Collaborate Disseminate
In diary entries “Huge Signed PE File” and “Huge Signed PE File: Keeping The Signature” I explain how to get rid of the overlay in a huge PE file.
Continue reading Extracting The Overlay Of A PE File, (Sun, May 29th)
In my diary entry “Huge Signed PE File” we stripped a huge PE file with signature like this:
Continue reading Huge Signed PE File: Keeping The Signature, (Sat, May 28th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, May 27th, 2022 https://isc.sans.edu/podcastdetail.html?id=8026, (Fri, May 27th)
Xavier&#;x26;#;39;s diary entry “A &#;x26;#;39;Zip Bomb&#;x26;#;39; to Bypass Security Controls &#;x26; Sandboxes” reminded me of something. I&#;x26;#;39;ve seen huge PE files like Xavier saw, but I&#;x26;#;39;ve also seen a couple of huge PE files that are signed. I will explain here how you can reduce their size.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, May 26th, 2022 https://isc.sans.edu/podcastdetail.html?id=8024, (Thu, May 26th)
Recently I&#;x26;#;39;ve been seeing more clients using DNS load balancing (GSLB) to load-balance traditional web, API and other services – it&#;x26;#;39;s an easy way to load balance between datacenters for instance. What I&#;x26;#;39;ve noticed lately, especially with servers that use cloud “as a service” offerings, is that:
Continue reading Using NMAP to Assess Hosts in Load Balanced Clusters, (Wed, May 25th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, May 25th, 2022 https://isc.sans.edu/podcastdetail.html?id=8022, (Wed, May 25th)
Python is a prevalent programming language and has a vast collection of packages on Python Package Index (pypi.org) that allow developers to build their code conveniently. Many of these packages can be installed and updated by the well-known âpip installâ command. However, many developers may take the updating and installation process for granted and may neglect to check what might have changed in the packages. I was recently alerted to such a particular post on Reddit [1], [2], and I decided to dive deeper to investigate the issue.
Continue reading ctx Python Library Updated with “Extra” Features, (Tue, May 24th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, May 24th, 2022 https://isc.sans.edu/podcastdetail.html?id=8020, (Tue, May 24th)
Recently, I noticed some requests hitting our honeypots that appear to attempt to exploit jQuery-File-Upload. jQuery-File-Upload is a popular tool for implementing file uploads. It has been around for a while and has had a few vulnerabilities in the past, but nothing recent as far as I can tell [1]. Allowing users to upload files securely is tricky. And jQuery-File-Upload is tempting faith by allowing uploads into the document root. The walk-through by Kristian Bremberg explaining past jQuery-File-Upload vulnerabilities is an excellent summary of all the things that can go wrong [2].
Continue reading Attacker Scanning for jQuery-File-Upload, (Mon, May 23rd)