Blind Spots in AI Just Might Help Protect Your Privacy

Researchers have found a potential silver lining in so-called adversarial examples, using it to shield sensitive data from snoops...

U.S. Dept Of Defense: Examples directory is PUBLIC on https://████████mil, leading to multiple vulns

Description: Hello, In an effort to consolidate reporting. I have located 4 issues with having the Examples Directory openmy require just 1 solution to mitigate The following URLs that show concern are the following: 1. https://█████mil/examples/servlets/servlet/SessionExample --Will lead to...

Crosslinked - LinkedIn Enumeration Tool To Extract Valid Employee Names From An Organization Through Search Engine Scraping

CrossLinked simplifies the processes of searching LinkedIn to collect valid employee names when performing password spraying or another security testing against an organization. Using similar search engine scraping capabilities found in tools like subscraper and pymeta, CrossLinked will find vali...

Evil Clippy - A Cross-Platform Assistant For Creating Malicious MS Office Documents

A cross-platform assistant for creating malicious MS Office documents. Can hide VBA macros, stomp VBA code via P-Code and confuse macro analysis tools. Runs on Linux, OSX and Windows. Current features Hide VBA macros from the GUI editor VBA stomping P-code abuse Fool analyst tools Serve VBA stomp...

GodOfWar - Malicious Java WAR Builder With Built-In Payloads

A command-line tool to generate war payloads for penetration testing / red teaming purposes, written in ruby. Features Preexisting payloads. try -l/--list cmdget filebrowser bindshell reverseshell reverseshellui Configurable backdoor. try --host/-port Control over payload name. To avoid malicious...

[SECURITY] Fedora 29 Update: botan2-2.9.0-1.fc29

Botan is a BSD-licensed crypto library written in C++. It provides a wide variety of basic cryptographic algorithms, X.509 certificates and CRLs, PKCS \10 certificate requests, a filter/pipe message processing system, and a wide variety of other features, all written in portable C++. The API...

CVE-2019-6719

An issue has been found in libIEC61850 v1.3.1. There is a use-after-free in the getState function in mms/isoserver/isoserver.c, as demonstrated by examples/serverexamplegoose/serverexamplegoose.c and examples/serverexample6140025/serverexample6140025.c...

CVE-2019-6719

An issue has been found in libIEC61850 v1.3.1. There is a use-after-free in the getState function in mms/isoserver/isoserver.c, as demonstrated by examples/serverexamplegoose/serverexamplegoose.c and examples/serverexample6140025/serverexample6140025.c...

CVE-2019-6439

examples/benchmark/tlsbench.c in a benchmark tool in wolfSSL through 3.15.7 has a heap-based buffer overflow...

org.apache.felix:org.apache.felix.http.bundle (2.2.1), org.apache.felix:org.apache.felix.http.jetty (2.2.1) +54 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (7.6.12.v20130726)

org.eclipse.jetty:jetty-server MAVEN version 7.6.12.v20130726 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.apache.felix:org.apache.felix.http.bundle 2.2.1 -...

BetterCap v2.10 - The Swiss Army Knife For 802.11, BLE And Ethernet Networks Reconnaissance And MITM Attacks

bettercap is the Swiss Army knife for 802.11, BLE and Ethernet networks reconnaissance and attacks. How to Install A precompiled version is available for each release, alternatively you can use the latest version of the source code from this repository in order to build your own binary. Make sure...

org.codehaus.cargo:cargo-jetty-7-and-onwards-deployer (1.2.3), org.cometd.java:cometd-java-examples (>=2.4.3, <=2.5.0-beta2) +51 more potentially affected by CVE-2017-7658 via org.eclipse.jetty:jetty-server (7.6.4.v20120524)

org.eclipse.jetty:jetty-server MAVEN version 7.6.4.v20120524 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.codehaus.cargo:cargo-jetty-7-and-onwards-deployer 1.2.3 -...

br.com.caelum.vraptor:vraptor-test (1.0.0), net.javacrumbs:mock-socket-http (>=0.1, <=0.6) +18 more potentially affected by CVE-2017-7656 via org.eclipse.jetty:jetty-server (7.0.0.m2)

org.eclipse.jetty:jetty-server MAVEN version 7.0.0.m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - br.com.caelum.vraptor:vraptor-test 1.0.0 - net.javacrumbs:mock-socket-http =0.1, =0.6 -...

br.com.caelum.vraptor:vraptor-test (1.0.0), net.javacrumbs:mock-socket-http (>=0.1, <=0.6) +18 more potentially affected by CVE-2017-7657 via org.eclipse.jetty:jetty-server (7.0.0.m2)

org.eclipse.jetty:jetty-server MAVEN version 7.0.0.m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - br.com.caelum.vraptor:vraptor-test 1.0.0 - net.javacrumbs:mock-socket-http =0.1, =0.6 -...

Atlas - Quick SQLMap Tamper Suggester

Atlas is an open source tool that can suggest sqlmap tampers to bypass WAF/IDS/IPS, the tool is based on returned status code. Screen Installation $ git clone https://github.com/m4ll0k/Atlas.git atlas $ cd atlas $ python atlas.py Usage $ python atlas.py --url http://site.com/index.php?id=PriceASC...

[SECURITY] Fedora 29 Update: yum-utils-1.1.31-517.fc29

yum-utils is a collection of utilities and examples for the yum package manager. It includes utilities by different authors that make yum easier and more powerful to use. These tools include: debuginfo-install, find-repos-of-install, needs-restarting, package-cleanup, repoclosure, repodiff,...

Running a security awareness program

So, you've finally convinced management of the need for security awareness training. What next? I’ve been performing security awareness training for around 10 years, and doing it full time here at PTP for the last 3 and a half years. From the thousands of sessions I have run I’ve found the most...

Public Shaming of Companies for Bad Security

Troy Hunt makes some good points, with good examples...

Firework - Leveraging Microsoft Workspaces in a Penetration Test

Firework is a proof of concept tool to interact with Microsoft Workplaces creating valid files required for the provisioning process. The tool also wraps some code from Responder to leverage its ability to capture NetNTLM hashes from a system that provisions a Workplace feed via it. This tool may...

DorkMe - Tool Designed With The Purpose Of Making Easier The Searching Of Vulnerabilities With Google Dorks

DorkMe is a tool designed with the purpose of making easier the searching of vulnerabilities with Google Dorks, such as SQL Injection vulnerabilities.DorkMe is a tool designed with the purpose of making easier the searching of vulnerabilities with Google Dorks, such as SQL Injection...