Author Archives: SANS Internet Storm Center, InfoCON: green

A feature that I use often is the port-forwarding capability implemented in the SSH protocol. It’s very convenient for pivoting inside a network or accessing a resource that is not directly reachable. Think about a management console that binds on the loopback interface of a server (which is good from a security point of view). How to access it remotely? SSH to the rescue!

Continue reading Port-Forwarding with Windows for the Win, (Thu, Oct 14th)→

Recently, I am seeing a lot of identical failed login attempts against my mail server. Just today, about 130,000 of them. The vast majority (124k+) come from one subnet: 31.130.184.0/24

Continue reading Please fix your E-Mail Brute forcing tool!, (Wed, Oct 13th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, October 13th, 2021 https://isc.sans.edu/podcastdetail.html?id=7712, (Wed, Oct 13th)→

This month we got patches for 81 vulnerabilities. Of these, 3 are critical, 3 were previously disclosed and 1 is being exploited according to Microsoft.

Continue reading Microsoft October 2021 Patch Tuesday, (Tue, Oct 12th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, October 12th, 2021 https://isc.sans.edu/podcastdetail.html?id=7710, (Tue, Oct 12th)→

If you are reviewing your web server logs periodically, you may notice some odd requests that are not HTTP requests in your logs. In particular if you have a web server listening on a non standard port. I want to quickly review some of the most common requests like that, that I am seeing:

Continue reading Things that go “Bump” in the Night: Non HTTP Requests Hitting Web Servers, (Mon, Oct 11th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, October 11th, 2021 https://isc.sans.edu/podcastdetail.html?id=7708, (Mon, Oct 11th)→

Wireshark version 3.4.9 was released.

Continue reading Wireshark 3.4.9 Released, (Sun, Oct 10th)→

In the past few weeks, I have captured multiple instance of traffic related to some past Oracle vulnerabilities that have already been patched. The first is related to a RCE (CVE-2017-10271) that can be triggered to execute commands remotely by bypassing the CVE-2017-3506 patch&#;x26;#;39;s limitations. The POST contains an init.sh script which doesn&#;x26;#;39;t appear to be available for download.

Continue reading Scanning for Previous Oracle WebLogic Vulnerabilities, (Sat, Oct 9th)→

One thing that is huge in making sense of large volumes of data is sorting. Which makes having good sorting tools and methods a big deal when you are working through findings in a security assessment of pentest. Or – just as importantly – in day-to-day system administration.

Continue reading Sorting Things Out – Sorting Data by IP Address, (Fri, Oct 8th)→