How We Found Another XSS in Google with Acunetix
Some time ago, Russian security researchers Andrey Leonov and Link found an XSS in Google Cloud with the help of Acunetix. Recently they found another XSS vulnerability. Here is how it happened. Read on »



https://preview.redd.it/8k5mfavrfnh41.png?width=910&format=png&auto=webp&s=9f163a59304f45574a3b17b591d48170411d1926
🗣AcunetixLtd


🎖@malwr

Hidden in PEB Sight: Hiding Windows API Imports With a Custom Loader
🗣thorn42

Very nice. Engaging writing style too.
👤ragnar_graybeard87


🎖@malwr

Purpose of `mov edi, edi`?
I was debugging a Windows' built in program and notices that almost all subroutines starts with mov edi, edi. e.g.

subsomething proc near
mov edi, edi
push ebp
mov ebp, esp
;do something...
leave
retn
subsomething endp

AFAIU, that mov edi, edi practically does nothing and affect nothing, and it only wastes space and computing time.

It seems like it's specific to Microsoft based C language compiled modules, cause I also use Delphi to create Windows programs, and none of their functions has such asm code pattern.

So, what's the purpose of that instruction?
🗣jcunews1

It's a nop. It's there for patching. Intel doesn't actually have formal nop instructions! For nops people often write xchg eax, eax, or something like this if they want a longer nop.
👤chrisgseaton

It's a no-op, on purpose, that can be overwritten.

Raymond Chen explains it, here: https://devblogs.microsoft.com/oldnewthing/20110921-00/?p=9583
👤chunkyks

https://devblogs.microsoft.com/oldnewthing/20110921-00/?p=9583
👤jedwardsol


🎖@malwr

Public Key Cryptography, How and Why Does It Work? [DC206](https://www.youtube.com/watch?v=133Ysr71YOw)
🗣cyberg0100


🎖@malwr

How to Write a Runescape Injection Bot
🗣Ectotalk

Sick dude!
👤Dternity


🎖@malwr

Best approach to include YARA/Sigma Rules for Thread Prevention
Heya.

I've been looking into assisting my currently deployed Endpoint Protection (McCrapee) with Yara/Sigma-Rules to catch intrusions that McAfee won't detect, including malicious word macros and others, like known APT IoCs and others.

I think tools like Loki and Thor are perfectly fine (thats pretty much an understatement, I love the Loki Scanner) for analysis on already compromised systems or analysing logs in my SIEM, but im more of looking for something that offers real time detection based on those rules, or at least enables me to automatically scan files from specific sources before they are actually executed (e.g. Mail Attachments or files downloaded from an webbrowser - thinking of previous emotet campaigns - but also files that are within an downloaded passworded .zip archive, unpacked and then executed).

Are there any real time solutions currently out there?I'd love a flexible system like that, which I can then dynamically a rules to, based on newly detected threads without the need to wait for my av vendor to deploy an update that is already outdated by the time it arrives..

Thanks!

Edit for clarity:

What I am looking for would be best described as another Endpoint Protection Client thats beeing deployed on all workstations and works alongside our current solution that provides the functionality to scan files (from certain locations) either on access or right after they are beeing downloaded using Yara Rules.

Reasoning for this is the lack of flexibility within our current solution, which yara rules do provide.

Most or possibly all yara based solutions I've seen so far are widely used for scanning possibly compromised systems or regular scans in general, but not as an additional layer of defense, which is what I am looking for.

Edit: spelling
🗣amapofmymind

I know of a couple solutions like this.

For one, I currently use a network file carver (suricata) to extract files from network flows and then spool them to disk. I've run yara rules against these and they definitely require some tuning, as they trigger constantly. Actual malicious files (vs. just packed or obfuscated) are few and far between.

I do know some private sector companies that do something like what you are describing. What they did was take yara and customize it to be their own inhouse EDR solution. So they write their own signatures to detect targeted attacks they discover in-house. However, all the example I know just used it as an on-demand scanner, vs. on-access. Not sure how you could implement that (and it would kill performance if you have a lot of signatures and disk I/O).
👤K3wp


🎖@malwr

For my cakeday, I present: adding occlusion queries to an old game I love, Blockland! (via DLL)
Video

A few changes were done using DLL injection:
- The game batches by texture normally, not by location, so a custom batching solution is needed.
- Occlusion queries are launched using a conservative bounding box surrounding the brick chunks.
- There are other fixes like a frustum culling improvement in order to cull chunks in the shadow map passes.

Code!
🗣Valcle


🎖@malwr

Scripts for Headless CWE Issue Detection
I want to use the Ghidra analyzeHeadless capability to automatically assess binaries and identify CWE issues. Does Ghidra fit such a scenario and is anyone aware of Ghidra scripts available to perform such analyses?

I have compiled binaries (ELF & amd64) from the Juliet 1.3 CWE test suite for C/C++ and run analyzeHeadless against them using the default out-of-the-box Ghidra scripts. I get no identification of any issues even though the original source has 100s of injected coding issues.

Perhaps I am thinking of Ghidra use and/or application incorrectly?

Btw, I am aware of BAP and cwe\_checker, but would like the broadest toolset for identifying as many vulnerabilities as possible in given binaries or firmware.
🗣dwardoh21


🎖@malwr