How We Found Another XSS in Google with Acunetix
Some time ago, Russian security researchers Andrey Leonov and Link found an XSS in Google Cloud with the help of Acunetix. Recently they found another XSS vulnerability. Here is how it happened. Read on »



https://preview.redd.it/8k5mfavrfnh41.png?width=910&format=png&auto=webp&s=9f163a59304f45574a3b17b591d48170411d1926
🗣AcunetixLtd


🎖@malwr

Hidden in PEB Sight: Hiding Windows API Imports With a Custom Loader
🗣thorn42

Very nice. Engaging writing style too.
👤ragnar_graybeard87


🎖@malwr

Purpose of `mov edi, edi`?
I was debugging a Windows' built in program and notices that almost all subroutines starts with mov edi, edi. e.g.

subsomething proc near
mov edi, edi
push ebp
mov ebp, esp
;do something...
leave
retn
subsomething endp

AFAIU, that mov edi, edi practically does nothing and affect nothing, and it only wastes space and computing time.

It seems like it's specific to Microsoft based C language compiled modules, cause I also use Delphi to create Windows programs, and none of their functions has such asm code pattern.

So, what's the purpose of that instruction?
🗣jcunews1

It's a nop. It's there for patching. Intel doesn't actually have formal nop instructions! For nops people often write xchg eax, eax, or something like this if they want a longer nop.
👤chrisgseaton

It's a no-op, on purpose, that can be overwritten.

Raymond Chen explains it, here: https://devblogs.microsoft.com/oldnewthing/20110921-00/?p=9583
👤chunkyks

https://devblogs.microsoft.com/oldnewthing/20110921-00/?p=9583
👤jedwardsol


🎖@malwr

Public Key Cryptography, How and Why Does It Work? [DC206](https://www.youtube.com/watch?v=133Ysr71YOw)
🗣cyberg0100


🎖@malwr

How to Write a Runescape Injection Bot
🗣Ectotalk

Sick dude!
👤Dternity


🎖@malwr

Best approach to include YARA/Sigma Rules for Thread Prevention
Heya.

I've been looking into assisting my currently deployed Endpoint Protection (McCrapee) with Yara/Sigma-Rules to catch intrusions that McAfee won't detect, including malicious word macros and others, like known APT IoCs and others.

I think tools like Loki and Thor are perfectly fine (thats pretty much an understatement, I love the Loki Scanner) for analysis on already compromised systems or analysing logs in my SIEM, but im more of looking for something that offers real time detection based on those rules, or at least enables me to automatically scan files from specific sources before they are actually executed (e.g. Mail Attachments or files downloaded from an webbrowser - thinking of previous emotet campaigns - but also files that are within an downloaded passworded .zip archive, unpacked and then executed).

Are there any real time solutions currently out there?I'd love a flexible system like that, which I can then dynamically a rules to, based on newly detected threads without the need to wait for my av vendor to deploy an update that is already outdated by the time it arrives..

Thanks!

Edit for clarity:

What I am looking for would be best described as another Endpoint Protection Client thats beeing deployed on all workstations and works alongside our current solution that provides the functionality to scan files (from certain locations) either on access or right after they are beeing downloaded using Yara Rules.

Reasoning for this is the lack of flexibility within our current solution, which yara rules do provide.

Most or possibly all yara based solutions I've seen so far are widely used for scanning possibly compromised systems or regular scans in general, but not as an additional layer of defense, which is what I am looking for.

Edit: spelling
🗣amapofmymind

I know of a couple solutions like this.

For one, I currently use a network file carver (suricata) to extract files from network flows and then spool them to disk. I've run yara rules against these and they definitely require some tuning, as they trigger constantly. Actual malicious files (vs. just packed or obfuscated) are few and far between.

I do know some private sector companies that do something like what you are describing. What they did was take yara and customize it to be their own inhouse EDR solution. So they write their own signatures to detect targeted attacks they discover in-house. However, all the example I know just used it as an on-demand scanner, vs. on-access. Not sure how you could implement that (and it would kill performance if you have a lot of signatures and disk I/O).
👤K3wp


🎖@malwr