Yara-rules

About What is this? A repo containing some of my privately developed Yara rules. Why? To contribute to the community. Can I use these rules? Of course! That's why I created this repo. You can use them in your detection systems. For example, CAPE sandbox, MalwareBazaar, UnPac.me and VirusTotal mus...

log4shell-rex

Log4Shell-Rex The following RegEx was written in an attempt to match indicators of a Log4Shell CVE-2021-44228 and CVE-2021-45046 exploitation. If you run a version from pre 2021/12/21, it's highly recommended to test and update. I've removed some quirks and enhanced performance. The Regex aims...

CAPE

CAPEv2 Python3 has now been released CAPEv2 With the imminent end-of-life for Python 2 January 1 2020, CAPEv1 will be phased out. Please upgrade to the Python 3 version as soon as possible. CAPE: Malware Configuration And Payload Extraction CAPE is a malware sandbox. It is derived from Cuckoo and...

CAPE-parsers

CAPE-parsers CAPE core and community parsers Configs structure CNCs: campaign: str botnet: str dgaseed: hex str version: str mutex: str useragent: str build: str cryptokey: str cryptokeytype: str algorithm. Ex: RC4, RSA public key. salsa20, xchacha20 raw: any other data goes here All CNC entries...

CAPE-parsers v0.1.69

CAPE-parsers CAPE core and community parsers Configs structure CNCs: campaign: str botnet: str dgaseed: hex str version: str mutex: str useragent: str build: str cryptokey: str cryptokeytype: str algorithm. Ex: RC4, RSA public key. salsa20, xchacha20 raw: any other data goes here All CNC entries...

CAPE-parsers v0.1.68

CAPE-parsers CAPE core and community parsers Configs structure root@kitploit: CNCs: campaign: str botnet: str dgaseed: hex str version: str mutex: str useragent: str build: str cryptokey: str cryptokeytype: str algorithm. Ex: RC4, RSA public key. salsa20, xchacha20 raw: any other data goes here A...

Friday Squid Blogging: Squid Washing Up on Cape Cod Beach

Lots of articles about this. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Blog moderation policy...

EUVD-2025-133785

Malicious code in teate-thy-py-cape npm...

CVE-2025-61945

Radiometrics VizAir is vulnerable to any remote attacker via access to the admin panel of the VizAir system without authentication. Once inside, the attacker can modify critical weather parameters such as wind shear alerts, inversion depth, and CAPE values, which are essential for accurate weathe...

CVE-2025-61945

Radiometrics VizAir is vulnerable to any remote attacker via access to the admin panel of the VizAir system without authentication. Once inside, the attacker can modify critical weather parameters such as wind shear alerts, inversion depth, and CAPE values, which are essential for accurate weathe...

CVE-2025-61945

Radiometrics VizAir is vulnerable to any remote attacker via access to the admin panel of the VizAir system without authentication. Once inside, the attacker can modify critical weather parameters such as wind shear alerts, inversion depth, and CAPE values, which are essential for accurate weathe...

CVE-2025-61945 Missing Authentication for Critical Function in Radiometrics VizAir

Radiometrics VizAir is vulnerable to any remote attacker via access to the admin panel of the VizAir system without authentication. Once inside, the attacker can modify critical weather parameters such as wind shear alerts, inversion depth, and CAPE values, which are essential for accurate weathe...

CVE-2025-61945

Radiometrics VizAir is affected by a missing authentication for critical functions vulnerability: an unauthenticated remote attacker can access the admin panel and modify key weather parameters (wind shear alerts, inversion depth, CAPE) and potentially disable alerts or alter runway settings. Mul...

CAPE 安全漏洞

CAPE is a malware sandbox by the individual developer Kevin OReilly. CAPE has a security vulnerability that stems from an analysis denial vulnerability in reporting/mongodb.py and reporting/jsondump.py, which allows an attacker to submit samples to generate deeply nested or oversized behavioral...

capegrimbeef.com.au Cross Site Scripting vulnerability OBB-3873301

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: I’m speaking at the International PolCampaigns Expo IPE24 in Cape Town, South Africa, January 25-26, 2024. The list is maintained on this page...

cape-red.de Cross Site Scripting vulnerability OBB-3679404

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Siemans WIBU Systems CodeMeter

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

cape-red.net Cross Site Scripting vulnerability OBB-3275050

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Friday Squid Blogging: 14-foot Giant Squid Washes Ashore in Cape Town

Its an Architeuthis dux, the second this year. As usual, you can also use this squid post to talk about the security stories in the news that I havent covered. Read my blog posting guidelines here...