r1cksec

@r1cksec@infosec.exchange

Red and blue rabbits,
Hackers hop in cyber space,
Code carrots they chase

This profile is from a federated server and may be incomplete. Browse more on the original instance.

r1cksec, to infosec

New cheatsheets pushed 🕵️‍♂️​

https://github.com/r1cksec/cheatsheets

Including:

A nice writeup about a XSS vulnerability found on chess.com♟️​
https://skii.dev/rook-to-xss

This tool can be used as a framework for CI/CD security analysis :github:​
https://github.com/CycodeLabs/raven

A great post about Process Injection in the context of Kernel Triggered Memory Scans :hacked:​
https://www.r-tec.net/r-tec-blog-process-injection-avoiding-kernel-triggered-memory-scans.html

r1cksec, to infosec

A cool post about how to search for threats in Windows services🕵️‍♂️​

https://detect.fyi/threat-hunting-suspicious-windows-service-names-2f0dceea204c?gi=25697c91242b

r1cksec,

@Fr333k I used https://www.midjourney.com for most of them

r1cksec, to infosec

Proof of concept code for CVE-2023-45866, CVE-2024-21306, and CVE-2024-0230 (Bluetooth keyboard injection in Android, Linux, macOS, iOS and Windows)🕵️‍♂️​

https://github.com/marcnewlin/hi_my_name_is_keyboard

r1cksec, to infosec

A nice and understandable blog post on how to create a shortcut file that will be executed once given keys are pressed🕵️‍♂️​

https://cocomelonc.github.io/persistence/2023/12/10/malware-pers-23.html

r1cksec, to infosec

In this blog post, the structure of a JA4+ fingerprints is explained🕵️‍♂️​

https://blog.apnic.net/2023/11/22/ja4-network-fingerprinting

#infosec #cybersecurity #jam #ja4+ #fingerprint #threatintel #forensic

r1cksec, to infosec

A C++ implementation of the Internal Monologue attack. It allows to get NetNTLM hashes of users using SSPI without touching lsass.exe 🕵️‍♂️​

https://github.com/MzHmO/NtlmThief

r1cksec, to infosec

Great writeup about the process of finding and exploiting a bug in Chrome🕵️‍♂️​

https://0x44.xyz/blog/cve-2023-4369

r1cksec, to infosec

This post describes how the account_id is encoded within the aws_access_key_id 🕵️‍♂️​

https://medium.com/@TalBeerySec/a-short-note-on-aws-key-id-f88cc4317489

r1cksec, to infosec

Interesting article about a malware which uses a Telegram bot as command and control server 🕵️‍♂️​

https://blog.cluster25.duskrise.com/2023/10/25/the-duck-is-hiring

r1cksec, to infosec

This blog post provides an overview of the location information that can be obtained from Google Maps data on Android 🕵️‍♂️​

https://thebinaryhick.blog/2023/10/17/finding-phones-with-google-maps-part-1-android

r1cksec, to infosec

A good example how to investigate a phishing campaign, including using crt.sh and urlscan.io 🕵️‍♂️​

https://infosecwriteups.com/behind-the-screens-exploring-a-fresh-phishing-campaign-in-indonesia-stealing-facebook-credentials-9240016c5989

r1cksec, to infosec

DuckDuckGo's image proxy can be used as a command and control channel🕵️‍♂️​

https://nopcorn.github.io/2023/09/25/duckduckgo-as-c2

A suitable proof of concept tool has also been published:

https://github.com/nopcorn/DuckDuckC2

r1cksec, to infosec

This service can be used to check an e-mail address or phone number for a few linked social media profiles🕵️‍♂️​

https://predictasearch.com

r1cksec, to infosec

An interesting interview with a member of the ransomware group 8BASE🕵️‍♂️

https://intelcocktail.com/8base-interview

r1cksec, to infosec

A great blogpost about Web Race Conditions🕵️‍♂️​

https://portswigger.net/research/smashing-the-state-machine

r1cksec, to infosec

By dumping the LSASS process you get credentials 😈​
Even though creating the dump using via comsvcs.dll have been known for a long time and this technique is often detected, you can still be successful using some PowerShell obfuscation :blobcatfingerguns: ​:

https://badoption.eu/blog/2023/06/21/dumpit.html

Once you have the file you can easily extract the credentials on the same machine using :blobcatnerd:​ :

https://github.com/powerseb/PowerExtract

r1cksec, to infosec

New cheatsheets pushed🕵️‍♂️​

https://github.com/r1cksec/cheatsheets

Including among others:

This article describes how Tor servers can be deanonymized based on an ETag and Shodan :blobwaitaminute:​

https://sh1ttykids.medium.com/new-techniques-uncovering-tor-hidden-service-with-etag-5249044a0e9d

r1cksec, to infosec

Reproducing Spyboy technique, which involves terminating all EDR/XDR/AVs processes by abusing the zam64.sys driver

https://github.com/ZeroMemoryEx/Terminator

r1cksec, to infosec

New cheatsheets pushed🕵️‍♂️​

https://github.com/r1cksec/cheatsheets

A new technique that can lead to code execution on a client. You search for a archive in Explorer, land on a server and unsuspectingly click on a .jar file. No warning, no , no execution blocker :blobcat0_0:​
https://badoption.eu/blog/2023/06/01/zipjar.html

An interesting article that shows an example of how to proceed when analyzing a 🤖​
https://www.akamai.com/blog/security-research/dark-frost-botnet-unexpected-author-profile

Two handy tools to quickly analyze emails :mail_smirk:​
https://github.com/deFr0ggy/NightOwl
https://github.com/z0m31en7/WhatMail

Go source code that creates an exe file that can delete itself ❌​
https://github.com/secur30nly/go-self-delete

A tool to disable & while remaining as undetected as possible 🥋​
https://github.com/icyguider/LightsOut

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • provamag3
  • thenastyranch
  • magazineikmin
  • mdbf
  • InstantRegret
  • rosin
  • Youngstown
  • slotface
  • love
  • Durango
  • kavyap
  • everett
  • tacticalgear
  • DreamBathrooms
  • megavids
  • cisconetworking
  • Leos
  • modclub
  • khanakhh
  • ethstaker
  • osvaldo12
  • GTA5RPClips
  • ngwrru68w68
  • anitta
  • tester
  • cubers
  • normalnudes
  • JUstTest
  • All magazines
    •