Unauthenticated Log Injection In Splunk SOAR - can inject ANSI (American National Standards Institute) escape codes into Splunk log files that, when a vulnerable terminal application reads them, can potentially result in malicious code execution in the vulnerable application
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
Splunk Vulnerability Disclosure
Unauthenticated Log Injection In Splunk SOAR
In Splunk SOAR versions lower than 6.1.0, a maliciously crafted request to web endpoint through Splunk SOAR can inject ANSI (American National Standards Institute) escape codes into Splunk log files that, when a vulnerable terminal application reads them…
[Hard Disk Forensics] I just published my Hard Disk Forensics video notes in the form of a free Udemy course.
Hi! I recorded some video notes last month and I thought of publishing them in the form of a free Udemy course just to understand how Udemy course creation works. Would appreciate your feedback!
https://www.udemy.com/course/hard-disk-forensics-a-learning-guide/
Thanks!
🗣untitledusername445
I've purchased the course, how much hour is this, I'll give the feedback when i complete it.
👤mutuno
Very cool. Thanks for this!
👤v_rocco
🎖@malwr
Hi! I recorded some video notes last month and I thought of publishing them in the form of a free Udemy course just to understand how Udemy course creation works. Would appreciate your feedback!
https://www.udemy.com/course/hard-disk-forensics-a-learning-guide/
Thanks!
🗣untitledusername445
I've purchased the course, how much hour is this, I'll give the feedback when i complete it.
👤mutuno
Very cool. Thanks for this!
👤v_rocco
🎖@malwr
Udemy
Free Tutorial - Hard Disk Forensics: A Learning Guide
Get a brief overview of everything you need to learn to master Hard Disk Forensics. - Free Course
👍2❤1
Github - ZygiskFrida: Injecting frida gadget via Zygisk
🗣Lico_
This is a little tool I have been working on. It is an alternative way to inject frida into android processes. Instead of embedding the gadget into the APK or frida-server injecting it via ptrace, this module loads the gadget via Zygisk. I found it useful as it is sometimes able to bypass simple checks out of the box and decided to open source it.
Didn‘t have much opportunity to work with C/C++ before and used this to learn a bit about zygisk modules and the language. So any feedback, contributions and suggestions are welcome.
👤Lico_
🎖@malwr
🗣Lico_
This is a little tool I have been working on. It is an alternative way to inject frida into android processes. Instead of embedding the gadget into the APK or frida-server injecting it via ptrace, this module loads the gadget via Zygisk. I found it useful as it is sometimes able to bypass simple checks out of the box and decided to open source it.
Didn‘t have much opportunity to work with C/C++ before and used this to learn a bit about zygisk modules and the language. So any feedback, contributions and suggestions are welcome.
👤Lico_
🎖@malwr
GitHub
GitHub - lico-n/ZygiskFrida: Injects frida gadget using zygisk to bypass anti-tamper checks.
Injects frida gadget using zygisk to bypass anti-tamper checks. - lico-n/ZygiskFrida
🔥1
Comrades in Arms? | North Korea Compromises Sanctioned Russian Missile Engineering Company
🗣jnazario
🎖@malwr
🗣jnazario
🎖@malwr
SentinelOne
Comrades in Arms? | North Korea Compromises Sanctioned Russian Missile Engineering Company
North Korean threat actors attempt to further missile program by compromising sanctioned Russian defense company with OpenCarrot backdoor.
Introduction to Command and Control Servers | TryHackMe Red Team Track
In this video walk-through, we covered an introduction to C2 servers. We explained C2 agents, payloads and their types (staged vs stageless), Droppers, beacons in addition to C2 agents obfuscation methods. We also covered some of the popular C2 servers including but not limited to Metasploit, Powershell Empire, Armitage and Cobalt Strike. This was part of the TryHackMe red team pathway.
Video is here
🗣MotasemHa
Thanks for the video! but I don't get why people still use Metasploit or Armitage in their red team engagements or to simulate attacks, these couple of frameworks are flagged by modern EDRs and mostly used by script kids IMHO. It would be much better if you switch them up with Covenant, Mythic, or Cobalt Strike.
👤KeyPrompt4278
🎖@malwr
In this video walk-through, we covered an introduction to C2 servers. We explained C2 agents, payloads and their types (staged vs stageless), Droppers, beacons in addition to C2 agents obfuscation methods. We also covered some of the popular C2 servers including but not limited to Metasploit, Powershell Empire, Armitage and Cobalt Strike. This was part of the TryHackMe red team pathway.
Video is here
🗣MotasemHa
Thanks for the video! but I don't get why people still use Metasploit or Armitage in their red team engagements or to simulate attacks, these couple of frameworks are flagged by modern EDRs and mostly used by script kids IMHO. It would be much better if you switch them up with Covenant, Mythic, or Cobalt Strike.
👤KeyPrompt4278
🎖@malwr
YouTube
Introduction to Command and Control Servers | TryHackMe Red Team Track
In this video walk-through, we covered an introduction to C2 servers. We explained C2 agents, payloads and their types (staged vs stageless), Droppers, beacons in addition to C2 agents obfuscation methods. We also covered some of the popular C2 servers including…
One-click setup SCCM Lab (as snaplabs.io template) for offensive tool testing (or for anything else)
🗣an0n_r0
little bit more context: https://twitter.com/an0n_r0/status/1687230842601451522
👤an0n_r0
🎖@malwr
🗣an0n_r0
little bit more context: https://twitter.com/an0n_r0/status/1687230842601451522
👤an0n_r0
🎖@malwr
X (formerly Twitter)
an0n (@an0n_r0) on X
Sharing my @snaplabsio #SCCM Lab template:
https://t.co/tfDVhjlFq5
By importing this you'll have a working SCCM environment immediately without any effort.
Specific extra configuration might be needed for various exploitation techniques, but hopefully…
https://t.co/tfDVhjlFq5
By importing this you'll have a working SCCM environment immediately without any effort.
Specific extra configuration might be needed for various exploitation techniques, but hopefully…
Vulnerable WordPress: Release 2023 July - Plugins:142 Vulns:179
🗣seyyid_
Par for the course.
👤DevSpectre1
To quote a wise man "WordPress is a remote shell with a handy blogging feature"
👤theskymoves
🎖@malwr
🗣seyyid_
Par for the course.
👤DevSpectre1
To quote a wise man "WordPress is a remote shell with a handy blogging feature"
👤theskymoves
🎖@malwr
GitHub
Release 2023 July - Lake Urmia · onhexgroup/Vulnerable-WordPress
Information about this release:
Worpress version: 6.2.2
Number of installed plugins (Clean and Vulnerable) : 142
Number of vulnerabilities: 179
adminuser: onhexgroup
adminpass: jidCy(SbEz!25qyjT...
Worpress version: 6.2.2
Number of installed plugins (Clean and Vulnerable) : 142
Number of vulnerabilities: 179
adminuser: onhexgroup
adminpass: jidCy(SbEz!25qyjT...
👍2
TunnelCrack, a combination of two widespread security vulnerabilities in VPNs - Both attacks manipulate the victim's routing table to trick the victim into sending traffic outside the protected VPN tunnel, allowing an adversary to read and intercept transmitted traffic
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
Mathyvanhoef
TunnelCrack: Widespread design flaws in VPN clients
We present two widespread design flaws in VPN client. These can be abused to make a victim leak traffic in plaintext outside the protected VPN tunnel.