Labtainers - Navy Postgraduate School - Center for Cybersecurity and Cyber Operations | Free Cybersecurity exercises & manuals covering a wide variety of topics. The Networking & Network Traffic Analysis portions should be of particular interest to forensicators.
🗣LordUlthar
🎖@malwr
🗣LordUlthar
🎖@malwr
nps.edu
Labtainers - Center for Cybersecurity and Cyber Operations - Naval Postgraduate School
Cybersecurity labs for Linux
GLORYHook - The first Linux hooking framework to allow merging two binary files into one
🗣partyfaker
🎖@malwr
🗣partyfaker
🎖@malwr
GitHub
GitHub - tsarpaul/GLORYHook: The first Linux hooking framework to allow merging two binary files into one!
The first Linux hooking framework to allow merging two binary files into one! - tsarpaul/GLORYHook
Git'ing Users for OSINT: Analysis of All GitHub Users - SANS@MIC Talk | A great case study of leveraging APIs for OSINT
🗣LordUlthar
🎖@malwr
🗣LordUlthar
🎖@malwr
YouTube
Git'ing Users for OSINT: Analysis of All GitHub Users | SANS@MIC Talk
Within the world of OSINT, many people solely focus on what data they can retrieve from a web browser. Others, like me, know the power and potential of using Application Programming Interfaces (APIs) to harvest huge amounts of data from platforms and incredible…
DARPA - Operationally Transparent Cyber (OpTC) Data Release - multi-day dataset that includes endpoint activity (including benign activity generation) from ~500 endpoints as well as Zeekurity data from the enterprise egress point.
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
GitHub
GitHub - FiveDirections/OpTC-data
Contribute to FiveDirections/OpTC-data development by creating an account on GitHub.
KAPE - A Beginner's Guide
🗣deltawing
Best viewed not on mobile due to size of visual aids.
👤deltawing
🎖@malwr
🗣deltawing
Best viewed not on mobile due to size of visual aids.
👤deltawing
🎖@malwr
AboutDFIR - The Definitive Compendium Project
KAPE - AboutDFIR - The Definitive Compendium Project
A detailed guide on how to use KAPE geared towards first-timers and visual learners.
Rom Hacking tool for Gameboy Advance game + detailed manual about how it was developed + talks
🗣bmacabeus
Awesome stuff, man.
👤Streiw
🎖@malwr
🗣bmacabeus
Awesome stuff, man.
👤Streiw
🎖@malwr
GitHub
GitHub - macabeus/klo-gba.js: 🧢 Reverse engineering tool for the Klonoa's GBA game
🧢 Reverse engineering tool for the Klonoa's GBA game - macabeus/klo-gba.js
Bypassing Symantec Endpoint Protection for Fun & Profit!
🗣input0
This is fun, but missing some details.
1. Version of Symantec Endpoint Protection tested is not listed. SEP14.3 came out a couple weeks ago and adds new capabilities including AMSI (finally).
1. Test was conducted on Windows 2012R2. Yes, Windows 2012R2 is still widespread in production and under support, however Windows 10/2016 have enhancements that make dumping credentials much more difficult (LSAS virtualization in Virtualization Bases Security).
Without this information, this blog really is "I walked through an intentionally vulnerable pen testing lab scenario", vs. "here is a demonstration that you should do something and actionable guidance on what you should do". (IE, you should upgrade your fleet to 2016/10, etc).
👤R-EDDIT
🎖@malwr
🗣input0
This is fun, but missing some details.
1. Version of Symantec Endpoint Protection tested is not listed. SEP14.3 came out a couple weeks ago and adds new capabilities including AMSI (finally).
1. Test was conducted on Windows 2012R2. Yes, Windows 2012R2 is still widespread in production and under support, however Windows 10/2016 have enhancements that make dumping credentials much more difficult (LSAS virtualization in Virtualization Bases Security).
Without this information, this blog really is "I walked through an intentionally vulnerable pen testing lab scenario", vs. "here is a demonstration that you should do something and actionable guidance on what you should do". (IE, you should upgrade your fleet to 2016/10, etc).
👤R-EDDIT
🎖@malwr
House of Io – Bypassing Safe-Linking and attacking Glibc's tcache
🗣eyalitki
Very interesting! I remember noticing the same thing about the first chunk but didn’t think much about. Good work getting a new exploit type out of the mitigation’s.
👤mdulin2
In a classic "Thank you /r/netsec" /u/awarau888 and I were able to develop their initial attack variant that was posted here a few days ago, into a working bypass.
👤eyalitki
🎖@malwr
🗣eyalitki
Very interesting! I remember noticing the same thing about the first chunk but didn’t think much about. Good work getting a new exploit type out of the mitigation’s.
👤mdulin2
In a classic "Thank you /r/netsec" /u/awarau888 and I were able to develop their initial attack variant that was posted here a few days ago, into a working bypass.
👤eyalitki
🎖@malwr
awarau
House of Io – Remastered
A few days ago, I (Awarau) published a blog post (link) with my analysis of the new heap mitigation, Safe-Linking, that will be introduced in GLibc 2.32. The blog post describes the mechanism, alon…