Cordyceps: C++ self-Injecting dropper based on various EDR evasion techniques.
This project consists of a simple C++ self-Injecting dropper focused on EDR evasion. To implement it, I have combined the use of Windows Thread Pooling to hide the call stack and the use of indirect syscalls to avoid hooking in the NTDLL.
● Thought of sharing: There are high changes that I will reject a candidate in an interview, if they are a bug-bounty hunter.
Following are some reasons for most and not all the hunters.
1. They are technically not sound. They only have limited information about the bug they identified or they usually identify like web based attacks or sometimes mobile apps.
2. They are mostly check-lists and tool reliant people.
3. They know very few bugs and start spraying on multiple targets. They are nuclei attackers (maybe this is a right term to have them associated).
4. They omit hard bugs almost always. They go for easy rewarding bugs. And not for zero-days or tricky RCEs.
5. Most hunters cannot perform a pentest. Since they're good (not in depth though) in specific bug or set of bugs.
6. Most of them are not researchers (as they are often called). They do not have patents, CVEs or published researches.
On the other hand, some top CTF players are excellent. And those who perform research are good for the job.
In an interview, I ask candidate what vulnerability class or type they are comfortable. They choose the easiest like IDOR or XSS or even SQLi. And are almost always web based attacks.
And then I ask them to tell me what mutation or universal XSS is. They be; we know reflected and stored and a bit about DOM (since they automate DOM).
For SQLi, 90% rely upon SQL-Map. The remaining use single quote combos 😂
If this skillset is at my gate. I'll choose to outsource through hacker-one; since they have bounty hunters.
I would need something more professional in the organisation to find issues. Because our goal is not to protect against nuclei templates but APT groups' that are nation-state.
cKure Red pinned «Telegram policy violated privacy 🔏 as the platform mentions that any government with "high democracy index" can request information of any telegram account and telegram shall comply with IP address of the username. The following thread from Kashmir deals…»
Telegram policy violated privacy 🔏 as the platform mentions that any government with "high democracy index" can request information of any telegram account and telegram shall comply with IP address of the username.
The following thread from Kashmir deals with such a request from telegram. Forget a similar incident was reported by the Dutch.
In a first, spyware is found on phone of prominent Russian journalist.
● This is highly likely that Russia deployed the same Zero-Day vulnerability in the (almost) publicly available mobile application hosting a false flag Cyber-Attack on the victim.
cKure Red pinned «United States: Cyber-Terrorism; Washington DC-based group targeted in apparent Pegasus hack by NSO Group (an Israeli state sponsored cyber-terrorist organization). Citizen Lab discovers alleged attack using ‘zero-click exploit’ on individual employed by DC…»
United States: Cyber-Terrorism; Washington DC-based group targeted in apparent Pegasus hack by NSO Group (an Israeli state sponsored cyber-terrorist organization).
Citizen Lab discovers alleged attack using ‘zero-click exploit’ on individual employed by DC organization.
cKure Red pinned «MalDoc in PDF - Detection bypass by embedding a malicious Word file into a PDF file. https://blogs.jpcert.or.jp/en/2023/08/maldocinpdf.html»
AnonFiles, the anonymous file upload and sharing website, has decided to call it a quits today. When attempting to visit their website you are greeted with a farewell message.
