Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, September 6th, 2024 https://isc.sans.edu/podcastdetail/9128, (Fri, Sep 6th)
I like to enrich my honeypot data from a variety of sources to help understand a bit more about the context of the attack. This includes the types of networks the attacks are coming from or whether malware submitted to a honeypot is new. I use a variety of sources to enrich my cowrie data using cowrieprocessor [1]:
Continue reading Enrichment Data: Keeping it Fresh, (Fri, Sep 6th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, September 5th, 2024 https://isc.sans.edu/podcastdetail/9126, (Thu, Sep 5th)
[This is a Guest Diary by Joshua Tyrrell, an ISC intern as part of the SANS.edu BACS program]
Continue reading Attack Surface [Guest Diary], (Wed, Sep 4th)
On August 10th, the popular learning platform “Moodle” released an update fixing %;%;cve:2024-43425%;%;. RedTeam Pentesting found the vulnerability and published a detailed blog post late last week. The blog post demonstrates in detail how a user with the “trainer” role could execute arbitrary code on the server. A trainer would have to publish a “calculated question”. These questions are generated dynamically by evaluating a formula. Sadly, the formula was evaluated using PHP';s “eval” command. As pointed out by RedTeam Pentesting, “eval” is a very dangerous command to use and should be avoided if at all possible. This applies not only to PHP but to most languages (also see my video about command injection vulnerabilities). As I usually say: “eval is only one letter away from evil”.
Continue reading Scans for Moodle Learning Platform Following Recent Update, (Wed, Sep 4th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, September 4th, 2024 https://isc.sans.edu/podcastdetail/9124, (Wed, Sep 4th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, September 3rd, 2024 https://isc.sans.edu/podcastdetail/9122, (Tue, Sep 3rd)
Just like “Protected OOXML Spreadsheets“, Word documents can also be protected:
Continue reading Protected OOXML Text Documents, (Mon, Sep 2nd)
Display filters are used to define expressions that decide which packets get displayed, and which not in Wireshark&#;x26;#;39;s packet list.
Continue reading Wireshark 4.4: Converting Display Filters to BPF Capture Filters, (Sun, Sep 1st)
This is the first 4.4 release. Many new features have been added, details are here.
Continue reading Wireshark 4.4.0 is now available, (Sat, Aug 31st)