exploit.org
5.38K subscribers
27 photos
1 video
27 links
FinTech & Cybersecurity.
contact@exploit.org
Download Telegram
Beyond the Code: Art of AppSec in Java: Part 1

Master your knowledge of application security, follow best practices and become stronger with us.

https://blog.exploit.org/java-appsec/
โค3๐Ÿ”ฅ3โšก1
NetArmor v1.1 released

+ Fixed ClientHello packet detection in TLS Fingerprinting

+ Advanced HTTP/2 Fingerprinting according to Akamai's White Paper

+ JDK 11 and upper support

+ ALPN support in Reactor Netty Provider

Github
โค5๐Ÿ”ฅ5๐Ÿ‘2โšก1
Beyond the Code: Exposing in Disguise

In this article we will review the usage of such techniques as TLS (JA3) Fingerprinting, HTTP/2 Fingerprinting in a use case of malicious client detection.

https://blog.exploit.org/exposing-in-disguise/
๐Ÿ‘7๐Ÿ”ฅ3โšก2โค1
New version of Above v2.5 sniffer

+ The tool now handles all frames and packets in the air
+ New 5 protocols support: EAPOL, ARP, IGMP, DHCP, ICMPv6
+ New visual output of packets
+ Completely rewritten and simplified code, removed threads, removed dependency on pcap_analyzer
+ Fixed code for some protocols for error handling

https://github.com/casterbyte/Above/releases/tag/v2.5
๐Ÿ‘6โค2๐Ÿ”ฅ2โšก1
Pivoting against Windows is a fairly complex post-exploitation process. In this article I will demonstrate my new method of link layer pivoting using SoftEther and without a virtual machine

Caster โ€” Witchhammer

https://blog.exploit.org/witchhammer
๐Ÿ”ฅ8โšก1
Everything Lit: Ways to achieve UEFI persistence.

Just one view of "extreme" techniques. Imagination and knowledge is all you need!

https://blog.exploit.org/everything-lit/
๐Ÿ‘8๐Ÿ”ฅ2โšก1
This media is not supported in the widget
VIEW IN TELEGRAM
โคโ€๐Ÿ”ฅ46๐Ÿ’ฉ9๐Ÿ‘6โค4๐Ÿคก4
Hi to all of those with superior taste and knowledge of true mastery.
Today we are giving away 10 Telegram Premiums amongst our subscribers.

Enjoy and hope the stakes play in your favour, while we do our job ๐Ÿ˜‰
Please open Telegram to view this post
VIEW IN TELEGRAM
๐Ÿ”ฅ32๐Ÿ‘10โค5๐Ÿณ4๐Ÿคฎ3
Alert for iOS users
Trust Wallet has just alerted about zero-day exploit in iMessage.

To disable iMessage go to Settings > Messages and toggle iMessage button.

The days are getting harder and harder ๐Ÿคท
๐Ÿ˜23๐Ÿ”ฅ3๐Ÿ˜ฑ2๐Ÿ’ฉ2โšก1
โš ๏ธPuTTY CVE-2024-31497 โš ๏ธ

๐Ÿ“ฐBrief: attacker can gain access to private key with public key and some signed messages on hand via forged identification signature of legitimate user. Signed messages may be publicly visible due to storage in public Git.

๐ŸšฉPossibilities: login into any servers key was used in, supply chain attacks software maintained git, etc.

๐Ÿ“—Affected versions: 0.80 and prior.

๐Ÿ“šFull description: https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-p521-bias.html
๐Ÿ˜ฑ17๐Ÿ‘11๐Ÿ”ฅ3๐Ÿ˜2๐Ÿ˜ˆ2
MikroTik equipment is widely distributed all over the world and its security is an acute issue. In this paper, Caster covered many aspects related to the network security of MikroTik equipment.

Caster - Lockdown

https://blog.exploit.org/caster-routeros-lockdown
โค15๐Ÿ”ฅ7๐Ÿ‘4๐ŸŒš4โšก1
Cisco equipment is widespread in production networks. In this article, Caster will demonstrate methods to protect Cisco IOS from network attacks.

Caster - Disciple

https://blog.exploit.org/caster-disciple
โค16โšก3๐Ÿ”ฅ3๐Ÿคฎ2
Poisoning attacks against Windows machines have become well known among pentesters. In this article, Caster will demonstrate how to detect poisoning attacks using Suricata.

Caster - Neurotransmitter

https://blog.exploit.org/caster-neurotransmitter
๐Ÿ”ฅ8โค5โšก2๐Ÿ™1๐Ÿ‘Œ1
Kerberos, while more secure than NTLM, also has some security nuances. In this article, researcher Caster will demonstrate techniques for detecting Kerberos attacks using Suricata.

Caster - Kerbhammer

https://blog.exploit.org/caster-kerbhammer
โค7๐Ÿ‘5๐Ÿ”ฅ4โšก1
UPDATE: Telegram has fixed this bug.

๐Ÿ™‚ Telegram started banning bots that send messages, where service number "t.me/+42777" is included in its content as a link.
Some of popular bots (like @fabrika) got already banned.

If you own a bot, turn off sending messages whose content depends on user input (e.g. greeting with user's firstname, etc.).

P.S Telegram started slowly rollbacking the bans.
Please open Telegram to view this post
VIEW IN TELEGRAM
๐Ÿ’ฉ15๐Ÿ‘6๐Ÿ˜2๐Ÿ•Š2โšก1
Tomorrow
โค12๐Ÿ”ฅ7๐Ÿ’ฉ4๐Ÿ‘Œ4๐Ÿ–•3
Active Directory is used in many networks and is often the target of attacks. In this article, Caster will demonstrate the capabilities of Suricata signatures to detect attacks against Active Directory.

Caster - If You Hadn't

https://blog.exploit.org/caster-ifyouhadnt
โค7๐Ÿ”ฅ3โšก1
I think network traffic analysis in pentest scenarios is vastly underrated. In this article, I will demonstrate a technique to silently analyze the security of network equipment based on traffic analysis alone.

Caster - Funeral

https://blog.exploit.org/caster-funeral
โค10๐Ÿ”ฅ6๐Ÿ‘5โœ2โšก1
๐Ÿš€ OWASP Netryx Release ๐Ÿš€
https://github.com/OWASP/www-project-netryx

We have our official release of Netryx under OWASP Foundation - advanced Java security framework designed to protect your data and save you from cyber attacks. Here are the key features:

JA3, JA4+, and HTTP/2 Fingerprinting:
identification of users based on TLS and HTTP connection establishment, which helps to avoid bots and bad actors.

Intrusion Detection System (IDS):
Collect and analyze data to detect and block malicious activities.

HTTP/2 0day Protection:
Block attacks exploiting vulnerabilities in the HTTP/2 protocol, preventing you from RST Stream vulnerability

Path Traversal Protection:
Prevent unauthorized access to files outside the web root directory, ensuring your data remains secure.

Protection Against Various Injection Attacks:
HTML, JS, LDAP, and CMD encoders ensuring safety against different types of injection attacks.

Secure Memory Management:
Ensure sensitive information like keys and tokens are safely handled in memory, protecting from Data in Use attacks.

And much more! All these features are implemented in Java, making OWASP Netryx a big addition to your security toolkit.

Don't forget to star the repository ๐Ÿ˜‰

#OWASP #Netryx #CyberSecurity #Java #WebSecurity
Please open Telegram to view this post
VIEW IN TELEGRAM
๐Ÿ”ฅ14๐Ÿ‘9โค6๐Ÿค”2โšก1