Security Operations

Decrypted: Rhysida Ransomware - "we are now publicly releasing our decryptor for download to all victims of the Rhysida ransomware"::The team at Avast has developed a decryptor for the Rhysida ransomware and released it for public download. The Rhysida ransomware has been active since May 2023. As of Feb 2024, their TOR site lists 78 attacked companies, including IT (Information Technology) sector, healthcare, universities, and government organizations.

Breach Analysis: APT29’s Attack on Microsoft - Password Spray & OAuth abuse.::undefined

Troy Hunt: How Spoutible’s Leaky API Spurted out a Deluge of Personal Data::Ever hear one of those stories where as it unravels, you lean in ever closer and mutter “No way! No way! NO WAY!” This one, as far as infosec stories go, had me leaning and muttering like never before. Here goes:

Last week, someone reached out to me with what

JSON Smuggling: A far-fetched intrusion detection evasion technique::undefined

Shellcode evasion using Wasm/Wat and Rust::undefined

ShmooCon 2024 Videos are up!::ShmooCon 2024by Shmoo Group, various presentersThe videos in this collection are from ShmooCon 2024, which occurred on 12 - 14 January 2024, at the Washington...

apk.sh makes reverse engineering Android apps easier, automating some repetitive tasks like pulling, decoding, rebuilding and patching an APK.::apk.sh makes reverse engineering Android apps easier, automating some repetitive tasks like pulling, decoding, rebuilding and patching an APK. - GitHub - ax/apk.sh: apk.sh makes reverse engineering Android apps easier, automating some repetitive tasks like pulling, decoding, rebuilding and patching an APK.

Trends in Phishing, Fraud, 'Dark AI Models', and how to better protect yourself.::We guard your domain, so you have peace of mind. Threat Visibility Platform.

How I Hacked My Air Purifier to Remove Cloud Dependency [Detailed Write-Up]::undefined

Deluder: Python utility for intercepting traffic of applications. Deluder can be used as an alternative for EchoMirage. It supports OpenSSL, GnuTLS, SChannel, WinSock and Linux Sockets out of the b...::Deluder is a tool for intercepting traffic of proxy unaware applications. Currently, Deluder supports OpenSSL, GnuTLS, SChannel, WinSock and Linux Sockets out of the box. ⚡ - GitHub - Warxim/deluder: Deluder is a tool for intercepting traffic of proxy unaware applications. Currently, Deluder supports OpenSSL, GnuTLS, SChannel, WinSock and Linux Sockets out of the box. ⚡

AnyDesk Incident Response 2-2-2024::undefined

Your Security Program Is Shit::Very shit

Frog4Shell — FritzFrog Botnet Adds One-Days to Its Arsenal::undefined

Leaky Vessels: Docker and runc Container Breakout Vulnerabilities - January 2024::Snyk Security Labs Team has identified four container breakout vulnerabilities in core container infrastructure components including Docker and runc, which also impacts Kubernetes.

CVE-2023-6246: Heap-based buffer overflow in the glibc's syslog()::undefined

New Visual Studio Code plugin for IaC security (plus collaboration, semgrep integration)::Introducing PoIEx - Points Of Intersection Explorer

Hunting for (Un)authenticated n-days in Asus Routers - Shielder::Notes on patch diffing, reverse engineering and exploiting CVE-2023-39238, CVE-2023-39239, and CVE-2023-39240.

Your Firewalls and Proxies are about to be blind to real TLS destinations: Learn about Encrypted Client Hello::undefined

“Scammers Paradise” —Exploring Telegram’s Dark Markets, Breeding Ground for Modern Phishing Operations::undefined

NMAP-formatter: convert NMAP results to HTML, CSV, JSON, graphviz (dot), SQLite::A tool that allows you to convert NMAP results to html, csv, json, markdown, graphviz (dot) or sqlite. Simply put it's nmap converter. - GitHub - vdjagilev/nmap-formatter: A tool that allows you to convert NMAP results to html, csv, json, markdown, graphviz (dot) or sqlite. Simply put it's nmap converter.

Microsoft, HPE hacks by Russia are just the tip of the iceberg - Microsoft said late Thursday that it had found more victims and was in the process of notifying them.::undefined

How I hacked chess.com::Playing Chess is one of the many hobbies I like to do in my spare time, apart from tinkering around with technology. However, I'm not very good at it, and after losing many games, I decided to see if I could do something I'm much better at; hacking the system!

CVE-2024-23897 Jenkins CLI PoC::undefined

New Zyxel RCE Vulnerability allows remote attackes execute commands as root!::undefined

Methodology - Security Research: How we discovered over 18,000 API secret tokens & $20M in Stripe tokens::Our security team scanned 189.5M URLs and found more than 18,000 exposed API secrets. Discover the methodology that led us to these findings.