A Deep Dive into Database Attacks [Part I]: SQL Obfuscation

Today, data breaches are a threat to every organization. According to a report from Risk Based Security covering the first half of 2017, over 6 billion records were exposed through 2,227 publicly-disclosed data breaches. The number of exposed records is already higher than the previous all-time...

ID-entify - Search for information related to a domain (Emails, Domains, Information on WEB technology, Type of Firewall, NS and MX records)

ID-entify is a tool that allows you to search for information in the passive way related to a domain. Developed By Carlos Ramírez López. SEARCH FOR INFORMATION RELATED TO A DOMAIN: Emails IP addresses Domains Information on WEB technology Type of Firewall NS and MX records Nmap to IP addresses an...

LuLu - macOS Firewall That Aims To Block Unauthorized (Outgoing) Network Traffic

LuLu is the free open-source macOS firewall that aims to block unauthorized outgoing network traffic, unless explicitly approved by the user: Full details and usage instructions can be found here. It's also important to understand LuLu's limitations! Some of these will be addressed as the softwar...

Cisco Confirms Critical Firewall Software Bug Is Under Attack

Attackers are trying to exploit a critical vulnerability in Cisco’s Adaptive Security Appliance firewall software, the company has confirmed. Cisco has updated its advisory for the vulnerability, which was first revealed on Jan. 29 and has been logged as CVE-2018-0101, on Feb. 7. “The Cisco Produ...

Sandstorm Server-Side Request Forgery Vulnerability Vulnerability

Sandstorm is a personal cloud platform. The platform features file storage, application management, task and project management, and more. A server-side request forgery vulnerability exists in the install application process in versions prior to Sandstorm build 0.203. A remote attacker can exploi...

Watch Out! New Cryptocurrency-Mining Android Malware is Spreading Rapidly

Due to the recent surge in cryptocurrency prices, threat actors are increasingly targeting every platform, including IoT, Android, and Windows, with malware that leverages the CPU power of victims' devices to mine cryptocurrency. Just last month, Kaspersky researchers spotted fake antivirus and...

CFC - Linux Centralized Firewall Control

Centralized firewall control provides a centralized way to manage the firewall on multiple servers or loadbalancers running iptables. This way you can quickly allow/block/del/search abuse ranges etc. with one command on several servers. It accesses those servers through ssh. It supports both IPv4...

How to Mitigate the Threat Cryptocurrency Mining Poses to Enterprise Security

The growing popularity of Bitcoin and other cryptocurrencies is generating curiosity—and concern—among security specialists. Crypto mining software has been found on user machines, often installed by botnets. Organizations need to understand the risks posed by this software and what actions, if...

pfSense < 2.3.1-p5 Multiple Vulnerabilities (SA-16_07 / SA-16_08)

According to its self-reported version number, the remote pfSense install is prior to 2.3.1-p5. It is, therefore, affected by multiple vulnerabilities as stated in the referenced vendor advisories. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid106502;...

pfSense < 2.3.3 Multiple Vulnerabilities (SA-17_01 - SA-17_03)

According to its self-reported version number, the remote pfSense install is affected by multiple vulnerabilities as stated in the referenced vendor advisories. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid106503; scriptversion"1.12"; scriptcvsdate"Date: 2019/11/08...

pfSense < 2.3.1 Multiple Vulnerabilities (SA-16_03 / SA-16-04)

According to its self-reported version number, the remote pfSense install is prior to 2.3.1. It is, therefore, affected by multiple vulnerabilities. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid106500; scriptversion"1.12";...

pfSense < 2.1.4 Multiple Vulnerabilities (SA-14_08 - SA-14_12)

According to its self-reported version number, the remote pfSense install is prior to 2.1.4. It is, therefore, affected by multiple vulnerabilities. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid106490; scriptversion"1.5"; scriptcvsdate"Date: 2019/04/05 23:25:05";...

pfSense < 2.3.4-p1 Multiple Vulnerabilities (SA-17_05 / SA-17_06)

According to its self-reported version number, the remote pfSense install is prior to 2.3.4-p1. It is, therefore, affected by multiple vulnerabilities as stated in the referenced vendor advisories. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid106505;...

pfSense < 2.2.1 Multiple Vulnerabilities (SA-15_02 - SA-15_04)

According to its self-reported version number, the remote pfSense install is prior to 2.2.1. It is, therefore, affected by multiple vulnerabilities as stated in the referenced vendor advisories. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid106493; scriptversion"1.7...

pfSense < 2.2.3 Multiple Vulnerabilities (SA-15_07) (Logjam)

According to its self-reported version number, the remote pfSense install is prior to 2.2.3. It is, therefore, affected by multiple vulnerabilities as stated in the referenced vendor advisories. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid106495;...

pfSense < 2.3.1-p1 Multiple Vulnerabilities (SA-16_05)

According to its self-reported version number, the remote pfSense install is prior to 2.3.1-p1. It is, therefore, affected by multiple vulnerabilities as stated in the referenced vendor advisories. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid106501;...

coTURN server unsafe telnet admin portal default configuration vulnerability

Summary An exploitable unsafe default configuration vulnerability exists in the TURN server function of coTURN prior to version 4.5.0.9. By default, the TURN server runs an unauthenticated telnet admin portal on the loopback interface. This can provide administrator access to the TURN server...

coTURN TURN server unsafe loopback forwarding default configuration vulnerability

Summary An exploitable unsafe default configuration vulnerability exists in the TURN server functionality of coTURN prior to 4.5.0.9. By default, the TURN server allows relaying external traffic to the loopback interface of its own host. This can provide access to other private services running o...

Trend Micro Threat Discovery Appliance 2.6.1062r1 Remote Code Execution Exploit

Exploit for linux platform in category remote exploits !/usr/local/bin/python """ Trend Micro Threat Discovery Appliance /opt/TrendMicro/MinorityReport/bin/ Then, all we do is create /engptnstores/prod/sensorSDK/data/si/dlpkill.sh with malicious code and get it executed... Notes: ====== - For thi...

Trend Micro Threat Discovery Appliance 2.6.1062r1 - 'dlp_policy_upload.cgi' Remote Code Execution

!/usr/local/bin/python """ Trend Micro Threat Discovery Appliance /opt/TrendMicro/MinorityReport/bin/ Then, all we do is create /engptnstores/prod/sensorSDK/data/si/dlpkill.sh with malicious code and get it executed... Notes: ====== - For this particular PoC, all I did was exec a bind shell using...