FuzzBench – Fuzzer Benchmarking As A Service
FuzzBench is a free service that evaluates fuzzers on a wide variety of real-world benchmarks, at Google scale. The goal...
SSRF Sheriff – A Simple SSRF-testing Sheriff Written In Go
This is an SSRF testing sheriff written in Go. It was originally created for the Uber H1-4420 2019 London Live...
Patch Tuesday – March 2020
Let's start off talking about CVE-2020-0688 from last month -- the Microsoft Exchange Validation Key RCE vulnerability. At the time...
Talking the Origins of THOTCON with Founder Nick Percoco
In a recent episode of Rapid7’s podcast, Security Nation, we talked with Nick Percoco, the creator of Chicago-based security conference...
Busting Ghostcat: An Analysis of the Apache Tomcat Vulnerability (CVE-2020-1938 and CNVD-2020-10487)
by: Magno Logan (Information Security Specialist) Discussions surrounding the Ghostcat vulnerability (CVE-2020-1938 and CNVD-2020-10487) found in Apache Tomcat puts it...
Durham, N.C. bull rushed by ransomware; recovery underway
The city of Durham, North Carolina and the government of Durham County have experienced disruptions since a ransomware attack last...
Don’t get fooled again: Fake coronavirus emails impersonate the WHO to deliver FormBook trojan
Fears over the novel coronavirus have triggered mass quarantines, Purell and Clorox shortages and financial market turmoil. As global concerns...
A week in security (March 2 – 8)
Last week on Malwarebytes Labs, we fired up part 1 of our series on child identity theft, asked how well...
International Women’s Day: awareness of stalkerware, monitoring, and spyware apps on the rise
Nine months ago, Malwarbytes recommitted itself to detecting invasive monitoring apps that can lead to the excessive harm of women—most...
Government based hacking groups are attacking Microsoft Exchange Servers
Various government-backed hacking groups and APTs are targeting and exploiting a vulnerability in Microsoft Exchange email servers. The vulnerability was...
Evil SSDP – Spoof SSDP Replies And Create Fake UPnP Devices To Phish For Credentials And NetNTLM Challenge/Response
This tool responds to SSDP multicast discover requests, posing as a generic UPNP device. Your spoofed device will magically appear...
Proton Framework – A Windows Post Exploitation Framework Similar To Other Penetration Testing Tools Such As Meterpreter And Powershell Invader Framework
About Proton FrameworkProton Framework is a Windows post exploitation framework similar to other penetration testing tools such as Meterpreter and...
How to Secure Containers, Applications, and Serverless Environments
This is the final post in our four-part series on security in the cloud. In part one, we discussed the...
Users can now Use 2 Step Verification on their Chrome and Safari Browser
Google has launched a new feature for ensuring users' security. You will now be able to enroll for 2 Factor...
250,000+ Login/Passwords Leaked in The Trident Crypto Fund Data Breach
More than 260,000 customers’ data was compromised online in a gigantic data breach that went down pretty recently.Trident Crypto Fund,...
NTLMRecon – A Tool To Enumerate Information From NTLM Authentication Enabled Web Endpoints
Note that the tool is still under development. Things may break anytime - hence, beta!A fast and flexible NTLM reconnaissance...
HoneyBot – Capture, Upload And Analyze Network Traffic
HoneyBot is a set of scripts and libraries for capturing and analyzing packet captures with PacketTotal.com. Currently this library provides...
Encryption Flaws Allow Hackers to Steal Vehicles without Leaving a Trace
New vulnerabilities were revealed earlier this week in the encryption frameworks utilized by immobilizers, the radio-enabled gadgets within cars that...
Lithuania leads a European Union Cyber Rapid Response Team (CRRT) at the European Union
Lithuania, the Netherlands, Poland, Romania, Croatia, and Estonia signed a Memorandum on the establishment of a European Union Cyber Rapid...
HTTP Asynchronous Reverse Shell – Asynchronous Reverse Shell Using The HTTP Protocol
Today there are many ways to create a reverse shell in order to be able to remotely control a machine...
Entropy Toolkit – A Set Of Tools To Exploit Netwave And GoAhead IP Webcams
Entropy Toolkit is a set of tools to exploit Netwave and GoAhead IP Webcams. Entropy is a powerful toolkit for...
Don’t install that security certificate; it’s a malware scam
Cybercriminals have been compromising websites to display a fake security certificate error message in hopes of tricking visitors into downloading...
Bring your own privacy: VPNs for consumers and orgs
VPNs (virtual private networks) have been popular for quite some time now, and they’re worth a huge amount of money...
Attention! Malvertising Campaigns Using Exploit Kits On The Rise
Of all the things that online advertising could be used for, spreading malware is the one that throws you off...
