Author Archives: Xavier

WiNX: The Ultra-Portable Wireless Attacking Platform

Posted on by

When you are performing penetration tests for your customers, you need to build your personal arsenal. Tools, pieces of hardware and software are collected here and there depending on your engagements to increase your toolbox. To perform Wireless intrusion tests, I’m a big fan of the WiFi Pineapple. I’ve one for

[The post WiNX: The Ultra-Portable Wireless Attacking Platform has been first published on /dev/random]

Continue reading WiNX: The Ultra-Portable Wireless Attacking Platform→

[SANS ISC] The easy way to analyze huge amounts of PCAP data

Posted on by

I published the following diary on isc.sans.org: “The easy way to analyze huge amounts of PCAP data“. When you are investigating a security incident, there are chances that, at a certain point, you will have to dive into network traffic analysis. If you’re lucky, you’ll have access to a network capture.

[The post [SANS ISC] The easy way to analyze huge amounts of PCAP data has been first published on /dev/random]

Continue reading [SANS ISC] The easy way to analyze huge amounts of PCAP data→

[SANS ISC] Getting some intelligence from malspam

Posted on by

I published the following diary on isc.sans.org: “Getting some intelligence from malspam“. Many of us are receiving a lot of malspam every day. By “malspam”, I mean spam messages that contain a malicious document. This is one of the classic infection vectors today and aggressive campaigns are started every week.

[The post [SANS ISC] Getting some intelligence from malspam has been first published on /dev/random]

Continue reading [SANS ISC] Getting some intelligence from malspam→

[SANS ISC] Another webshell, another backdoor!

Posted on by

I published the following diary on isc.sans.org: “Another webshell, another backdoor!“. I’m still busy to follow how webshells are evolving… I recently found another backdoor in another webshell called “cor0.id”. The best place to find webshells remind pastebin.com[1]. When I’m testing a webshell, I copy it in a VM located

[The post [SANS ISC] Another webshell, another backdoor! has been first published on /dev/random]

Continue reading [SANS ISC] Another webshell, another backdoor!→

FSEC 2017 Wrap-Up Day #2

Posted on by

Here we go with a quick wrap-up of the second day. It started smoothly around 09:00 and was dedicated to more technical talks. After some refill of coffee, I was ready to follow all talks presented in the main track. It started with LiveOverflow who presented “Play CTF“. CTF games

[The post FSEC 2017 Wrap-Up Day #2 has been first published on /dev/random]

Continue reading FSEC 2017 Wrap-Up Day #2→

FSEC 2017 Wrap-Up Day #1

Posted on by

There are more and more infosec events worldwide and it’s always nice to attend new events and meet new people. This time, it is the case with FSEC. First visit to this security conference organized in Varazdin, Croatia. I had the honor to be invited as a speaker. This is already

[The post FSEC 2017 Wrap-Up Day #1 has been first published on /dev/random]

Continue reading FSEC 2017 Wrap-Up Day #1→

Interesting List of Windows Processes Killed by Malicious Software

Posted on by

Just a quick blog post about an interesting sample that I found today. Usually, modern pieces of malware implement anti-debugging and anti-VM techniques. They perform some checks against the target and when a positive result is found, they silently exit… Such checks might be testing the screen resolution, the activity

[The post Interesting List of Windows Processes Killed by Malicious Software has been first published on /dev/random]

Continue reading Interesting List of Windows Processes Killed by Malicious Software→

[SANS ISC] AutoIT based malware back in the wild

Posted on by

I published the following diary on isc.sans.org: “AutoIT based malware back in the wild“. One week ago I wrote a diary with an analysis of a malicious RAR archive that contained an AutoIT script. The technique was not new but I was curious to see if this was a one-shot

[The post [SANS ISC] AutoIT based malware back in the wild has been first published on /dev/random]

Continue reading [SANS ISC] AutoIT based malware back in the wild→

[SANS ISC] Malicious AutoIT script delivered in a self-extracting RAR file

Posted on by

I published the following diary on isc.sans.org: “Malicious AutoIT script delivered in a self-extracting RAR file“. Here is another sample that hit my curiosity. As usual, the infection vector was an email which delivered some HTML code in an attached file called “PO_5634_780.docx.html” (SHA1:d2158494e1b9e0bd85e56e431cbbbba465064f5a). It has a very low VT

[The post [SANS ISC] Malicious AutoIT script delivered in a self-extracting RAR file has been first published on /dev/random]

Continue reading [SANS ISC] Malicious AutoIT script delivered in a self-extracting RAR file→

[SANS ISC] Malicious AutoIT script delivered in a self-extracting RAR file

Posted on by

I published the following diary on isc.sans.org: “Malicious AutoIT script delivered in a self-extracting RAR file“. Here is another sample that hit my curiosity. As usual, the infection vector was an email which delivered some HTML code in an attached file called “PO_5634_780.docx.html” (SHA1:d2158494e1b9e0bd85e56e431cbbbba465064f5a). It has a very low VT

[The post [SANS ISC] Malicious AutoIT script delivered in a self-extracting RAR file has been first published on /dev/random]

Continue reading [SANS ISC] Malicious AutoIT script delivered in a self-extracting RAR file→