#Malware_analysis
1. Earth Preta Spear-Phishing
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
2. Luna Moth Callback Phishing Campaign
https://unit42.paloaltonetworks.com/luna-moth-callback-phishing
3. Finding malicious PyPI packages through static code analysis
https://securitylabs.datadoghq.com/articles/guarddog-identify-malicious-pypi-packages
]-> CLI tool: https://github.com/DataDog/guarddog
1. Earth Preta Spear-Phishing
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
2. Luna Moth Callback Phishing Campaign
https://unit42.paloaltonetworks.com/luna-moth-callback-phishing
3. Finding malicious PyPI packages through static code analysis
https://securitylabs.datadoghq.com/articles/guarddog-identify-malicious-pypi-packages
]-> CLI tool: https://github.com/DataDog/guarddog
Trend Micro
Earth Preta Spear-Phishing Governments Worldwide
#tools
#Offensive_security
1. Another approach to thread stack spoofing
https://github.com/Kudaes/Unwinder
2. Dumping DPAPI credz remotely
https://github.com/login-securite/DonPAPI
3. Reverse Shell Generator
https://www.revshells.com
#Offensive_security
1. Another approach to thread stack spoofing
https://github.com/Kudaes/Unwinder
2. Dumping DPAPI credz remotely
https://github.com/login-securite/DonPAPI
3. Reverse Shell Generator
https://www.revshells.com
GitHub
GitHub - Kudaes/Unwinder: Call stack spoofing for Rust
Call stack spoofing for Rust. Contribute to Kudaes/Unwinder development by creating an account on GitHub.
#exploit
1. CVE-2022-26696:
macOS Sandbox Escape vulnerability via Terminal
https://wojciechregula.blog/post/macos-sandbox-escape-via-terminal
2. CVE-2022-33917:
Arm Mali CSF: page freed while still mapped into host userspace due to VMA split mishandling
]-> https://googleprojectzero.blogspot.com/2022/11/mind-the-gap.html
1. CVE-2022-26696:
macOS Sandbox Escape vulnerability via Terminal
https://wojciechregula.blog/post/macos-sandbox-escape-via-terminal
2. CVE-2022-33917:
Arm Mali CSF: page freed while still mapped into host userspace due to VMA split mishandling
]-> https://googleprojectzero.blogspot.com/2022/11/mind-the-gap.html
wojciechregula.blog
macOS Sandbox Escape vulnerability via Terminal
Introduction In 2020 I observed a strange behavior a sandboxed macOS app may launch any application that won’t inherit the main app’s sandbox profile. It was even funnier as the sandboxed app can spawn those new apps with environment variables. I of course…
#Malware_analysis
1. ViperSoftX: Hiding in System Logs and Spreading VenomSoftX
https://decoded.avast.io/janrubin/vipersoftx-hiding-in-system-logs-and-spreading-venomsoftx
2. DUCKTAIL: An infostealer malware targeting Facebook Business accounts (.pdf)
https://ift.tt/yrkLdsi
3. Aurora: a rising stealer flying under the radar
https://blog.sekoia.io/aurora-a-rising-stealer-flying-under-the-radar
1. ViperSoftX: Hiding in System Logs and Spreading VenomSoftX
https://decoded.avast.io/janrubin/vipersoftx-hiding-in-system-logs-and-spreading-venomsoftx
2. DUCKTAIL: An infostealer malware targeting Facebook Business accounts (.pdf)
https://ift.tt/yrkLdsi
3. Aurora: a rising stealer flying under the radar
https://blog.sekoia.io/aurora-a-rising-stealer-flying-under-the-radar
Gendigital
ViperSoftX: Hiding in System Logs and Spreading VenomSoftX
Unveiling the Stealth Tactics of ViperSoftX Malware
#tools #Fuzzing #Red_Team_Tactics
1. REcollapse - tool for black-box regex fuzzing to bypass validations and discover normalizations in web applications
https://github.com/0xacb/recollapse
2. Lateral Movement With Havoc C2 and Microsoft EDR
https://assume-breach.medium.com/home-grown-red-team-lateral-movement-with-havoc-c2-and-microsoft-edr-300b7389b1f7
1. REcollapse - tool for black-box regex fuzzing to bypass validations and discover normalizations in web applications
https://github.com/0xacb/recollapse
2. Lateral Movement With Havoc C2 and Microsoft EDR
https://assume-breach.medium.com/home-grown-red-team-lateral-movement-with-havoc-c2-and-microsoft-edr-300b7389b1f7
GitHub
GitHub - 0xacb/recollapse: REcollapse is a helper tool for black-box regex fuzzing to bypass validations and discover normalizations…
REcollapse is a helper tool for black-box regex fuzzing to bypass validations and discover normalizations in web applications - 0xacb/recollapse
antimalware_scan_interface_bypasses_det.pdf
721.4 KB
#Red_Team_Tactics
"Antimalware Scan Interface Bypasses: Evading Detection to Perform Post Exploitation Activities", 2022.
"Antimalware Scan Interface Bypasses: Evading Detection to Perform Post Exploitation Activities", 2022.
FReD.pdf
288.3 KB
#Research
#Sec_code_review
"FRED: Identifying File Re-Delegation in Android System Services", 2022.
]-> Tool: https://github.com/wspr-ncsu/fred
#Sec_code_review
"FRED: Identifying File Re-Delegation in Android System Services", 2022.
]-> Tool: https://github.com/wspr-ncsu/fred
CVE-2020-1493.pdf
75.9 KB
#Whitepaper
1. MS Outlook 2019 16.0.13231 - RCE (CVE-2020-16947);
2. MS Outlook 2019 16.0.12624 - Out-Of-Bounds Read (CVE-2020-1493);
3. MS Outlook 2019 16.0.12624 - RCE (CVE-2020-1349).
1. MS Outlook 2019 16.0.13231 - RCE (CVE-2020-16947);
2. MS Outlook 2019 16.0.12624 - Out-Of-Bounds Read (CVE-2020-1493);
3. MS Outlook 2019 16.0.12624 - RCE (CVE-2020-1349).
WebView_sec.pdf
740.3 KB
#Threat_Research
"Identity Confusion in WebView-based Mobile App-in-app Ecosystems", 2022.
"Identity Confusion in WebView-based Mobile App-in-app Ecosystems", 2022.
RTFM_v2.epub
247.4 KB
#Tech_book
"Red Team Field Manual, Version 2.0", 2022.
"Red Team Field Manual, Version 2.0", 2022.
#tools
#Offensive_security
1. OFRAK (Open Firmware Reverse Analysis Konsole) - binary analysis and modification platform
https://github.com/redballoonsecurity/ofrak#getting-started
2. Wireguard-initramfs - dropbear over wireguard
https://github.com/r-pufky/wireguard-initramfs
3. A Python rewriting of PowerSploit's PowerView
https://github.com/the-useless-one/pywerview
#Offensive_security
1. OFRAK (Open Firmware Reverse Analysis Konsole) - binary analysis and modification platform
https://github.com/redballoonsecurity/ofrak#getting-started
2. Wireguard-initramfs - dropbear over wireguard
https://github.com/r-pufky/wireguard-initramfs
3. A Python rewriting of PowerSploit's PowerView
https://github.com/the-useless-one/pywerview