19 matches found
awesome-soc
Awesome SOC SOC（CSIRTを含む）を構築し、運用し、成熟させるための運用ハンドブック兼ナレッジベース。以下をカバーしています： SOCの基礎 検知エンジニアリング 脅威インテリジェンス SOCメトリクス/KPI SOC自動化 AIのユースケースとベストプラクティス SOP（SOCプレイブック） これらは、SOC/CSIRTアナリストおよびチームマネージャーとしての自身の経験、ならびに著名な論文に基づく私の見解です。CERT/CSIRTよりもSOCに重点を置いています。 私のモットーは、対応（レスポンス）がなければ、検知は無意味である、というものです。...
FIR
FIR是什么？它适用于谁？ FIR（快速事件响应）是一个旨在实现敏捷性和速度的网络安全事件管理平台。它允许轻松创建、跟踪和报告网络安全事件。 FIR适用于需要跟踪网络安全事件的任何人员（CSIRT、CERT、SOC等）。它根据我们的需求和团队习惯进行了定制，但在发布前我们投入了大量精力使其尽可能通用，以便世界各地的其他团队也可以根据自身需求使用和自定义它。 请查阅维基了解用户手册以及更多截图！ 安装 安装FIR有两种方式。如果你只想试用一下，可以通过使用Docker运行FIR。 如果你喜欢它并希望在生产环境中部署，这里是安装方法。 技术规格...
fastfinder
FastFinder A lightweight incident response tool for threat hunting and forensic triage ✨ Overview FastFinder is a powerful, lightweight incident response tool designed for cybersecurity professionals conducting threat hunting, live forensics, and endpoint triage. Built for both Windows and Linux...
Ashwesker-CVE-2025-68645
Ashwesker-CVE-2025-68645 POC BLH Magelang CSIRT 2026 by babyrootkid ⚠️ リポジトリ移転 このリポジトリは新しい公式リポジトリに移転しました: 👉 https://github.com/MaxMnMl/zimbramail-CVE-2025-68645-poc...
EUVD-2026-15402
From Panorama Web HMI, an attacker can gain read access to certain Web HMI server files, if he knows their paths and if these files are accessible to the Servin process execution account. Installations based on Panorama Suite 2022-SP1 22.50.005 are vulnerable unless update PS-2210-02-4079 or high...
China-Linked Hackers Target Myanmar's Top Ministries with Backdoor Blitz
The China-based threat actor known as Mustang Panda is suspected to have targeted Myanmar's Ministry of Defence and Foreign Affairs as part of twin campaigns designed to deploy backdoors and remote access trojans. The findings come from CSIRT-CTI, which said the activities took place in November...
Sielco Analog FM Transmitter 2.12 Remote Privilege Escalation
Summary Sielco designs and produces FM radio transmitters for professional broadcasting. The in-house laboratory develops standard and customised solutions to meet all needs. Whether digital or analogue, each product is studied to ensure reliability, resistance over time and a high standard of...
The Golden Hour of Incident Response
As a CSIRT consultant, I cannot overemphasize the importance of effectively managing the first hour in a critical incident. Finding out what to do is often a daunting task in a critical incident. In addition, the feeling of uneasiness often prevents an incident response analyst from making...
Exploit for Incorrect Authorization in Qnap Photo_Station
QNAP Pre-Auth Root RCE CVE-2019-7192 CVE-2019-7195 Checker...
Tufin Secure Change Remote Code Execution Exploit
Tufin SecureChange uses Richfaces version 4.3.5 which suffers from a remote code execution vulnerability. Product: Secure Change Vendor: Tufin Subject: Tufin SecureChange uses Richfaces 4.3.5, vulnerable to CVE-2015-0279 unauthenticated RCE CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H base score...
D-Link DIR636L Remote Command Injection Vulnerability
D-Link DIR636L suffers from a remote command injection vulnerability. SWISSCOM CSIRT SECURITY ADVISORY - http://www.swisscom.com/security CVE ID: CVE-2015-1187 Product: D-Link DIR636L Vendor: D-Link Subject: Remote Command Injection - Incorrect Authentication Effect: Remotely exploitable Author:...
1830 Photonic Service Switch PSS-32/16/4 Cross Site Scripting
SWISSCOM CSIRT ADVISORY - http://www.swisscom.com/security CVE ID: CVE-2014-3809 Product: 1830 Photonic Service Switch PSS-32/16/4 Vendor: Alcatel-Lucent Subject: Reflected Cross-site Scripting - XSS Effect: Remotely exploitable Author: Stephan Rickauer stephan.rickauer at swisscom.com Date:...
Pi3Web <= 2.0.3 (ISAPI) Remote Denial of Service Exploit
No description provided by source. Pi3Web ISAPI DoS vulnerability Discovered by: Hamid Ebadi CSIRT Team Member Amirkabir University CSIRT Laboratory APA Laboratory [email protected] Introduction Pi3Web is a free, multithreaded, highly configurable and extensible HTTP server and development...
PostNuke ContentExpress Module Blind Sql Injection Vulnerability
Exploit for unknown platform in category web applications ================================================================ PostNuke ContentExpress Module Blind Sql Injection Vulnerability ================================================================ Date: 17/03/2010 Software Link:...
pi3web-dos.txt
Pi3Web ISAPI DoS vulnerability Discovered by: Hamid Ebadi CSIRT Team Member Amirkabir University CSIRT Laboratory APALaboratory [email protected] Introduction Pi3Web is a free, multithreaded, highlyconfigurable and extensible HTTP server and development environment for crossplatform internet serv...
Pi3Web 2.0.3 - ISAPI Remote Denial of Service
Pi3Web 2.0.3 - ISAPI Remote Denial of Service Pi3Web ISAPI DoS vulnerability Discovered by: Hamid Ebadi CSIRT Team Member Amirkabir University CSIRT Laboratory APA Laboratory [email protected] Introduction Pi3Web is a free, multithreaded, highly configurable and extensible HTTP server and...
Pi3Web <= 2.0.3 (ISAPI) Remote Denial of Service Exploit
No description provided by source. Pi3Web ISAPI DoS vulnerability Discovered by: Hamid Ebadi CSIRT Team Member Amirkabir University CSIRT Laboratory APA Laboratory [email protected] Introduction Pi3Web is a free, multithreaded, highly configurable and extensible HTTP server and development...
Pi3Web 2.0.3 - 'ISAPI' Remote Denial of Service
Pi3Web ISAPI DoS vulnerability Discovered by: Hamid Ebadi CSIRT Team Member Amirkabir University CSIRT Laboratory APA Laboratory [email protected] Introduction Pi3Web is a free, multithreaded, highly configurable and extensible HTTP server and development environment for cross platform internet...