How to Use Wireshark to Capture, Filter and Inspect Packets https://www.howtogeek.com/104278/how-to-use-wireshark-to-capture-filter-and-inspect-packets/
How-To Geek
How to Use Wireshark to Capture, Filter and Inspect Packets
Wireshark, a network analysis tool formerly known as Ethereal, captures packets in real time and display them in human-readable format. Wireshark includes filters, color coding, and other features that let you dig deep into network traffic and inspect individual…
Russia's APT28 targets Ukraine government with bogus Windows updates https://www.theregister.com/2023/05/02/russia_apt28_ukraine_phishing/
The Register
Russia's APT28 targets Ukraine government with bogus Windows updates
Nasty emails designed to infect systems with info-stealing malware
❤2👍2
Chain Reaction: ROKRAT’s Missing Link https://research.checkpoint.com/2023/chain-reaction-rokrats-missing-link/
Check Point Research
Chain Reaction: ROKRAT’s Missing Link - Check Point Research
Key findings Introduction From the many reports on APT37 in recent months, to Mandiant’s announcement on APT43, a lot of attention is currently focused on North Korean threat actors – and with good reason. North Korea has a long history of attacking its southern…
ETWHash – “He who listens, shall receive” https://labs.nettitude.com/blog/etwhash-he-who-listens-shall-receive/
LRQA
ETWHash -
ETWHash is a small C# tool used during Red Team engagements, that can consume ETW SMB events and extract NetNTLMv2 hashes for cracking offline, unlike currently documented methods.
PaperCut Exploitation - A Different Path to Code Execution https://vulncheck.com/blog/papercut-rce
VulnCheck
VulnCheck - Outpace Adversaries
Vulnerability intelligence that predicts avenues of attack with speed and accuracy.
Test Point Break: Analysis of Huawei’s OTA Fix For BootROM Vulnerabilities https://labs.taszk.io/articles/post/huawei_kirin990_bootrom_patch/
labs.taszk.io
Test Point Break: Analysis of Huawei’s OTA Fix For BootROM Vulnerabilities
Reverse engineering the OTA that broke the bootrom exploits
👍2
So long passwords, thanks for all the phish https://security.googleblog.com/2023/05/so-long-passwords-thanks-for-all-phish.html
Google Online Security Blog
So long passwords, thanks for all the phish
By: Arnar Birgisson and Diana K Smetters, Identity Ecosystems and Google Account Security and Safety teams Starting today , you can create a...
CVE-2023-29383: Abusing Linux chfn to Misrepresent /etc/passwd https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2023-29383-abusing-linux-chfn-to-misrepresent-etc-passwd/
Trustwave
CVE-2023-29383: Abusing Linux chfn to Misrepresent etc passwd | Trustwave
Two years ago, I picked out chfn as a candidate to be reviewed for security bugs. Why chfn I hear you ask? (Thanks for asking.) It is one of a small number of Set owner User ID (SUID) programs loaded with Linux which means it runs with the permissions of…
Leveraging XFG to help with reverse engineering https://m417z.com/Leveraging-XFG-to-help-with-reverse-engineering/
M417Z
Leveraging XFG to help with reverse engineering
Microsoft eXtended Flow Guard (XFG) is a control-flow integrity (CFI) technique that extends CFG with function call signatures. It was presented by Microsoft in 2019, and it’s an interesting mitigation, but this blog post isn’t going to discuss its security…
Some great notes on macOS Internals https://gist.github.com/kconner/cff08fe3e0bb857ea33b47d965b3e19f
Gist
macOS Internals
macOS Internals. GitHub Gist: instantly share code, notes, and snippets.
👍1
santa: A binary authorization system for macOS https://github.com/google/santa
GitHub
GitHub - google/santa: A binary authorization and monitoring system for macOS
A binary authorization and monitoring system for macOS - google/santa
👍1
CVE-2021-38001: A Brief Introduction to V8 Inline Cache and Exploitating Type Confusion https://y4y.space/2023/05/06/cve-2021-38001-a-brief-introduction-to-v8-inline-cache-and-exploitating-type-confusion/
www.y4y.space
CVE-2021-38001: A Brief Introduction to V8 Inline Cache and Exploitating Type Confusion · y4y
Some Background Info
AgentTesla - Full Loader Analysis - Resolving API Hashes Using Conditional Breakpoints https://embee-research.ghost.io/agenttesla-full-analysis-api-hashing/
Embee Research
AgentTesla Malware Analysis - How To Resolve API Hashes With Conditional Breakpoints
Analysis of a Multi-Stage Loader for AgentTesla. Covering Ghidra, Dnspy, X32dbg, API Hashing and more!
Deobfuscating the Recent Emotet Epoch 4 Macro https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/deobfuscating-the-recent-emotet-epoch-4-macro/
Trustwave
Deobfuscating the Recent Emotet Epoch 4 Macro
I’ve always been fascinated by wireless communications. The ability to launch seemingly invisible packets of information up into the air without even the need to consider aerodynamics itself seems like some kind of magic.
strings2 - Extract strings from binary files and process memory https://github.com/glmcdona/strings2
GitHub
GitHub - glmcdona/strings2: strings2: An improved strings extraction tool.
strings2: An improved strings extraction tool. Contribute to glmcdona/strings2 development by creating an account on GitHub.
Finding 0-day vulnerabilities in apps using the Red Team approach(RTC0005) https://redteamrecipe.com/Finding-0-day-vulnerabilities-in-apps-using-the-Red-Team-approach/
ExpiredDomains.com
redteamrecipe.com is for sale! Check it out on ExpiredDomains.com
Buy redteamrecipe.com for 195 on GoDaddy via ExpiredDomains.com. This premium expired .com domain is ideal for establishing a strong online identity.
Ethereum Transactions: 101 Things You Need to Know https://medium.com/@sergiomazariego/ethereum-transactions-101-things-you-need-to-know-d2e39cc1b10
Medium
Ethereum Transactions: 101 Things You Need to Know
IntroductionIn this blog post, you will find explanations of the basic concepts, terminologies, and technicalities involved in…
Auditing the Home Assistant Pre-Auth Attack Surface https://www.elttam.com/blog/pwnassistant/
Elttam
PwnAssistant - Controlling /home's via a Home Assistant RCE - elttam
How we found a critical pre-authentication RCE in Home Assistant, exploring the attack surface and publishing advisories including CVE-2023-27482.
Vulnerability Analysis with Ghidra Scripting https://medium.com/@cy1337/vulnerability-analysis-with-ghidra-scripting-ccf416cfa56d
Medium
Vulnerability Analysis with Ghidra Scripting
As some of you may have seen, I posted a challenge to use Ghidra to identify a vulnerability in a WarGames themed game. There has been a…
The Art of Clipboard Forensics Recovering Deleted Data https://xret2pwn.github.io/The-Art-of-Clipboard-Forensics-Recovering-Deleted-Data/
RET2Pwn
The Art of Clipboard Forensics Recovering Deleted Data
Introduction
🔥1