-json-web-token-jwt-ac5f4efbc41b
https://medium.com/@musab_alharany/10-ways-to-exploit-json-web-token-jwt-ac5f4efbc41b
Medium
10 ways to exploit JWT (JSON Web Token):
بسم الله الرحمن الرحيم
Damn Exploitable Android App - Abusing Info Leaks to bypass ASLR
— https://www.mobilehackinglab.com/blog/damn-exploitable-android-app-abusing-info-leaks-to-bypass-aslr
— https://www.mobilehackinglab.com/blog/damn-exploitable-android-app-abusing-info-leaks-to-bypass-aslr
Mobilehackinglab
Damn Exploitable Android App - Abusing Info Leaks to bypass ASLR
Dive into our latest blog to learn a clever technique for exploiting format string vulnerabilities to bypass ASLR, revealing key memory addresses and targeting the Damn Exploitable Android App.
Diving into Starlink's User Terminal Firmware
Deep dive in to firmware:
— https://blog.quarkslab.com/starlink.html
P.S. Den, thx for the link!🤝
Deep dive in to firmware:
— https://blog.quarkslab.com/starlink.html
P.S. Den, thx for the link!
Please open Telegram to view this post
VIEW IN TELEGRAM
Quarkslab
Diving into Starlink's User Terminal Firmware - Quarkslab's blog
This blog post presents an overview of Starlink's User Terminal runtime internals, focusing on the communications that happen within the device and with user applications and some tools that can help further research on the same topic.
Abusing mhyprotect (not mhyprot2) to kill AVs / EDRs / XDRs / Protected Processes
Repo has demo (Crowdstrike Falcon and MsDefender):
— https://github.com/zer0condition/mhydeath
Repo has demo (Crowdstrike Falcon and MsDefender):
— https://github.com/zer0condition/mhydeath
GitHub
GitHub - zer0condition/mhydeath: Abusing mhyprotect to kill AVs / EDRs / XDRs / Protected Processes.
Abusing mhyprotect to kill AVs / EDRs / XDRs / Protected Processes. - zer0condition/mhydeath
BadBazaar espionage tool targets Android users via trojanized Signal and Telegram apps
https://www.welivesecurity.com/en/eset-research/badbazaar-espionage-tool-targets-android-users-trojanized-signal-telegram-apps/
https://www.welivesecurity.com/en/eset-research/badbazaar-espionage-tool-targets-android-users-trojanized-signal-telegram-apps/
Welivesecurity
BadBazaar espionage tool targets Android users via trojanized Signal and Telegram apps
ESET research uncovers active campaigns linked to the China-aligned APT group known as GREF that distributing espionage code previously targeting Uyghurs.
Contain Yourself: Staying Undetected Using the Windows Container Isolation Framework
https://www.deepinstinct.com/blog/contain-yourself-staying-undetected-using-the-windows-container-isolation-framework
https://www.deepinstinct.com/blog/contain-yourself-staying-undetected-using-the-windows-container-isolation-framework
Deep Instinct
Contain Yourself: Staying Undetected Using the Windows Container Isolation Framework | Deep Instinct
This blog is based on a session we presented at DEF CON 2023 on Friday, August 11, 2023, in Las Vegas: Contain Yourself: Staying Undetected Using the Windows Container Isolation Framework.
Mashing Enter To Bypass Full Disk Encryption With Tpm, Clevis, Dracut And Systemd
— https://pulsesecurity.co.nz/advisories/tpm-luks-bypass
— https://pulsesecurity.co.nz/advisories/tpm-luks-bypass
Pulse Security
Mashing Enter to bypass full disk encryption with TPM, Clevis, dracut and systemd
This vulnerability allows a physically-present attacker to control the full disk encryption unlock process and gain complete access to decrypted content in some cases where a TPM, dracut and Clevis are used.
CVE-2023-36874 Windows Error Reporting LPE BOF
This is a mature and operational CobaltStrike BOF implementation of Filip Dragovic's (@filip_dragovic) CVE-2023-36874 Windows Error Reporting LPE exploit.
— https://github.com/Octoberfest7/CVE-2023-36874_BOF
This is a mature and operational CobaltStrike BOF implementation of Filip Dragovic's (@filip_dragovic) CVE-2023-36874 Windows Error Reporting LPE exploit.
— https://github.com/Octoberfest7/CVE-2023-36874_BOF
GitHub
GitHub - Octoberfest7/CVE-2023-36874_BOF: Weaponized CobaltStrike BOF for CVE-2023-36874 Windows Error Reporting LPE
Weaponized CobaltStrike BOF for CVE-2023-36874 Windows Error Reporting LPE - Octoberfest7/CVE-2023-36874_BOF
Forwarded from Sys-Admin InfoSec
bld.sys-adm.in successfully converted to ada.openbld.net 135.125.204.230 will be removed from OpenBLD.net DNS in the coming days, please change the settings on your devices to the current IP addresses.135.125.204.230 ближайшие дни будет выведен из OpenBLD.net DNS пожалуйста измените настройки на своих устройствах, на актуальные IP адреса.Previous notification:
Please open Telegram to view this post
VIEW IN TELEGRAM
Telegram
Sys-Admin InfoSec
📢 OpenBLD.net DNS 🤬 H1 2023 Updates & News
What new we have in OpenBLD.net today:
🔹 New optimized DNS Fronted / Backend engines
🔹 Updated Geo Localized ecosystem
🔹 New integrated centralize Cactusd service
🔹 Optimized works with free video services…
What new we have in OpenBLD.net today:
🔹 New optimized DNS Fronted / Backend engines
🔹 Updated Geo Localized ecosystem
🔹 New integrated centralize Cactusd service
🔹 Optimized works with free video services…