Channel Public Channel

Alaid TechThread

@offensive_thread

Vulnerability discovery, threat intelligence, reverse engineering, AppSec

Open in Telegram

Subscribers: 1.14K
Photos: 7
Videos: 2
Links: 1.4K

Showing posts older than #599 · Back to latest

Older Posts 20 shown

Post #598 41 Jun 26, 2019, 08:25 UTC

Атаки на IPC в Kaspersky

https://blog.silentsignal.eu/2019/06/24/self-defenseless-exploring-kasperskys-local-attack-surface/

Post #597 56 Jun 24, 2019, 12:23 UTC

How I Hacked the Microsoft Outlook Android App and Found CVE-2019-1105
https://www.f5.com/labs/articles/threat-intelligence/how-i-hacked-the-microsoft-outlook-android-app-and-found-cve-2019-1105#.XRCqdjj5OfA.twitter

F5 Labs How I Hacked the Microsoft Outlook Android App and Found CVE-2019-1105 It looked like a simple XSS in the Outlook Android app, but the app developers couldn’t reproduce it so they didn’t fix it. Then things got interesting. Here’s the story of how I discovered CVE-2019-1105.

Post #596 53 Jun 20, 2019, 15:00 UTC

Реализация файловой системы поверх системных артефактов (Windows и macOS)

https://github.com/SafeBreach-Labs/AltFS

GitHub GitHub - SafeBreach-Labs/AltFS: The Alternative Fileless File System The Alternative Fileless File System. Contribute to SafeBreach-Labs/AltFS development by creating an account on GitHub.

Post #595 61 Jun 17, 2019, 07:17 UTC

Шпаргалка по форензике на Windows
https://jpminty.github.io//cheatsheet/DFIR/#

Jai Minton Digital Forensics and Incident Response Cheatsheet containing a variety of commands and concepts relating to digital forensics and incident response.

Post #594 62 Jun 16, 2019, 17:25 UTC

Энциклопедия известных группировок

https://github.com/blackorbird/APT_REPORT/blob/master/Threat%20Group%20Cards.pdf

GitHub APT_REPORT/Threat Group Cards.pdf at master · blackorbird/APT_REPORT Interesting APT Report Collection And Some Special IOC - blackorbird/APT_REPORT

Post #593 57 Jun 14, 2019, 13:16 UTC

AESDDoS Botnet Malware Infiltrates Containers via Exposed Docker APIs
https://blog.trendmicro.com/trendlabs-security-intelligence/aesddos-botnet-malware-infiltrates-containers-via-exposed-docker-apis/

Trend Micro AESDDoS Botnet, Containers, Exposed Docker APIs An API misconfiguration in the open-source version of the popular DevOps tool Docker Engine-Community allows attackers to infiltrate containers and run a variant of AESDDoS.

Post #592 55 Jun 14, 2019, 08:22 UTC

Exploiting CVE-2019-1040 - Combining relay vulnerabilities for RCE and Domain Admin
https://dirkjanm.io/exploiting-CVE-2019-1040-relay-vulnerabilities-for-rce-and-domain-admin/

dirkjanm.io Exploiting CVE-2019-1040 - Combining relay vulnerabilities for RCE and Domain Admin Earlier this week, Microsoft issued patches for CVE-2019-1040, which is a vulnerability that allows for bypassing of NTLM relay mitigations. The vulnerability was discovered by Marina Simakov and Yaron Zinar (as well as several others credited in the Microsoft…

Post #591 51 Jun 13, 2019, 10:17 UTC

RAMBleed
Reading Bits in Memory Without Accessing Them
https://rambleed.com/

Post #590 46 Jun 13, 2019, 10:15 UTC

Digging up the Past: OS X File Versioning
https://versprite.com/blog/security-research/file-versioning-mac-os-x/

VerSprite Digging up the Past: OS X File Versioning In this case study of OS X digital forensics, we were tasked to recover the version history of documents created using Apple’s TextEdit application.

Post #589 6 Jun 12, 2019, 17:53 UTC

Forwarded from r0 Crew (Channel)

Heap Overflow Exploitation on Windows 10 Explained https://blog.rapid7.com/2019/06/12/heap-overflow-exploitation-on-windows-10-explained/ #exploitation #dukeBarman

Post #588 36 Jun 12, 2019, 09:41 UTC

https://blog.preempt.com/security-advisory-critical-vulnerabilities-in-ntlm

Post #587 41 Jun 11, 2019, 07:56 UTC

Want to take over the Java ecosystem? All you need is a MITM!
https://medium.com/@jonathan.leitschuh/want-to-take-over-the-java-ecosystem-all-you-need-is-a-mitm-1fc329d898fb

Medium Want to take over the Java ecosystem? All you need is a MITM! Hundreds of incredibly popular and widely deployed Java libraries & JVM compilers are still downloading their dependencies over HTTP with…

Post #586 36 Jun 11, 2019, 04:03 UTC

Bypass XSS filters using JavaScript global variables
https://www.secjuice.com/bypass-xss-filters-using-javascript-global-variables/

Secjuice bypass-xss-filters-using-javascript-global-variables In this article, theMiddle discusses the many possibilities to exploit a reflected (or even stored) XSS when there are filters or WAF's protecting the website.

Post #585 43 Jun 7, 2019, 07:01 UTC

https://github.com/ramshans/2019-Security-Data-Science-Colloquium-?files=1

GitHub ramshans/2019-Security-Data-Science-Colloquium- Slides and material from 2019 Security Data Science Colloquium hosted by Microsoft - ramshans/2019-Security-Data-Science-Colloquium-

Post #584 60 Jun 5, 2019, 09:26 UTC

The Bible of Kerberos attacks

https://www.tarlogic.com/en/blog/how-to-attack-kerberos

Post #583 63 Jun 5, 2019, 06:20 UTC

Поиск интересных COM объектов

https://www.fireeye.com/blog/threat-research/2019/06/hunting-com-objects.html

Google Cloud Mandiant Cybersecurity Consulting Transform cyber defense with Mandiant. Engage frontline experts for incident response, threat intelligence services, and cyber risk management.

Post #582 40 Jun 4, 2019, 16:32 UTC

Анализ недавнего 0day в Windows

Another Task Scheduler 0day, Another Task Scheduler Micropatch (The SandboxEscaper Saga)
https://blog.0patch.com/2019/06/another-task-scheduler-0day-another.html

0Patch Another Task Scheduler 0day, Another Task Scheduler Micropatch (The SandboxEscaper Saga) Backward Compatibility is Hard, and so is Stacked Impersonation by Simon Raner and Mitja Kolsek, the 0patch Team [Update 6/12/201...

Post #581 40 Jun 4, 2019, 12:09 UTC

macOS 0-Day Flaw Lets Hackers Bypass Security Features With Synthetic Clicks
https://thehackernews.com/2019/06/macOS-synthetic-click.html

Post #580 38 Jun 4, 2019, 06:27 UTC

Обход AMSI и WLDP

https://modexp.wordpress.com/2019/06/03/disable-amsi-wldp-dotnet/

modexp How Red Teams Bypass AMSI and WLDP for .NET Dynamic Code Introduction Previous Research AMSI Example in C AMSI Context AMSI Initialization AMSI Scanning CLR Implementation of AMSI AMSI Bypass A (Patching Data) AMSI Bypass B (Patching Code 1) AMSI Bypass …

Post #579 36 Jun 3, 2019, 19:05 UTC

Разбор уязвимости command injection в Nvidia GeForce Experience

https://rhinosecuritylabs.com/application-security/nvidia-rce-cve-2019-5678/

Rhino Security Labs NVIDIA GeForce Experience OS Command Injection CVE-2019-5678 This post walks through the discovery process of the NVIDIA GeForce Experience OS command injection vulnerability, assigned to CVE-2019-5678.

Older posts →