2024-02-17 // Recent cybersecurity developments include NullSection, a tool for nullifying ELF binary headers to hinder reverse engineering; a process for exploiting an RCE in Splunk Enterprise with a malicious XSL file for reverse shell execution; Burp Suite’s Sessionless extension for manipulating signed web tokens and simulating authorization attacks; guidelines for creating fake identities and secure work environments for OSINT; Echotrail’s identification of common Windows processes for app permissions; The ThreatHunting Project, a resource for cyber threat hunting techniques; The Vergilius Project’s insights into Windows kernel structures; vulnerabilities in TPMs for attestation and encryption; an exploit in Microsoft Outlook (CVE-2024-21413) for password hash theft; and the WEB-Wordlist-Generator for creating defense wordlists against cyber attacks. [more...]

2024-02-16 // Today, a PoC for an RCE vulnerability in Empire C2 framework versions before 5.9.3, the WEB-Wordlist-Generator tool for creating targeted cyber defense wordlists, ADExplorerSnapshot.py for parsing Active Directory snapshots into BloodHound for security analysis, an analysis of DJI Pilot app’s ART hijacking mechanism and unpacking method using DxFx, Python-Backdoor, a cross-platform tool for remote access with multiple features, Ubuntu’s command-not-found package potentially suggesting malicious snap packages, ICSrank for assessing security of industrial internet-connected devices, NipeJS for identifying JavaScript leaks, a study on deceptive language models in the sleeper-agents-paper, SploitScan for vulnerability identification and prioritization, DarkCool for penetration testing and forensic analysis, 0up for encrypted file-sharing, sdcampbell/nmapurls for parsing Nmap XML reports, and a PoC exposing a vulnerability in Xiaomi’s HyperOS bootloader unlock restrictions. [more...]

2024-02-15 // Today, ESC13 introduces a method exploiting Active Directory Certificate Services for privilege escalation through certificate issuance linked to group memberships. Secbutler, a command-line utility, simplifies tasks for cybersecurity professionals, covering reverse shell command generation and more. The rust-shellcode and XC utilities demonstrate innovative approaches in shellcode execution and reverse shell capabilities, respectively, enhancing methods to bypass antivirus detection and facilitate file transfers. Notable findings include a remote buffer overflow vulnerability in wpa_supplicant for Android, and HarfangLab’s insights into reverse engineering .NET AOT applications. IOCTLance showcases vulnerability identification in Windows Driver Model drivers using symbolic execution. Techniques for executing Browser In The Browser (BITB) phishing attacks and the exploitation of various software vulnerabilities, including CVE-2022-20186 in Android Mali GPU drivers and CVE-2023-6546 in the Linux kernel, highlight the evolving landscape of cybersecurity threats and defenses. These contributions, along with tools for LDAP monitoring, Drupal vulnerability exploitation, and Linux persistence, underscore the continuous development and diversification of cybersecurity practices. [more...]

2024-02-14 // Marcus Hutchins introduced EDR-Preloading to run code secretly before security systems start. Domainim is a new tool for finding web security risks, including checking hostnames and ports. A flaw in the Laravel PHP framework lets hackers run code from afar, urging updates for safety. Techniques for analyzing RedLine stealer malware were shared. TInjA helps find website vulnerabilities. A WinRAR exploit showshow hackers can sneakily run harmful code. The CVE-2024-23897 bug in Jenkins could let someone remotely control systems, highlighting the need for good security. Rick Ramgattie found exposed RazorPay API keys on GitHub, showing why secure coding is crucial. Webhood is a new tool for checking website safety. There are new methods to patch .NET functions to avoid detection. Wildcard-mail-finder and nrich help find email patterns and scan for vulnerabilities. APKLeaks scans Android apps for hidden data, focusing on privacy. DFSCoerce-exe allows using different login details for security, and ShellSweep finds potential webshells to protect servers. A demo for CVE-2022-36553 shows how to exploit certain vulnerabilities for learning. Finally, Swarm offers cloud-based security scanning, showing advancements in cybersecurity tools. [more...]

2024-02-13 // Today, a new way to turn off Windows Defender, a computer’s guard against viruses. There’s a tool named go-secdump that can find computer secrets from far away. Z-Labs made a new tool to help test computer security across different systems. There are tips for secretly checking computers without getting caught. Netlas.io helps find weaknesses in computer networks. There’s also a way to hide when looking through directories to stay unnoticed. Lastly, CookieBlock helps control which website cookies can stay on your browser, keeping your internet use private. [more...]