#Fuzzing
Fuzztruction - prototype of a fuzzer that does not directly mutate inputs but instead uses a so-called generator application to produce an input for our fuzzing target
https://github.com/fuzztruction/fuzztruction#preparing-the-runtime-environment-docker-image

#exploit
1. CVE-2022-31705:
Geekpwn 2022 Vmware EHCI OOB
https://github.com/s0duku/cve-2022-31705

2. Linux >=4.10: UAF in __do_semtimedop() due to lockless check outside RCU section
https://bugs.chromium.org/p/project-zero/issues/detail?id=2391

3. Lexmark Printers/Copiers haxx 0-day Exploit
https://github.com/blasty/lexmark

#Research
"BlockScope: Detecting and Investigating Propagated Vulnerabilities in Forked Blockchain Projects", 2022.
]-> https://github.com/VPRLab/BS_VulnReport

#Offensive_security
1. Microsoft LAPS(E) in Judgement
https://www.trustedsec.com/blog/a-lapse-in-judgement
2. NonHeavyFTP:
A FTP Server pwn chanllenge
https://f0cus77.github.io/RWCTF-2023-NonHeavyFTP-writeup

#tools
#Malware_analysis
SEMA - ToolChain using Symbolic Execution for Malware Analysis
https://github.com/csvl/SEMA-ToolChain

#Threat_Research
1. RCE bug in JWT Secret Poisoning (CVE-2022-23529)
https://unit42.paloaltonetworks.com/jsonwebtoken-vulnerability-cve-2022-23529
2. Bring-Your-Own-Vulnerable-Driver Tactic in Attempt to Bypass Endpoint Security
https://www.crowdstrike.com/blog/scattered-spider-attempts-to-avoid-detection-with-bring-your-own-vulnerable-driver-tactic
3. Navigating the Vast Ocean of Sandbox Evasions
https://unit42.paloaltonetworks.com/sandbox-evasion-memory-detection

Exploit for CVE-2022-20452
privilege escalation on Android from installed app to system app (or another app)
downLoad

#android #exploit

SpyDialer

Free search contact information by phone number, name, address or email.

Even shows the names of the neighbors, but the information displayed by the service requires additional verification.

https://spydialer.com

#osint #humint #usa

When searching for geolocation information, don't forget to check the whois. At https://iqwhois.com/advanced-search STREET name you can find all the sites registered to people who live there.

It's possible also search by city and zip code.

#osint #geoint

A new feature in*huntintel.io:

1. Open Instagram Username Search Tool
2. Enter the name of the account.
3. Wait (if you think you are waiting too long, refresh the page)
4. See the geotagged user's posts on the world map!

1 month/1 check a day free (code CYBER100)

Secret Handshake

A prototype malware C2 channel using x509 certificates over mTLS

I always wondered if threat actors ever used x509 certificates as part of their C2 communication, not to encrypt the network traffic but to actually embed the C2 communication in the x509 cert. After searching for something like this in the wild for 5 years I finally decided to just code it myself to see if it's possible...it is

https://github.com/jconwell/secret_handshake

#malware

CVE-2022-31705
POC
Geekpwn 2022 Vmware EHCI OOB
download

Exfiltration Over a Blocked Port on a Next-Gen Firewall
https://ift.tt/fUmqaGz

Submitted January 12, 2023 at 02:37PM by cuptugout
via reddit https://ift.tt/OtUCM2b

#Offensive_security
1. SMB "Access is denied" caused by anti-NTLM relay protection
https://medium.com/tenable-techblog/smb-access-is-denied-caused-by-anti-ntlm-relay-protection-659c60089895
2. Implementation of Persistence via Recycle Bin by adding "open\command" subkey to the "HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell" key and changing its value to the implant path
https://github.com/D1rkMtr/RecyclePersist
3. Vulnerabilities on redirected•com
https://dhakalbibek.medium.com/2022-a-year-of-fascinating-discoveries-d3277dfb006f