NetworkSniffer: Log iOS network traffic without a proxy https://github.com/evilpenguin/NetworkSniffer
GitHub
GitHub - evilpenguin/NetworkSniffer: Log iOS network traffic without a proxy
Log iOS network traffic without a proxy. Contribute to evilpenguin/NetworkSniffer development by creating an account on GitHub.
Analysis about the issues happened in Google last Monday » Google Cloud Infrastructure Components Incident #20013 https://status.cloud.google.com/incident/zall/20013#20013004
Architecture of a ransomware (1/2) https://securityshenaningans.medium.com/architecture-of-a-ransomware-1-2-1b9fee757fcb
Medium
Architecture of a ransomware (1/2)
Last couple of months we’ve seen a rise in ransomware related incidents, mostly due to the increase of remote work COVID-19. Nevertheless…
.NET Process injection in a new process with QueueUserAPC using D/invoke - compatible with gadgettojscript https://gist.github.com/jfmaes/944991c40fb34625cf72fd33df1682c0
Gist
.NET Process injection in a new process with QueueUserAPC using D/invoke - compatible with gadgettojscript
.NET Process injection in a new process with QueueUserAPC using D/invoke - compatible with gadgettojscript - DInjectQueuerAPC.cs
Good report on the last events with SolarWinds Orion » Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/
Microsoft News
Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect…
We, along with the security industry and our partners, continue to investigate the extent of the Solorigate attack. While investigations are underway, we want to provide the defender community with intel to understand the scope and impact, remediation guidance…
Discovering, exploiting and shutting down a dangerous Windows print spooler vulnerability https://www.accenture.com/us-en/blogs/cyber-defense/discovering-exploiting-shutting-down-dangerous-windows-print-spooler-vulnerability
Accenture
What We Think | Business & Technology Insights
Accenture thought leadership offers business and technology insights on key market forces & technologies to set your company on the path to value. Learn more.
uafuzz: Binary-level Directed Fuzzing for Use-After-Free Vulnerabilities https://securityonline.info/uafuzz/
Penetration Testing
uafuzz: Binary-level Directed Fuzzing for Use-After-Free Vulnerabilities
uafuzz is a directed fuzzer dedicated to Use-After-Free (UAF) bugs at binary-level by carefully tuning the key components of directed fuzzing
Remote code execution in Elixir-based Paginator https://www.alphabot.com/security/blog/2020/elixir/Remote-code-execution-vulnerability-in-Elixir-based-Paginator-project.html
Alphabot
Remote code execution in Elixir-based Paginator - Alphabot Security
A look at CVE-2020-15150, a remote code execution vulnerability in the Elixir-based Paginator.
Proxying Android app traffic – Common issues / checklist https://blog.nviso.eu/2020/11/19/proxying-android-app-traffic-common-issues-checklist/
NVISO Labs
Proxying Android app traffic – Common issues / checklist (June 2025)
A checklist for intercepting traffic from Android applications using various techniques
PYSA/Mespinoza Ransomware https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/
The DFIR Report
PYSA/Mespinoza Ransomware
Over the course of 8 hours the PYSA/Mespinoza threat actors used Empire and Koadic as well as RDP to move laterally throughout the environment, grabbing credentials from as many systems as possible on the way to their objective. The threat actors took their…
Windows RpcEptMapper Service Insecure Registry Permissions EoP https://itm4n.github.io/windows-registry-rpceptmapper-eop/
itm4n’s blog
Windows RpcEptMapper Service Insecure Registry Permissions EoP
If you follow me on Twitter, you probably know that I developed my own Windows privilege escalation enumeration script - PrivescCheck - which is a sort of updated and extended version of the famous PowerUp. If you have ever run this script on Windows 7 or…
D810: Creating an extensible deobfuscation plugin for IDA Pro https://eshard.com/posts/d810_blog_post_1/
Remote stack overflow in Samsung baseband caused by malformed P-TMSI REALLOCATION COMMAND https://fredericb.info/2020/11/remote-stack-overflow-in-samsung-baseband-caused-by-malformed-p-tmsi-reallocation-command.html
fred's notes
Remote stack overflow in Samsung baseband caused by malformed P-TMSI REALLOCATION COMMAND
Description When Samsung Shannon baseband receives message P-TMSI REALLOCATION COMMAND (9.4.7 in TS 24.008) from network, the length of the Mobile Identity IE (10.5.1.4) is not properly checked. Mobile identity data is directly copied to a stack buffer without…
Mobile App Digital Forensic Analysis: Extract an Android Backup File https://medium.com/bugbountywriteup/extract-an-android-backup-file-96172efd4d86
Medium
Extract an Android Backup File
Mobile App Digital Forensic Analysis
Not good, Activision banned the researcher for studying the secuirty of its networking code :( » Getting Banned for Security Research https://nedwill.github.io/blog/jekyll/update/2020/11/25/banned-for-research.html
nedwill’s security blog
Getting Banned for Security Research
Note that this post does not reflect the opinions of my employer nor my colleagues, and I conducted this research on my own time.
CVE-2020-0022 an Android 8.0-9.0 Bluetooth Zero-Click RCE – BlueFrag https://insinuator.net/2020/04/cve-2020-0022-an-android-8-0-9-0-bluetooth-zero-click-rce-bluefrag/
Microsoft Defender for Identity: Kerberoasting https://thalpius.com/2020/11/30/microsoft-defender-for-identity-kerberoasting/
Microsoft Security Blog
Microsoft Defender for Identity: Kerberoasting
[WARNING] This blog post is created when Microsoft Windows still came in a physical box with multiple installation disks. Microsoft released a new detection this month for Microsoft Defender for Id…
Foundations of a Multi-Cloud Security Strategy https://cloudberry.engineering/article/multi-cloud-security-strategy-foundations/
cloudberry.engineering
Foundations of a Multi-Cloud Security Strategy
I’ve spent a good year working on a security strategy to manage multi-cloud environments, in this article I want to share what I wish we did in advance to be better prepared.
Testing for Directory or Path Traversal Vulnerabilities https://medium.com/bugbountywriteup/testing-for-directory-or-path-traversal-vulnerabilities-dfbe49fdfe92
Medium
Testing for Directory or Path Traversal Vulnerabilities
In this article, we’ll be discussing, how to perform Directory Traversal or Path Traversal attacks, aka “dot-dot-slash”, “directory…
Nice detailed post! » Windows 10 KVAS and Software SMEP https://wumb0.in/windows-10-kvas-and-software-smep.html