Adventures in Shellcode Obfuscation! Part 3: Encryption
#redsiege

By Mike Saunders, Principal Security Consultant   This blog is the third in a series of blogs on obfuscation techniques for hiding shellcode. You can find the rest of the […]

via RedSiege Blog (author: Red Siege)

Adventures in Shellcode Obfuscation! Part 4: RC4 with a Twist
#redsiege

by Mike Saunders, Principal Security Consultant This blog is the fourth in a series of blogs on obfuscation techniques for hiding shellcode. You can find the rest of the series […]

via RedSiege Blog (author: Red Siege)

Europol Coordinates Global Action Against Criminal Abuse of Cobalt Strike
#cobaltstrike

Press Release: View Original Europol Announcement 03 Jul 2024 – Law enforcement has teamed up with the private sector to fight against the abuse of a legitimate security tool by criminals who were using it to infiltrate victims’ IT systems. Older, unlicensed versions of the Cobalt Strike red teaming tool were targeted during a week [...]

via Cobalt Strike Blog

From linen to silk – Using Microsoft Service Fabric to elevate privileges
#netspi

The NetSPI Agents discovered a local privilege escalation path in Microsoft Service Fabric Runtime. Learn how the vulnerability was discovered and exploited.

via NetSPI Technical Blog (author: James Williams)

Prototype Pollution: A Deep-Dive
#netspi

Learn about Prototype Pollution – what it is, why it exists, and real examples of how it can be exploited.

via NetSPI Technical Blog (author: Rob Jepson)

Fickle PDFs: exploiting browser rendering discrepancies
#portswigger

Imagine the CEO of a random company receives an email containing a PDF invoice file. In Safari and MacOS Preview, the total price displayed is £399. After approval, the invoice is sent to the accounti

via PortSwigger Research

HackingDave’s Rule of Five
#trustedsec

Buckle up! This is a different type of blog that isn’t our normally scheduled technical prowess or superhuman talents we have here at TrustedSec. Each month, I have the privilege of hosting a meeting with new employees…

via TrustedSec Blog (author: David Kennedy)

Drink Like a Phish
#specterops

via SpecterOps Team Medium (author: Forrest Kasler)

GitHub Actions exploitation: repo jacking and environment manipulation
#synacktiv

via Synacktiv Blog (author: Hugo Vincent)

dirDevil: Hiding Code and Content Within Folder Structures
#trustedsec

&LTp>Welcome back to another round of "Hiding in Plain Sight," exploring weird places to stash data or payloads. In our last edition, we explored an easy method of encoding a payload into RGB values of a PNG file and hosting…&LT/p>

via TrustedSec Blog (author: @ nyxgeek)

This Meeting Should Have Been an Email
#objectivesee

A DPRK stealer, dubbed BeaverTail, targets users via a trojanized meeting app. Let's analyze it comprehensively.

via Objective-See Blog

Mythic 3.3 Beta: Rise of the Events
#specterops

via SpecterOps Team Medium (author: Cody Thomas)

Technical Analysis: Killer Ultra Malware Targeting EDR Products in Ransomware Attacks
#trustedsec

&LTp>This post was written by John Dwyer, Director of Security Research at Binary Defense, and made possible through the contributions of TrustedSec Senior Research Analyst Kevin Haubris and Eric Gonzalez of Binary…&LT/p>

via TrustedSec Blog (author: John Dwyer)

Phish Out of Water
#specterops

via SpecterOps Team Medium (author: Forrest Kasler)

Cobalt Strike 4.10: Through the BeaconGate
#cobaltstrike

Cobalt Strike 4.10 is now available. This release introduces BeaconGate, the Postex Kit, and Sleepmask-VS. In addition, we have overhauled the Sleepmask API, refreshed the Jobs UI, added new BOF APIs, added support for hot swapping C2 hosts, and more. This has been a longer release cycle than in previous releases to allow us to [...]

via Cobalt Strike Blog (author: William Burgess)

GitHub Actions exploitation: self hosted runners
#synacktiv

via Synacktiv Blog (author: Hugo Vincent)

The Security Principle Every Attacker Needs to Follow
#specterops

via SpecterOps Team Medium (author: Elad Shamir)

What is Your Compliance Kryptonite?
#trustedsec

Have you ever felt frustrated about security compliance? Well, you're not alone. We've all got some kind of 'Kryptonite' when it comes to Compliance. I asked some of our InfoSec auditors to share their Kryptonite. Their…

via TrustedSec Blog (author: Steve Maxwell)

Advenutures in Shellcode Obfuscation! Part 5: Base64
#redsiege

by Mike Saunders, Principal Consultant This blog is the fifth in a series of blogs on obfuscation techniques for hiding shellcode. You can find the rest of the series here. […]

via RedSiege Blog (author: Red Siege)

Shellcode: Modular Exponentiation for Diffie-Hellman Key Exchange.
#odzhan

Table Of Contents Introduction Symmetric vs Asymmetric Encryption with RSA Digital Signatures with RSA History Diffie-Hellman Key Exchange Crypto API Binary Exponentiation Methods Arbitrary-precision Arithmetic Addition Subtraction Multiplication Division Exponentiation Modular Multiplicative Inverse Modular Addition Modular Multiplication Modular Exponentiation Counting …

via modexp Blog (author: odzhan)

The Security Principle Every Attacker Needs to Follow
#specterops

via SpecterOps Team Medium (author: Elad Shamir)