Investigating the Navalny Poisoning

Bellingcat has investigated the near-fatal poisoning of Alexey Navalny by the Russian FSB back in August. The details display some impressive traffic analysis. Navalny got a confession out of one of the poisoners, displaying some masterful social engineering. Lots of interesting opsec details in...

UPDATE: FudgeC2 0.5.7

FudgeC2 0.5.7 was released in June and this post documents the changes made to it. As you may remember, this awesome adversary emulation system was listed in my older post titled - List of Open Source C2 Post-Exploitation Frameworks. The new version brings system SMTP support, operations security...

Bart Gellman on Snowden

Bart Gellman's long-awaited at least by me book on Edward Snowden, Dark Mirror: Edward Snowden and the American Surveillance State, will finally be published in a couple of weeks. There is an adapted excerpt in the Atlantic. It's an interesting read, mostly about the government surveillance of hi...

AutoSploit v4.0 - Automated Mass Exploiter

As the name might suggest AutoSploit attempts to automate the exploitation of remote hosts. Targets can be collected automatically through Shodan, Censys or Zoomeye. But options to add your custom targets and host lists have been included as well. The available Metasploit modules have been select...

UPDATE: Merlin v0.8.0

PenTestIT RSS Feed A week ago an update - Merlin v0.8.0 was released. There was a brief mention about Merlin in my post titled - List of Open Source C2 Post-Exploitation Frameworks. This new version includes several new features to increase Operations Security OPSEC and usability. One of the more...

NetSet - Operational Security Utility And Automator

Operational Security utility and automator. NetSet is designed to automate a number of operations that will help the user with securing their network traffic. It also provides an easy way to gather proxies and run utilities through Tor. All the utilities installed and used by NetSet will be...

Beers with Talos Ep. #49: POS Malware, RSA Highlights, and SOL OpSec Fails

Beers with Talos BWT Podcast Ep. 49 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing, click here. Recorded March 15, 2019. We recorded this after coming back from RSA, with some on-location highlights included. This episode ope...

NEC EXPRESS CLUSTER clpwebmc Remote Root Exploit

NEC EXPRESS CLUSTER comes with Cluster Manager, a Java applet for cluster configuration and management. The underlying webserver 'clpwebmc' runs as root and accepts connections on TCP port 29003 which can be initiated without authentication in the default installation. / 2017 update: as of 3.3.4...

The grugq on Reality Winner, the Intercept, and OPSEC

Good commentary...

Windows Penetration Testing Tool: RedSnarf

Windows Penetration Testing Tool RedSnarf is a pen-testing / red-teaming tool by Ed William and Richard Davy for retrieving hashes and credentials from Windows workstations, servers and domain controllers using OpSec Safe Techniques. RedSnarf aims to do the following: Leave no evidence on the hos...

Pentesting Active Directory Environments: CrackMapExec

Pentesting Active Directory Environments: CrackMapExec CrackMapExec a.k.a CME is a post-exploitation tool that helps automate assessing the security of large Active Directory networks. Built with stealth in mind, CME follows the concept of “Living off the Land”: abusing built-in Active Directory...

Razer Synapse rzpnk.sys ZwOpenProcess

A vulnerability exists in the latest version of Razer Synapse v2.20.15.1104 as of the day of disclosure which can be leveraged locally by a malicious application to elevate its privileges to those of NTAUTHORITY\SYSTEM. The vulnerability lies in a specific IOCTL handler in the rzpnk.sys driver th...

Jessy Irwin on Password Security, Opsec and User Education

Dennis Fisher talks with Jessy Irwin of 1Password about her path into the security world, the many security challenges in the education sector, the password-security problem, and security jewelry. Download: digitalunderground219.mp3 Music by Chris Gonsalves...

Kris McConkey on OpSec Failures

At last week’s Security Analyst Summit Kris McConkey, part of PricewaterhouseCoopers’ UK Cyber Threat Operations team, discusses hacker OpSec failures: How attackers are still humans and sometimes make mistakes like using personal email addresses and real names in their campaigns...

Hackers' Op-Sec Failures Important Clues to Uncover APT Gangs

CANCUN – Sophistication, resourcefulness and ingenuity are characteristics usually associated with state-sponsored espionage hacker groups. But they’re certainly not infallible. Like most detective work, security analysts generally are able to toss back the covers on APT campaigns and major...

CVE-2000-0807

The OPSEC Authentication Spoof issue (CVE-2000-0807) affects Check Point VPN-1/FireWall-1 prior to the patches described in the ISS/FireWall-1 vulnerability alert. The security hole arises in the OPSEC authentication mechanism, allowing a remote attacker to spoof authentication and gain access to...

CVE-2000-0807

The OPSEC communications authentication mechanism fwn1 in Check Point VPN-1/FireWall-1 4.1 and earlier allows remote attackers to spoof connections, aka the "OPSEC Authentication Vulnerability."...

CVE-2000-0807

The OPSEC communications authentication mechanism fwn1 in Check Point VPN-1/FireWall-1 4.1 and earlier allows remote attackers to spoof connections, aka the "OPSEC Authentication Vulnerability."...