List of cybersecurity resources for training, conferences, speaking, labs, reading, etc that are free all the time or during COVID-19 https://github.com/gerryguy311/CyberProfDevelopmentCovidResources/blob/master/README.md
GitHub
Free_CyberSecurity_Professional_Development_Resources/README.md at master · gerryguy311/Free_CyberSecurity_Professional_Development_Resources
An awesome list of FREE resources for training, conferences, speaking, labs, reading, etc that are free. Originally built during COVID-19 for cybersecurity professionals with downtime can take adva...
Nice explanation to capture IP packets on Windows without requiring any extra software or drivers to be installed https://www.nospaceships.com/2018/09/19/packet-capture-on-windows-without-drivers.html
NoSpaceships Ltd
Packet capture on Windows without drivers
Introduction
AVAST SecureLine VPN - Arbitrary File Creation Vulnerability https://nafiez.github.io/security/arbitrary%20file/eop/2020/07/21/avast-secureline-vpn-arb-file-eop.html
Security Research
CVE-2020-25289 - AVAST SecureLine VPN - Arbitrary File Creation Vulnerability
My Personal Security Research
Remembering old stuff :) --> Exploring the MS-DOS Stub https://osandamalith.com/2020/07/19/exploring-the-ms-dos-stub/
🔐Blog of Osanda
Exploring the MS-DOS Stub | 🔐Blog of Osanda
A long time ago when I got my first computer, I accidentally opened a 32-bit demo with a nice chiptune inside MS-DOS and it worked. I was surprised by how this happens. I was curious to find out ho…
MMS Exploit Part 2: Effective Fuzzing of the Qmage Codec https://googleprojectzero.blogspot.com/2020/07/mms-exploit-part-2-effective-fuzzing-qmage.html
projectzero.google
MMS Exploit Part 2: Effective Fuzzing of the Qmage Codec
Posted by Mateusz Jurczyk, Project ZeroThis post is the second of a multi-part series capturing m...
In Memory Cobalt Strike Shellcode Beacon decoding to evade AVs https://shells.systems/in-memory-shellcode-decoding-to-evade-avs/
Shells.Systems
In-Memory shellcode decoding to evade AVs/EDRs - Shells.Systems
Estimated Reading Time: 9 minutesDuring the previous week, I was doing some research about win32 APIs and how we can use them during weaponizing our attack, I already did some work related to process injection in the past, but I was looking for something…
Bypassing MassLogger Anti-Analysis — a Man-in-the-Middle Approach https://www.fireeye.com/blog/threat-research/2020/08/bypassing-masslogger-anti-analysis-man-in-the-middle-approach.html
Google Cloud Blog
Bypassing MassLogger Anti-Analysis — a Man-in-the-Middle Approach | Mandiant | Google Cloud Blog
Qiling (based on Unicorn engine) For Malware Analysis tutorial https://n1ght-w0lf.github.io/tutorials/qiling-for-malware-analysis-part-1/ and https://n1ght-w0lf.github.io/tutorials/qiling-for-malware-analysis-part-2/
n1ghtw0lf
Qiling For Malware Analysis: Part 1
Qiling is an advanced binary emulation framework written in python and based on Unicorn…
dazzleUP: A tool that detects the privilege escalation vulnerabilities caused by misconfigurations and missing updates in the Windows operating systems https://github.com/hlldz/dazzleUP
GitHub
GitHub - hlldz/dazzleUP: A tool that detects the privilege escalation vulnerabilities caused by misconfigurations and missing updates…
A tool that detects the privilege escalation vulnerabilities caused by misconfigurations and missing updates in the Windows operating systems. - hlldz/dazzleUP
Forensic analysis of disclosed uninitialized kernel memory https://dfir.ru/2019/03/25/forensic-analysis-of-disclosed-uninitialized-kernel-memory/
My DFIR Blog
Forensic analysis of disclosed uninitialized kernel memory
Memory images, page files, hibernation files, crash dumps are standard targets for memory forensics. But there are unusual ones: for example, chunks of disclosed (leaked) uninitialized kernel memor…
Seeing (Sig)Red https://sensepost.com/blog/2020/seeing-sigred/
Intro to Android App Reverse Engineering workshop https://github.com/maddiestone/AndroidAppRE
GitHub
GitHub - maddiestone/AndroidAppRE: Android App Reverse Engineering Workshop
Android App Reverse Engineering Workshop. Contribute to maddiestone/AndroidAppRE development by creating an account on GitHub.
proof-of-concept Windows Driver for injecting DLL into user-mode processes using APC https://github.com/wbenny/injdrv
GitHub
GitHub - wbenny/injdrv: proof-of-concept Windows Driver for injecting DLL into user-mode processes using APC
proof-of-concept Windows Driver for injecting DLL into user-mode processes using APC - wbenny/injdrv
Bypassing Symantec Endpoint Protection for Fun & Profit (Defense Evasion) https://cognosec.com/bypassing-symantec-endpoint-protection-for-fun-profit-defense-evasion/e
Fuzzing software: advanced tricks (Part 2) https://securitylab.github.com/research/fuzzing-software-2
GitHub Security Lab
Fuzzing software: advanced tricks (Part 2)
In this second part of a two-part series about common challenges you usually face in your fuzzing work, we’ll visit some advanced fuzzing tricks.
Malware Reverse Engineering Handbook https://ccdcoe.org/library/publications/malware-reverse-engineering-handbook/
Exploiting popular macOS apps with a single “.terminal” file https://medium.com/@metnew/exploiting-popular-macos-apps-with-a-single-terminal-file-f6c2efdfedaa
Medium
Exploiting popular macOS apps with a single “.terminal” file.
A story about macOS File Quarantine, 10years old bug, OneDrive entitlements and UX Security in apps.
Ensiko: A Webshell With Ransomware Capabilities
https://blog.trendmicro.com/trendlabs-security-intelligence/ensiko-a-webshell-with-ransomware-capabilities/
https://blog.trendmicro.com/trendlabs-security-intelligence/ensiko-a-webshell-with-ransomware-capabilities/
Trend Micro
Research, News, and Perspectives
Mirai Botnet Exploit Weaponized to Attack IoT Devices via CVE-2020-5902 https://blog.trendmicro.com/trendlabs-security-intelligence/mirai-botnet-exploit-weaponized-to-attack-iot-devices-via-cve-2020-5902/
Trend Micro
Research, News, and Perspectives
GHSL-2020-072: Arbitrary file disclosure in JinJava - CVE-2020-12668 https://securitylab.github.com/advisories/GHSL-2020-072-hubspot_jinjava
GitHub Security Lab
GHSL-2020-072: Arbitrary file disclosure in JinJava - CVE-2020-12668
A user with privileges to write JinJava templates, for example in a CMS context, will be able to read arbitrary files from the file system.