This One Time on a Pen Test: Doing Well With XML
Each year, Rapid7 penetration testers complete hundreds of internally and externally based penetration testing service engagements. This post is part...
Month: October 2020
Release the Kraken: Fileless APT attack abuses Windows Error Reporting service
This blog post was authored by Hossein Jazi and Jérôme Segura. On September 17th, we discovered a new attack called...
Cloudfare will now send you DDoS attack alert when your website is under attack
Cloudfare has announced a new feature for their paid customers to set up alert notifications for when their website or...
Offering Users More For Their Activity – Similar Items Upon Checkout
The shopping isn't finished once you've purchased your item. If you've ever done shopping online, then you know all about...
Lockphish – The First Tool For Phishing Attacks On The Lock Screen, Designed To Grab Windows Credentials, Android PIN And iPhone Passcode
Lockphish it's the first tool (07/04/2020) for phishing attacks on the lock screen, designed to grab Windows credentials, Android PIN...
IoTMap – Research Project On Heterogeneous IoT Protocols Modelling
IoTMap is a tool that models IoT networks using one or multiple protocols simultaneously. This is work in progress, as...
Easily Explore Your Log Data with a Single Query in InsightIDR
We are delighted to announce that Log Search now supports grouping by multiple fields in your log data. By running...
Ransomware Payments and Sanctions – U.S. Treasury Advisory
On Oct. 1, the United States Treasury Department Office of Foreign Assets Control (OFAC) issued an advisory concerning ransomware payments...
Student Result Management System 1.0 – Multiple SQL Injection Vulnerabilities
Posted by b1nary on Oct 06# Exploit Title: Student Result Management System 1.0 - Multiple SQL Injection Vulnerabilities # Date:...
CVE-2020-24722: GAEN Protocol Metadata Deanonymization and Risk-score Inflation Issues
Posted by Stefan Marsiske via Fulldisclosure on Oct 06GAEN Protocol Metadata Deanonymization and Risk-score Inflation Issues (CVE-2020-24722) Summary The TX...
CVE-2020-25790
Posted by Rodolfo Augusto do Nascimento Tavares on Oct 06Hello, all Could you please publish the item below? I attached...
FortSIEM <= 5.2.8 RCE due to EL Injection – analysis
Posted by Red Timmy Security on Oct 06On June 21st 2020 Fortinet has released a security bulletin for its FortiSIEM...
Common bugs make anti-virus solutions vulnerable to exploitation
The very anti-malware solutions meant to protect organizations for things like increasing privilege can be exploited to do just that....
Chowbus – 444,224 breached accounts
In October 2020, the Asian food delivery app Chowbus suffered a data breach which led to over 800,000 records being...
Mobile network operator falls into the hands of Fullz House criminal group
Most victims of Magecart-based attacks tend to be typical online shops selling various goods. However, every now and again we...
A week in security (September 28 – October 4)
Last week on Malwarebytes Labs, we dug into what happens when card fraud comes calling, we gave a rundown on...
Spending on information security in Russia will increase eightfold
Russia intends to sharply increase the cost of information security, and mainly on cryptography, and not on personal data protectionAccording...
Be on the look out for 2 new features on Google meet: Q&A and Polls
Video Conferencing is the one tool that makes work from home achievable and hassle free and with systems like Zoom,...
‘InterPlanetary Storm’ Botnet Now Targeting MAC and IoT Devices
First discovered in 2019, the InterPlanetary Storm malware has resurfaced with a new variant targeting Mac and Android along with...
MosaicRegressor: Lurking in the Shadows of UEFI
Part II. Technical details (PDF) UEFI (or Unified Extensible Firmware Interface) has become a prominent technology that is embedded within...
Kube-Score – Kubernetes Object Analysis With Recommendations For Improved Reliability And Security
kube-score is a tool that performs static code analysis of your Kubernetes object definitions. The output is a list of...
SCREEN_KILLER – Tool To Track Progress For Reporting (Capture Screenshot, Commands And Outputs) During Pentest Engagement And OSCP
This script was to developed to capture screenshot during pentest engagment and OSCP. IMPORTANT: The screenshot feature is no longer...
Why Every Organization Needs a Vulnerability Management Policy
The importance of information security in the modern business world cannot be overstated. It’s vital for organizations to take a...
SEC Consult SA-20201005-0 :: Multiple Critical Vulnerabilities in RocketLinx Series
Posted by SEC Consult Vulnerability Lab on Oct 05SEC Consult Vulnerability Lab Security Advisory < 20201005-0 > ======================================================================= title: Multiple...
