Collaborate Disseminate
During Thanksgiving week, we noticed this quite unusual XML-format MS Office Document file Figure 1: Email Sample Saving a Word document file as XML is a legitimate option but criminals had taken advantage of this file format to circumvent malware…
Continue reading Demystifying Obfuscation Used in the Thanksgiving Spam Campaign
Sometimes pentesters and security researchers need to modify existing Java application but have no access to its source. For example, it might be necessary to adjust the logic a bit to see how the application works in certain specific conditions….
Continue reading Exploring and Modifying Android and Java Applications for Security Research
Hacker’s Wish Come True After Infecting Visitors of Make-A-Wish Website With Cryptojacking After coming back from a vacation, the first thing to do is catch up with what happened while you were gone. That is what I did earlier this…
Continue reading Hacker’s Wish Come True After Infecting Visitors of Make-A-Wish Website With Cryptojacking
Whilst there is a wealth of information out there about how to build environments that can be used for training, offensive tradecraft development and blue team response detection, a vital part of these environments is hard to emulate. A computer…
Continue reading Sheepl : Automating People for Red and Blue Tradecraft
Context AJAX stands for Asynchronous JavaScript And XML. It’s a set of web development techniques using many web technologies on the client side to create asynchronous web applications. In some cases, XML is not used, but JavaScript is almost always…
Continue reading Taking Advantage of AJAX for Account Enumeration
The second to last Patch Tuesday of 2018 is here with patches for 55 CVEs. This includes 11 rated “Critical”, 42 rated “Important” and one each rated “Moderate” and “Low”. The release also contains three advisories including the standard patch…
Continue reading Microsoft Patch Tuesday, November 2018
At precisely 155 commits ahead of the latest version, ModSecurity version 3.0.3 contains a number of improvements and features to enhance the ModSecurity experience. In this blog post, we’ll explain some of the new capabilities in the latest release. B… Continue reading ModSecurity v3.0.3: What To Expect
Many types of malware send and receive data via HTTP. They may either be sending updates back to their command and control (CnC) centers or they may receive updates. Typically these won’t be sent in plain text but rather with…
Continue reading Decoding Hancitor Malware with Suricata and Lua
Many types of malware send and receive data via HTTP. They may either be sending updates back to their command and control (CnC) centers or they may receive updates. Typically these won’t be sent in plain text but rather with…
Continue reading Decoding Hancitor Malware with Suricata and Lua
David Middlehurst of Trustwave SpiderLabs presented at the first ever conference dedicated to the Mitre ATT&CK framework earlier this week, on October 23, 2018. Mitre hosted the event
Continue reading DOH! DNS Over HTTPS Poses Possible Risks to Enterprises