CVE-2023-24034

creationtimestamp| type| source ---|---|--- 2023-12-02 10:56:01+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/6045...

CVE-2023-44796

creationtimestamp| type| source ---|---|--- 2023-11-17 07:00:08+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/5848...

Google Expands Its Bug Bounty Program to Tackle Artificial Intelligence Threats

Google has announced that it's expanding its Vulnerability Rewards Program VRP to compensate researchers for finding attack scenarios tailored to generative artificial intelligence AI systems in an effort to bolster AI safety and security. "Generative AI raises new and different concerns than...

Exploit for Improper Authentication in Fit2Cloud Jumpserver

Process of exploiting the JumpServer unauthorized acce...

CVE-2023-32364

creationtimestamp| type| source ---|---|--- 2023-09-26 14:54:54+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/5222...

HTMLSmuggler - HTML Smuggling Generator And Obfuscator For Your Red Team Operations

The full explanation what is HTML Smuggling may be found here. The primary objective of HTML smuggling is to bypass network security controls, such as firewalls and intrusion detection systems, by disguising malicious payloads within seemingly harmless HTML and JavaScript code. By exploiting the...

EmploLeaks - Finding Leaked Employees Info for the Win

Developed by Faraday security researchers, this cutting-edge tool utilizes the power of OpenSource Intelligence techniques. EmploLeaks extracts valuable insights by scouring various platforms, to compile a comprehensive list of employees associated with a given company and cross-reference these...

PurpleOps - An Open-Source Self-Hosted Purple Team Management Web Application

An open-source self-hosted purple team management web application. Key Features Template engagements and testcases Framework friendly Role-based Access Control & MFA Inbuilt DOCX reporting + custom template support How PurpleOps is different: No attribution needed Hackable, no "no-reversing"...

PenTales: What It’s Like on the Red Team

At Rapid7 we love a good pen test story. So often they show the cleverness, skill, resilience, and dedication to our customer’s security that can only come from actively trying to break it! In this series, we’re sharing some of our favorite tales from the pen test desk and hopefully highlight som...

Trawler - PowerShell Script To Help Incident Responders Discover Adversary Persistence Mechanisms

Dredging Windows for Persistence What is it? Trawler is a PowerShell script designed to help Incident Responders discover potential indicators of compromise on Windows hosts, primarily focused on persistence mechanisms including Scheduled Tasks, Services, Registry Modifications, Startup Items,...

CVE-2023-30533

creationtimestamp| type| source ---|---|--- 2023-08-11 03:59:21+00:00| published-proof-of-concept| https://t.me/crackcodes/4014 2023-08-11 04:00:05+00:00| published-proof-of-concept| Telegram/oCXtildE2yTi9IxdSuzh8AMqV0fg39dXN2lm3qeaYClxQ 2023-08-11 11:17:53+00:00| published-proof-of-concept|...

Microsoft’s AI Red Team Has Already Made the Case for Itself

Since 2018, a dedicated team within Microsoft has attacked machine learning systems to make them safer. But with the public release of new generative AI tools, the field is already evolving...

Bashfuscator - A Fully Configurable And Extendable Bash Obfuscation Framework

Documentation What is Bashfuscator? Bashfuscator is a modular and extendable Bash obfuscation framework written in Python 3. It provides numerous different ways of making Bash one-liners or scripts much more difficult to understand. It accomplishes this by generating convoluted, randomized Bash...

Identifying a DNS Exfiltration Attack That Wasn’t Real — This Time

A recent red team DNS exfiltration alert confirms that Akamai Secure Internet Access is an effective security tool for this type of detection and analysis...

VX-API - Collection Of Various Malicious Functionality To Aid In Malware Development

The VX-API is a collection of malicious functionality to aid in malware development. It is recommended you clone and/or download this entire repo then open the Visual Studio solution file to easily explore functionality and concepts. Some functions may be dependent on other functions present with...

SQLFluff users with access to config file, using `libary_path` may call arbitrary python code

Impact In environments where untrusted users have access to the config files e.g. .sqlfluff, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. Jinja macros are executed within a sandboxed...

How Talos IR’s Purple Team can help you prepare for the worst-case scenario

Purple Team exercises are included within the Cisco Talos Incident Response Retainer service and our experts can help your organization find security holes before the bad guys can. As your trusted advisor, our purple team, which is a combination of both red and blue teams, emulates one joint atta...

New COSMICENERGY Malware Exploits ICS Protocol to Sabotage Power Grids

A new strain of malicious software that's engineered to penetrate and disrupt critical systems in industrial environments has been unearthed. Google-owned threat intelligence firm Mandiant dubbed the malware COSMICENERGY , adding it was uploaded to the VirusTotal public malware scanning utility i...

CVE-2023-27327

creationtimestamp| type| source ---|---|--- 2023-05-09 20:26:33+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/4326 2023-05-10 11:03:01+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/8270 2023-05-12 18:37:54+00:00| published-proof-of-concept|...

AppDomain Manager Injection: New Techniques For Red Teams

AppDomain Manager Injection is a very versatile and useful technique for red team operators. This technique allows you to effectively turn any Microsoft.NET application on a Windows host into a lolbin Living Off the Land Binary by forcing the application to load a specially crafted .NET assembly,...