🔎CSE для поиска публичных камер наблюдения.

📎https://cybdetective.com/webcamcse.html

📱 Telegram | 🌐 ВК | 📲 MAX

🔎Быстрый поиск URL по кэшу поисковиков и вебархивам

📎https://cybdetective.com/quickcacheandarhivesearch.html

📱 Telegram | 🌐 ВК | 📲 MAX

🔎Flowsint — это инструмент с открытым исходным кодом для исследования графов OSINT, разработанный для этичного проведения расследований, обеспечения прозрачности и проверки.

📎https://github.com/reconurge/flowsint
📎https://www.flowsint.io/

📱 Telegram | 🌐 ВК | 📲 MAX

🔎WireTapper — это инструмент OSINT для анализа беспроводных сетей, который пассивно обнаруживает и отображает на карте сети Wi-Fi, Bluetooth, камеры видеонаблюдения, транспортные средства, наушники, телевизоры, устройства IoT и вышки сотовой связи.

📎https://github.com/h9zdev/WireTapper

📱 Telegram | 🌐 ВК | 📲 MAX

Claw Guard — ClawHub Skill Security Scanner v2

Scans OpenClaw skill directories for malware, prompt injection, data exfiltration, and other security threats.

v2 improvements:

▶️Context-aware analysis: distinguishes "uses .env" vs "steals .env"
▶️Well-known application ports whitelisted (Radarr, Sonarr, Plex, etc.)
▶️Self-scan exclusion (scanner ignores its own detection patterns)
▶️Smarter risk scoring: only counts real threats, not documentation
▶️False positive tags: findings can be marked as likely FP with explanation
▶️VT threshold: 1 detection on 90+ engines = not CRITICAL

Usage:

python3 scan_skill.py <skill_path>
python3 scan_skill.py --batch <path1> <path2> ...
python3 scan_skill.py --json <skill_path>
python3 scan_skill.py --vt <skill_path>
python3 scan_skill.py --vt --vt-key <api_key> <skill_path>
python3 scan_skill.py --vt --no-upload <skill_path>

😈 Telegraph as a Malware Command-and-Control Resolver 😈

What this malware is doing

▶️This malware uses telegra.ph, a publishing platform operated by Telegram, as a dead-drop resolver for its command-and-control (C2) infrastructure.

▶️Instead of hard-coding an IP address or domain, the malware retrieves a public Telegraph page and extracts configuration data from it at runtime.

In this case, the malware fetches a fixed URL:

https://telegra.ph/3657468-10-13

It then parses the HTML and looks specifically for this tag:

<meta property="og:description" content="...">

The value of og:description is expected to contain Base64-encoded data, which is then XOR-decrypted to produce the actual C2 host (IP or domain).

How it works step by step

1️⃣HTTP request to a trusted platform
The malware performs a normal HTTPS GET request to telegra.ph, a domain that is:

▶️widely trusted
▶️rarely blocked
▶️commonly allowed through firewalls

2️⃣ Extraction of metadata instead of page content

Rather than parsing the visible page body, the malware reads the Open Graph metadata (og:description), which is usually ignored by scanners.

3️⃣ Multi-layer decoding

▶️The content is split into tokens
▶️Each token is Base64-decoded
▶️The decoded bytes are XOR-decrypted using a static key
▶️The result is concatenated into a string used as HOST

4️⃣ Dynamic C2 resolution

▶️The resolved host is used for a TCP reverse connection
▶️The malware never stores the C2 address statically

5️⃣ Remote kill / disable

▶️If the Telegraph page is edited (e.g., changed to content="1"), the resolver breaks
▶️This immediately disables all deployed samples without updating them


Why attackers use Telegraph for this

This technique is intentionally designed for resilience and stealth:

▶️C2 infrastructure can be changed instantly
▶️No redeployment of malware is required
▶️Indicators of compromise are minimized
▶️Traffic blends in with legitimate web browsing
▶️Trusted domains evade many security controls

📖 This is a textbook example of a dead-drop C2 resolver.

This malware component functions as:

▶️Stage-2 loader
▶️Backdoor client
▶️Dead-drop resolver
▶️Fileless configuration fetcher

❌ It is not persistent by itself and relies on external control.

🔗 Channel: https://t.iss.one/+ZcWpNaZALkIxYjUy

🖥 Репозиторий: Echidna— инструмент для фаззинга смарт контрактов

Echidna — это инструмент для проведения фаззинга смарт контрактов, который предоставляет возможность автоматического тестирования контрактов на наличие уязвимостей и ошибок.

— Данный инструмент создает и запускает тестовые смарт контракты, которые позволяют исследовать различные пути выполнения смарт контракта и выявить потенциальные уязвимости.

⏺ Ссылка на GitHub

#Vulnerability #Fuzzing #Web3