Infogram: Application Vulnerable to CSRF - Remove Invited user

POC: 1. Login to the application with a business account. 2. Go to Manage teams, where we can send invites to a team member. Send a Invite to a team member 3. After the invite is sent to a user, the admin has option to Remove User. 4. While trying to remove the user, capture the request in burp ,...

QSC17 Focuses on Digital Transformation’s Challenges and Opportunities

Qualys Security Conference 2017 finds Qualys rapidly advancing in its ongoing quest to seamlessly and transparently thread security into the fabric of IT environments, and to make it essential for digital transformation. At QSC17, happening this week in Las Vegas, Qualys executives will share how...

September 29, 2017 – Morning Cyber Coffee Headlines – “Autumn” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! September 29, 2017 - Headlines NY Regulator Says Equifax Making Progress on...

CrackMapExec v3.1.5 - A Swiss Army Knife For Pentesting Networks

CrackMapExec a.k.a CME is a post-exploitation tool that helps automate assessing the security of large Active Directory networks. Built with stealth in mind, CME follows the concept of "Living off the Land": abusing built-in Active Directory features/protocols to achieve it's functionality and...

SANS Institute: Hackers Paint a Bullseye on Your Employees and Endpoints

End users and their devices are right smack in the center of the battle between enterprise InfoSec teams and malicious hackers, and it’s not hard to see why. When compromised, connected endpoints — desktops, laptops, smartphones, tablets — offer intruders major entry points into corporate network...

CWA for Windows: How to disable Citrix Receiver from popping up during logon to the Desktop.

This article is intended for Citrix administrators and technical teams only.Non-admin users must contact their company’s Help Desk/IT support team and can refer toCTX297149for more information How to disable Citrix Receiver from popping up during logon to the Desktop...

Invoke-CradleCrafter - PowerShell Remote Download Cradle Generator and Obfuscator

Invoke-CradleCrafter is a PowerShell v2.0+ compatible PowerShell remote download cradle generator and obfuscator. Purpose Invoke-CradleCrafter exists to aid Blue Teams and Red Teams in easily exploring, generating and obfuscating PowerShell remote download cradles. In addition, it helps Blue Team...

Receiver for Windows 4.8, error "The specified module could not be found."

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Unable to launch Published Desktops, it fails to launch with error"The specified module could not be...

csgo.gaming-teams.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-272156 Description| Value ---|--- Affected Website:| csgo.gaming-teams.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

How to Secure Public Clouds while Boosting Digital Transformation

It’s happening all over the business world. Organizations of all sizes and in all industries are aggressively deploying innovative products to new online consumer channels, digitizing their core services and transitioning core business workloads to public clouds as part of digital transformation...

Frans Visits Vegas: Frans Visits Vegas Announcement

Hey hackers and soon to be hackers! F204937 I will be doing a webinar for 1 hour at 21:00pm PDT Wednesday the 26th, the night before DEFCON and h1-702 2017. The idea is to share knowledge on how to win over security teams and gain influence as a hacker. I will cover the following topics: How I go...

Rapid7 acquires Komand for security orchestration and automation

Today, Rapid7 announced the acquisition of Komand, an orchestration and automation solution for both security and IT teams. You can read the formal announcement here, but I wanted to share a little bit about why Im so excited about this acquisition. Komand has been bold. Theyve been unafraid to...

StoreFront Management console shows error "No Web Receiver Services found within IIS site '-1'. defaultDocument"

This article is intended for Citrix administrators and technical teams only.Non-admin users must contact their company’s Help Desk/IT support team and can refer toCTX297149for more information StoreFront Management console shows error "No Web Receiver Services found within IIS site '-1'...

WakaTime: [Privilege Escalation] Authenticated users can manipulate others fullname without their knowledge [Team Vector]

Hi Team, Summary, When my free trial subscription was activated on wakatime.com, i also found that there is a new tab or features which is the Teams, In Teams you can manipulate again others fullname without their knowledge. as the details of my other reports Privilege Escalation Authenticated...

sportrobe.com XSS vulnerability

Vulnerable URL: http://www.sportrobe.com/teams.asp?league=1"...

Save Time by Streamlining Vendor Risk Assessments in the Cloud

As your organization enthusiastically adopts cloud and mobile services from multiple new vendors, are your already-busy security and compliance teams scrambling to assess the risks of using these new providers’ products? Are you still using a manual process for conducting these vendor evaluations...

Receiver 4.3 /4.4 When Client is Locked via Start Menu, User is Prompted with the Login Screen Twice

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Receiver 4.3 Desktop Lock + Private LC3579 When client is locked via Start Menu Lock, user is requir...

Update on Petya malware attacks

As happened recently with WannaCrypt, we again face a malicious attack in the form of ransomware, Petya. In early reports, there was a lot of conflicting information reported on the attacks, including conflation of unrelated and misleading pieces of data, so Microsoft teams mobilized to investiga...

Tradition and Technology: Trend Micro Takes to the Water for Dragon Boat Challenge

At Trend Micro, we’re used to fighting it out against a constant barrage of cyber threats facing our customers. But we don’t just want to be number one in cybersecurity: We’re also highly competitive elsewhere. As a company proud of our East Asian links we’re keen Dragon Boat racers, and guess...

Collaborative Storytelling at Rapid7

Great ideas can come from anywhere! At Rapid7, we design and develop wonderful products we hope you think so too!. Everything here starts with stories. Storytelling matters: The ability to tell a compelling story is the defining quality of human nature. Storytelling is just as important in busine...