Author Archives: Xavier

Your Password is Already In the Wild, You Did not Know?

Posted on by

There was a lot of buzz about the leak of two huge databases of passwords a few days ago. This has been reported by Try Hunt on his blog. The two databases are called “Anti-Trust-Combo-List” and “Exploit.In“. If the sources of the leaks are not officially known, there are some

[The post Your Password is Already In the Wild, You Did not Know? has been first published on /dev/random]

Continue reading Your Password is Already In the Wild, You Did not Know?→

[SANS ISC] My Little CVE Bot

Posted on by

I published the following diary on isc.sans.org: “My Little CVE Bot“. The massive spread of the WannaCry ransomware last Friday was another good proof that many organisations still fail to patch their systems. Everybody admits that patching is a boring task. They are many constraints that make this process very

[The post [SANS ISC] My Little CVE Bot has been first published on /dev/random]

Continue reading [SANS ISC] My Little CVE Bot→

[SANS ISC] When Bad Guys are Pwning Bad Guys…

Posted on by

I published the following diary on isc.sans.org: “When Bad Guys are Pwning Bad Guys…“. A few months ago, I wrote a diary about webshells[1] and the numerous interesting features they offer. They’re plenty of web shells available, there are easy to find and install. They are usually delivered as one

[The post [SANS ISC] When Bad Guys are Pwning Bad Guys… has been first published on /dev/random]

Continue reading [SANS ISC] When Bad Guys are Pwning Bad Guys…→

Identifying Sources of Leaks with the Gmail “+” Feature

Posted on by

For years, Google is offering two nice features with his gmail.com platform to gain more power of your email address. You can play with the “+” (plus) sign or “.” (dot) to create more email addresses linked to your primary one. Let’s take an example with John who’s the owner

[The post Identifying Sources of Leaks with the Gmail “+” Feature has been first published on /dev/random]

Continue reading Identifying Sources of Leaks with the Gmail “+” Feature→

[SANS ISC] The story of the CFO and CEO…

Posted on by

I published the following diary on isc.sans.org: “The story of the CFO and CEO…“. I read an interesting article in a Belgian IT magazine[1]. Every year, they organise a big survey to collect feelings from people working in the IT field (not only security). It is very broad and covers their

[The post [SANS ISC] The story of the CFO and CEO… has been first published on /dev/random]

Continue reading [SANS ISC] The story of the CFO and CEO…→

[SANS ISC] HTTP Headers… the Achilles’ heel of many applications

Posted on by

I published the following diary on isc.sans.org: “HTTP Headers… the Achilles’ heel of many applications“. When browsing a target web application, a pentester is looking for all “entry” or “injection” points present in the pages. Everybody knows that a static website with pure HTML code is less juicy compared to a

[The post [SANS ISC] HTTP Headers… the Achilles’ heel of many applications has been first published on /dev/random]

Continue reading [SANS ISC] HTTP Headers… the Achilles’ heel of many applications→

Who’s Visiting the Phishing Site?

Posted on by

Today, while hunting, I found a malicious HTML page in my spam trap. The page was a fake JP Morgan Chase bank. Nothing fancy. When I found such material, I usually search for “POST” HTTP requests to collect URLs and visit the websites that receive the victim’s data. As usual, the

[The post Who’s Visiting the Phishing Site? has been first published on /dev/random]

Continue reading Who’s Visiting the Phishing Site?→

FIRST TC Amsterdam 2017 Wrap-Up

Posted on by

Here is my quick wrap-up of the FIRST Technical Colloquium hosted by Cisco in Amsterdam. This is my first participation to a FIRST event. FIRST is an organization helping in incident response as stated on their website: FIRST is a premier organization and recognized global leader in incident response. Membership

[The post FIRST TC Amsterdam 2017 Wrap-Up has been first published on /dev/random]

Continue reading FIRST TC Amsterdam 2017 Wrap-Up→

[SANS ISC] Analysis of a Maldoc with Multiple Layers of Obfuscation

Posted on by

I published the following diary on isc.sans.org: “Analysis of a Maldoc with Multiple Layers of Obfuscation“. Thanks to our readers, we get often interesting samples to analyze. This time, Frederick sent us a malicious Microsoft Word document called “Invoice_6083.doc” (which was delivered in a zip archive). I had a quick

[The post [SANS ISC] Analysis of a Maldoc with Multiple Layers of Obfuscation has been first published on /dev/random]

Continue reading [SANS ISC] Analysis of a Maldoc with Multiple Layers of Obfuscation→

Archive.org Abused to Deliver Phishing Pages

Posted on by

The Internet Archive is a well-known website and more precisely for its “WaybackMachine” service. It allows you to search for and display old versions of websites. The current Alexa ranking is 262 which makes it a “popular and trusted” website. Indeed, like I explained in a recent SANS ISC diary, whitelists

[The post Archive.org Abused to Deliver Phishing Pages has been first published on /dev/random]

Continue reading Archive.org Abused to Deliver Phishing Pages→