Google open-sources Tsunami vulnerability scanner https://www.zdnet.com/article/google-open-sources-tsunami-vulnerability-scanner/
ZDNET
Google open-sources Tsunami vulnerability scanner
Google says Tsunami is an extensible network scanner for detecting high-severity vulnerabilities with as little false-positives as possible.
Purple Fox EK Adds Exploits for CVE-2020-0674 and CVE-2019-1458 to its Arsenal https://www.proofpoint.com/us/blog/threat-insight/purple-fox-ek-adds-exploits-cve-2020-0674-and-cve-2019-1458-its-arsenal
Proofpoint
Purple Fox Malware EK Adds More Exploits to Its Arsenal | Proofpoint US
Purple Fox is an exploit kit (EK) that has been built to replace the RIG exploit kit (EK) in the distribution chain of Purple Fox malware. Learn more.
Reverse engineering of the Anubis malware https://orangecyberdefense.com/uk/blog/uncategorized/reverse-engineering-of-the-anubis-malware/
United Kingdom
Reverse engineering of the Anubis malware | Orange Cyberdefense
Anubis is an Android malware. It is known for stealing banking credentials and allowing its master to spy on the smartphone’s user. Find out more about reverse engineering of this malware.
Apache Tomcat RCE by deserialization (CVE-2020-9484) – write-up and exploit
https://www.redtimmy.com/java-hacking/apache-tomcat-rce-by-deserialization-cve-2020-9484-write-up-and-exploit/
https://www.redtimmy.com/java-hacking/apache-tomcat-rce-by-deserialization-cve-2020-9484-write-up-and-exploit/
Remote Code Execution in Citrix ADC https://swarm.ptsecurity.com/remote-code-execution-in-citrix-adc/
How x86_64 addresses memory https://blog.yossarian.net/2020/06/13/How-x86_64-addresses-memory
Living Off Windows Land – A New Native File “downldr” https://labs.sentinelone.com/living-off-windows-land-a-new-native-file-downldr/
SentinelOne
Living Off Windows Land - A New Native File "downldr" - SentinelLabs
A newly discovered LOLBin offers an alternative to certutil for helping adversaries download files from a remote server. Meet desktopimgdownldr.exe.
Sandboxing in Linux with zero lines of code https://blog.cloudflare.com/sandboxing-in-linux-with-zero-lines-of-code/
The Cloudflare Blog
Sandboxing in Linux with zero lines of code
In this post we will review Linux seccomp and learn how to sandbox any (even a proprietary) application without writing a single line of code.
An update on our security incident (on Twitter) https://blog.twitter.com/en_us/topics/company/2020/an-update-on-our-security-incident.html
Twitter
An update on our security incident
An update on our security incident and what we know so far.
Nice intro to SEH exploiting --> The Basics of Exploit Development 2: SEH Overflows https://www.coalfire.com/The-Coalfire-Blog/March-2020/The-Basics-of-Exploit-Development-2-SEH-Overflows
Coalfire.com
The Basics of Exploit Development 2: SEH Overflows
Advanced Windows Malware Analysis - Acquiring Memory Artifacts https://darungrim.com/research/2020-07-10-windows-malware-analysis-process-artifacts.html
HugeDomains
DarunGrim.com is for sale | HugeDomains
Find a domain name today. We make it easy.
Persistence Using Universal Windows Platform https://oddvar.moe/2018/09/06/persistence-using-universal-windows-platform-apps-appx/
Oddvar Moe's Blog
Persistence using Universal Windows Platform apps (APPX)
TL;DR Persistence can be achieved with Appx/UWP apps using the debugger options. This technique will not be visible by Autoruns. Two different approaches exists (registry keys). Listed below are th…
Antimalware Scan Interface Provider for Persistence
https://b4rtik.github.io/posts/antimalware-scan-interface-provider-for-persistence/
https://b4rtik.github.io/posts/antimalware-scan-interface-provider-for-persistence/
Breaking the D-Link DIR3060 Firmware Encryption - Static analysis of the decryption routine - Part 2.1 https://0x434b.dev/breaking-the-d-link-dir3060-firmware-encryption-static-analysis-of-the-decryption-routine-part-2-1/
Low-level adventures
Breaking the D-Link DIR3060 Firmware Encryption - Static analysis of the decryption routine - Part 2.1
Welcome back to part 2 of this series! If you have not checked out part 1 yet, please do so first, as it highlights important reconnaissance steps!
So let us dive right into the IDA adventure to get a better look at how imgdecrypt operates to secure firmware…
So let us dive right into the IDA adventure to get a better look at how imgdecrypt operates to secure firmware…
It Only Takes A Minute to Clone a Credit Card, Thanks to a 50-Year-Old Problem https://www.cyberdlab.com/content/dam/cyberdlab/insights/it-only-takes-a-minute-to-clone-a-credit-card-thanks-to-a-50-year-old-problem/It_Only_Takes_a_Minute_to_Clone_a_Credit_Card_%20Thanks_to_a_50_Year_Old_Problem.pdf
Reversing DexGuard, Part 3 – Code Virtualization
https://www.pnfsoftware.com/blog/reversing-dexguard-virtualization/
https://www.pnfsoftware.com/blog/reversing-dexguard-virtualization/