OSIN links from MISP

Includes a set of public OSINT feeds:

https://www.misp-project.org/feeds/

Excessive Expansion: Uncovering Critical Security Vulnerabilities in Jenkins

https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/

/ ExecIT - DLL Shellcode self-inyector/runner based on HWSyscalls, ideally thought to be executed with rundll32. May grant fileless execution if victim endpoint has access to attacker-controlled SMB share:

https://github.com/florylsk/ExecIT

SOC Analyst Interview Questions

https://letsdefend.io/blog/soc-analyst-interview-questions/

net/ipv6: Revert remove expired routes with a separated list of routes

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dade3f6a1e4e35a5ae916d5e78b3229ec34c78ec

Ref: https://nvd.nist.gov/vuln/detail/CVE-2023-6200

FACTION - Pen Test Report Generation and Assessment Collaboration

https://github.com/factionsecurity/faction

/ Linux Kernel Exploitation: Getting started & BOF

https://santaclz.github.io/2023/11/03/Linux-Kernel-Exploitation-Getting-started-and-BOF.html

/ runc: CVE-2024-21626: high severity container breakout attack

https://www.openwall.com/lists/oss-security/2024/01/31/6

RedTeam-Checker

automated tool designed to monitor the persistence of backdoors and default settings on compromised machines over time:

https://github.com/Drakiat/RedTeam-Checker

Buying Spying - Google report about of commercial spyware

https://storage.googleapis.com/gweb-uniblog-publish-prod/documents/Buying_Spying_-_Insights_into_Commercial_Surveillance_Vendors.pdf

Method for Decrypting Data Infected with Rhysida Ransomware

https://arxiv.org/pdf/2402.06440.pdf

/ Nodejs - Code injection and privilege escalation through Linux capabilities (CVE-2024-21892) - (High)

and another 7 fixes for vulnerabilities released for node:

https://nodejs.org/en/blog/vulnerability/february-2024-security-releases

/ CVE-2024-21413 - Expect Script POC

Microsoft Outlook Leak credentials & Remote Code Execution Vulnerability when chained with CVE-2023-21716 (through the preview panel) CVSS:3.1 9.8 / 8.5:

https://github.com/duy-31/CVE-2024-21413

/ Exploring AMD Platform Secure Boot

..dig deeper into the nitty gritty details of PSB, including a first glimpse of how it works under the hood, how it should be configured and, naturally, how various major vendors fail to do so.

https://labs.ioactive.com/2024/02/exploring-amd-platform-secure-boot.html

CrimsonEDR - EDR Attack Sumulator

CrimsonEDR is an open-source project engineered to identify specific malware patterns, offering a tool for honing skills in circumventing Endpoint Detection and Response (EDR). By leveraging diverse detection methods, it empowers users to deepen their understanding of security evasion tactics:

https://github.com/Helixo32/CrimsonEDR/tree/main

/ Python Risk Identification Tool for generative AI (PyRIT)

The Python Risk Identification Tool for generative AI (PyRIT) is an open access automation framework to empower security professionals and ML engineers to red team foundation models and their applications.

https://github.com/Azure/PyRIT

/ A Catastrophe For Control: Understanding the ScreenConnect Authentication Bypass (CVE-2024-1709 & CVE-2024-1708)

https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

Details on Apple’s Shortcuts Vulnerability: A Deep Dive into CVE-2024-23204

https://www.bitdefender.com/blog/labs/details-on-apples-shortcuts-vulnerability-a-deep-dive-into-cve-2024-23204/

/ OpenBLD.net PDP Beta Program Announce

Personal DoH Profiling (PDP), a new service that provides:

- Complete isolation of your DNS requests, ensuring that no one can track your online activity.
- Personalized DNS settings, so you can block ads, malicious websites, and other unwanted content.
- Robust security with DNSSEC, TLSv1.2, and TLSv1.3.
- Self Allow/Block lists controls and more...

Details: https://news.1rj.ru/str/openbld/56