MmMapIoSpace Returns NULL: Tracing the Real Kernel Mechanism Through ntoskrnl
https://www.reddit.com/r/redteamsec/comments/1vyt58m/mmmapiospace_returns_null_tracing_the_real_kernel/
submitted by /u/Important_Map6928 (https://www.reddit.com/user/Important_Map6928)
[link] (https://sibouzitoun.tech/articles/mmmapiospace-returns-null-tracing-the-real-kernel-mechanism-through-ntoskrnlexe/) [comments] (https://www.reddit.com/r/redteamsec/comments/1vyt58m/mmmapiospace_returns_null_tracing_the_real_kernel/)
https://www.reddit.com/r/redteamsec/comments/1vyt58m/mmmapiospace_returns_null_tracing_the_real_kernel/
submitted by /u/Important_Map6928 (https://www.reddit.com/user/Important_Map6928)
[link] (https://sibouzitoun.tech/articles/mmmapiospace-returns-null-tracing-the-real-kernel-mechanism-through-ntoskrnlexe/) [comments] (https://www.reddit.com/r/redteamsec/comments/1vyt58m/mmmapiospace_returns_null_tracing_the_real_kernel/)
Real-world tradecraft from a recovered intrusion set against a Phillipine Nuclear Agency: forged ownCloud pre-signed URLs, custom MT19937 exploit, low-and-slow exfil
https://www.reddit.com/r/redteamsec/comments/1vyyrbn/realworld_tradecraft_from_a_recovered_intrusion/
<!-- SC_OFF -->The Hunt.io (http://hunt.io/) research team recovered an operator's full open directory, useful as a look at how someone actually chained known bugs in the field. ownCloud CVE-2023-49105: five Python scripts forging pre-signed WebDAV URLs off an empty PBKDF2 salt. OC-Credential set to the impersonated account, GET against /remote.php/dav/files//, no creds needed. The fifth script adds PROPFIND Depth: 1 enumeration to reach folders not known in advance. Low-and-slow exfil: randomized time.sleep(random.uniform(3, 6)) between requests, tightened to 1.5 to 3.5 in one script, to dodge volumetric detection. CVE-2024-28000 (LiteSpeed Cache): a Go build reimplementing MT19937 with PHP mt_rand() parity, self-tested against 11 seed/output pairs, 30 workers across a 0 to 999,999 seed range. Landed on seed 311787 and created an admin account via the REST API. Fallback path: XML-RPC brute force with rockyou.txt against the same site, successful independently. Staged frameworks: Sliver, Metasploit, Mettle, plus a custom stage-1 ELF loader pulling a Mettle stage-2. Full breakdown and IOCs: https://hunt.io/blog/chinese-speaking-operator-philippine-nuclear-naval-contractor <!-- SC_ON --> submitted by /u/Straight-Practice-99 (https://www.reddit.com/user/Straight-Practice-99)
[link] (https://hunt.io/blog/chinese-speaking-operator-philippine-nuclear-naval-contractor) [comments] (https://www.reddit.com/r/redteamsec/comments/1vyyrbn/realworld_tradecraft_from_a_recovered_intrusion/)
https://www.reddit.com/r/redteamsec/comments/1vyyrbn/realworld_tradecraft_from_a_recovered_intrusion/
<!-- SC_OFF -->The Hunt.io (http://hunt.io/) research team recovered an operator's full open directory, useful as a look at how someone actually chained known bugs in the field. ownCloud CVE-2023-49105: five Python scripts forging pre-signed WebDAV URLs off an empty PBKDF2 salt. OC-Credential set to the impersonated account, GET against /remote.php/dav/files//, no creds needed. The fifth script adds PROPFIND Depth: 1 enumeration to reach folders not known in advance. Low-and-slow exfil: randomized time.sleep(random.uniform(3, 6)) between requests, tightened to 1.5 to 3.5 in one script, to dodge volumetric detection. CVE-2024-28000 (LiteSpeed Cache): a Go build reimplementing MT19937 with PHP mt_rand() parity, self-tested against 11 seed/output pairs, 30 workers across a 0 to 999,999 seed range. Landed on seed 311787 and created an admin account via the REST API. Fallback path: XML-RPC brute force with rockyou.txt against the same site, successful independently. Staged frameworks: Sliver, Metasploit, Mettle, plus a custom stage-1 ELF loader pulling a Mettle stage-2. Full breakdown and IOCs: https://hunt.io/blog/chinese-speaking-operator-philippine-nuclear-naval-contractor <!-- SC_ON --> submitted by /u/Straight-Practice-99 (https://www.reddit.com/user/Straight-Practice-99)
[link] (https://hunt.io/blog/chinese-speaking-operator-philippine-nuclear-naval-contractor) [comments] (https://www.reddit.com/r/redteamsec/comments/1vyyrbn/realworld_tradecraft_from_a_recovered_intrusion/)
The Authorization Check That Only Fired When You Asked It To
A payment-processor IDOR, a timing oracle, and how a hunting harness turned one weak signal into a criticalContinue reading on Medium »
Read more...
A payment-processor IDOR, a timing oracle, and how a hunting harness turned one weak signal into a criticalContinue reading on Medium »
Read more...
Medium
The Authorization Check That Only Fired When You Asked It To
A payment-processor IDOR, a timing oracle, and how a hunting harness turned one weak signal into a critical
How I Got My First Bounty After a Year of Hunting
So, hello everyone! My name is Pranav Patil. I’m a security researcher and, like many of you reading this, I’m also on the bug bounty…Continue reading on Medium »
Read more...
So, hello everyone! My name is Pranav Patil. I’m a security researcher and, like many of you reading this, I’m also on the bug bounty…Continue reading on Medium »
Read more...
Medium
How I Got My First Bounty After a Year of Hunting
So, hello everyone! My name is Pranav Patil. I’m a security researcher and, like many of you reading this, I’m also on the bug bounty…
The Offensive Security & Bug Bounty Stack I Built for Myself — Now Free for Everyone
A walkthrough of OpenSwarm’s 12-phase autonomous security pipeline — from scoping and recon to vulnerability hunting, exploitation…Continue reading on Medium »
Read more...
A walkthrough of OpenSwarm’s 12-phase autonomous security pipeline — from scoping and recon to vulnerability hunting, exploitation…Continue reading on Medium »
Read more...
Medium
The Offensive Security & Bug Bounty Stack I Built for Myself — Now Free for Everyone
A walkthrough of OpenSwarm’s 12-phase autonomous security pipeline — from scoping and recon to vulnerability hunting, exploitation…
Reverse Engineering Windows Security Center
https://www.reddit.com/r/redteamsec/comments/1vzm0x7/reverse_engineering_windows_security_center/
submitted by /u/ObligationLucky842 (https://www.reddit.com/user/ObligationLucky842)
[link] (https://github.com/NirvanaOn/OWN-Defender) [comments] (https://www.reddit.com/r/redteamsec/comments/1vzm0x7/reverse_engineering_windows_security_center/)
https://www.reddit.com/r/redteamsec/comments/1vzm0x7/reverse_engineering_windows_security_center/
submitted by /u/ObligationLucky842 (https://www.reddit.com/user/ObligationLucky842)
[link] (https://github.com/NirvanaOn/OWN-Defender) [comments] (https://www.reddit.com/r/redteamsec/comments/1vzm0x7/reverse_engineering_windows_security_center/)
$$$ I Tried a Simple Registration Endpoint… and Accidentally Found a Critical Admin Account…
No login. No authorization. One API request. And suddenly… I had an administrator account.Continue reading on Medium »
Read more...
No login. No authorization. One API request. And suddenly… I had an administrator account.Continue reading on Medium »
Read more...
Medium
$$$ I Tried a Simple Registration Endpoint… and Accidentally Found a Critical Admin Account Takeover
No login. No authorization. One API request. And suddenly… I had an administrator account.
From an OTP Race Condition to Zero-Interaction Account Takeover
DisclaimerContinue reading on Medium »
Read more...
DisclaimerContinue reading on Medium »
Read more...
Medium
From an OTP Race Condition to Zero-Interaction Account Takeover
Disclaimer
15 Access Control Mistakes Developers Keep Making: Master Real-World Application Security
Ever found yourself staring down a “bypass” bug report and thinking, “How did we miss this?”Continue reading on Medium »
Read more...
Ever found yourself staring down a “bypass” bug report and thinking, “How did we miss this?”Continue reading on Medium »
Read more...
Medium
15 Access Control Mistakes Developers Keep Making: Master Real-World Application Security
Ever found yourself staring down a “bypass” bug report and thinking, “How did we miss this?” You’re not alone. Access control flaws quietly…
Atlas
https://kitploit.com/en/tools/github/portbuster1337/atlas
Cross-platform network execution toolkit (SMB/Kerberos/WMI/LDAP/DCSync) built on TrustedSec's Titanis - NetExec-style workflow in C#
https://kitploit.com/en/tools/github/portbuster1337/atlas
Cross-platform network execution toolkit (SMB/Kerberos/WMI/LDAP/DCSync) built on TrustedSec's Titanis - NetExec-style workflow in C#
conductai
https://kitploit.com/en/tools/github/sseshachala/conductai
AI agent governance for teams. Runtime firewalls tell you what happened; Conduct Guard controls what can happen — signed policy, verified chain, fail-closed by default. Ships with Router (LLM proxy), 20+ compliance packs, canvas UI, and a playbook engine.
https://kitploit.com/en/tools/github/sseshachala/conductai
AI agent governance for teams. Runtime firewalls tell you what happened; Conduct Guard controls what can happen — signed policy, verified chain, fail-closed by default. Ships with Router (LLM proxy), 20+ compliance packs, canvas UI, and a playbook engine.
$$$ I Tried a Simple Registration Endpoint… and Accidentally Found a Critical Admin Account…
https://alfazhossain0.medium.com/i-tried-a-simple-registration-endpoint-and-accidentally-found-a-critical-admin-account-9af2b90cf4a3?source=rss------bug_bounty-5
https://alfazhossain0.medium.com/i-tried-a-simple-registration-endpoint-and-accidentally-found-a-critical-admin-account-9af2b90cf4a3?source=rss------bug_bounty-5
No login. No authorization. One API request. And suddenly… I had an administrator account.Continue reading on Medium » (https://alfazhossain0.medium.com/i-tried-a-simple-registration-endpoint-and-accidentally-found-a-critical-admin-account-9af2b90cf4a3?source=rss------bug_bounty-5)
From an OTP Race Condition to Zero-Interaction Account Takeover
https://medium.com/@noureldin_shaban/from-an-otp-race-condition-to-zero-interaction-account-takeover-2a95bde82181?source=rss------bug_bounty-5
https://medium.com/@noureldin_shaban/from-an-otp-race-condition-to-zero-interaction-account-takeover-2a95bde82181?source=rss------bug_bounty-5
DisclaimerContinue reading on Medium » (https://medium.com/@noureldin_shaban/from-an-otp-race-condition-to-zero-interaction-account-takeover-2a95bde82181?source=rss------bug_bounty-5)
15 Access Control Mistakes Developers Keep Making: Master Real-World Application Security
https://medium.com/@verylazytech/15-access-control-mistakes-developers-keep-making-master-real-world-application-security-34df61fb9741?source=rss------bug_bounty-5
https://medium.com/@verylazytech/15-access-control-mistakes-developers-keep-making-master-real-world-application-security-34df61fb9741?source=rss------bug_bounty-5
Ever found yourself staring down a “bypass” bug report and thinking, “How did we miss this?”Continue reading on Medium » (https://medium.com/@verylazytech/15-access-control-mistakes-developers-keep-making-master-real-world-application-security-34df61fb9741?source=rss------bug_bounty-5)