Channel Public Channel

Alaid TechThread

@offensive_thread

Vulnerability discovery, threat intelligence, reverse engineering, AppSec

Open in Telegram

Subscribers: 1.14K
Photos: 7
Videos: 2
Links: 1.4K

Showing posts older than #960 · Back to latest

Older Posts 20 shown

Post #959 66 Sep 1, 2020, 10:59 UTC

A Voyage to Uncovering Telemetry: Identifying RPC Telemetry for Detection Engineers

https://ipc-research.readthedocs.io/en/latest/subpages/RPC.html

Post #958 69 Aug 31, 2020, 20:12 UTC

Smart Greybox Fuzzing

https://thuanpv.github.io/publications/TSE19_aflsmart.pdf

Post #957 60 Aug 31, 2020, 18:01 UTC

Malware Development Pt. 1: Dynamic Module Loading in Go

https://posts.specterops.io/malware-development-pt-1-dynamic-module-loading-in-go-1121f07f3a5a

SpecterOps Blog Your new best friend: Introducing BloodHound Community Edition!

Post #956 53 Aug 28, 2020, 19:39 UTC

Grafana <= 6.4.3 Arbitrary File Read

https://swarm.ptsecurity.com/grafana-6-4-3-arbitrary-file-read/

PT SWARM Grafana 6.4.3 Arbitrary File Read An article about an Arbitrary File Read vulnerability (CVE-2019-19499) in Grafana

Post #955 48 Aug 28, 2020, 19:17 UTC

Hook system calls on Windows by using Kaspersky's hypervisor

https://github.com/iPower/KasperskyHook

GitHub GitHub - iPower/KasperskyHook: Hook system calls on Windows by using Kaspersky's hypervisor Hook system calls on Windows by using Kaspersky's hypervisor - iPower/KasperskyHook

Post #954 58 Aug 25, 2020, 12:27 UTC

Wireshark Tutorial: Decrypting HTTPS Traffic

https://unit42.paloaltonetworks.com/wireshark-tutorial-decrypting-https-traffic/

Unit 42 Wireshark Tutorial: Decrypting HTTPS Traffic This short Wireshark tutorial explains decrypting HTTPS traffic, including when you can accomplish it and how to do it.

Post #953 47 Aug 23, 2020, 09:42 UTC

Introduction to Windows tokens for security practitioners

https://www.elastic.co/blog/introduction-to-windows-tokens-for-security-practitioners

Elastic Blog Introduction to Windows tokens for security practitioners Windows access token manipulation attacks are well known and abused from an offensive perspective, but rely on an extensive body of arcane Windows security internals. In this blog post, we demystify h...

Post #952 53 Aug 19, 2020, 20:57 UTC

Windows .Net Core SDK elevation of privilege

https://itm4n.github.io/dotnet-sdk-eop/

itm4n’s blog Windows .Net Core SDK Elevation of Privilege There was a weird bug in the DotNet Core Toolset installer that allowed any local user to elevate their privileges to SYSTEM. In this blog post, I want to share the details of this bug that was silently (but only partially) fixed despite not being acknowledged…

Post #951 47 Aug 18, 2020, 10:32 UTC

Death from Above: Lateral Movement from Azure to On-Prem AD

https://posts.specterops.io/death-from-above-lateral-movement-from-azure-to-on-prem-ad-d18cb3959d4d

Medium Death from Above: Lateral Movement from Azure to On-Prem AD I’ve been looking into Azure attack primitives over the past couple of months to gain a better understanding of how the system works, what…

Post #950 42 Aug 17, 2020, 16:27 UTC

FireWalker: A New Approach to Generically Bypass User-Space EDR Hooking

https://www.mdsec.co.uk/2020/08/firewalker-a-new-approach-to-generically-bypass-user-space-edr-hooking/

MDSec FireWalker: A New Approach to Generically Bypass User-Space EDR Hooking - MDSec Introduction During red team engagements, it is not uncommon to encounter Endpoint Defence & Response (EDR) / Prevention (EDP) products that implement user-land hooks to gain insight in to a...

👍 1

Post #949 42 Aug 16, 2020, 22:13 UTC

PowerSharpPack. Many usefull offensive CSharp Projects wraped into Powershell

https://github.com/S3cur3Th1sSh1t/PowerSharpPack

GitHub GitHub - S3cur3Th1sSh1t/PowerSharpPack Contribute to S3cur3Th1sSh1t/PowerSharpPack development by creating an account on GitHub.

Post #948 68 Aug 12, 2020, 19:48 UTC

Hunting for SQL injections (SQLis) and Cross-Site Request Forgeries (CSRFs) in WordPress Plugins

https://medium.com/tenable-techblog/hunting-for-sql-injections-sqlis-and-cross-site-request-forgeries-csrfs-in-wordpress-plugins-632dafc9cd2f

Medium Hunting for SQL injections (SQLis) and Cross-Site Request Forgeries (CSRFs) in WordPress Plugins This is a detailed overview of the bugs found while reviewing the source code of WordPress plugins. I cover 3 reported vulnerabilities…

Post #947 46 Aug 12, 2020, 10:56 UTC

Windows Print Spooler patch bypass re-enables persistent backdoor

https://www.zerodayinitiative.com/blog/2020/8/11/windows-print-spooler-patch-bypass-re-enables-persistent-backdoor

Zero Day Initiative Zero Day Initiative — Windows Print Spooler Patch Bypass Re-Enables Persistent Backdoor In May 2020, Microsoft patched CVE-2020-1048 , a critical privilege escalation bug in Windows. Through this vulnerability, an attacker with the ability to execute low-privileged code on a Windows machine can easily establish a persistent backdoor, allowing…

Post #946 42 Aug 12, 2020, 10:55 UTC

CVE-2020-1048, CVE-2020-1337. Bugs in Windows Print Spooler

https://github.com/SafeBreach-Labs/Spooler

DEF CON Safe Mode Talk by SafeBreach Labs:
https://youtu.be/RvABLQpiZks

GitHub SafeBreach-Labs/Spooler Contribute to SafeBreach-Labs/Spooler development by creating an account on GitHub.

Post #945 41 Aug 11, 2020, 16:31 UTC

Noctilucent, tool for Domain Fronting using TLS 1.3

https://github.com/SixGenInc/Noctilucent

DEF CON Safe Mode Talk:
https://youtu.be/TDg092qe50g

GitHub GitHub - SixGenInc/Noctilucent: Using TLS 1.3 to evade censors, bypass network defenses, and blend in with the noise Using TLS 1.3 to evade censors, bypass network defenses, and blend in with the noise - SixGenInc/Noctilucent

Post #944 43 Aug 11, 2020, 09:56 UTC

CVE-2020-11518 Unauthenticated RCE in ADSelfService Plus

https://honoki.net/2020/08/10/cve-2020-11518-how-i-bruteforced-my-way-into-your-active-directory/

Post #943 64 Aug 3, 2020, 21:36 UTC

Applied Purple Teaming Threat Optics Lab - Azure Terraform

https://github.com/DefensiveOrigins/APT-Lab-Terraform

GitHub GitHub - DefensiveOrigins/APT-Lab-Terraform: Purple Teaming Attack & Hunt Lab - Terraform Purple Teaming Attack & Hunt Lab - Terraform. Contribute to DefensiveOrigins/APT-Lab-Terraform development by creating an account on GitHub.

Post #942 77 Jul 26, 2020, 07:18 UTC

Hunting for bugs in VirtualBox

http://blog.paulch.ru/2020-07-26-hunting-for-bugs-in-virtualbox-first-take.html

Post #941 98 Jul 23, 2020, 20:50 UTC

Attacking MS Exchange Web Interfaces

https://swarm.ptsecurity.com/attacking-ms-exchange-web-interfaces/

Post #940 68 Jul 22, 2020, 20:26 UTC

SharePoint and Pwn :: Remote Code Execution Against SharePoint Server Abusing DataSet (CVE-2020-1147)

https://srcincite.io/blog/2020/07/20/sharepoint-and-pwn-remote-code-execution-against-sharepoint-server-abusing-dataset.html

Older posts →