#Threat_Research
1. Analysis of the First Critical Vulnerability of Aptos Move VM
https://medium.com/numen-cyber-labs/analysis-of-the-first-critical-0-day-vulnerability-of-aptos-move-vm-8c1fd6c2b98e
2. OWASSRF - New Exploit Method for Exchange Bypassing ProxyNotShell Mitigations
https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations

#Red_Team_Tactics
1. Process reparenting in MS Windows
https://blog.trailofbits.com/2022/12/20/process-reparenting-microsoft-windows
2. CLI tool/library to enhance and speed up script/exploit writing with string conversion/manipulation
https://github.com/noraj/ctf-party

#tools
#Malware_analysis
1. PortexAnalyzer - free PE parser tailored for malware analysis
https://github.com/struppigel/PortexAnalyzerGUI/releases
2. XLLing in Excel - Evolution of malicious XLLs
https://blog.talosintelligence.com/xlling-in-excel-malicious-add-ins

#exploit
1. CVE-2022-48870:
maccms admin+ xss attacks
https://github.com/Cedric1314/CVE-2022-48870

2. CVE-2022-39253:
Docker host file read
https://github.com/ssst0n3/docker-cve-2022-39253-poc

​​chatgpt_chinese_prompt_hack

Use prompt hack to bypass OpenAI's content policy restrictions by golfzert

https://github.com/golfzert/chatgpt-chinese-prompt-hack

​​hackGPT

OpenAI and #ChatGPT to do hackerish things by NoDataFound

https://github.com/NoDataFound/hackGPT

MONTI RANSOMWARE
http://mblogci3rudehaagbryjznltdp33ojwzkq6hn2pckvjq33rycmzczpid.onion

​​CVE-2022-39253

Docker host file read

https://github.com/ssst0n3/docker-cve-2022-39253-poc

#cve #poc

Puckungfu: A NETGEAR WAN Command Injection
https://ift.tt/8pYDvB4

Submitted December 22, 2022 at 05:02PM by ArbitraryWrite
via reddit https://ift.tt/paMGtRe

​​CVE-2022-48870

maccms admin+ xss attacks

https://github.com/Cedric1314/CVE-2022-48870

#cve

​​CVE-2022-2602

PoC Kernel Privilege Escalation Linux

https://github.com/kiks7/CVE-2022-2602-Kernel-Exploit

#cve

​​Copilot, for your terminal

A CLI tool that generates shell scripts from a human readable description.

https://github.com/m1guelpf/plz-cli

​​SquarePhish

SquarePhish is an advanced phishing tool that uses a technique combining the OAuth Device code authentication flow and QR codes.

https://github.com/secureworks/squarephish

​​plution

Prototype pollution scanner using headless chrome

https://github.com/raverrr/plution

​​CVE-2022-48870

maccms admin+ xss attacks

https://github.com/Cedric1314/CVE-2022-48870

#cve

​​MSI Shenanigans

This repository contains Proof of Concept code and harmless weaponised packages representing various weaponisation strategies that Threat Actors abuse in Windows Installer MSI format.

https://github.com/mgeeky/msi-shenanigans

MSI Shenanigans. Part 1 – Offensive Capabilities Overview:
https://mgeeky.tech/msi-shenanigans-part-1/

​​CVE-2022-2602

PoC Kernel Privilege Escalation Linux

https://github.com/kiks7/CVE-2022-2602-Kernel-Exploit

#cve

​​Golden Nuggets

Burp Suite Extension to easily create Wordlists based off URI, URI Parameters and Single Words (Minus the Domain)

https://github.com/GainSec/GoldenNuggets-1

​​ctf-party

A CLI tool & library to enhance and speed up script/exploit writing for CTF players (or security researchers, bug bounty hunters, pentesters but mostly focused on CTF) by patching the String class to add a short syntax of usual code patterns. The philosophy is also to keep the library to be pure ruby (no dependencies) and not to re-implement what another library is already doing well (eg. xorcist for xor).

https://github.com/noraj/ctf-party