Хорошая презентация по патч-диффингу на примере Microsoft https://doc.dustri.org/reverse/Brian%20Pak%20-%20Effective%20Patch%20Analysis%20for%20Microsoft%20Updates%20-%20Power%20of%20Community%20-%202016.11.pdf
Автоматичиская генерация и анализ IOC с примененем свёрточных нейронных сетей https://repository.asu.edu/attachments/186547/content/Panwar_asu_0010N_17075.pdf
PoC 0day Windows https://twitter.com/SandboxEscaper/status/1054744201244692485
Twitter
SandboxEscaper
https://t.co/1Of8EsOW8z Here's a low quality bug that is a pain to exploit.. still unpatched. I'm done with all this anyway. Probably going to get into problems because of being broke now.. but whatever.
https://blog.reversinglabs.com/blog/cvs-dde-exploits-and-obfuscation - Новые техники обфускации DDE в MS Office
ReversingLabs
Three New DDE Obfuscation Methods
Cisco Talos and ReversingLabs discover a new spam campaign spreading the Adwind 3.0 remote access tool (RAT), ReversingLabs details three new DDE obfuscation methods.
DarkSpiritz : A penetration testing framework for UNIX systems https://github.com/DarkSpiritz/DarkSpiritz
Forwarded from r0 Crew (Channel) (Bear0)
Анти-отладочные приёмы с примерами
https://forum.reverse4you.org/showthread.php?t=3062 #win #antidebug #re #darw1n
https://forum.reverse4you.org/showthread.php?t=3062 #win #antidebug #re #darw1n
R0 CREW
Анти-отладочные приёмы с примерами
Оригинал: apriorit.com С точки зрения ПО, реверс - это процесс исследования программы для получения закрытой информации о том, как она работает и какие алгоритмы она использует. Хотя реверс-инжиниринг может быть преследовать легальный цели, чаще всего считается…
Forwarded from r0 Crew (Channel) (Bear0)
(De)coding an iOS Kernel Vulnerability https://phrack.org/papers/viewer_discretion_advised.html #ios #exploit #dukeBarman
https://www.pingcastle.com
Get Active Directory Security at 80% in 20% of the time
Get Active Directory Security at 80% in 20% of the time
PingCastle
Home - PingCastle
Because the Active Directory security lies in the process and not in expensive tools, our solution is simple: download PingCastle and apply its methodology.
https://lgtm.com/blog/apple_xnu_icmp_error_CVE-2018-4407
Kernel RCE caused by buffer overflow in Apple's ICMP packet-handling code (CVE-2018-4407)
Kernel RCE caused by buffer overflow in Apple's ICMP packet-handling code (CVE-2018-4407)
The GitHub Blog
The next step for LGTM.com: GitHub code scanning!
Today, GitHub code scanning has all of LGTM.com’s key features—and more! The time has therefore come to announce the plan for the gradual deprecation of LGTM.com.
Применение рекурентных нейронных сетей для построения декомпилятора:
https://www.cs.unm.edu/~eschulte/data/katz-saner-2018-preprint.pdf
https://www.cs.unm.edu/~eschulte/data/katz-saner-2018-preprint.pdf