⭕️شرکت امنیتی سوفِس در گزارشی از کمپین یک #بدافزار اندرویدی علیه مشتریان چهار بانک ایرانی خبر داد. این چهار بانک عبارتند از بانکهای ملت، صادرات، رسالت و بانک مرکزی.
این بدافزار امکان سرقت نام کاربری و پسورد حسابهای بانکی و خواندن پیامک کاربران را دارد. نکته مهم دیگه درباره این بدافرار استفاده از یک گواهی دیجیتالی احتمالا بسرقت رفته از یک شرکت در مالزی است که برای قراردادن بدافرار در گوگل پلی استفاده شده است.
همچنین از اونجاییکه نام تعدادی اَپ کریپتو در سورس کد بدافزار قرار داره، احتمالا سازنده های این بدافزار اهداف بزرگتری در سر داشته اند.
https://news.sophos.com/en-us/2023/07/27/uncovering-an-iranian-mobile-malware-campaign/
https://github.com/sophoslabs/IoCs/blob/master/Iranian-banking-malware.csv
#malware #mobile #android
@Engineer_Computer
این بدافزار امکان سرقت نام کاربری و پسورد حسابهای بانکی و خواندن پیامک کاربران را دارد. نکته مهم دیگه درباره این بدافرار استفاده از یک گواهی دیجیتالی احتمالا بسرقت رفته از یک شرکت در مالزی است که برای قراردادن بدافرار در گوگل پلی استفاده شده است.
همچنین از اونجاییکه نام تعدادی اَپ کریپتو در سورس کد بدافزار قرار داره، احتمالا سازنده های این بدافزار اهداف بزرگتری در سر داشته اند.
https://news.sophos.com/en-us/2023/07/27/uncovering-an-iranian-mobile-malware-campaign/
https://github.com/sophoslabs/IoCs/blob/master/Iranian-banking-malware.csv
#malware #mobile #android
@Engineer_Computer
🔥4👍2🤯1
Malicious ISO File Leads to Domain Wide Ransomware
Link : https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware
@Engineer_Computer
Link : https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware
@Engineer_Computer
ManageEngine JDBC RCE
Blog : https://xz.aliyun.com/t/12380
Repo : https://github.com/Kyo-w/ManageEngineRce
@Engineer_Computer
Blog : https://xz.aliyun.com/t/12380
Repo : https://github.com/Kyo-w/ManageEngineRce
@Engineer_Computer
ALPHV Ransomware Affiliate Targets Vulnerable Backup Installations to Gain Initial Access
Link : https://www.mandiant.com/resources/blog/alphv-ransomware-backup
@Engineer_Computer
Link : https://www.mandiant.com/resources/blog/alphv-ransomware-backup
@Engineer_Computer
keepass-password-dumper.zip
182 KB
🔓KeePass 2.X Master Password Dumper (CVE-2023-32784)
KeePass Master Password Dumper is a simple PoC tool used to dump the master password from KeePass's memory. Apart from the first password character, it is mostly able to recover the password in plaintext. No code execution on the target system is required, just a memory dump. It doesn't matter where the memory comes from - can be the process dump, swap file (pagefile.sys), hibernation file (hiberfil.sys) or RAM dump of the entire system. It doesn't matter whether or not the workspace is locked. It is also possible to dump the password from RAM after KeePass is no longer running, although the chance of that working goes down with the time it's been since then.
@Engineer_Computer
KeePass Master Password Dumper is a simple PoC tool used to dump the master password from KeePass's memory. Apart from the first password character, it is mostly able to recover the password in plaintext. No code execution on the target system is required, just a memory dump. It doesn't matter where the memory comes from - can be the process dump, swap file (pagefile.sys), hibernation file (hiberfil.sys) or RAM dump of the entire system. It doesn't matter whether or not the workspace is locked. It is also possible to dump the password from RAM after KeePass is no longer running, although the chance of that working goes down with the time it's been since then.
@Engineer_Computer
CVE-2023-27363.pdf
443.4 KB
🔥🔥🔥Foxit PDF Reader exportXFAData Exposed Dangerous Method RCE Vulnerability
(CVE-2023-27363) - PoC here.
PoC is deeply based in the previous work made by Sebastian Apelt aka bitshifter123 and publicly available in this repository. So this exploits a path traversal vuln (four backslashes) + arbitrary file write (HTA)
@Engineer_Computer
(CVE-2023-27363) - PoC here.
PoC is deeply based in the previous work made by Sebastian Apelt aka bitshifter123 and publicly available in this repository. So this exploits a path traversal vuln (four backslashes) + arbitrary file write (HTA)
@Engineer_Computer
foxit_cve_2023-27363_extracted.js
9.4 KB
timeout = app.setTimeOut("event.target.exportXFAData({cPath: \"/c/users/\" + identity.loginName + \"/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/evil.hta\"});
@Engineer_Computer
@Engineer_Computer
Mastering Bug Bounty.zip
895.3 KB
🔴 Mastering Bug Bounty: A Comprehensive Handbook for Ethical Hackers, authored by Aaron Rodriguez
@Engineer_Computer
@Engineer_Computer
The Red Team Guide.pdf
12.1 MB
The Red Team Guide.A practical guide for Red Teams and Offensive Security 241pages
@Engineer_Computer
@Engineer_Computer
Pentah0wnage: Pre-Auth RCE in Pentaho Business Analytics Server
Link : https://research.aurainfosec.io/pentest/pentah0wnage
@Engineer_Computer
Link : https://research.aurainfosec.io/pentest/pentah0wnage
@Engineer_Computer
Remote Code Execution Vulnerability in Azure Pipelines
Link : https://www.legitsecurity.com/blog/remote-code-execution-vulnerability-in-azure-pipelines-can-lead-to-software-supply-chain-attack
@Engineer_Computer
Link : https://www.legitsecurity.com/blog/remote-code-execution-vulnerability-in-azure-pipelines-can-lead-to-software-supply-chain-attack
@Engineer_Computer
Malicious Self-Extracting Archives
Link : https://www.crowdstrike.com/blog/self-extracting-archives-decoy-files-and-their-hidden-payloads
@Engineer_Computer
Link : https://www.crowdstrike.com/blog/self-extracting-archives-decoy-files-and-their-hidden-payloads
@Engineer_Computer
Australian Open Source Intelligence Gathering Resources, Australias Largest Open Source Intelligence Repository for Cyber Professionals and Ethical Hackers
https://github.com/DFW1N/DFW1N-OSINT/
@Engineer_Computer
https://github.com/DFW1N/DFW1N-OSINT/
@Engineer_Computer
GitHub
GitHub - DFW1N/DFW1N-OSINT: Australian Open Source Intelligence Gathering Resources, …
Australian Open Source Intelligence Gathering Resources, Australias Largest Open Source Intelligence Repository for Cybe...
ELINT.pdf
563.7 KB
📡The E-Intelligence System
"Electronic Intelligence (ELINT), often known as E-Intelligence, is intelligence obtained through electronic sensors. Other than personal communications, ELINT intelligence is usually obtained. The goal is usually to determine a target's capabilities, such as radar placement. Active or passive sensors can be employed to collect data. A provided signal is analyzed and contrasted to collected data for recognized signal types.
The information may be stored if the signal type is detected; it can be classed as new if no match is found. ELINT collects and categorizes data. In a military setting (and others that have adopted the usage, such as a business), intelligence helps an organization make decisions that can provide them a strategic advantage over the competition. The term "intel" is frequently shortened. The two main subfields of signals intelligence (SIGINT) are ELINT and Communications Intel (COMINT)."
#Intelligence #SIGINT #ELINT #radar #signal #Electronic_Warfare #UAV #ESM
"Electronic Intelligence (ELINT), often known as E-Intelligence, is intelligence obtained through electronic sensors. Other than personal communications, ELINT intelligence is usually obtained. The goal is usually to determine a target's capabilities, such as radar placement. Active or passive sensors can be employed to collect data. A provided signal is analyzed and contrasted to collected data for recognized signal types.
The information may be stored if the signal type is detected; it can be classed as new if no match is found. ELINT collects and categorizes data. In a military setting (and others that have adopted the usage, such as a business), intelligence helps an organization make decisions that can provide them a strategic advantage over the competition. The term "intel" is frequently shortened. The two main subfields of signals intelligence (SIGINT) are ELINT and Communications Intel (COMINT)."
#Intelligence #SIGINT #ELINT #radar #signal #Electronic_Warfare #UAV #ESM
StackRot.zip
11.5 MB
🔥🔥🔥exploitation write-up & exploit code of StackRot (CVE-2023-3269) now available(Github repo)!
@Engineer_Computer
@Engineer_Computer