WPScan v3.4.0 - Black Box WordPress Vulnerability Scanner

WPScan is a free, for non-commercial use, black box WordPress vulnerability scanner written for security professionals and blog maintainers to test the security of their sites. INSTALL Prerequisites: Ruby = 2.2.2 - Recommended: 2.3.3 Curl = 7.21 - Recommended: latest - FYI the 7.29 has a segfault...

44% of Security Professionals Spend More than 20 Hours a Week Responding to Alerts

As the global cybersecurity climate continues to heat up, so too do the subsequent levels of alert fatigue IT security professionals have to deal with. A recent survey by Imperva reveals that nine percent of UK security teams battle with over five million alerts each week. Five million, just let...

6 ways to keep up with cybersecurity without going crazy

As we dive headfirst into National Cybersecurity Awareness Month, it seems only fitting to discuss ways to stay on top of developments in modern cybersecurity and privacy. What's the best way to stay protected? How can you determine if something is a scam? Which big company has been breached now?...

Moodle 3.x PHP Unserialize Remote Code Execution Exploit

Exploit for php platform in category web applications ======================================================================= title: Remote Code Execution via PHP unserialize product: Moodle - Open-source learning platform vulnerable version: 3.5 to 3.5.1, 3.4 to 3.4.4, 3.1 to 3.1.13 and earlier...

Partner Perspectives: VMRay + Carbon Black Bridge the Gap Between Threat Hunting & Incident Response

In 2016, Carbon Black and VMRay introduced an out-of-the-box integration combining the capabilities of two industry-best platforms: Cb Response and the VMRay Analyzer. Leveraging the threat hunting and incident response capabilities of Cb Response, alongside the malware analysis and detection...

SANS THIR Summit Wrap Up – “We Have 15 Minutes”

Heading back to San Diego before I get on another flight 30 hours later. Lots of people say "what are you crazy? Why do that?"…to which I say: "we cannot achieve any mission without sacrifice." Going to events like the SANS Threat Hunting IR summit remind just how many dedicated people we have on...

Report: Nearly Half of Security Professionals Think They Could Execute a Successful Insider Attack on Their Organization

As potential threats and entry points into organizations’ databases keep growing, so does the amount of money folks are throwing at detecting and actioning insider threats. In fact, the ballooning amount of money being spent on cybersecurity overall clearly highlights the seriousness with which...

Lynis 2.6.8 - Security Auditing Tool for Unix/Linux Systems

We are excited to announce this major release of auditing tool Lynis. Several big changes have been made to core functions of Lynis. These changes are the next of simplification improvements we made. There is a risk of breaking your existing configuration. Lynis is an open source security auditin...

Announcing “Cb Threat Hunters,” Carbon Black’s First Skill-Based Program

Carbon Black is excited to announce “Cb Threat Hunters,” the company’s first skill-based program debuting at Cb Connect 2018. Cb Threat Hunters gives you the opportunity to develop your threat-hunting skills to stay ahead of evolving attacks. With this program, our expert team will arm you with t...

ThreatList: Almost All Security Pros Believe Election Systems Are at Risk

As the U.S. midterm election season gets underway in earnest, concerns about the ability to hack the vote is more in the spotlight than ever. A fresh survey from Venafi has found that a full 93 percent of security pros are concerned about cyber-attacks targeting election infrastructure. The poll,...

10 Endpoint Security Problems Solved by the Cloud – Getting The Help You Need

Last week we looked at how the cloud helps you respond quickly to threats. This week, we’re going to examine why the cloud outperforms traditional AV when it comes to getting the help you need. It's You vs. Them Once upon a time, viruses were produced by individual hackers who were more intereste...

Lynis 2.6.6 - Security Auditing Tool for Unix/Linux Systems

We are excited to announce this major release of auditing tool Lynis. Several big changes have been made to core functions of Lynis. These changes are the next of simplification improvements we made. There is a risk of breaking your existing configuration. Lynis is an open source security auditin...

Active Directory Reconnaissance: ADRecon

ADRecon is a tool which extracts various artifacts as highlighted below out of an AD environment in a specially formatted Microsoft Excel report that includes summary views with metrics to facilitate analysis. The report can provide a holistic picture of the current state of the target AD...

Search and Dump System Configuration: otseca

The main assumption of creating this tool was easier and faster delivery of commands sets to be performed on customer environments. As a result of such a scan I wanted to get the most useful information about system components that will be subjected to penetration tests and audits at a later time...

Register for Carbon Black’s 2018 Customer Conference – Cb Connect in NYC – Oct. 10 & 11

Cb Connect, Carbon Black’s premier customer and partner event of the year, heads to New York City this fall for a two-day conference at Center 415, where you’ll join hundreds of security professionals to discuss: Moving your endpoint security to the cloud Best practices for threat hunting and...

Bingo, Amigo! Jackpotting: ATM malware from Latin America to the World

Introduction Of all the forms of attack against financial institutions around the world, the one that brings traditional crime and cybercrime together the most is the malicious ecosystem that exists around ATM malware. Criminals from different backgrounds work together with a single goal in mind:...

Sonatype Nexus Repository Manager OSS/Pro 2.14.5 / 3.7.1 XSS

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Cross-Site Scripting Vulnerabilities product: Sonatype Nexus Repository Manager OSS/Pro vulnerable version: =2.14.5, =3.7.1 fixed version: 2.14.6, 3.8.0 CVE...

DVWA - Damn Vulnerable Web Application

Damn Vulnerable Web Application DVWA is a PHP/MySQL web application that is damn vulnerable. Its main goal is to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and to aid...

Expert: IoT Botnets the Work of a ‘Vast Minority’

In December 2017, the U.S. Department of Justice announced indictments and guilty pleas by three men in the United States responsible for creating and using Mirai, a malware strain that enslaves poorly-secured "Internet of Things" or IoT devices like security cameras and digital video recorders f...

New Dridex Variant Emerges With An FTP Twist

A variant of the Dridex banking trojan recently popped up in an email campaign, with an unusual twist: The attackers used compromised FTP sites for hosting malicious documents, according to researchers at Forcepoint. It was a notable departure from the norm of using HTTP links and could represent...