Cr3dOv3r - Know The Dangers Of Credential Reuse Attacks

Your best friend in credential reuse attacks. Cr3dOv3r simply you give it an email then it does two simple jobs but useful : Search for public leaks for the email and if it any, it returns with all available details about the leak Using hacked-emails site API. Now you give it this email's old or...

Faraday v2.7 - Collaborative Penetration Test and Vulnerability Management Platform

Faraday is the Integrated Multiuser Risk Environment you have alwasy been looking for! It maps and leverages all the data you generate in real time , letting you track and understand your audits. Our dashboard for CISOs and managers uncovers the risks and impacts and risks being assessed by the...

How to solve the Malwarebytes CrackMe: a step-by-step tutorial

The topic of this post is a Malwarebytes CrackMe—an exercise in malware analysis that I recently created. First, the challenge was created to serve internal purposes, but then it was released to the community on Twitter and triggered a lot of positive response. Thanks to all of you who sent in yo...

X (Formerly Twitter): POODLE SSLv3 bug on multiple twitter smtp servers (mx3.twitter.com,199.59.148.204,199.16.156.108 and 199.59.148.204)

Summary: POODLE SSLv3 bug on multiple twitter smtp servers Description: CVE-2014-3566: The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle...

A week in security (October 30 – November 5)

Last week on our blog, we told you what to expect at the upcoming Irisscon security conference in Dublin. We gave you a quick introduction into the why and how of analyzing malware based on their API calls. And we issued a warning about some lesser-known cybercrimes. Plus we explained why emergin...

Beers with Talos EP 16: Strong Copy - Bad Rabbit and the Nyetya Connection

Beers with Talos BWT Podcast Episode 16 is now available. Download this episode and subscribe to Beers with Talos:img border="0" data-original-height="45" data-original-width="160" src="https://2.bp.blogspot.com/-E-RSSZ9jbUY/WaWCkLGZnZI/AAAAAAAAAJE/Ciiz-Si...

Twitter iOS client information disclosure vulnerability

Twitter iOS client is an iOS-based mobile client program for accessing the Twitter social network and micro blogs. A security vulnerability exists in versions 6.62 and 6.62.1 of the iOS-based Twitter client, which stems from the program failing to validate Twitter's server certificate. A remote...

Tweep - An Advanced Twitter Scraping Tool

Tweep is an advanced Twitter scraping tool written in python that allows for scraping Tweets and pictures from Twitter profiles without using Twitter's API. Benefits Some of the benefits of using Tweep vs Twitter API: Fast initial setup Can be used anonymously No rate limitations Can fetch all...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of October 23, 2017

Just like Bugs Bunny wears disguises to avert his enemies, there’s another “wascally” rabbit causing trouble in the form of ransomware. Bad Rabbit is the latest ransomware campaign hitting Eastern European countries with what looks like a variant of the Petya/NotPetya ransomware. Bad Rabbit sprea...

FS Monster Clone SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: FS Monster Clone - 'id' SQL Injection Exploit Author: 8bitsec Vendor Homepage: https://fortunescripts.com/ Software Link: https://fortunescripts.com/product/monster-clone/ Version: 24 October 17 Tested on: Kali Linux 2.0 | Mac O...

FS Shutter Stock Clone SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: FS Shutter Stock Clone - 'keywords' SQL Injection Exploit Author: 8bitsec Vendor Homepage: https://fortunescripts.com/ Software Link: https://fortunescripts.com/product/shutterstock-clone/ Version: 24 October 17 Tested on: Kali...

X (Formerly Twitter): OS Command Execution on User's PC via CSV Injection

Summary: Twitter is vulnerable to CSV Injection. If an attacker can successfully exploit this, then they will compromise the PC of the user. The injection point is via a tweet on the main twitter.com site while the retrieval point is via the “Export Data” option on the analytics site. Description...

FS Monster Clone - 'id' SQL Injection

Exploit Title: FS Monster Clone - 'id' SQL Injection Date: 2017-10-24 Exploit Author: 8bitsec Vendor Homepage: https://fortunescripts.com/ Software Link: https://fortunescripts.com/product/monster-clone/ Version: 24 October 17 Tested on: Kali Linux 2.0 | Mac OS 10.12.6 Email: [email protected]...

419 scammer offers USD $60 million—and a free child

Scammers often come crawling out of the woodwork in all sorts of places you wouldn't necessarily expect. This is to their advantage when trying to keep suspicion in check; after all, we're pretty much pre-programmed to think 419 scams will only wander into our inboxes. Twitter, though? That's a...

Live streaming Cryptopals

tl;dr: I'm livecoding the Cryptopals in Go on Twitch, one set every Sunday. The recordings are on YouTube. Oh, wow. I love the idea. Would anyone here seriously watch 20 to 40 hours of me doing crypto, math and Go? Mic, screen, and everything. -- Filippo Valsorda @FiloSottile October 16, 2016...

Google Busy Removing More Malicious Chrome Extensions from Web Store

Google scrambled this week to remove a malicious Chrome extension from its store and users’ machines after a popular Twitter account disclosed the issue publicly. The incident ramped up again one day later when the developers were able to get two other shady plugins past Google’s defenses before...

Pundits Say Attackers Redefining Objectives, Approaches

BOSTON—The nature of cyberattacks is changing and increasingly leveraging social media as they take aim at new targets. That’s the consensus of cybersecurity experts discussing the evolving nature of threats from nation states to hackers for hire. That’s not to say ransomware isn’t going anywhere...

DiskBoss Enterprise 8.4.16 Local Buffer Overflow

!/usr/bin/python ======================================================================================================================== Exploit Author: C4t0ps1s Exploit Title: DiskBoss Enterprise v8.4.16 Local Buffer OverflowCode execution Date: 03-10-2017 Twitter: @C4t0ps1s Email:...

DiskBoss Enterprise 8.4.16 - Local Buffer Overflow Exploit

Exploit for windows platform in category local exploits !/usr/bin/python ======================================================================================================================== Exploit Author: C4t0ps1s Exploit Title: DiskBoss Enterprise v8.4.16 Local Buffer OverflowCode execution...

DiskBoss Enterprise 8.4.16 - Local Buffer Overflow

!/usr/bin/python ======================================================================================================================== Exploit Author: C4t0ps1s Exploit Title: DiskBoss Enterprise v8.4.16 Local Buffer OverflowCode execution Date: 03-10-2017 Twitter: @C4t0ps1s Email:...