threatbox

Threatbox - 標準攻撃プラットフォーム ThreatBoxは、標準化され制御されたLinuxベースの攻撃プラットフォームです。私はこのバージョンを何年も使用してきました。当初はスクリプトの集まりとして始まり、ローリング仮想マシンとして存在し、Linux ISOを構築するコードとして存在し、現在はAnsibleプレイブックのセットに変換されました。なぜAnsibleなのか？なぜダメなのでしょう？これは標準攻撃プラットフォームの設定における次の自然な進化のように思えました。 このプロジェクトは、Ansibleプレイブックとロールを使用して、Linuxターゲット（Ubuntu...

dapr

driver-attack-platform 背景：https://github.com/nccgroup/dapr/wiki 前提条件 相对较新版本的 nodejs（已在 v11.4.0 版本上测试） 如果目标是 Linux 桌面，并且使用 NVM 管理 nodejs 安装，请运行以下命令以允许以 root 身份运行 node。 https://stackoverflow.com/a/29903645 如果目标是 Android 设备，请安装 ADB。设备上必须存在 su，或者 ADB 必须以 root 身份运行。 安装 root@kitploit: cd server npm...

Cybersecurity AI: Humanoid Robots As Attack Vectors

We present a systematic security assessment of the Unitree G1 humanoid showing it operates simultaneously as a covert surveillance node and can be purposed as an active cyber operations platform. Partial reverse engineering of Unitree's proprietary FMX encryption reveal a static Blowfish-ECB laye...

CVE-2023-4095 User enumeration vulnerability in Fujitsu Arconte Áurea

User enumeration vulnerability in Arconte Áurea 1.5.0.0 version. The exploitation of this vulnerability could allow an attacker to obtain a list of registered users in the application, obtaining the necessary information to perform more complex attacks on the platform...

Authentication flaw

The application fails to prevent users from connecting to it over unencrypted connections. An attacker able to modify a legitimate user's network traffic could bypass the application's use of SSL/TLS encryption and use the application as a platform for attacks against its users...

UPDATE: P4wnP1 v0.1.0-alpha1

PenTestIT RSS Feed P4wnP1 update time guys and this time it is the P4wnP1 v0.1.0-alpha1, the first pre-built image! It has almost been a year since I last posted about this Raspberry Pi based, customizable USB attack platform and yet, what an update! Read on! What is P4wnP1? P4wnP1 is a highly...

Equation APT Group Attack Platform A Study in Stealth

Spies thrive only when they’re able to quietly infiltrate targets and slither away unnoticed; this principle is the same whether we’re talking about the physical world, or digital. The recently uncovered Equation APT group is prime example of the investment nation-state sponsored attackers make i...

Regin Cyberespionage Malware Platform Modules Disclosed

The Regin malware platform used to steal secrets from government agencies, banks and GSM network operators caught the attention of security experts who called it one of the most advanced attack platforms that has been studied, surpassing Flame, Duqu, even Stuxnet. Researchers at Kaspersky Lab sai...

USBDriveby Device Can Install Backdoor, Override DNS Settings in Seconds

Samy Kamkar has a special talent for turning seemingly innocuous things into rather terrifying attack tools. First it was an inexpensive drone that Kamkar turned into a flying hacking platform with his Skyjack research, and now it’s a $20 USB microcontroller that Kamkar has loaded with code that...