Nice series here >> Hunting for Persistence in Linux (Part 1): Auditd, Sysmon, Osquery (and Webshells) https://pberba.github.io/security/2021/11/22/linux-threat-hunting-for-persistence-sysmon-auditd-webshell/ (and good summary map in https://pberba.github.io/assets/posts/common/20220201-linux-persistence.pdf)
pepe berba
Hunting for Persistence in Linux (Part 1): Auditd, Sysmon, Osquery (and Webshells)
An introduction to monitoring and logging in linux to look for persistence.
🔥1
Man-in-the-Middle Attacks without Rogue AP:
When WPAs Meet ICMP Redirects https://csis.gmu.edu/ksun/publications/WiFi_Interception_SP23.pdf
When WPAs Meet ICMP Redirects https://csis.gmu.edu/ksun/publications/WiFi_Interception_SP23.pdf
Threat Brief: Attacks on Critical Infrastructure Attributed to Insidious Taurus (aka Volt Typhoon) https://unit42.paloaltonetworks.com/volt-typhoon-threat-brief/
Unit 42
Threat Brief: Attacks on Critical Infrastructure Attributed to Insidious Taurus (Volt Typhoon)
Insidious Taurus, aka Volt Typhoon, is a nation-state TA attributed to the People's Republic of China. We provide an overview of their current activity and mitigations recommendations.
Mercenary mayhem: A technical analysis of Intellexa's PREDATOR spyware https://blog.talosintelligence.com/mercenary-intellexa-predator/
Cisco Talos
Mercenary mayhem: A technical analysis of Intellexa's PREDATOR spyware
Commercial spyware use is on the rise, with actors leveraging these sophisticated tools to conduct surveillance operations against a growing number of targets. Cisco Talos has new details of a commercial spyware product sold by the spyware firm Intellexa…
🤔1
GobRAT malware written in Go language targeting Linux routers https://blogs.jpcert.or.jp/en/2023/05/gobrat.html
JPCERT/CC Eyes
GobRAT malware written in Go language targeting Linux routers - JPCERT/CC Eyes
JPCERT/CC has confirmed attacks that infected routers in Japan with malware around February 2023. This blog article explains the details of the attack confirmed by JPCERT/CC and GobRAT malware, which was used in the attack. ### Attack flow up to...
WinDiff: open-source web-based tool to browse and compare symbol and type information of Microsoft Windows binaries across different versions of the OS https://windiff.vercel.app/ GitHub: https://github.com/ergrelet/windiff
GitHub
GitHub - ergrelet/windiff: Tool that allows comparing symbol, type and syscall information of Microsoft Windows binaries across…
Tool that allows comparing symbol, type and syscall information of Microsoft Windows binaries across different versions of the OS, using a Web UI and/or LLMs. - ergrelet/windiff
Meterpreter vs Modern EDR(s) https://redops.at/en/blog/meterpreter-vs-modern-edrs-in-2023
RedOps - English
Meterpreter vs Modern EDR(s) - RedOps
👍1
Don't Click That ZIP File! Phishers Weaponizing .ZIP Domains to Trick Victims https://thehackernews.com/2023/05/dont-click-that-zip-file-phishers.html
Fortinet Series 1 — Analysis of CVE-2022–40684 https://medium.com/@INTfinity/fortinet-series-1-analysis-of-cve-2022-40684-88870994e6e0
Medium
Fortinet Series 1 — Analysis of CVE-2022–40684
Introduction
FortiOS, FortiProxy, and FortiSwitchManager Authentication Bypass Technical Deep Dive (CVE-2022-40684) https://www.horizon3.ai/fortios-fortiproxy-and-fortiswitchmanager-authentication-bypass-technical-deep-dive-cve-2022-40684/
Horizon3.ai
FortiOS, FortiProxy, and FortiSwitchManager Authentication Bypass Technical Deep Dive (CVE-2022-40684)
Fortinet recently patched a critical authentication bypass vulnerability that gives an attacker the ability to login as an administrator,
Fortigate - Authentication Bypass Lead to Full Device Takeover https://labs.hakaioffsec.com/fortigate-authentication-bypass/
Hakai Offensive Security
Fortigate - Authentication Bypass Lead to Full Device Takeover
1Day vulnerability research by Hakai - Research Team
This post is about the journey to create a Proof-of-concept about CVE-2022-40684, this vulnerability has been assigned by Fortinet as an authentication bypass using an alternate path or channel vulnerability…
This post is about the journey to create a Proof-of-concept about CVE-2022-40684, this vulnerability has been assigned by Fortinet as an authentication bypass using an alternate path or channel vulnerability…
COMPSCI 390R
Reverse Engineering & Vulnerability Analysis (lectures and other material) https://pwn.umasscybersec.org/
Reverse Engineering & Vulnerability Analysis (lectures and other material) https://pwn.umasscybersec.org/
PentestGPT - A GPT-empowered Penetration Testing Tool https://www.kitploit.com/2023/05/pentestgpt-gpt-empowered-penetration.html
KitPloit - PenTest & Hacking Tools
PentestGPT - A GPT-empowered Penetration Testing Tool
Analysis of Attack Cases: From Korean VPN Installations to MeshAgent Infections https://asec.ahnlab.com/en/53267/
ASEC
Analysis of Attack Cases: From Korean VPN Installations to MeshAgent Infections - ASEC
Analysis of Attack Cases: From Korean VPN Installations to MeshAgent Infections ASEC
Shedding light on AceCryptor and its operation https://www.welivesecurity.com/2023/05/25/shedding-light-acecryptor-operation/
WeLiveSecurity
Shedding light on AceCryptor and its operation
ESET researchers reveal details about a prevalent cryptor that operates as a cryptor-as-a-service and is used by tens of malware families.
New macOS vulnerability, Migraine, could bypass System Integrity Protection https://www.microsoft.com/en-us/security/blog/2023/05/30/new-macos-vulnerability-migraine-could-bypass-system-integrity-protection/
Microsoft News
New macOS vulnerability, Migraine, could bypass System Integrity Protection
A new vulnerability could allow an attacker with root access to bypass SIP in macOS and perform arbitrary operations on a device.
STARFACE: Authentication with Password Hash Possible https://www.redteam-pentesting.de/en/advisories/rt-sa-2022-004/-starface-authentication-with-password-hash-possible
www.redteam-pentesting.de
RedTeam Pentesting - STARFACE: Authentication with Password Hash Possible
RedTeam Pentesting discovered that the web interface of STARFACE as well as its REST API allows authentication using the SHA512 hash of the password instead of the cleartext password. While storing password hashes instead of cleartext passwords in an application’s…
Printerlogic multiple vulnerabilities https://seclists.org/fulldisclosure/2023/May/16
seclists.org
Full Disclosure: Printerlogic multiple vulnerabilities