CRLFuzz - A Fast Tool To Scan CRLF Vulnerability Written In Go https://t.co/JkG1BAJ7Zf
— Nicolas Krassas (@Dinosn) September 20, 2020

Maze: ransomware que usa máquinas virtuales
https://blog.segu-info.com.ar/2020/09/maze-ransomware-que-usa-maquinas.html

❗️ Revelan por qué no hay que usar un cargador ajeno de iPhone

🔸 La costumbre de pedir prestado un cargador de móvil puede traer consecuencias no deseadas a los usuarios de iPhones. Un artículo advierte de que el simple acto de conectar el celular a un cable de carga de otras personas, o usar el que se puede conseguir en un hotel o aeropuerto, representa una amenaza real para la seguridad de los datos personales que almacena el dispositivo.

SEPA MÁS - https://es.rt.com/7vi9

Herramienta OSINT para probar errores tipográficos en dominios y evitar ataques de phishing

http://feedproxy.google.com/~r/GuruDeLaInformtica/~3/uT-8huGOTBE/herramienta-osint-para-probar-errores-tipograficos-en-dominios-y-evitar-ataques-de-phishing

A new ransomware hacking group, named "OldGremlin," is aggressively targeting large corporate networks of medical labs, banks, manufacturers, and software developers in Russia.

https://thehackernews.com/2020/09/russian-ransomware-hack.html

📃 "¿Qué es el Typosquatting?" https://derechodelared.com/que-es-el-typosquatting/

National Vulnerability Database
CVE-2020-5783

In IgniteNet HeliOS GLinq v2.2.1 r2961, the login functionality does not contain any CSRF protection mechanisms.

National Vulnerability Database
CVE-2020-4727

IBM InfoSphere Information Server 11.7 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.

>>) Free web penetration testing course‌‌

From basic to intermediate
(106 videos)

https://mega.nz/folder/EzgQXaQQ

Kamerka: una herramienta de reconocimiento para dispositivos IoT e infraestructuras críticas | WeLiveSecurity
https://www.welivesecurity.com/la-es/2020/09/21/kamerka-herramienta-reconocimiento-dispositivos-iot-infraestructuras-criticas/

Kerberos attacks cheatsheet
https://gist.github.com/TarlogicSecurity/2f221924fef8c14a1d8e29f3cb5c5c4a
+ Active Directory Attacks
https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Active%20Directory%20Attack.md

Dropbox Escalation of Privileges to SYSTEM on Windows

https://dreamlab.net/en/blog/post/dropbox-escalation-of-privileges-to-system-on-windows/

CVE-2020-0968:
IE 9, 11 - Scripting Engine Memory Corruption Vulnerability/Operation Domino (PoC)
https://ti.dbappsecurity.com.cn/blog/index.php/2020/09/18/cve-2020-0968/
Attack overview:
https://ti.dbappsecurity.com.cn/blog/index.php/2020/09/18/operation-domino/

Alien: el nuevo malware bancario para Android

https://unaaldia.hispasec.com/2020/09/alien-el-nuevo-malware-bancario-para-android.html

National Vulnerability Database
CVE-2020-4607

IBM Security Secret Server (IBM Security Verify Privilege Vault Remote 1.2 ) could allow a local user to bypass security restrictions due to improper input validation. IBM X-Force ID: 184884.

Obtener conversaciones de Whatsapp desde la nube
https://blog.segu-info.com.ar/2020/09/obtener-conversaciones-de-whatsapp.html

Threat Research:
Taking down the SSO, Account Takeover in the Websites
of Kolesa due to Insecure JSONP Call (PoC)
https://medium.com/bugbountywriteup/taking-down-the-sso-account-takeover-in-3-websites-of-kolesa-due-to-insecure-jsonp-call-facd79732e45

National Vulnerability Database
CVE-2020-9491

In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by processors like ListenHTTP, HandleHttpRequest, etc. However intracluster communication such as cluster request replication, Site-to-Site, and load balanced queues continued to support TLS v1.0 or v1.1.

Pentesting Mobile 101: Controlando de manera remota un Dispositivo Android con Scrcpy

http://feedproxy.google.com/~r/snifer/~3/B5gK-mc0sT4/srcpy-screen-mirroring-android-sin-root.html

Fortinet's Fortigate VPN solution running default settings leave over 200,000 businesses vulnerable to man-in-the-middle (MitM) attacks.

Learn how: https://thehackernews.com/2020/09/fortigate-vpn-security.html