#hacktricks-feed

1 messages · Page 1 of 1 (latest)

wild ibex
#

Which day would you prefer my Twitch stream to take place?
It will be at 5pm(UTC), 6pm(CET), 12pm(EST), 10.30pm(IST).
#hacktricks #cybersecurity #hacking #live

boreal karma
#

<@&937047799441268746> ^

wild ibex
#

Thx

wild ibex
#

First cloud hacking twitch session scheduled next Wednesday (7th) at 6.30pm(CET)!

I will be explaining hacking techniques in twitch Wednesdays at 5.30pm(UTC), 6.30pm(CET), 12.30(EST), 11pm(IST).
If you want to learn about hacking cloud, kubernetes, web and resolve interesting CTFs feel free to follow!

Twitch: https://lnkd.in/d2bYdUNS
Youtube: https://lnkd.in/damJC2JX
Twitter: https://lnkd.in/dbZ9s8t4

misty forge
#

Any regedit kings around?

deep valeBOT
deep valeBOT
#
deep valeBOT
deep valeBOT
deep valeBOT
deep valeBOT
deep valeBOT
deep valeBOT
#
deep valeBOT
deep valeBOT
#

📓 New content has been added to the following pages 📓

deep valeBOT
deep valeBOT
limber badge
limber badge
limber badge
limber badge
limber badge
limber badge
limber badge
limber badge
limber badge
limber badge
deep valeBOT
deep valeBOT
deep valeBOT
deep valeBOT
deep valeBOT
verbal jolt
#

Hacking

deep valeBOT
#

🛠️ Tool | 💣 RCE | 🌐 Web | 💰 Bug Bounty

🔗 Original article: https://blog.bughunt.com.br/cobalt-strike/

Cobalt Strike is a legitimate red team tool now heavily abused for stealthy cyberattacks, enabling credential theft, lateral movement, and data exfiltration even in critical government networks.

BugHunt

Entenda o que é o Cobalt Strike, como ele impactou as relações Brasil-Paraguai e como proteger sua empresa contra essa ameaça cibernética crescente.

deep valeBOT
#

🌐 Web | 🛡️ Threat Group | 💣 Ransomware | 💉 Social Engineering

🔗 Original article: https://unit42.paloaltonetworks.com/muddled-libra/

Muddled Libra is a technical threat group using phishing, social engineering, RMM tools, and ransomware to breach enterprises, evade defenses, steal data, and extort victims. Their attacks are mapped to MITRE ATT&CK and involve advanced persistence and credential theft.

Unit 42

Muddled Libra continues to evolve. From social engineering to adaptation of new technologies, significant time is spent breaking down organizational defenses.

#

🤖 AI | 💉 Prompt Injection | 💣 RCE | 🛡️ OWASP

🔗 Original article: https://unit42.paloaltonetworks.com/agentic-ai-threats/

Hands-on guide to exploiting and defending agentic AI apps: prompt injection, RCE, SQLi, BOLA, and more, with attack payloads, code, and mitigations.

Unit 42

Programs leveraging AI agents are increasingly popular. Nine attack scenarios using open-source agent frameworks show how bad actors target these applications. Programs leveraging AI agents are increasingly popular. Nine attack scenarios using open-source agent frameworks show how bad actors target these applications.

#

🌐 Web | 🛡️ CVE | 💣 RCE | 💰 Bug Bounty

🔗 Original article: https://www.yeswehack.com/learn-bug-bounty/practical-guide-path-traversal-attacks

A technical, actionable guide to exploiting and mitigating path traversal in web apps/APIs, covering payloads, bypasses, fuzzing, real-world CVEs, and escalation to RCE. Includes code, attack vectors, and defense strategies.

Know much about exploiting path traversal or arbitrary file read vulnerabilities? Learn some practical attacks for unearthing high impact, lucrative vulnerabilities.

#

🌐 Web | 💣 RCE | 🛠️ Tool | 💰 Bug Bounty

🔗 Original article: https://sensepost.com/blog/2025/browser-cache-smuggling-the-return-of-the-dropper/

Browser Cache Smuggling abuses browser cache and DLL hijacking to stealthily deliver and execute malware via trusted apps like Teams. Includes code, OPSEC tips, and mitigations.

#

🛠️ Tool | 🛡️ Windows | 💰 Bug Bounty | 🔨 Registry

🔗 Original article: https://www.synacktiv.com/publications/lsa-secrets-revisiting-secretsdump.html

Explains stealthy Windows secrets extraction using <code>regsecrets.py</code> and <code>dpapidump.py</code>, which avoid EDR detection by querying the registry directly and bypassing ACLs. Includes technical steps, code, and impact.

#

🛡️ CVE | 💣 RCE | 🌐 Web | 🔒 Phishing

🔗 Original article: https://research.checkpoint.com/2025/19th-may-threat-intelligence-report/

Critical RCE flaws in SAP NetWeaver (CVE-2025-31324/42999) and Fortinet (CVE-2025-32756) are exploited in the wild. Chrome (CVE-2025-4664) faces a high-severity data leak bug. Major phishing and ransomware campaigns are also detailed.

Check Point Research

For the latest discoveries in cyber research for the week of 19th May, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Fashion giant Dior confirmed a data breach that exposed customer information from its Fashion and Accessories line. The leaked data includes names, gender, phone numbers, email addresses, postal addres...

#

💣 RCE | 🛡️ CVE | 🌐 Web | 🛠️ Tool

🔗 Original article: https://www.thezdi.com/blog/2025/5/16/pwn2own-berlin-2025-day-two-results

Pwn2Own Berlin 2025 Day Two saw 20 unique 0-days exploited live, including RCEs and privilege escalations in SharePoint, VMware ESXi, Firefox, Redis, VirtualBox, and RHEL using advanced memory and logic flaws.

#

🌐 Web | 🤖 AI | 💰 Bug Bounty | 🔒 Access Control

🔗 Original article: https://www.pentestpartners.com/security-blog/exploiting-copilot-ai-for-sharepoint/

Attackers can exploit Microsoft Copilot for SharePoint to extract sensitive data, bypass permissions, and evade detection using AI agents. Custom agents increase risk by enabling data aggregation and knowledge base poisoning.

Pen Test Partners

TL;DR Introduction SharePoint is a Microsoft platform that enables collaborative working and information sharing. This done with team sites. They work like regular intranet pages with graphics and text, but they also give you places to store and manage your files. Notably, when files and images are shared on Microsoft Teams, SharePoint automatic...

#

🛡️ DFIR | 🛠️ Tool | 🔒 Forensics | 💻 Windows

🔗 Original article: https://www.pentestpartners.com/security-blog/the-remote-desktop-puzzle-dfir-techniques-for-dealing-with-rdp-bitmap-cache/

Guide to extracting and reconstructing RDP Bitmap Cache for DFIR: use BMC-Tools and RDPCacheStitcher to recover user activity and credentials, even after log deletion.

Pen Test Partners

TL;DR Introduction A lot of people are aware of RDP and what its functions are. It’s known for providing remote access and making life easier for administrators and users. With that comes insight for forensic investigators, regarding the ‘bitmap cache’. This is often overlooked, but when analysed correctly can provide some great understand...

#

🛡️ CVE | 💣 RCE | 🌐 Web | 💻 Malware

🔗 Original article: https://research.checkpoint.com/2025/5th-may-threat-intelligence-report/

Multiple critical vulnerabilities and malware: SonicWall, Apple AirPlay, NVIDIA Riva, Magento supply chain, Outlaw botnet, and Gremlin Stealer. Includes CVEs, attack vectors, and exploitation details.

Check Point Research

For the latest discoveries in cyber research for the week of 5th May, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Three major UK retailers – Co-op, Harrods and Marks & Spencer (M&S) – were hit by cyberattacks that disrupted operations and compromised sensitive data. The attacks are believed linked to the Scatte...

#

🛡️ CVE | 💣 RCE | 🌐 Web | 🧪 AI

🔗 Original article: https://www.thezdi.com/blog/2025/5/15/pwn2own-berlin-2025-day-one-results

Pwn2Own Berlin 2025 Day One featured technical exploits for privilege escalation and sandbox escapes on Linux, Windows, VirtualBox, Docker, and AI, using UAF, integer overflow, OOB write, and type confusion bugs.

#

📱 Android | 🛡️ Data Leak | 🌐 Web | 💰 Bug Bounty

🔗 Original article: https://ndevtk.github.io/writeups/2025/06/06/android-leak/

A race condition in Android's lock screen lets attackers briefly view sensitive app content or install apps without unlocking, exposing private data.

#

🛡️ CVE | 💣 RCE | 🌐 Web | 💰 Bug Bounty

🔗 Original article: https://blog.rapid7.com/2025/06/04/rapid7-q1-2025-incident-response-findings/

Technical review of Q1 2025 attacks: MFA bypass, Fortinet (CVE-2024-55591), SimpleHelp RCEs, SEO poisoning, BunnyLoader, and ransomware. Includes attack chains, exploitation steps, and impact.

Rapid7

Rapid7's Q1 2025 incident response data reveals key IAV trends, top incidents, common malware, and threat patterns across industries based on real investigations.

#

🌐 Web | 🛡️ Kerberos | 💣 Relay Attack | 🛠️ Tool

🔗 Original article: https://www.synacktiv.com/publications/abusing-multicast-poisoning-for-pre-authenticated-kerberos-relay-over-http-with.html

Shows how to exploit Kerberos relay over HTTP using LLMNR poisoning with Responder and krbrelayx, including all technical steps, commands, and real-world impact.

#

🛠️ Tool | 🌐 Web | 💰 Bug Bounty | 🛡️ CVE

🔗 Original article: https://github.com/Geidalaodicha/burpGPTplus

burpGPTplus is a Burp Suite extension using GPT-3.5-turbo to automate web vulnerability analysis, focusing on OWASP Top 10 risks, with free API relay support.

GitHub

Contribute to Geidalaodicha/burpGPTplus development by creating an account on GitHub.

#

🛡️ Credential Access | 🛠️ Red Team | 💻 Windows | 💰 Bug Bounty

🔗 Original article: https://trustedsec.com/blog/red-team-gold-extracting-credentials-from-mdt-shares

Misconfigured MDT shares often expose plaintext credentials (domain join, admin, BitLocker, etc.) to any AD user. Attackers can extract these from INI/XML files, enabling privilege escalation and domain compromise.

#

🛡️ CVE | 💣 RCE | 🛠️ Tool | 🌐 Web

🔗 Original article: https://www.mdsec.co.uk/2024/12/extracting-account-connectivity-credentials-accs-from-symantec-management-agent-aka-altiris/

Step-by-step guide to extracting privileged credentials from Symantec Management Agent (Altiris) using EvilAltiris, enabling privilege escalation and lateral movement. Includes code, cryptographic details, and remediation advice.

Introduction On a recent Red Team for a particularly hardened client, we were looking to escalate our privileges in order to move off the endpoint and pivot into the server...

#

🌐 Web | 🛡️ CVE | 🛠️ Tool | 💰 Bug Bounty

🔗 Original article: https://posts.specterops.io/do-you-own-your-permissions-or-do-your-permissions-own-you-c829a91f5e45?source=rss----f05f8696e3cc---4

Explains how BlockOwnerImplicitRights in AD blocks privilege escalation via object ownership, details BloodHound's new logic for accurate attack path mapping, and covers CVE-2021-42291.

Medium

tl;dr: Less FPs for Owns/WriteOwner and new Owns/WriteOwnerLimitedRights edges

#

⛓️ Web3 | 🛡️ CVE | 🛠️ Tool | 💣 RCE

🔗 Original article: https://blog.trailofbits.com/2025/05/30/a-deep-dive-into-axioms-halo2-circuits/

Trail of Bits' audit of Axiom's Halo2 ZKP circuits found critical under-constrained bugs and logic errors that could break blockchain security. The post details technical pitfalls, exploitation, and remediation for ZKP circuit developers.

The Trail of Bits Blog

Over two audits in 2023, we reviewed a blockchain system developed by Axiom that allows computing over the entire history of Ethereum, all verified by zero-knowledge proofs (ZKPs) on-chain using ZK-verified elliptic curve and SNARK recursion operations. This system is built using the Halo2 framework—a complex, emerging technology that presents...

#

🛡️ CVE | 💣 RCE | 🔨 Exploit | 🌐 Web

🔗 Original article: https://research.checkpoint.com/2025/21st-april-threat-intelligence-report/

Covers NTLM hash disclosure (CVE-2025-24054), iOS RCE flaws, Oracle's critical patch, Waiting Thread Hijacking injection, and BYOVD ransomware with technical exploitation details and impact.

Check Point Research

For the latest discoveries in cyber research for the week of 21st April, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Retail giant Ahold Delhaize has suffered a cyber-attack resulting in data theft of customer information from its US business systems. The attack, claimed by ransomware group INC Ransom, impacted Ahol...

#

🛡️ CVE | 🌐 Web | 💣 RCE | 🛠️ Tool

🔗 Original article: https://posts.specterops.io/the-renaissance-of-ntlm-relay-attacks-everything-you-need-to-know-abfc3677c34e?source=rss----f05f8696e3cc---4

NTLM relay attacks remain a major threat in Active Directory. This post details technical exploitation, attack paths (SMB, LDAP, ADCS), and new BloodHound features for visualizing and mitigating these risks.

Medium

NTLM relay attacks have been around for a long time. While many security practitioners think NTLM relay is a solved problem, or at least a…

#

🛡️ CVE | 💣 RCE | 🌐 Web | 💰 Bug Bounty

🔗 Original article: https://www.thezdi.com/blog/2025/4/8/the-april-2025-security-update-review

Covers April 2025 Microsoft and Adobe patches: critical RCEs, EoPs, and SFBs, including actively exploited Windows EoP (CVE-2025-29824) and wormable LDAP/RDS RCEs. No exploitation reported for Adobe bugs.

#

📱 Mobile | 🛠️ Tool | 💉 SSL Pinning | 🔎 Reverse

🔗 Original article: https://sensepost.com/blog/2025/intercepting-https-communication-in-flutter-going-full-hardcore-mode-with-frida/

Step-by-step guide to bypassing SSL pinning in Flutter apps using reFlutter (static patching) and Frida (dynamic hooking), enabling HTTPS interception for security testing.

#

💣 RCE | 🛡️ CVE | 🌐 Web | 🛠️ Tool

🔗 Original article: https://www.offsec.com/blog/cve-2025-0655/

Critical RCE in D-Tale (CVE-2025-0655): Unauthenticated attackers can enable custom filters and execute arbitrary Python code via API, leading to full server compromise. Patch in v3.16.1.

OffSec

A critical remote code execution (RCE) vulnerability in the D-Tale data visualization tool was identified which allowed attackers to execute arbitrary system exams, abusing an exposed API endpoint.

#

🛡️ CVE | 💉 NTLM Relay | 🌐 Web | 🛠️ Tool

🔗 Original article: https://www.synacktiv.com/publications/taking-the-relaying-capabilities-of-multicast-poisoning-to-the-next-level-tricking.html

A new technique forces Windows SMB clients to fall back to WebDav, enabling HTTP-based NTLM/Kerberos relaying via multicast poisoning. This increases the impact of attacks in AD environments.

#

🌐 Web | 🛡️ CVE | 💣 RCE | 🛠️ Tool

🔗 Original article: https://www.offsec.com/blog/cve-2025-24893/

Critical unauthenticated RCE in XWiki (CVE-2025-24893) via SolrSearch macro lets attackers run arbitrary Groovy code remotely. Exploitable with a simple GET request; PoC available. Patch immediately.

OffSec

An RCE vulnerability in XWiki was found allowing unauthenticated attackers to execute arbitrary Groovy code remotely without authentication or prior access.

#

🛠️ Tool | 🌐 Web | 🤖 AI/ML | 💰 Bug Bounty

🔗 Original article: https://sensepost.com/blog/2025/capchan-solving-captcha-with-image-classification/

A technical guide to automating CAPTCHA solving using image classification and machine learning, featuring the open-source tool capchan. Includes code, attack steps, and practical use for security testing.

#

🛠️ Tool | 🌐 Web | 🤖 AI | 💉 XSS

🔗 Original article: https://portswigger.net/research/shadow-repeater-ai-enhanced-manual-testing

Shadow Repeater is a Burp Suite extension that uses AI to generate and test payload variations, automating the discovery of XSS, path traversal, and novel web vulnerabilities.

PortSwigger Research

Have you ever wondered how many vulnerabilities you've missed by a hair's breadth, due to a single flawed choice? We've just released Shadow Repeater, which enhances your manual testing with AI-powere

#

⛓️ Web3 | 🛡️ CVE | 💰 Bug Bounty | 🛠️ Tool

🔗 Original article: https://medium.com/immunefi/top-3-bugs-from-the-thundernft-invite-only-program-373da9824cc9?source=rss----6cdc579be8a0---4

Three major ThunderNFT bugs: NFT theft via order update, ERC1155 under-delivery due to hardcoded logic, and sellers blocked from accepting bids. All issues are now fixed.

Medium

From 12th August to 2nd September 2024, the ThunderNFT protocol hosted an Invite-Only Program (IOP) on the Immunefi platform for…

#

🌐 Web | 🛡️ CVE | 💣 Auth Bypass | 💰 Bug Bounty

🔗 Original article: https://bishopfox.com/blog/sonicwall-cve-2024-53704-ssl-vpn-session-hijacking

CVE-2024-53704 lets attackers hijack SonicWall SSL VPN sessions by sending a base64-encoded null cookie. Exploit is simple and critical; patch immediately.

Bishop Fox

Security researchers have exploited CVE-2024-53704, an authentication bypass affecting the SSL VPN component of unpatched SonicWall firewalls. Watch demo!

#

🛡️ CVE | 💣 RCE | 🛠️ Tool | 🌐 Web

🔗 Original article: https://github.com/kn0x0x/CVE-2025-32756-POC

Critical unauthenticated RCE in Fortinet (CVE-2025-32756) via stack buffer overflow in /remote/hostcheck_validate. Python PoC available. Patch immediately.

GitHub

Proof of Concept for CVE-2025-32756 - A critical stack-based buffer overflow vulnerability affecting multiple Fortinet products. - kn0x0x/CVE-2025-32756-POC

#

🛠️ Tool | 💣 RCE | 🌐 Web | 💰 Bug Bounty

🔗 Original article: https://www.mdsec.co.uk/2023/08/leveraging-vscode-extensions-for-initial-access/

Step-by-step guide to exploiting VSCode extensions for phishing and RCE via the vscode:// URI handler and marketplace spoofing, with full code and mitigation steps.

Introduction On a recent red team engagement, MDSec were tasked with crafting a phishing campaign for initial access. The catch was that the in-scope phishing targets were developers with technical...

#

🛡️ CVE | 💣 RCE | 💰 Bug Bounty | 💻 Windows

🔗 Original article: https://www.mdsec.co.uk/2024/01/cve-2024-20656-local-privilege-escalation-in-vsstandardcollectorservice150-service/

CVE-2024-20656: Local privilege escalation in Visual Studio's VSStandardCollectorService150 via DACL reset and junction abuse, enabling SYSTEM access. Exploit uses VSDiagnostics.exe, NTFS junctions, and MSI repair. Patched Jan 2024.

Overview Visual Studio is a complex and powerful IDE developed by Microsoft and comes with a lot of features that can be interesting from a red team perspective. During this...

#

🌐 Web | 🛡️ CVE | 💣 DoS | 🛠️ Tool

🔗 Original article: https://bishopfox.com/blog/sonicwall-sonicos-versions-7-1-x-and-8-0-x

Remote unauthenticated DoS (CVE-2025-32818) in SonicWall SonicOS SSL VPN lets attackers crash and reboot devices via crafted HTTP POST requests. Update to 7.2.0/8.0.1 or disable SSL VPN.

Bishop Fox

Blog describes how Bishop Fox staff identified a vulnerability in SonicWall SonicOS 7.1.x and 8.0.x in the SSL VPN service and solutions for customers.

#

🌐 Web | 🛡️ CVE | 🔑 SAML | 💣 RCE

🔗 Original article: https://portswigger.net/research/saml-roulette-the-hacker-always-wins

Chained round-trip and namespace confusion attacks in ruby-saml let attackers bypass SAML authentication and gain admin access on GitLab by exploiting XML parser inconsistencies.

PortSwigger Research

Introduction In this post, we’ll show precisely how to chain round-trip attacks and namespace confusion to achieve unauthenticated admin access on GitLab Enterprise by exploiting the ruby-saml library

#

🌐 Web | 🛡️ CVE | 🛠️ Tool | 💰 Bug Bounty

🔗 Original article: https://posts.specterops.io/an-operators-guide-to-device-joined-hosts-and-the-prt-cookie-bcd0db2812c4?source=rss----f05f8696e3cc---4

Step-by-step guide to extracting and abusing PRT cookies from device-joined Windows hosts for SSO/MFA bypass and post-exploitation in Azure/Entra ID environments, with detailed enumeration, extraction, and detection techniques.

#

🌐 Web | 🛡️ APT | 💉 Phishing | 🛡️ Threat Intel

🔗 Original article: https://unit42.paloaltonetworks.com/iranian-attackers-impersonate-model-agency/

Iranian APT cloned a model agency site, using obfuscated JavaScript for advanced visitor fingerprinting and social engineering. Data is exfiltrated via POST, enabling targeted attacks. No CVEs, but detailed technical analysis and IOCs are provided.

Unit 42

A suspected Iranian espionage campaign impersonated a model agency site for data collection, including fictitious models as possible social engineering lures. A suspected Iranian espionage campaign impersonated a model agency site for data collection, including fictitious models as possible social engineering lures.

#

🌐 Web | 🛡️ LLM | 💉 Prompt Injection | 🛠️ Tool

🔗 Original article: https://unit42.paloaltonetworks.com/comparing-llm-guardrails-across-genai-platforms/

Compares LLM guardrails across platforms, showing how prompt injection and role-play can bypass filters. Strict settings cause false positives, especially for code prompts. Output filters rarely block harmful content. Security pros must test and tune guardrails for real-world attacks.

Unit 42

We compare the effectiveness of content filtering guardrails across major GenAI platforms and identify common failure cases across different systems. We compare the effectiveness of content filtering guardrails across major GenAI platforms and identify common failure cases across different systems.

#

🌐 Web | 💉 Prompt Injection | 🛡️ Protocol | 💣 Exploit

🔗 Original article: https://blog.trailofbits.com/2025/04/21/jumping-the-line-how-mcp-servers-can-attack-you-before-you-ever-use-them/

Explains how MCP servers can exploit prompt injection in tool descriptions to bypass security controls and manipulate AI models before any tool is used, leading to severe risks like code exfiltration and privilege escalation.

The Trail of Bits Blog

This post is about a vulnerability in the Model Context Protocol (MCP) called “Line Jumping,” where malicious servers can inject prompts through tool descriptions to manipulate AI model behavior without being explicitly invoked, effectively bypassing security measures designed to protect users.

#

🛡️ CVE | 💣 RCE | 🌐 Web | 🛠️ Tool

🔗 Original article: https://www.mdsec.co.uk/2023/06/cve-2023-26258-remote-code-execution-in-arcserve-udp-backup/

CVE-2023-26258 in ArcServe UDP allows attackers to bypass authentication, extract and decrypt admin credentials, and gain RCE using crafted requests and provided tools.

Overview During a recent adversary simulation, the MDSec ActiveBreach red team were performing a ransomware scenario, with a key objective set on compromising the organisation’s backup infrastructure. As part of...

#

💣 RCE | 🌐 Web | 🛡️ CVE | 🛠️ Tool

🔗 Original article: https://www.synacktiv.com/publications/etude-de-cas-comment-hunters-international-et-ses-affilies-ciblent-vos-hyperviseurs.html

Step-by-step technical analysis of a Hunters International ransomware attack on VMware ESXi: from malvertising and credential theft to lateral movement, data exfiltration, and deployment of a custom, obfuscated Rust ransomware.

#

🛡️ CVE | 🌐 Web | 🛠️ Tool | 💰 Bug Bounty

🔗 Original article: https://posts.specterops.io/decrypting-the-forest-from-the-trees-661694ed1616?source=rss----f05f8696e3cc---4

Step-by-step guide to extracting and decrypting SCCM forest discovery credentials, including code, API endpoints, and tool usage. High risk for lateral movement; essential for red teamers and defenders.

Medium

TL;DR: SCCM forest discovery accounts can be decrypted including accounts used for managing untrusted forests. If the site server is a…

#

📱 Android | 🕵️ Spyware | 🦠 Malware | 🔬 Analysis

🔗 Original article: https://labs.k7computing.com/index.php/android-spyware-alert-fake-government-app-targeting-android-users-in-india/

Detailed technical analysis of a fake Android government app dropper/stealer using anti-analysis, multi-stage payloads, and advanced data theft and persistence techniques.

K7 Labs

Recently, we came across a detection in our telemetry report named “PM KISAN YOJNA”, masquerading as the official government application […]

#

🛡️ CVE | 📡 IoT | 💣 RCE | 🌐 Web

🔗 Original article: https://www.pentestpartners.com/security-blog/fire-detection-system-been-pwned-youre-not-going-to-sea/

Critical unpatched SSH and VNC credential flaws in Consilium CS5000 fire panels (CVE-2025-46352, CVE-2025-41438) allow remote takeover and disabling of fire detection. Only network and physical controls can mitigate risk.

Pen Test Partners

Consilium Salwico CS5000 Fire Panel vulnerability advisory. CVE-2025-46352 – Default Account & CVE-2025-41438 – Hardcoded VNC Credentials

#

🤖 AI | 🛠️ Tool | 🌐 Web | 💰 Bug Bounty

🔗 Original article: https://trustedsec.com/blog/teaching-a-new-dog-old-tricks-phishing-with-mcp

Shows how to use custom MCP servers and Claude AI to automate and personalize phishing, including code, config, and workflow for scalable, targeted attacks.

TrustedSec

As AI evolves with MCP, can a new “dog” learn old tricks? In this blog, we test Claude AI’s ability to craft phishing pretexts—and just how much effort it…

#

💣 Malware | 🛠️ Tool | 🔨 Rust | 💻 Windows

🔗 Original article: https://bishopfox.com/blog/rust-for-malware-development

Step-by-step guide to Rust malware: process enumeration, stealthy remote mapping injection, and C2 staging with Sliver. Full code, commands, and reverse engineering challenges included.

Bishop Fox

Bishop Fox's Nick Cerne, will compare developing malware in Rust compared to its C counterparts and develop a simple malware dropper for demonstration.

#

🛠️ Tool | 🌐 Web | 💰 Bug Bounty | 📡 IoT

🔗 Original article: https://github.com/0xAwali/WebSocketChecker

WebSocketChecker is a Burp Suite extension that scans WebSocket messages for leaked secrets and credentials using regex, helping security professionals detect and prevent sensitive data exposure in real time.

GitHub

Burp suite extension to find sensitive information by checking incoming text OR binary websocket messages - 0xAwali/WebSocketChecker

#

🛡️ Malware | 🛠️ Obfuscation | 💻 .NET | 🔎 ThreatIntel

🔗 Original article: https://unit42.paloaltonetworks.com/malicious-payloads-as-bitmap-resources-hide-net-malware/

Malware campaign hides .NET payloads in bitmap resources, using multi-stage loaders and advanced obfuscation to deliver Agent Tesla, XLoader, and Remcos RAT. Includes technical unpacking steps, IoCs, and detection tips.

Unit 42

Unit 42 details a new malware obfuscation technique where threat actors hide malware in bitmap resources within .NET applications. These deliver payloads like Agent Tesla or XLoader. Unit 42 details a new malware obfuscation technique where threat actors hide malware in bitmap resources within .NET applications. These deliver payloads like Agent...

#

🛠️ Tool | 🌐 Web | 💣 Red Team | 📡 Network

🔗 Original article: https://github.com/art3x/ascan_sliver

ArtScan is a 20 KB C-based port scanner for Sliver C2, supporting threaded IP/port scans, ping sweeps, NetBIOS lookups, and banner grabbing. It enables fast, stealthy network recon for red teams.

GitHub

Tiny and fast port scanner (Sliver edition). Contribute to art3x/ascan_sliver development by creating an account on GitHub.

#

🛡️ CVE | 💣 RCE | 🌐 Web | 💰 Bug Bounty

🔗 Original article: https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/

CVE-2023-23397 lets attackers steal NTLM credentials via malicious Outlook calendar invites using UNC paths, enabling privilege escalation with minimal user action.

Date: 14th March 2023 Today saw Microsoft patch an interesting vulnerability in Microsoft Outlook. The vulnerability is described as follows: Microsoft Office Outlook contains a privilege escalation vulnerability that allows...

#

🦠 Malware | 💉 Social Engineering | 🛡️ Threat Intel | 🌐 Web

🔗 Original article: https://unit42.paloaltonetworks.com/lampion-malware-clickfix-lures/

Lampion malware uses ClickFix lures and multi-stage, obfuscated VBS scripts to steal banking data via phishing and social engineering. The campaign employs advanced evasion, scheduled tasks, and large payloads. High risk for targeted sectors.

Unit 42

Lampion malware distributors are now using the social engineering method ClickFix. Read our analysis of a recent campaign. Lampion malware distributors are now using the social engineering method ClickFix. Read our analysis of a recent campaign.

#

🛡️ CVE | 🌐 Web | 💣 RCE | 🛠️ Tool

🔗 Original article: https://posts.specterops.io/the-sql-server-crypto-detour-5ff9ac7033de?source=rss----f05f8696e3cc---4

Shows how to extract or brute-force SQL Server encryption keys, revealing a hardcoded DMK password in ManageEngine ADSelfService Plus, allowing attackers to decrypt sensitive data from backups.

Medium

As part of my role as Service Architect here at SpecterOps, one of the things I’m tasked with is exploring all kinds of technologies to…

#

📡 IoT | 🛡️ CVE | 💣 RCE | 💉 XSS

🔗 Original article: https://www.pentestpartners.com/security-blog/rces-and-more-in-the-kunbus-gmbh-revolution-pi-plc/

Four critical CVEs in Revolution Pi PLC allow unauthenticated RCE, authentication bypass, and XSS, enabling full device compromise, root access, and industrial process control.

Pen Test Partners

TL;DR Introduction The Revolution Pi is a programmable logic controller (PLC) made by KUNBUS Gmbh. PLCs are ruggedised devices sitting near the lowest layer of an industrial network. They use simple I/O and fieldbus protocols to control field devices (valves, actuators, etc.) and monitor processes. The Revolution Pi is unique in that the docum...

#

🛠️ Tool | ⛓️ Active Directory | 💣 PrivEsc | 🛡️ PoC

🔗 Original article: https://github.com/logangoins/SharpSuccessor

SharpSuccessor is a .NET PoC tool that automates privilege escalation in Active Directory via the BadSuccessor attack, weaponizing dMSA objects to gain Domain Admin from low-privileged users.

GitHub

SharpSuccessor is a .NET Proof of Concept (POC) for fully weaponizing Yuval Gordon’s (@YuG0rd) BadSuccessor attack from Akamai. - logangoins/SharpSuccessor

#

🛠️ Tool | 🌐 Web | 🔑 Secrets | 🛡️ Pentest

🔗 Original article: https://github.com/vsec7/BurpSuite-Xkeys

BurpSuite-Xkeys is a Burp Suite extension that passively scans HTTP responses for exposed secrets (keys, tokens, credentials), helping identify sensitive data leaks in web applications.

GitHub

A Burp Suite Extension to extract interesting strings (key, secret, token, or etc.) from a webpage. - vsec7/BurpSuite-Xkeys

#

🛡️ CVE | 🌐 Web | 💻 Tool | 📡 IoT

🔗 Original article: https://research.checkpoint.com/2025/2nd-june-threat-intelligence-report/

Covers Chrome CVEs (RCE), WordPress plugin exploits (SQLi, XSS), a $12M DeFi hack, IoT botnet (PumaBot), and law enforcement's takedown of Lumma Infostealer using a Dell iDRAC flaw.

Check Point Research

For the latest discoveries in cyber research for the week of 2nd June, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES IT management software company ConnectWise confirmed that a sophisticated nation-state cyberattack had compromised its environment, affecting a limited number of customers using its ScreenConnect remot...

#

🛠️ Tool | 📡 IoT | 🌐 Web | 💰 Bug Bounty

🔗 Original article: https://www.thezdi.com/blog/2025/3/14/building-an-electric-vehicle-simulator-to-research-evses

A detailed guide to building an EV simulator for J1772 chargers, enabling researchers to trigger and test EVSE charging states for security research and exploit development.

#

🛡️ CVE | 💣 RCE | 🔨 Tool | 💻 Windows

🔗 Original article: https://www.mdsec.co.uk/2024/04/cve-2024-21111-local-privilege-escalation-in-oracle-virtualbox/

CVE-2024-21111 lets any local user on Windows escalate to SYSTEM by abusing VirtualBox log file handling, directory permissions, and Windows symlink/junction tricks.

VirtualBox is a popular open source, cross-platform, virtualization software developed by Oracle Corporation. Earlier this year we identified an arbitrary file move vulnerability in the VirtualBox system service service that...

#

📱 Android | 🛠️ Tool | 🧪 Pentest | 🔒 Frida

🔗 Original article: https://github.com/Brut-Security/BrutDroid/

BrutDroid automates Android emulator rooting, Frida setup, SSL pinning/root detection bypass, and Burp cert install for efficient app pentesting and dynamic analysis.

GitHub

BrutDroid — Android Emulator Automation Toolkit. Contribute to Brut-Security/BrutDroid development by creating an account on GitHub.

#

🌐 Web | 🛡️ CVE | 💣 RCE | 💰 Bug Bounty

🔗 Original article: https://bishopfox.com/blog/sonicwall-cve-2024-53704-exploit-details-blog

CVE-2024-53704 lets attackers hijack any active SSL VPN session on unpatched SonicWall firewalls, granting full internal access without credentials. Patch immediately.

Bishop Fox

Bishop Fox researcher, Jon Williams, explains how they successfully exploited CVE-2024-53704, an authentication bypass in unpatched SonicWall firewalls.

#

🛡️ CVE | 💣 RCE | 🛠️ Tool | 💻 Windows

🔗 Original article: https://googleprojectzero.blogspot.com/2024/12/the-windows-registry-adventure-5-regf.html

Deep technical dive into the Windows Registry 'regf' file format, highlighting structure, key fields, and real-world vulnerabilities (with CVEs), plus actionable exploitation and fuzzing tips.

#

🌐 Web | 🛡️ Bypass | 💻 Tool | 💰 Bug Bounty

🔗 Original article: https://www.pentestpartners.com/security-blog/bypass-sharepoint-restricted-view-to-exfiltrate-data-using-copilot-ai-and-more/

Step-by-step technical guide to bypassing SharePoint Restricted View using OCR, Copilot AI, browser tweaks, and HTML/script extraction, with code and actionable instructions.

Pen Test Partners

TL;DR Introduction As Red Teamers, we often find information in SharePoint that can be useful for us in later attacks. As part of this we regularly want to download copies of the file, or parts of their contents. In this blog post we will discuss how the Restricted View privilege on SharePoint hampers our goals, […]

#

🛠️ Tool | 🌐 Web | 💰 Bug Bounty | 🛡️ CVE

🔗 Original article: https://freedium.cfd/https://medium.com/@thelazypentester/automating-authenticated-scans-in-burp-suite-for-2fa-applications-ae93882e26c9

Step-by-step guide to automating Burp Suite scans for 2FA-protected apps, covering session handling, macro setup, 2FA automation, and debugging.

#

🛡️ CVE | 💣 RCE | 🌐 Web | 🛠 Tool

🔗 Original article: https://blog.rapid7.com/2025/05/29/cve-2025-48045-cve-2025-48046-cve-2025-48047-mici-netfax-server-product-vulnerabilities-not-fixed/

Three CVEs in MICI NetFax (<3.0.1.0) allow RCE as root via default credential leaks, password exposure, and command injection. Exploitation is straightforward and critical; no patch is available.

Rapid7

Rapid7 discovered 3 vulnerabilities in MICI Network Co., Ltd’s NetFax server allowing for an authenticated attack chain resulting in RCE against the device as the root user.

#

🛡️ CVE | 💣 RCE | 🌐 Web | 💰 Bug Bounty

🔗 Original article: https://www.thezdi.com/blog/2025/3/11/the-march-2025-security-update-review

March 2025 Patch Tuesday fixes 67 CVEs in Microsoft and Adobe products, including several actively exploited RCE and EoP bugs. Key attack vectors: malicious files, VHDs, and privilege escalation. Immediate patching is recommended.

#

🛠️ Tool | ⛓️ Active Directory | 💻 Post-Exploitation | 🌐 Web

🔗 Original article: https://bishopfox.com/blog/2025-red-team-tools-c2-frameworks-active-directory-network-exploitation

A technical roundup of top red team tools for C2, Active Directory, and network exploitation, detailing their features, attack capabilities, and impact for advanced offensive security operations.

Bishop Fox

Discover top Red Team tools for 2025, including C2 frameworks, AD exploitation, and network attack tools for advanced offensive security ops.

#

🛡️ CVE | 💣 LPE | 🌐 Windows | 🔨 Exploit

🔗 Original article: https://cyberdom.blog/abusing-the-windows-update-stack-to-gain-system-access-cve-2025-21204/

CVE-2025-21204 lets local users escalate to SYSTEM by abusing NTFS junctions in the Windows Update Stack. Exploitation is simple, stealthy, and uses only native tools. Patch immediately and monitor for suspicious junctions and file writes.

The CVE-2025-21204 is precisely that kind of vulnerability. It doesn't require a zero-day exploit or complex memory corruption chain. It doesn't need a phishing campaign or a dropped malware loader. All it takes is: A misused filesystem trust, a writable folder, and a SYSTEM process doing what it was built to do.

#

🛡️ CVE | 🌐 Web | 💰 Bug Bounty | 🔧 Tool

🔗 Original article: https://www.yeswehack.com/news/middleware-mayhem-zoolander-malta

Covers CVE-2025-29927 (Next.js auth bypass), bug bounty trends, technical exploitation guides (HTTP, GraphQL, prototype pollution), and new security tools. Highly technical and actionable for security professionals.

Our roundup includes impressive Next.js research as well as reprieves for the imperilled CVE database and for hackers over “unfair” criminal charges in Malta.

#

🌐 Web | 🛡️ WAF | 💉 Injection | 🛠️ Tool

🔗 Original article: https://portswigger.net/research/bypassing-wafs-with-the-phantom-version-cookie

Shows how legacy cookie attributes and quoted-string encoding can bypass WAFs, enabling injection attacks. Includes code, examples, and Burp Suite automation for security testing.

PortSwigger Research

HTTP cookies often control critical website features, but their long and convoluted history exposes them to parser discrepancy vulnerabilities. In this post, I'll explore some dangerous, lesser-known

#

📡 IoT | 🛠️ Reverse Engineering | 🛡️ Vulnerability | 💣 Buffer Overflow

🔗 Original article: https://www.synacktiv.com/publications/analyse-dun-decodeur-tnt.html

Deep technical analysis of a DVB decoder: firmware extraction, IR protocol bugs, and buffer overflows in DVB table parsing. Overflows are not exploitable, but the post is highly educational for IoT security.

#

🌐 Web | 🛡️ CVE | 💰 Bug Bounty | 🛠️ Tool

🔗 Original article: https://blog.trailofbits.com/2025/04/30/insecure-credential-storage-plagues-mcp/

MCP tools often store API keys in plaintext, world-readable files, making them easy targets for local attackers or malware. This exposes sensitive data and services to full compromise.

The Trail of Bits Blog

This post describes how many examples of MCP software store long-term API keys for third-party services in plaintext on the local filesystem, often with insecure, world-readable permissions.

#

🛡️ Malware | 🛠️ Tool | 💰 Infostealer | 🌐 Phishing

🔗 Original article: https://unit42.paloaltonetworks.com/darkcloud-stealer-and-obfuscated-autoit-scripting/

DarkCloud Stealer uses obfuscated AutoIt scripts in a multi-stage phishing attack to steal credentials, browser data, and more, evading detection with advanced anti-analysis and persistence techniques.

Unit 42

A new DarkCloud Stealer campaign is using AutoIt obfuscation for malware delivery. The attack chain involves phishing emails, RAR files and multistage payloads. A new DarkCloud Stealer campaign is using AutoIt obfuscation for malware delivery. The attack chain involves phishing emails, RAR files and multistage payloads.

#

☁️ Cloud | 🔗 DNS | 🛡️ CVE | 🌐 Web

🔗 Original article: https://unit42.paloaltonetworks.com/azure-openai-dns-resolution/

A DNS misconfiguration in Azure OpenAI let multiple tenants share a domain that resolved to an external IP, risking cross-tenant data leaks and MitM attacks. Microsoft quickly fixed the issue.

Unit 42

We discovered an Azure OpenAI misconfiguration allowing shared domains, potentially leading to data leaks. Microsoft quickly resolved the issue. We discovered an Azure OpenAI misconfiguration allowing shared domains, potentially leading to data leaks. Microsoft quickly resolved the issue.

#

💣 RCE | 🌐 Web | 🛡️ CVE | 💰 Bug Bounty

🔗 Original article: https://medium.com/immunefi/sky-remote-code-execution-bugfix-review-9bfbeb8c1c17?source=rss----6cdc579be8a0---4

Critical RCE in vote.makerdao.com via gray-matter Markdown parsing let attackers run system commands. Fixed by disabling JS engine. Severity: Critical.

Medium

On 25 September 2023, a security researcher named xss submitted a critical vulnerability to Sky (formerly known as MakerDAO) through…

#

🛠️ Tool | 📱 Android | 🔬 Reverse Engineering | 🧩 Binary Analysis

🔗 Original article: https://eshard.com/posts/frida-tracer-lightweight-time-travel-analysis

Shows how to use Frida to collect lightweight time travel traces on real Android devices, enabling efficient, focused reverse engineering and debugging of native code.

Discover how Frida tracing enhances Time Travel Analysis for Android reverse engineering, enabling more effective binary analysis on real devices.

#

🛡️ Active Directory | 🛠️ Tool | 🌐 Web | 💣 Detection Evasion

🔗 Original article: https://www.mdsec.co.uk/2024/02/active-directory-enumeration-for-red-teams/

Technical guide on evading detection during Active Directory enumeration. Covers LDAP/ADWS telemetry, tool analysis, detection rules, and OpSec tradecraft for red teams, with actionable code and examples.

The Directory Service is the heart and soul of many organisations, and whether its Active Directory, OpenLDAP or something more exotic, as a source of much knowledge it often acts...

#

🛡️ CVE | 💣 RCE | 🌐 Web | 🔨 Exploit

🔗 Original article: https://unit42.paloaltonetworks.com/threat-brief-sap-netweaver-cve-2025-31324/

CVE-2025-31324 is a critical unauthenticated RCE in SAP NetWeaver Visual Composer, exploited via arbitrary file upload. Attackers deploy web shells and reverse shells for full system control. Exploitation is easy and widespread. Patch and monitor immediately.

Unit 42

CVE-2025-31324 impacts SAP NetWeaver's Visual Composer Framework. We share our observations on this vulnerability using incident response cases and telemetry. CVE-2025-31324 impacts SAP NetWeaver's Visual Composer Framework. We share our observations on this vulnerability using incident response cases and telemetry.

#

🌐 Web | 🛡️ CVE | 💣 Auth Bypass | 🛠️ Next.js

🔗 Original article: https://www.offsec.com/blog/cve-2025-29927/

Critical Next.js bug (CVE-2025-29927) lets attackers bypass middleware auth by spoofing the x-middleware-subrequest header. Upgrade Next.js or block the header to mitigate.

OffSec

In this CVE blog, we explore a vulnerability in Next.js stemming from the improper trust of the x-middleware-subrequest header.

#

🛡️ Windows | 🛠️ Tool | 💣 Exploit | 💻 Kernel

🔗 Original article: https://googleprojectzero.blogspot.com/2025/01/windows-exploitation-tricks-trapping.html

Windows 11 24H2 lets any user run a local fake SMB server on a custom port, enabling reliable local kernel TOCTOU exploitation without admin rights.

#

🛡️ CVE | 🖥️ Windows | 💣 RCE | 🛠️ Exploit

🔗 Original article: https://googleprojectzero.blogspot.com/2025/05/the-windows-registry-adventure-8-exploitation.html

Step-by-step guide to exploiting Windows registry hive memory corruption for privilege escalation and RCE, with CVEs, attack steps, WinDbg usage, and real-world impact.

#

🛠️ Tool | 🌐 Web | 🛡️ Secrets | 💰 Bug Bounty

🔗 Original article: https://trufflesecurity.com/blog/introducing-trufflehog-s-burp-suite-extension-a-techical-deep-dive

TruffleHog's Burp Suite extension scans HTTP traffic for secrets (API keys, credentials) in real time, automating detection and verification to prevent leaks. Integrates TruffleHog CLI with Burp Suite for web security testing.

Scan for secrets using TruffleHog inside Burp Suite.

#

📡 IoT | 🌐 Web | 🛡️ CVE | 💣 RCE

🔗 Original article: https://www.pentestpartners.com/security-blog/fully-segregated-networks-your-dual-homed-devices-might-disagree/

Dual-homed devices in OT/ICS can be exploited to bypass network segmentation, enabling lateral movement via default creds, outdated firmware, and exposed services. Attackers can pivot across critical networks, risking severe operational and safety impact.

Pen Test Partners

TL;DR Introduction When we carry out security assessments in Operational Technology (OT) and Industrial Control System (ICS) environments, one thing that often stands out is the use of dual-homed devices. In this blog post, I look at a recent OT / ICS engagement with a Critical National Infrastructure (CNI) client, which shows why dual-homed dev...

#

🌐 Web | 💰 Bug Bounty | 🛠️ Tool | 🛡️ Recon

🔗 Original article: https://www.yeswehack.com/learn-bug-bounty/recon-hackers-guide-google-dorking

A technical guide to Google dorking for bug bounty, with detailed search operators, example queries, and workflow for finding exposed files, credentials, and login portals.

An explainer for leveraging Google dorking (or hacking) techniques, which offer a simple, passive way to uncover crucial intel for potential vulnerabilities.

#

🌐 Web | 💉 XSS | 🛡️ CVE | 🔨 Exploit

🔗 Original article: https://portswigger.net/research/stealing-httponly-cookies-with-the-cookie-sandwich-technique

The "cookie sandwich" attack abuses legacy cookie parsing, XSS, and CORS issues to steal HttpOnly cookies, enabling session hijacking even when cookies are marked as HttpOnly.

PortSwigger Research

In this post, I will introduce the "cookie sandwich" technique which lets you bypass the HttpOnly flag on certain servers. This research follows on from Bypassing WAFs with the phantom $Version cookie

#

🛡️ CVE | 💣 RCE | 🌐 Web | 🛠️ Tool

🔗 Original article: https://research.checkpoint.com/2025/26th-may-threat-intelligence-report/

Covers critical CVEs in Firefox, WordPress, and Versa Concerto, Docker cryptojacking, SEO poisoning with Bumblebee malware, and Kling AI impersonation. Includes technical details and exploitation methods.

Check Point Research

For the latest discoveries in cyber research for the week of 26th May, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Cellcom, a Wisconsin-based wireless provider, has been impacted by a cyberattack that resulted in widespread outages of voice and SMS services beginning on May 14, 2025. The incident disrupted communic...

#

🛡️ CVE | 🌐 Web | 💣 RCE | 💰 Bug Bounty

🔗 Original article: https://research.checkpoint.com/2025/12th-may-threat-intelligence-report/

Critical CVEs in Android, Kibana, WordPress, and Samsung MagicINFO are under active attack. Exploitation details, PoCs, and attack vectors are provided. Also covers credential leaks and advanced phishing targeting crypto users.

Check Point Research

For the latest discoveries in cyber research for the week of 12th May, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The UK’s Legal Aid Agency has suffered a cyberattack. The agency, which operates under the Ministry of Justice to provide billions in legal aid funding, has stated that financial information relating...

#

🌐 Web | 🛡️ CVE | 💣 RCE | 💰 Bug Bounty

🔗 Original article: https://googleprojectzero.blogspot.com/2025/03/blasting-past-webp.html

Deep dive into BLASTPASS: how a WebP heap overflow (CVE-2023-41064/4863) and PKPass parsing bug (CVE-2023-41061) enabled zero-click RCE on iOS via heap grooming and a crafted binary plist.

#

🌐 Web | 🛡️ CVE | 💉 XSS | 🛠️ Tool

🔗 Original article: https://www.mdsec.co.uk/2023/09/the-not-so-pleasant-password-manager/

Critical unauthenticated XSS (CVE-2023-27121) in Pleasant Password Server enables full credential theft. Exploit, PoC, and DB decryption methods are detailed.

Overview During a recent adversary simulation, the MDSec ActiveBreach red team were asked to investigate the organisation’s Password Manager solution, with the key objective of compromising stored credentials, ideally from...

#

🛡️ CVE | 🛠️ Tool | 💻 macOS | 💣 RCE

🔗 Original article: https://googleprojectzero.blogspot.com/2025/05/breaking-sound-barrier-part-i-fuzzing.html

A step-by-step technical guide to fuzzing macOS coreaudiod via Mach IPC, covering harness creation, reverse engineering, and debugging for sandbox escape research.

#

🛡️ CVE | 💣 RCE | 🌐 Web | 🛠️ Tool

🔗 Original article: https://www.thezdi.com/blog/2025/5/7/cve-2024-44236-remote-code-execution-vulnerability-in-apple-macos

CVE-2024-44236 is a critical out-of-bounds write in macOS sips, exploitable via crafted ICC Profile files, leading to remote code execution. Patch immediately.

#

🛠️ Tool | 💣 Evasion | 🛡️ Red Team | 🌐 Web

🔗 Original article: https://www.mdsec.co.uk/2023/09/nighthawk-0-2-6-three-wise-monkeys/

Nighthawk 0.2.6 adds advanced EDR evasion: call stack masking, in-memory execution, module stomping, stealthy screenshot capture, custom loader generation, and EDR network blocking. Highly technical, aimed at red teams.

Overview See no evil, hear no evil, speak no evil. This Japanese maxim epitomises the EDRs coming up against our latest release of Nighthawk. Following copious amounts of research and...

#

🛠️ Tool | 🛡️ CVE | 💣 RCE | 🌐 Web

🔗 Original article: https://github.com/RedTeamPentesting/wspcoerce

wspcoerce exploits MS-WSP over SMB to force Windows hosts to authenticate to attacker servers, enabling NTLM relay and domain escalation attacks.

GitHub

wspcoerce coerces a Windows computer account via SMB to an arbitrary target using MS-WSP - RedTeamPentesting/wspcoerce

#

🛡️ CVE | 💣 RCE | 🌐 Web | 🔨 Bug Bounty

🔗 Original article: https://www.yeswehack.com/news/airborne-airplay-deleted-files-slop

Technical roundup: GitHub secret hunting, Apple AirPlay RCE ('Airborne'), CSWSH mitigations, ASUS driver RCE, iPhone bricking, VS Code ASCII exploit, Python file write to RCE, and fuzzing WebSockets. Includes actionable attack vectors and exploitation steps.

Our latest roundup features warnings about AI slop reports, a large-scale hunt for secrets hidden in GitHub commits, and AirPlay attacks that travel via P2P.

#

🛡️ CVE | 💉 Credential Theft | 🔨 Tool | 🌐 Web

🔗 Original article: https://www.pentestpartners.com/security-blog/vnc-rdp-for-all-to-see/

The post shows how attackers can intercept and crack VNC passwords using packet sniffing and a Python script, due to lack of encryption and weak authentication.

Pen Test Partners

TL;DR Introduction VNC (Virtual Network Computing) is a widely deployed service in perhaps forgotten corners of legacy enterprise networks. This is mainly because it’s a tried and trusted protocol that simply works, however this is disregarding its security flaws and disadvantages in the modern age. A more well-known example could be the compa...

#

🌐 Web | 🛡️ CVE | 💣 RCE | 🛠️ Tool

🔗 Original article: https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/

Critical unauthenticated RCE in CraftCMS (CVE-2025-32432) via Yii behavior injection. Attackers exploit image transform endpoint to execute arbitrary PHP, upload webshells, and overwrite files. Full technical details, code, and detection tips provided.

#

🌐 Web | 🛡️ CVE | 💣 RCE | 💰 Bug Bounty

🔗 Original article: https://boostsecurity.io/blog/weaponizing-dependabot-pwn-request-at-its-finest

Shows how attackers can exploit GitHub Dependabot workflows to auto-merge malicious code, inject commands, and bypass branch protections using advanced 'Confused Deputy' techniques.

Learn how Dependabot can be co-opted to exploit some sensitive workflows, through the Confused Deputy Problem and branch name injections.

#

🛠️ Tool | 🌐 Web | 📡 Recon | 🛡️ OSINT

🔗 Original article: https://github.com/Elite-Security-Systems/radar

RADAR is a DNS reconnaissance tool that identifies technologies and services via DNS records, aiding security pros in mapping attack surfaces and automating asset discovery.

GitHub

RADAR (Rapid Assessment of DNS And Reconnaissance) is an advanced DNS reconnaissance tool designed to identify technologies and services used by domains through their DNS footprints - Elite-Securit...

#

🌐 Web | 🛡️ CVE | 💣 RCE | 💉 XSS

🔗 Original article: https://portswigger.net/research/top-10-web-hacking-techniques-of-2024

A technical roundup of 2024's top web hacking techniques, including new attacks on OAuth, HTTP request smuggling, SQLi, XSS, and Apache, with detailed exploitation steps, CVEs, and actionable insights.

PortSwigger Research

Welcome to the Top 10 Web Hacking Techniques of 2024, the 18th edition of our annual community-powered effort to identify the most innovative must-read web security research published in the last year

#

🛡️ CVE | 💣 RCE | 🌐 Web | 💰 Bug Bounty

🔗 Original article: https://www.thezdi.com/blog/2025/5/17/pwn2own-berlin-2025-day-three-results

Pwn2Own Berlin 2025 Day Three: Researchers exploited zero-days in Windows, NVIDIA, Firefox, and VMware, demonstrating privilege escalation, VM escapes, and memory corruption. Technical vulnerability classes and impacts are detailed, but no exploit code or CVEs are provided.

#

🌐 Web | 💣 RCE | 🛡️ Red Team | 🛠️ Tool

🔗 Original article: https://www.mdsec.co.uk/2025/03/red-teaming-with-servicenow/

Step-by-step guide to abusing ServiceNow's legitimate features for RCE, credential theft, and privilege escalation. Includes code, commands, and attack details for Windows and Unix environments.

Introduction Over the course of numerous Red Team engagements MDSec has often gained privileged access to a target’s ServiceNow instance. This has, in turn, facilitated a variety of compromise actions...

#

🛠️ Tool | 🌐 Web | 🤖 AI | 💰 Bug Bounty

🔗 Original article: https://portswigger.net/research/document-my-pentest

Document My Pentest is a Burp Suite extension that uses AI and regex-based input reflection to automate and improve web pentest documentation, reducing manual work and false positives.

PortSwigger Research

Tired of repeating yourself? Automate your web security audit trail. In this post I'll introduce a new Burp AI extension that takes the boring bits out of your pen test. Web security testing can be a

#

🛡️ CVE | 💣 RCE | 🌐 Web | 💰 Bug Bounty

🔗 Original article: https://www.thezdi.com/blog/2025/5/13/the-may-2025-security-update-review

May 2025 Patch Tuesday fixes 40 Adobe and 75 Microsoft CVEs, including RCE and EoP bugs under active attack. Key CVEs: CVE-2025-30397 (RCE), CVE-2025-32701/32706/32709/30400 (EoP). Patch actively exploited vulnerabilities immediately.

#

🛡️ CVE | 💣 RCE | 🌐 Web

🔗 Original article: https://bishopfox.com/blog/tomcat-cve-2025-24813-what-you-need-to-know-blog

CVE-2025-24813 is an RCE chain in Tomcat requiring rare misconfigurations. Exploitation is unlikely for most, but patching and config review are advised.

Bishop Fox

Blog breakdown of CVE-2025-24813 in Apache Tomcat—what it is, who’s actually at risk, and why most users likely aren’t affected. Keep calm, patch servers.

#

🌐 Web | 💉 NoSQLi | 🛡️ MongoDB | 💣 Injection

🔗 Original article: https://sensepost.com/blog/2025/getting-rid-of-pre-and-post-conditions-in-nosql-injections/

Explains advanced MongoDB NoSQL injection techniques to bypass pre-conditions using syntax injection, $where, and duplicate keys, with practical payloads and a focus on impact and limitations.

#

🌐 Web | 💉 XSS | 🛡️ CVE | 🔧 Tool

🔗 Original article: https://portswigger.net/research/bypassing-character-blocklists-with-unicode-overflows

Unicode overflow attacks use codepoint truncation to bypass input filters, enabling XSS and other exploits. The post explains the technique with code and tools.

PortSwigger Research

Unicode codepoint truncation - also called a Unicode overflow attack - happens when a server tries to store a Unicode character in a single byte. Because the maximum value of a byte is 255, an overflo

#

🛡️ CVE | 💣 RCE | 🌐 Web | 🛠️ Tool

🔗 Original article: https://blog.trailofbits.com/2025/04/29/deceiving-users-with-ansi-terminal-codes-in-mcp/

Attackers can exploit unsanitized ANSI escape codes in MCP tools to hide malicious payloads, overwrite output, clear screens, and phish users, enabling covert RCE and supply chain attacks in terminal-based AI agents.

The Trail of Bits Blog

This post describes attacks using ANSI terminal code escape sequences to hide malicious instructions to the LLM, leveraging the line jumping vulnerability we discovered in MCP.

#

🌐 Web | 🛡️ CVE | 💉 JWT | 💣 Exploitation

🔗 Original article: https://pentesterlab.com/blog/jwt-vulnerabilities-attacks-guide

A hands-on guide to exploiting JWT vulnerabilities: signature bypass, none algorithm, weak secrets, algorithm confusion, kid injection, embedded JWK (CVE-2018-0114), JKU/X5U abuse, and Java ECDSA bug (CVE-2022-21449). Includes code, attack steps, and mitigations.

#

🛠️ Tool | 🌐 Web | 💣 Red Team | 📡 Network

🔗 Original article: https://github.com/django-88/NomadScanner

NomadScanner is a stealthy, in-memory Windows port scanner for red teams, supporting advanced evasion, custom payloads, and randomized HTTP probes. Highly OPSEC-safe for authorized network reconnaissance.

GitHub

Contribute to django-88/NomadScanner development by creating an account on GitHub.

#

🌐 Web | 🛡️ CVE | 💣 RCE | 🔒 Data Theft

🔗 Original article: https://blog.trailofbits.com/2025/04/23/how-mcp-servers-can-steal-your-conversation-history/

Malicious MCP tool descriptions can silently exfiltrate entire LLM chat histories using trigger phrases, enabling persistent, stealthy data theft from AI chat environments.

The Trail of Bits Blog

This post explains how malicious MCP servers can exploit the Model Context Protocol to covertly exfiltrate entire conversation histories by injecting trigger phrases into tool descriptions, allowing for targeted data theft against specific organizations.

#

🛠️ Tool | 🌐 Web | 💰 Bug Bounty | 🛡️ Auth

🔗 Original article: https://github.com/forteBruno/Token-Tailor

Token Tailor automates JWT/Basic token renewal in Burp Suite, ensuring uninterrupted authenticated testing and tool integration. Ideal for web security professionals.

GitHub

Token Tailor is a Burp Suite Community Edition extension that aims to simplify security testing by automating JWT renewal. - forteBruno/Token-Tailor

#

🛠️ Tool | 🌐 Web | 💣 PrivEsc | 💰 Bug Bounty

🔗 Original article: https://gist.github.com/snovvcrash/a1ae180ab3b49acb43da8fd34e7e93df

Python PoC for extracting dMSA secrets in Active Directory using Kerberos tickets. Enables privilege escalation by automating dMSA key extraction. Useful for red teamers and defenders.

Gist

BadSuccessor (@YuG0rd) previous-keys PoC with minikerberos-getDmsa (@skelsec) for all AD users and computers - dMSASync.py

#

📱 Mobile | 🛠️ Tool | 🔓 Jailbreak | 🔧 Exploit

🔗 Original article: https://www.pentestpartners.com/security-blog/how-to-load-unsigned-or-fake-signed-apps-on-ios/

Step-by-step guide to loading unsigned/fake-signed iOS apps using AppSync Unified, AltStore, Sideloadly, and TrollStore. Covers jailbreak, exploits, and security impact for penetration testers.

Pen Test Partners

TL;DR Introduction In certain circumstances it can be challenging installing client applications for testing. Situations arise where the application could be provided unsigned or requires self-signing. As a result, the application cannot be directly provisioned to the device. Installing the application can be challenging without access to a MacB...

#

🛡️ CVE | 💣 RCE | 🌐 Web | 🛠️ Tool

🔗 Original article: https://starlabs.sg/blog/2025/06-solo-a-pixel-6-pro-story-when-one-bug-is-all-you-need/

Technical walkthrough of exploiting CVE-2023-48409 on Pixel 6 Pro: integer overflow in Mali GPU driver enables kernel RCE via heap underflow, pagetable spraying, and bypass of Android security.

STAR Labs

During my internship I was tasked to analyze a Mali GPU exploit on Pixel 7/8 devices and adapt it to make it work on another device: the Pixel 6 Pro.
While the exploit process itself is relatively straightforward to reproduce (in theory we just need to find the correct symbol offsets and signatures for our target device), what’s interesting ab...

#

🌐 Web | 🛡️ CVE | 💣 SSRF | 🛠️ Tool

🔗 Original article: https://portswigger.net/research/new-crazy-payloads-in-the-url-validation-bypass-cheat-sheet

New URL validation bypass payloads use advanced IP encodings, userinfo parsing tricks, and CORS bypasses to exploit SSRF, open redirect, and CORS misconfigurations.

PortSwigger Research

The strength of our URL Validation Bypass Cheat Sheet lies in the contributions from the web security community, and today’s update is no exception. We are excited to introduce a new and improved IP a

deep valeBOT
#

🛠️ Tool | ⛓️ Active Directory | 💣 Network | 🌐 Web

🔗 Original article: https://bishopfox.com/blog/2025-red-team-tools-c2-frameworks-active-directory-network-exploitation

A technical overview of top red team tools for C2, Active Directory, and network exploitation, including Sliver, Cobalt Strike, Metasploit, BloodHound, and more. Essential for simulating attacks and testing enterprise security.

#

🛡️ CVE | 💣 RCE | 🌐 Web | 💰 Bug Bounty

🔗 Original article: https://www.synacktiv.com/publications/taking-the-relaying-capabilities-of-multicast-poisoning-to-the-next-level-tricking.html

A new technique forces Windows SMB clients to fall back to WebDav, enabling HTTP-based NTLM/Kerberos relaying via multicast poisoning. This greatly enhances unauthenticated relay attacks in Active Directory.

#

🌐 Web | 🛡️ Kerberos | 🛠️ Tool | 💣 Relay

🔗 Original article: https://www.synacktiv.com/publications/abusing-multicast-poisoning-for-pre-authenticated-kerberos-relay-over-http-with.html

Shows how to relay Kerberos over HTTP using LLMNR poisoning with Responder and krbrelayx, enabling pre-auth attacks on AD HTTP services. Includes full exploitation steps, tool usage, and mitigations.

#

🔥 Malware | 🛡️ Threat Intel | 💻 Windows | 💾 Infostealer

🔗 Original article: https://unit42.paloaltonetworks.com/darkcloud-stealer-and-obfuscated-autoit-scripting/

DarkCloud Stealer uses obfuscated AutoIt scripts and multi-stage payloads to steal credentials and sensitive data. Delivered via phishing, it decrypts and executes payloads in memory, evades analysis, and persists on Windows systems.

#

💣 RCE | 🌐 Web | 🛡️ Malware | 💻 Virtualization

🔗 Original article: https://www.synacktiv.com/publications/etude-de-cas-comment-hunters-international-et-ses-affilies-ciblent-vos-hyperviseurs.html

Hunters International used malvertising, RATs, and advanced scripting to compromise VMware ESXi, exfiltrate data, and deploy a Rust-based, obfuscated ransomware. The article details the full technical attack chain and ransomware internals.

#

🛡️ CVE | 💣 PrivEsc | 🛠️ Tool | 🌐 Web

🔗 Original article: https://www.mdsec.co.uk/2024/12/extracting-account-connectivity-credentials-accs-from-symantec-management-agent-aka-altiris/

Shows how to extract privileged credentials from Symantec Management Agent (Altiris) using EvilAltiris, enabling privilege escalation and lateral movement via policy key manipulation and decryption.

#

🛡️ CVE | 💣 RCE | 🌐 Web | 💰 Bug Bounty

🔗 Original article: https://blog.rapid7.com/2025/05/29/cve-2025-48045-cve-2025-48046-cve-2025-48047-mici-netfax-server-product-vulnerabilities-not-fixed/

Three CVEs in MICI NetFax Server allow RCE as root via default credential disclosure, password leakage, and command injection. Exploitation is straightforward and no patch is available.

#

🦠 Malware | 🛡️ Obfuscation | 🖼️ Steganography | 💻 Windows

🔗 Original article: https://unit42.paloaltonetworks.com/malicious-payloads-as-bitmap-resources-hide-net-malware/

Malware hides payloads in .NET bitmap resources, using multi-stage loaders and advanced obfuscation to deliver Agent Tesla, XLoader, and Remcos RAT. Steganography and reflection help evade detection. Includes technical unpacking steps, IoCs, and analysis tips.

#

🛡️ CVE | 💻 Active Directory | 💣 RCE | 🛠️ Tool

🔗 Original article: https://posts.specterops.io/the-renaissance-of-ntlm-relay-attacks-everything-you-need-to-know-abfc3677c34e?source=rss----f05f8696e3cc---4

NTLM relay attacks exploit weaknesses in Windows authentication, enabling attackers to escalate privileges and move laterally. The post details technical attack vectors, exploitation steps, mitigations, and BloodHound's new features for visualizing relay paths.

deep valeBOT
deep valeBOT
#

🛡️ CVE | 🌐 Web | 💣 RCE | 🛠️ Tool

🔗 Original article: https://posts.specterops.io/the-renaissance-of-ntlm-relay-attacks-everything-you-need-to-know-abfc3677c34e?source=rss----f05f8696e3cc---4

NTLM relay attacks exploit legacy Windows authentication to impersonate users and escalate privileges via SMB, LDAP, and ADCS. This post explains attack methods, technical details, and mitigations, highlighting new BloodHound features for identifying vulnerable paths.

#

🌐 Web | 🛡️ CVE | 🛠️ Tool | 💉 NTLM Relay

🔗 Original article: https://www.synacktiv.com/publications/taking-the-relaying-capabilities-of-multicast-poisoning-to-the-next-level-tricking.html

A technique tricks Windows SMB clients to fallback to WebDav HTTP client on specific SMB errors, enabling HTTP NTLM authentication capture and powerful NTLM/Kerberos relaying attacks in Active Directory multicast poisoning scenarios.

#

🛡️ CVE | 🌐 Web | 💣 RCE | 💰 Bug Bounty

🔗 Original article: https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/

CVE-2023-23397 is a critical Outlook vulnerability allowing NTLM relay attacks via malicious calendar reminders in crafted MSG files, enabling privilege escalation and credential theft. Immediate patching is essential.

#

🛡️ .NET | 🦠 Malware | 🕵️‍♂️ Obfuscation | 🖼️ Steganography

🔗 Original article: https://unit42.paloaltonetworks.com/malicious-payloads-as-bitmap-resources-hide-net-malware/

Malware hides payloads as bitmap resources in .NET apps using multi-stage loaders and XOR obfuscation to evade detection. Final payloads include Agent Tesla info-stealer. Analysis uses .NET debugging hooks to extract payloads.

#

🛡️ CVE | 🛠️ Authentication Bypass | 🌐 Web | 💣 ATO

🔗 Original article: https://www.openbugbounty.org/blog/1120-ato-bug-in-twitters/

A Twitter vulnerability allowed attackers with hijacked sessions to bypass password checks, delete and add phone numbers, disable 2FA, and reset passwords, leading to full account takeover. The flaw was responsibly disclosed and rewarded with a $1120 bounty.

#

🌐 Web | 🛡️ CVE | ☁️ Cloud Security | 💣 Privilege Escalation

🔗 Original article: https://unit42.paloaltonetworks.com/aws-roles-anywhere/

This post explains how AWS IAM Roles Anywhere's default permissive trust policies can lead to privilege escalation using stolen certificates, and provides detailed mitigation steps including restrictive trust policies and certificate attribute mapping.

#

🛡️ CVE | 🛠️ Tool | 🌐 Web | 💣 RCE

🔗 Original article: https://www.mdsec.co.uk/2024/12/extracting-account-connectivity-credentials-accs-from-symantec-management-agent-aka-altiris/

This post explains how to extract highly privileged Account Connectivity Credentials (ACCs) from Symantec Management Agent using SMATool and custom tools, enabling privilege escalation and remote code execution.

#

🛡️ CVE | 🌐 Web | 💣 RCE | 🛠️ Tool

🔗 Original article: https://posts.specterops.io/update-dumping-entra-connect-sync-credentials-4a9114734f71?source=rss----f05f8696e3cc---4

Microsoft Entra Connect Sync switched from user password to app registration with certificate auth. Attackers can add new cert keys to persist access without admin tokens, expanding attack surface. Detection via Azure AD audit logs is possible.

#

🦠 Malware | 🌐 Web | 💰 Cryptocurrency | 🤖 Botnet

🔗 Original article: https://unit42.paloaltonetworks.com/blitz-malware-2025/

Blitz is a Windows malware spread via backdoored game cheats using anti-sandbox checks and PowerShell to download a bot and Monero miner from Hugging Face Spaces. It supports keylogging, screenshots, DDoS, and remote commands, controlled via a FastAPI-based C2. The operator ceased activity in 2025.

#

🛡️ CVE | 💣 RCE | 🌐 Web | 🛠️ Tool

🔗 Original article: https://unit42.paloaltonetworks.com/threat-brief-sap-netweaver-cve-2025-31324/

CVE-2025-31324 is a critical SAP NetWeaver vulnerability allowing unauthenticated file upload and remote code execution via /developmentserver/metadatauploader. Attackers deploy JSP web shells and advanced reverse shells like GOREVERSE. Palo Alto Networks offers protections and IoCs for defense.

#

🛡️ OT/ICS | 🌐 Network Security | 🔄 Pivoting | 🖥️ Dual-Homed Devices

🔗 Original article: https://www.pentestpartners.com/security-blog/fully-segregated-networks-your-dual-homed-devices-might-disagree/

Dual-homed devices in OT/ICS networks can be exploited to bypass segmentation, enabling attackers to pivot across critical infrastructure using default credentials, outdated firmware, and exposed services like SSH and Telnet.

#

🛡️ CVE | 💣 RCE | 🌐 Web | 💉 XSS

🔗 Original article: https://www.pentestpartners.com/security-blog/rces-and-more-in-the-kunbus-gmbh-revolution-pi-plc/

Four critical vulnerabilities in KUNBUS Revolution Pi PLC allow unauthenticated remote code execution and XSS attacks, risking industrial control and safety. Exploits include Node-RED auth bypass, PiCtory SSO path traversal, stored and reflected XSS leading to root shell access.

#

🤖 AI Exploitation | 🌐 Web | 🛡️ Access Control | 🔍 Red Teaming

🔗 Original article: https://www.pentestpartners.com/security-blog/exploiting-copilot-ai-for-sharepoint/

Microsoft Copilot AI in SharePoint can be exploited to stealthily access sensitive data, bypassing permissions and logs. Attackers use AI agents as advanced search tools to find secrets and internal info, revealing new risks in AI-assisted collaboration platforms.

#

🌐 Web | 🛡️ CVE | 💉 Phishing | 💰 Crypto

🔗 Original article: https://cyble.com/blog/crypto-phishing-applications-on-the-play-store/

Over 20 malicious Android apps on Google Play steal crypto wallet mnemonic phrases via phishing, impersonating popular wallets. They use WebView to load phishing sites and are distributed through compromised developer accounts, risking irreversible crypto theft.

#

🛡️ CVE | 💣 RCE | 🪟 Windows | 🛠️ Tool

🔗 Original article: https://cyberdom.blog/abusing-the-windows-update-stack-to-gain-system-access-cve-2025-21204/

CVE-2025-21204 is a Windows Update Stack local privilege escalation via directory junction hijacking, allowing non-admin users to execute code as SYSTEM. Patched in April 2025, it exploits trusted path validation flaws using native Windows tools.

#

🛡️ CVE | 💣 LPE | 🌐 Windows | 🛠️ Exploit

🔗 Original article: https://www.mdsec.co.uk/2024/01/cve-2024-20656-local-privilege-escalation-in-vsstandardcollectorservice150-service/

CVE-2024-20656 is a Windows local privilege escalation in Visual Studio's VSStandardCollectorService150. It exploits file permission resets via junction points and MSI repair to gain SYSTEM privileges.

#

🛡️ CVE | 🌐 Web | 💣 RCE | 🛠️ Tool

🔗 Original article: https://posts.specterops.io/an-operators-guide-to-device-joined-hosts-and-the-prt-cookie-bcd0db2812c4?source=rss----f05f8696e3cc---4

Guide on exploiting device-joined Windows hosts to extract Azure AD Primary Refresh Tokens (PRT) for bypassing MFA and accessing cloud resources via SSO, including detailed enumeration, token extraction, and usage techniques.

#

🌐 Web | 🛡️ CVE | 💣 RCE | 💰 Bug Bounty

🔗 Original article: https://research.checkpoint.com/2025/inferno-drainer-reloaded-deep-dive-into-the-return-of-the-most-sophisticated-crypto-drainer/

Inferno Drainer is a sophisticated crypto phishing campaign abusing Discord and smart contracts to steal over $9M. It uses obfuscated JavaScript, blockchain-stored configs, proxy servers, and short-lived contracts to evade detection.

deep valeBOT
deep valeBOT
deep valeBOT
#

🛡️ CVE | 🌐 Web | 💉 Social Engineering | 💣 RAT

🔗 Original article: https://blog.rapid7.com/2025/06/10/blacksuit-continues-social-engineering-attacks-in-wake-of-black-bastas-internal-conflict/

BlackSuit ransomware group uses email bombing and social engineering via Microsoft Teams and calls to gain remote access, deploying a Java RAT with cloud-based C2 and credential harvesting. They use QEMU VMs and Rust malware for proxying. Mitigations include MFA, Teams restrictions, and user training.

#

🛡️ CVE | 🛠️ Tool | 🔐 Cryptography | 💣 Key Destruction

🔗 Original article: https://blog.trailofbits.com/2025/06/10/what-we-learned-reviewing-one-of-the-first-dkls23-libraries-from-silence-laboratories/

Trail of Bits audited Silence Laboratories' Silent Shard TSS library using the DKLs23 OT-based protocol, uncovering critical nonce reuse and abort handling flaws that enabled key destruction attacks, which were promptly fixed.

deep valeBOT
#

🛡️ CVE | 💣 RCE | 🕸️ Web | 🛠️ EoP

🔗 Original article: https://blog.rapid7.com/2025/06/10/patch-tuesday-june-2025/

Microsoft June 2025 Patch Tuesday fixes 67 vulnerabilities including two zero-days: WebDAV RCE (CVE-2025-33053) exploited by Stealth Falcon, and SMB client EoP (CVE-2025-33073). Critical RCEs affect KDC Proxy and Office Preview Pane. Immediate patching is recommended.

deep valeBOT
#

🛡️ Supply Chain | 🛠️ Tool | 🌐 Web | 🛡️ CVE

🔗 Original article: https://sensepost.com/blog/2025/depscanner-find-orphaned-packages-before-the-bad-guys-do/

Depscanner detects orphaned dependencies in GitHub repos vulnerable to supply chain attacks, demonstrated with npm and Python examples. It reveals a real vulnerability involving pnpm workspaces and shows how attackers can exploit missing packages for code execution.

#

🛡️ CVE | 🌐 Web | 💣 RCE | 🛠️ Tool

🔗 Original article: https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025

CVE-2025-33073 is a Windows SMB client vulnerability allowing authenticated remote SYSTEM command execution via NTLM reflection bypass using crafted DNS records. The blog details discovery, exploitation, Kerberos impact, and patch analysis with commands and code.

#

🛡️ CVE | 🌐 Web | 💣 RCE | 🛠️ Tool

🔗 Original article: https://www.synacktiv.com/en/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025.html

CVE-2025-33073 is a critical Windows SMB client vulnerability allowing authenticated remote SYSTEM command execution by abusing NTLM local authentication via crafted DNS records. The blog details discovery, exploitation, root cause, Kerberos impact, and patch analysis.

wild ibex
#

LLMs are going to kill source code audits.
They are faster, cheaper and with all the context they are getting better than senior pentesters. However, it's not as easy as copy-paste the whole code of a repository and send it to a LLM, as that is usually too big and there is always code that, even if vulnerable, won't be reachable from an ...

deep valeBOT
deep valeBOT
deep valeBOT
#

🌐 Web | 🛡️ CVE | 💣 RCE | 💰 Bug Bounty

🔗 Original article: https://research.checkpoint.com/2025/from-trust-to-threat-hijacked-discord-invites-used-for-multi-stage-malware-delivery/

A malware campaign hijacks expired Discord invite links to redirect users to malicious servers, delivering multi-stage payloads including AsyncRAT and Skuld Stealer targeting crypto wallets, using advanced evasion and trusted cloud services for stealthy infection.

#

🛡️ CVE | 🌐 Web | 💣 RCE | 💉 Arbitrary File Upload

🔗 Original article: https://horizon3.ai/attack-research/attack-blogs/cisco-ios-xe-wlc-arbitrary-file-upload-vulnerability-cve-2025-20188-analysis/

CVE-2025-20188 is an unauthenticated arbitrary file upload vulnerability in Cisco IOS XE WLC caused by a hard-coded JWT secret. Exploitation enables remote code execution via path traversal in file uploads. Mitigation requires patching or disabling the vulnerable feature.

#

🌐 Web | 🛡️ Obfuscation | 💉 Malvertising | 🛠️ JavaScript

🔗 Original article: https://unit42.paloaltonetworks.com/malicious-javascript-using-jsfiretruck-as-obfuscation/

Malicious JavaScript using JSFireTruck obfuscation infects websites, redirecting search engine traffic to malicious iframes. The blog explains the obfuscation technique, exploitation steps, and detection methods.

deep valeBOT
#

🛡️ CVE | 📱 iOS | 💣 Zero-click | 🕵️‍♂️ Forensics

🔗 Original article: https://citizenlab.ca/2025/06/first-forensic-confirmation-of-paragons-ios-mercenary-spyware-finds-journalists-targeted/

Forensic analysis confirms Paragon's Graphite spyware exploited a zero-click iMessage vulnerability (CVE-2025-43200) to stealthily infect journalists' iOS devices, with mitigation in iOS 18.3.1. This enables full remote compromise, posing severe privacy risks.

deep valeBOT
deep valeBOT
#

📱 Mobile | 🛠️ Tool | 🌐 Web | 🛡️ CVE

🔗 Original article: https://www.mobile-hacker.com/2025/06/12/stryker-app-goes-free-the-ultimate-mobile-pentesting-toolkit

Stryker is a free Android pentesting app offering WiFi and network vulnerability scanning, WPS and WPA attacks, exploit management, and integration with tools like Nmap and Metasploit, enabling powerful mobile penetration testing with root access.

deep valeBOT
deep valeBOT
deep valeBOT
#

📱 Android | 🛠️ Tool | 🛡️ Security | 💣 Exploitation

🔗 Original article: https://www.mobile-hacker.com/2025/06/16/how-to-run-adb-and-fastboot-on-a-non-rooted-android-smartphone-using-termux/

Run ADB and Fastboot on non-rooted Android phones using Termux, enabling pentesting, rooting, and forensics without a PC. Exploits include apps with debuggable or backup-enabled flags, and CVE-2024-0044 data exfiltration.

deep valeBOT
deep valeBOT
#

🌐 Web | 🛡️ CVE | 💉 SQLi | 🛠️ Tool

🔗 Original article: https://infosecwriteups.com/exploiting-unsanitized-url-handling-sql-injection-via-deep-links-in-ios-app-write-up-of-flipcoin-066899b09fc2

Flipcoin iOS app has a local SQL Injection via unsanitized deep link parameters. Using Ghidra and Frida, an attacker extracts sensitive recovery keys and exfiltrates data remotely through the unsanitized 'testnet' parameter.

deep valeBOT
deep valeBOT
deep valeBOT
deep valeBOT
deep valeBOT
deep valeBOT
deep valeBOT
deep valeBOT
deep valeBOT
deep valeBOT
#

🛡️ CVE | 🌐 Web | 🎁 PoC | 💰 Bug Bounty

🔗 Original article: https://medium.com/@mrxdevil404/how-i-bypassed-rate-limits-to-trigger-account-takeovers-sms-flooding-and-impersonation-9ed42ca1501f

This post reveals how bypassing rate limits in password resets, KYC tokens, and SMS sending can lead to account takeovers, impersonation, and financial loss, with detailed scripts and WAF bypass techniques.

#

🛡️ CVE | 🌐 Web | 💣 RCE | 🎁 PoC

🔗 Original article: https://sean.heelan.io/2025/05/22/how-i-used-o3-to-find-cve-2025-37899-a-remote-zeroday-vulnerability-in-the-linux-kernels-smb-implementation/

A remote use-after-free vulnerability (CVE-2025-37899) in the Linux kernel SMB implementation was discovered using OpenAI's o3 LLM, demonstrating AI-assisted vulnerability research with detailed code analysis and exploitation steps.

deep valeBOT
deep valeBOT
deep valeBOT
deep valeBOT
deep valeBOT
deep valeBOT
deep valeBOT
deep valeBOT
deep valeBOT
deep valeBOT
deep valeBOT
deep valeBOT
deep valeBOT
#

🛡️ CVE | 🌐 Web | 🎁 PoC | 🔐 Encryption

🔗 Original article: https://github.com/honestcorrupt/-CVE-Proof-of-Concept-Airtel-Android-App-Insecure-Local-Storage-of-Sensitive-Data

Airtel Android app stores sensitive payment and user data unencrypted in local storage, exposing it to theft and privacy risks. PoC video shows how to access this data. CVE-2025-5154 reported. Fix: use AES-256 encryption and Android Keystore.

deep valeBOT
#

🛡️ CVE | 🌐 Web | 💣 RCE | 🎁 PoC

🔗 Original article: https://www.cyberark.com/resources/threat-research-blog/is-your-ai-safe-threat-analysis-of-mcp-model-context-protocol

Thorough threat analysis of MCP reveals 13 vulnerabilities including tool poisoning, command injection, path traversal, and admin bypass, enabling data theft and remote code execution. Mitigations include code review, sandboxing, and strict user approvals.

#

🛡️ CVE | 🌐 Web | 💣 RCE | 🎁 PoC

🔗 Original article: https://blog.koi.security/marketplace-takeover-how-we-couldve-taken-over-every-developer-using-a-vscode-fork-f0f8cf104d44

A critical flaw in Open VSX's auto-publishing workflow lets attackers steal privileged tokens during npm install, enabling full marketplace takeover and remote code execution on millions of developer machines.

deep valeBOT
deep valeBOT
deep valeBOT
deep valeBOT
deep valeBOT
deep valeBOT
deep valeBOT
deep valeBOT
deep valeBOT
deep valeBOT
deep valeBOT
deep valeBOT
#

🛡️ CVE | 🌐 Web | 💣 RCE | 🎁 PoC

🔗 Original article: https://www.token.security/blog/azures-role-roulette-how-over-privileged-roles-and-api-vulnerabilities-expose-enterprise-networks

Azure built-in roles have over-privileged read permissions allowing attackers to leak VPN pre-shared keys via a vulnerable GET API, enabling network access. Microsoft fixed the VPN key leak but not the over-privileged roles issue.

deep valeBOT
deep valeBOT
#

🛡️ Ad Fraud | 📱 Android | 🎁 PoC | 🛠️ Obfuscation

🔗 Original article: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-iconads/

IconAds is a sophisticated Android ad fraud operation using obfuscated code, hidden launcher activities, unique C2 domains, and Play Store signature checks to hide malicious apps that load out-of-context ads, generating massive fraudulent ad traffic.

deep valeBOT
deep valeBOT
#

🛡️ CVE | 🌐 Web | 🎁 PoC | 💣 RCE

🔗 Original article: https://medium.com/@terp0x0/how-i-found-my-first-critical-bug-bounty-unauthenticated-arbitrary-file-upload-lead-to-lfi-via-5f33c80fc44f

Critical unauthenticated arbitrary file upload leads to LFI via filename path traversal. Using curl, sensitive files like /etc/passwd were accessed remotely. PHP uploads do not execute, so no RCE was possible.

deep valeBOT
#

🛡️ CVE | 🌐 Web | 🎁 PoC | 💣 Memory Leak

🔗 Original article: https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/

CVE-2025-5777 is a memory disclosure in Citrix NetScaler caused by uninitialized variable use when 'login' parameter lacks a value, leaking stack data via XML responses. The blog details exploitation, patch analysis, detection, and active in-the-wild attacks.

deep valeBOT
deep valeBOT
deep valeBOT
deep valeBOT
deep valeBOT
#

🛡️ CVE | 🌐 Web | 💣 RCE | 🎁 PoC

🔗 Original article: https://unit42.paloaltonetworks.com/initial-access-broker-exploits-leaked-machine-keys/

An initial access broker exploits leaked ASP.NET Machine Keys to execute malicious .NET assemblies in IIS memory via View State deserialization, enabling stealthy remote code execution and post-exploitation activities including privilege escalation and network reconnaissance.

deep valeBOT
#

🌐 Web | 🛡️ CVE | 🔍 Recon | 💥 Memory Leak

🔗 Original article: https://doublepulsar.com/citrixbleed-2-electric-boogaloo-cve-2025-5777-c7f5e349d206

  • CVE-2025-5777: Unauthenticated remote memory-leak in Citrix Netscaler Gateway/AAA
  • Exploit: Crafted HTTP GET returns raw memory dump
  • Analysis: Extract CITRIXSESSION and PCoIP tokens with xxd/scripts
  • Hijack: Replay tokens via Cookie header to bypass MFA
  • Recon: Shodan query http.favicon.hash:-1292923998,-1166125415 or org:YourOrg ssl:YourOrg html:Citrix
  • Impact: CVSS 8.8, high confidentiality; ICA/PCoIP session takeover
  • Remediation: Patch and run kill icaconnection -all & kill pcoipConnection -all
#

📡 IoT | 💣 RCE | 🛠️ Tool | 🎁 PoC

🔗 Original article: https://www.synacktiv.com/en/publications/from-cheap-iot-toy-to-your-smartphone-getting-rce-by-leveraging-a-companion-app.html

Summary

  • Analyzed the Android LW FPV app (com.klh.lwfpv) controlling the Eachine E58 drone on Android 14.
  • Unpacked Bangcle with Frida; extracted native libraries (liblewei-3.2.2.so, liblewei_uartprotol.so, liblewei63.so, libFHDEVNet.so).
  • Identified multiple memory corruption bugs: H264 heap overflow, VGA stream heap OOB write, JNI heap overflow, BSS overflow in FlyInfo parsing, stack overflow in GetUserList.
  • Built a two-stage NC() leak primitive to exfiltrate stack cookies and base addresses.
  • Exploited JNI heap overflow to corrupt LinearAllocator dtor list in libhwui.so and created a Call-Oriented Programming primitive.
  • Leveraged a gadget to leak libc and call system(), achieving full RCE on the smartphone.
  • Tools: Wireshark, Frida, Python. Unpatched as of July 2025.
#

🛡️ CVE | 🔗 DLL Sideloading | 🔒 Privilege Escalation | 🎁 PoC

🔗 Original article: https://trustedsec.com/blog/cve-2025-1729-privilege-escalation-using-tpqmassistant-exe

CVE-2025-1729 is a DLL sideloading privilege escalation in Lenovo’s TPQMAssistant.exe. A daily scheduled task runs the binary from the user-writable C:\ProgramData\Lenovo\TPQM\Assistant directory, allowing insertion of a malicious hostfxr.dll. When loaded, the DLL executes arbitrary code under the current user. If an administrator logs in before the next run, the malicious DLL executes in their session (medium integrity), enabling privilege escalation to SYSTEM via UAC bypass. Mitigation: update to TrackPoint Quick Menu v1.12.54.0 (UWP), which relocates the binary to a protected path and removes the vulnerable task. 🎁 PoC

deep valeBOT
#

🌐 Web | 🛡️ CVE | 🗒️ Info Disclosure | 🎁 PoC

🔗 Original article: https://horizon3.ai/attack-research/attack-blogs/cve-2025-5777-citrixbleed-2-write-up-maybe/

CVE-2025-5777 is a high-severity memory disclosure in Citrix NetScaler ADC/Gateway that leaks up to 127 bytes of adjacent heap/stack memory via the /p/u/doAuthentication.do endpoint by sending a POST with only the login field. The nsppe parser reuses buffers without clearing all form data, causing an uninitialized pointer to be reflected and null-terminated in the HTTP response. Attackers can exfiltrate nsroot session tokens and plaintext credentials using curl or a simple Python polling script. Indicators include debug logs (ns.log) with non-printable characters and multiple active sessions per user. Mitigation requires patching to versions ≥ 14.1-43.56/13.1-58.32, terminating ICA/PCoIP sessions, and auditing using show ns runningConfig -withDefaults and diff.

#

🖥️ Active Directory | 🛠️ Tool | 🔑 Password Cracking | 📊 Audit

🔗 Original article: https://www.pentestpartners.com/security-blog/how-to-conduct-a-password-audit-in-active-directory-ad/

  • Step-by-step guide to extract AD password hashes via ntdsutil.exe, vssadmin and Impacket secretsdump (remote/offline).
  • Transfer files to Kali with impacket-smbserver and robocopy.
  • Crack NTLM hashes using John the Ripper (custom rules) and Hashcat (-m 1000, -a 0, -r).
  • Analyze cracked credentials and privileged groups with DPAT to produce metrics on password strength, reuse and compliance.
  • High-severity impact: plaintext AD credentials enable full domain compromise, requiring ongoing audits and remediation.
#

🛡️ CVE | 🌐 Web | 💧 InfoLeak | 🔍 Shodan

🔗 Original article: https://doublepulsar.com/citrixbleed-2-electric-boogaloo-cve-2025-5777-c7f5e349d206

  • CitrixBleed 2 (CVE-2025-5777) is an unauthenticated remote memory leak in Citrix NetScaler Gateway/AAA servers.
  • A simple HTTP request returns server memory, exposing session tokens and credentials.
  • Attackers can replay leaked tokens to hijack sessions and bypass MFA.
  • Discover vulnerable hosts via Shodan: http.favicon.hash:-1292923998,-1166125415 or org:YourOrg ssl:YourOrg html:Citrix.
  • Mitigation: apply fixed builds (CTX693420), then run:
    kill icaconnection -all
    kill pcoipConnection -all
    
#

🛡️ CVE | 💣 DLL Sideloading | 🖥️ Windows | 🎁 PoC

🔗 Original article: https://trustedsec.com/blog/cve-2025-1729-privilege-escalation-using-tpqmassistant-exe

  • Lenovo TPQMAssistant.exe (CVE-2025-1729) runs daily at 9:30 AM under the logged-in user in a writable folder (C:\ProgramData\Lenovo\TPQM\Assistant).
  • It attempts to load hostfxr.dll from its folder, which is missing, enabling DLL sideloading.
  • A PoC hostfxr.dll showing a message box confirms code execution on the next task run.
  • When an administrator logs in, the task loads the malicious DLL in their session; existing UAC bypasses can escalate to SYSTEM.
  • Lenovo’s fix (UWP TrackPoint Quick Menu v1.12.54.0) relocates the scheduler to C:\Program Files (x86)\Lenovo\TPQM\TPQMAssistant and removes the legacy Win32 task.
#

📡 IoT | 📱 Mobile | 💣 RCE | 🎁 PoC

🔗 Original article: https://www.synacktiv.com/en/publications/from-cheap-iot-toy-to-your-smartphone-getting-rce-by-leveraging-a-companion-app.html

  • The LW FPV Android app for the Eachine E58 drone was reverse-engineered on Android 14 to target native JNI libraries and drone endpoints (TCP 7060/8060, UDP 40000/50000, TCP 8888).
  • Multiple memory corruptions were discovered: AVC and VGA stream heap overflows/OOB writes, JNI heap overflow (SendGetRecPlan), BSS overflow (ParseGLInfoData), stack overflow (GetUserList) and an in-protocol info leak via NC.
  • The leak primitive discloses stack canaries, heap pointers and library base addresses.
  • A heap overflow corrupts libhwui’s LinearAllocator destructor list, yielding a call-oriented programming primitive.
  • Using COP, sub_738E8 is invoked to leak libc, then system("sh") is called for full RCE.
  • PoC includes Frida and Python scripts automating the chain.
deep valeBOT
#

🛡️ CVE | 💣 RCE | ✉️ Email | 🎁 PoC

🔗 Original article: https://www.exploit-db.com/exploits/52356

CVE-2025-47176 is a high-severity RCE in Outlook’s SyncObject.Path parser. A Python PoC uses pywin32 to dispatch Outlook, create a MailItem with a malicious path (..\..\..\windows\system32\cmd.exe), and host an HTTP server that triggers path normalization via os.path.normpath, resulting in a shutdown /r /t 5. Alternatively, a crafted .prf (with OfflineAddressBookPath=.../...//...//windows/system32/cmd.exe) imported via OUTLOOK.EXE /importprf malicious.prf achieves the same effect without scripting. Test only in controlled environments.

#

🤖 Android | 💬 Telegram | 🦠 Malware | 💳 Financial

🔗 Original article: https://www.group-ib.com/blog/rise-of-qwizzserial/

Qwizzserial is a Kotlin-based Android SMS stealer spread via fake Telegram channels impersonating government and financial services. Using a Classiscam-style operation and Telegram bots, attackers auto-generate customized APKs that persistently request SMS/phone permissions, prompt for bank card and phone details, then intercept and zip SMS data. It flags balance-related messages using regex, issues USSD queries for SIM info, and exfiltrates data via Telegram Bot API. Later variants add NP Manager & Allatori obfuscation, battery-optimization bypass, and switch to HTTP gate servers (http://llkjllj.top) before relaying to Telegram. Over ~1,200 variants emerged, infecting ~100K devices in Uzbekistan and stealing at least US$62K. Prevention includes behavior-based detection of sideloaded SMS apps, user education, and avoiding untrusted APKs.

deep valeBOT
#

📱 Android | 💣 Tapjacking | 🛡️ CVE | 🎁 PoC

🔗 Original article: https://taptrap.click/

  • TapTrap abuses Android activity transition animations to invisibly launch a target activity that intercepts user taps.<br/>- A zero-permission app uses startActivity() with overridePendingTransition() or ActivityOptions.makeCustomAnimation() and a custom animation (alpha 0.01, duration 3000ms) to hide the new screen.<br/>- Decoy UI elements in the malicious app align with hidden prompts’ controls, causing taps to confirm sensitive actions.<br/>- The app relaunches itself before the animation ends to conceal the hidden activity.<br/>- Analysis of 99,705 apps found 76.3% vulnerable; a 3s→6s off-by-one bug doubles the attack window.<br/>- Impact includes silent permission grants, device admin activation for remote wipe, and stealthy attacks on apps and websites.<br/>- Firefox (CVE-2025-1939) and Chrome (CVE-2025-3067) have patches; Android remains unpatched. Disable or reduce system animations to mitigate.
deep valeBOT
#

🛡️ CVE | 🌐 Web | 🛠️ Tool | 🎁 PoC

🔗 Original article: https://github.com/win3zz/CVE-2025-5777

CVE-2025-5777 (CitrixBleed 2) is an out-of-bounds read in Citrix NetScaler ADC/Gateway’s authentication endpoint <code>/p/u/doAuthentication.do</code>. A malformed POST with <code>login</code> (no ‘=’) causes the server to leak ~127 bytes of uninitialized stack memory in the <InitialValue> XML tag. The Python3 PoC exploit.py uses aiohttp, colorama, regex extraction, and a custom hex-dump to automate memory leaks (dependencies: pip3 install aiohttp colorama). Leaked tokens and credentials enable session hijacking and MFA bypass. Mitigate by applying Citrix firmware CTX693420 (e.g., 14.1-43.56, 13.1-58.32+, 12.1-55.328+, 13.1-37.235+) and restricting malformed POSTs monitoring.

#

🖥️ Windows | 🛡️ CVE | 💣 LPE | 🎁 PoC

🔗 Original article: https://github.com/Wh04m1001/CVE-2025-48799

CVE-2025-48799 is a local Windows Update service privilege escalation on Windows 10/11 when Storage Sense is set to install apps on a secondary drive. By creating an NTFS junction from the install folder on, e.g., D:\WindowsApps to a protected directory like C:\Windows\System32\config, <code>wuauserv</code>—running as SYSTEM—will follow and delete that folder. A C++ PoC automates registry changes, junction creation, and AppX installation via PowerShell or COM, then plants a malicious DLL or executable in the deleted system folder. On load by a SYSTEM process, the attacker spawns a SYSTEM cmd.exe. Mitigation: reset Storage Sense, delete attacker-controlled junctions, and install Microsoft’s July 2025 patch.

deep valeBOT
#

🔍 Recon | 🌐 Web | 🛠️ Tool | 💰 Bug Bounty

🔗 Original article: https://www.yeswehack.com/learn-bug-bounty/recon-series-recap-reconnaissance-footprinting

  • Recon Series Recap: A three-part guide on reconnaissance:<br/>
  1. Fundamentals: Passive (WHOIS, DNS, CRT logs, OSINT) vs active (Nmap, forced browsing).<br/>
  2. Endpoint & Parameter Discovery: Burp Suite crawling, robots.txt/sitemap.xml, Google dorks, JS analysis (LinkFinder, Burp extensions), bookmarklets, fuzzing with ffuf/Gobuster/Burp Intruder.<br/>
  3. Subdomain & Asset Enumeration: Passive via Subfinder/Amass/certs; active DNS brute-forcing, Host header fuzzing, reverse DNS (dnsx), crawler extraction, live host probing (httpx).<br/>
  4. HTTP Fingerprinting: Header analysis, banner grabbing, malformed requests, error page inspection, cookie fingerprinting, passive Shodan/Wappalyzer checks.<br/>
    Tools: Burp Suite, Nmap, ffuf, Gobuster, Subfinder, Amass, dnsx, httpx, BChecks, curl, openssl.
deep valeBOT
#

🪟 Windows | 🗄️ Filesystem | ⚠️ Info Disclosure | 🎁 PoC

🔗 Original article: https://swarm.ptsecurity.com/buried-in-the-log-exploiting-a-20-years-old-ntfs-vulnerability/

Buried in the log: Exploiting a 20-Year-Old NTFS Vulnerability describes CVE-2017-11817, an NTFS driver flaw in Windows 7 and earlier that writes uninitialized kernel pool memory to the hidden $LogFile journal on volume mount. The bug originates from Ntfs!LfsRestartLogFile omitting a memset after ExAllocatePoolWithTag; Windows 8+ inserts this fix. Attackers can mount any NTFS volume and read $LogFile via raw disk access (e.g., dd or Win32 CreateFile/ReadFile) to extract ~7.5 KB of leaked kernel data. Researchers used bochspwn and WinDbg to identify the leak; public PoC and dump scripts on Packet Storm automate locating the “RSTR” records and extracting the 3800-byte buffers for forensic analysis.

deep valeBOT
#

🌐 Web | 🛡️ CVE | 💣 RCE | 🎁 PoC

🔗 Original article: https://linz04.github.io/2025/06/20/CVE-2025-5959/

CVE-2025-5959 is a WebAssembly type confusion in V8 where the canonicalization compared only the type index, ignoring nullability bits. By performing a birthday attack on the 64-bit MurmurHash hashing of canonical types and permuting ref/ref null fields across >32-field structs, an attacker can create two distinct struct types (structA, structB) with identical canonical indices. A JavaScript PoC uses WasmModuleBuilder to store null in a nullable struct and then load it via a non-nullable struct, triggering a SIGSEGV. This primitive enables arbitrary read/write, OOB memory access, and potential sandbox escape. The patch adds a check for matching bitfield flags (is_equal_except_index) before index comparison in CanonicalType::Equals(). Update to the latest V8/Chrome release to mitigate this issue.

deep valeBOT
#

🌐 Web | 🔐 Auth Bypass | 💉 IDOR | 🎁 PoC

🔗 Original article: https://ian.sh/mcdonalds

McHire vulnerabilities summary: 1) A hidden “Paradox team members” login at https://www.mchire.com/signin accepts default credentials (123456:123456), granting admin access to internal workflows. 2) An IDOR in PUT /api/lead/cem-xhr allows attackers to enumerate lead_id values and retrieve full PII, candidacy history, and raw auth tokens for any applicant. PoC cURL demonstrates exploitation. Combined, these flaws exposed over 64 million records. Paradox.ai patched both issues within 24 hours.

#

📡 Hardware | 🔍 Reverse-engineering | 💣 RCE | 🎁 PoC

🔗 Original article: https://www.synacktiv.com/en/publications/let-me-cook-you-a-vulnerability-exploiting-the-thermomix-tm5.html

Thermomix TM5 exploit: Reverse-engineered the TM5 main board, handled GPMIC-interleaved metadata to recover firmware and keys. Decrypted Cook Sticks (USB recipe modules) encrypted via AES-128-CBC, bypassed firmware anti-downgrade by tampering AES-EAX nonces, gained arbitrary code execution and persistence via rootfs patch and malicious firmware installation.

#

🌐 Web | 🛡️ CVE | 💣 RCE | 🎁 PoC

🔗 Original article: https://www.synacktiv.com/publications/laravel-appkey-leakage-analysis.html

  • Overview of Laravel’s AES-256-CBC+HMAC encryption and JSON payload format.
  • The default <code>decrypt()</code> method unserializes decrypted data, enabling RCE if <code>APP_KEY</code> is known.
  • Introduction of PHPGGC for gadget chains and <strong>laravel-crypto-killer</strong> tool for encrypt/decrypt/bruteforce 🎁 PoC.
  • Exploits on Invoice Ninja (CVE-2024-55555), Snipe-IT (CVE-2024-48987), Crater (CVE-2024-55556) via pre-auth deserialization.
  • Large-scale capture of default Laravel cookies and offline brute forcing of <code>APP_KEY</code> with laravel-crypto-killer and high-performance <code>nounours</code> (~1.5 B tries/s).
  • Results: ~3.99%→~3.56% crack rates, ~1.3 k servers still vulnerable to CVE-2018-15133, widespread key reuse patterns.
deep valeBOT
#

🌐 Web | 🛡️ CVE | 💣 RCE | 🎁 PoC

🔗 Original article: https://www.offsec.com/blog/cve-2025-27636/

CVE-2025-27636 is a remote code execution vulnerability in Apache Camel’s exec component due to case-sensitive header filtering. Affected versions: 3.10.0–3.22.3, 4.8.0–4.8.4, 4.10.0–4.10.1. Attackers can upload a malicious Camel XML route and send HTTP requests with mixed-case headers (e.g., CAmelExecCommandExecutable, CAmelExecCommandArgs) to execute OS commands. Patched in 3.22.4+, 4.8.5+, 4.10.2+. Mitigations: upgrade Camel, restrict endpoint access, normalize headers via WAF, and run as a non-root user.

#

🌐 Web | 🛡️ WAF | 💣 Bypass | 🎁 PoC

🔗 Original article: https://trustedsec.com/blog/azures-front-door-waf-wtf-ip-restriction-bypass

The blog reveals that Azure Front Door WAF’s default IP restriction variable RemoteAddr accepts X-Forwarded-For header values, enabling IP allowlist bypass by spoofing the header. A simple curl -H "X-Forwarded-For: allowed_ip" returns HTTP 200 despite a 403 policy. Attackers can automate enumeration of allowed IPs using Burp Suite Intruder by fuzzing the X-Forwarded-For header over a /16 in ≈40 minutes. Microsoft declined to change this behavior. Recommended fixes: switch to SocketAddr, strip or validate XFF, or use Application Gateway WAF.

#

🛡️ CVE | 💉 SQLi | 🌐 Web | 💣 RCE

🔗 Original article: https://fortiguard.fortinet.com/psirt/FG-IR-25-151

Unauthenticated SQL Injection in FortiWeb GUI (CVE-2025-25257)

  • Critical (CVSS 9.6) SQLi in HTTP/HTTPS admin endpoints allows remote attackers to inject and execute arbitrary SQL without authentication.
  • Affected versions: 7.6.0–7.6.3, 7.4.0–7.4.7, 7.2.0–7.2.10, 7.0.0–7.0.10.
  • Exploitation: send payloads like ' OR '1'='1-- to bypass login, use UNION SELECT to dump admin_users, or inject UPDATE statements for password resets and RCE. Example with curl and automation via sqlmap.
  • Remediation: upgrade to 7.6.4+, 7.4.8+, 7.2.11+ or 7.0.11+; workaround: disable HTTP/HTTPS admin interface.
deep valeBOT
#

🛠️ Tool | 📡 Wireless | 📱 Android | 🎁 PoC

🔗 Original article: https://forums.kali.org/t/hijacker-on-the-samsung-galaxy-s10-with-wireless-injection/10305

  • Enables 802.11 packet monitor and injection on the Samsung Galaxy S10’s internal BCM4375B1 chip using NexMon and the Hijacker app.
  • Patch the firmware by flashing the NexMon Magisk zip and load it via LD_PRELOAD in Hijacker.
  • Configure monitor/injection commands with nexutil and ifconfig in Hijacker settings.
  • In a Kali chroot, preload the patched library (kalilibnexmon.so) to tools like wifite for injection without external adapters.
  • Impact: High; enables deauthentication, WPA2 handshake capture, and advanced wireless attacks directly on the device.
#

🛡️ Anti-analysis | 📦 DLL Sideloading | 💣 Obfuscation | 🛠️ Tool

🔗 Original article: https://unit42.paloaltonetworks.com/slow-tempest-malware-obfuscation/

  • Bundles loader DLL (<code>zlibwapi.dll</code>) and encrypted payload DLL (<code>ipc_core.dll</code>) in an ISO side-loaded by <code>DingTalk.exe</code>.<br/>- Loader invokes <code>GlobalMemoryStatusEx</code> to ensure ≥ 6 GB RAM before XOR-decrypting and mapping the payload in memory.<br/>- Main function (>17 k asm lines) uses dynamic <code>JMP RAX</code> obfuscation via nine-instruction dispatchers based on CPU flags (ZF/CF).<br/>- Deobfuscation: IDAPython locates <code>JMP RAX</code>, extracts dispatcher bytecodes, Unicorn emulates dispatchers to derive targets, patches direct jumps and triggers IDA reanalysis to restore CFG.<br/>- Obfuscated <code>CALL RAX</code> calls resolved by emulation and an IDAPython SetCallee script to map Windows API, recovering function signatures and variables.
#

📱 Android | 🔗 Deep Link | 💣 App Impersonation | 🎁 PoC

🔗 Original article: https://medium.com/@frankheat/how-malicious-android-apps-can-impersonate-yours-using-deep-links-8eac7f245aaf

  • Malicious Android apps can hijack custom URI deep links by matching the application-level label and icon of a target app while keeping their own launcher identity.<br/>- Android’s chooser dialog uses application-level metadata, enabling visual impersonation when both apps handle the same scheme (e.g., <code>safebank://</code>).<br/>- PoC code for SafeBank and RecipeShare is available at https://github.com/frankheat/deeplink-impersonation-poc.<br/>- Impact: remote execution of malicious handlers, phishing of credentials, unauthorized actions.<br/>- Mitigation: use Android App Links with <code>autoVerify="true"</code> and a <code>DigitalAssetLinks.json</code>; users should avoid ambiguous dialog options and verify package names.
deep valeBOT
#

🛡️ CVE | 💣 RCE | 🌐 Web | 🎁 PoC

🔗 Original article: https://labs.watchtowr.com/pre-auth-sql-injection-to-rce-fortinet-fortiweb-fabric-connector-cve-2025-25257/

  • CVE-2025-25257: Unauthenticated SQL injection in Fabric Connector’s <code>get_fabric_user_by_token</code> via insecure <code>snprintf</code> across FortiWeb 7.0–7.6.<br/>- Diff: v7.6.3 uses dynamic SQL, v7.6.4 uses prepared statements.<br/>- Attack vector: <code>Authorization: Bearer %128s</code> parsed by <code>sscanf</code>, dropping spaces; bypass with MySQL comments (<code>/**/</code>) for time-based and boolean injections.<br/>- RCE chain: Exploit <code>INTO OUTFILE</code> to write a <code>.pth</code> into Python <code>site-packages</code>, abusing site hooks when <code>ml-draw.py</code> runs under <code>/bin/python</code>.<br/>- PoC assets: HTTP requests, diffs, GDB traces, demo video, GitHub repo. 🎁 PoC
#

🌐 Web | 💣 XXE | 🛠️ lxml | 🎁 PoC

🔗 Original article: https://www.yeswehack.com/dojo/dojo-ctf-challenge-winners-42

  • A Python web app parses user XML with <code>lxml.etree.XMLParser(load_dtd=True, resolve_entities=True)</code>, enabling XXE file reads.
  • Pre-lxml 5.4.0: Override an undefined DTD entity by loading <code>/tmp/xml/config.dtd</code>, defining a <code>%flag</code> parameter entity for <code>file:///tmp/flag.txt</code>, then nesting an error entity to trigger an exception that leaks the flag. 🎁 PoC
  • Post-lxml 5.4.0: Abuse libxml2’s parameter-entity support to define a general entity <code>c</code> with a <code>meow://%file;</code> URI. Invoking &c; causes an invalid URI error that discloses the flag. 🎁 PoC
  • Impact: arbitrary file disclosure, confidentiality loss.
  • Remediation: upgrade lxml ≥ 5.4.0, disable DTD/entities, validate/whitelist XML, hide raw parser errors.
deep valeBOT
#

🌐 Web | 🛡️ CVE | 💣 RCE | 💰 Ransomware

🔗 Original article: https://www.pentestpartners.com/security-blog/sil3ncer-deployed-rce-porn-diversion-and-ransomware-on-an-sftp-only-server/

Sil3ncer Deployed demonstrates how attackers exploited an outdated Telerik UI AsyncUploadHandler (v2016.1.225.45) via CVE-2019-18935 to gain RCE on Windows Server 2012, bypass Defender using PowerShell exclusions, establish persistence with a typo-named admin and registry backdoor, covertly re-enter through Ngrok tunnelling and RDP loopback, deploy custom Sil3ncer ransomware (using a JSON config to encrypt files with a .sil3ncer extension and drop Telegram-based ransom notes), and erase tracks via cleanup scripts and account deletion. Key mitigations include patching third-party components, hardening logging, alerting on suspicious commands, blocking tunnelling domains, and enforcing secure RDP access.

deep valeBOT
#

🌐 Web | ⛓️ Supply Chain Attack | 💣 RCE | 🎁 PoC

🔗 Original article: https://patchstack.com/articles/critical-malware-found-in-gravityforms-official-plugin-site/

  • GravityForms v2.9.12 was backdoored: an <code>update_entry_detail</code> hook exfiltrated metadata and wrote a base64-decoded PHP payload for RCE.<br/>- A second backdoor <code>list_sections</code>, triggered via <code>notification.php</code>, validates a hardcoded token and enables unauthenticated admin creation, arbitrary code eval, file upload, user enumeration/deletion, and directory listing.<br/>- IoCs: IPs 185.193.89.19, 193.160.101.6; domains gravityapi.org/io; secret token; function names and file paths.<br/>- Patch to v2.9.13 (released July 7, 2025), block malicious domains/IPs, scan for affected files, and enforce code integrity checks.
deep valeBOT
#

🌐 Web | 💉 HTML Injection | 💣 SSRF | ☁️ AWS

🔗 Original article: https://medium.com/@0x_xnum/how-i-escalated-simple-html-injection-to-ssrf-via-pdf-rendering-682ea94b3194

  • Found HTML injection in the title field of a JSON-based certificate generator on learn.target.com.<br/>- Injected <iframe> tags rendered server-side via wkhtmltopdf/Puppeteer, fetching external URLs.<br/>- Confirmed SSRF by observing DNS/HTTP callbacks (Burp Collaborator, nc -lvp 8000).<br/>- Accessed AWS IMDSv1 at 169.254.169.254 endpoints to leak IAM role name and temporary credentials.<br/>- High-severity impact: remote compromise of cloud resources; awarded $1,000.
deep valeBOT
#

🛠️ Tool | 🔍 Fuzzing | 🎁 PoC | 🌐 MS-RPC

🔗 Original article: https://www.incendium.rocks/posts/Revisiting-MS-RPC-Vulnerability-Research-automation/

  • MS-RPC-Fuzzer sorts RPC methods by output→input dependencies, reusing valid context handles for complex parameters.
  • Demonstrated on Printerbug: host IPv4 returns a usable handle for RpcOpenPrinter→RpcRemoteFindFirstPrinterChangeNotificationEx.
  • Offers default and sorted modes, NTLM coerce via UNC, overflow testing, file-path fuzzing, blacklisting.
  • Open source: warpnet/MS-RPC-Fuzzer 🎁 PoC
#

💣 Backdoor | 🛡️ DLL Sideloading | ☁️ Serverless C2 | 🚨 Cloud Exfiltration

🔗 Original article: https://unit42.paloaltonetworks.com/windows-backdoor-for-novel-c2-communication/

New HazyBeacon Windows backdoor abuses DLL sideloading in mscorsvw.exe and covert C2 via AWS Lambda URLs. It downloads 7z, file collector, and custom uploaders to gather targeted documents, archive and split them, and attempts exfiltration via Google Drive and Dropbox before cleaning up.

#

📱 Android | 🐧 Termux | 🔓 Privilege Escalation | 🎁 PoC

🔗 Original article: https://www.mobile-hacker.com/2025/07/14/shizuku-unlocking-advanced-android-capabilities-without-root/

  • Shizuku uses ADB or root to start a privileged Java Binder service, exposing system APIs without rooting.<br/>- Install rish in Termux to inherit ADB-level privileges and run shell commands like ps, netstat, and logcat.<br/>- Use Shizuku-enabled apps (Android Debloater, NetGuard, WiFiList, etc.) for system customization, network control, and security auditing.
#

🌐 Web | 💣 RCE | 🛠️ Tool | 🎁 PoC

🔗 Original article: https://unit42.paloaltonetworks.com/preventing-clickfix-attack-vector/

ClickFix is a clipboard-hijacking social engineering technique using JavaScript to inject malicious commands into Win+R/Win+X dialogs, bypassing phishing controls. 2025 campaigns distributing NetSupport RAT, Latrodectus, and Lumma Stealer used ClearFake infrastructure to pastejack PowerShell or MSHTA commands, sideload loaders (msvcp140.dll, libcef.dll) and AutoIt droppers for RCE and persistence. Hunting involves parsing RunMRU entries, monitoring Security Event IDs 4688/4663, and correlating clipboard paste telemetry.

deep valeBOT
#

🛡️ CVE | 💣 RCE | 🌐 .NET | 🎁 PoC

🔗 Original article: https://www.lrqa.com/en/cyber-labs/remote-code-execution-in-broadcom-altiris-irm/

CVE-2025-5333 is a critical unauthenticated RCE in Broadcom Altiris IRM’s legacy .NET Remoting endpoint (tcp://host:4011/IRM/HostedService) due to insecure deserialization (TypeFilterLevel=Full). Discovered via PowerShell enumeration and dnSpy decompilation; exploited with James Forshaw’s ExploitRemotingService tool to invoke arbitrary methods (e.g., directory listing). Mitigations include closing port 4011, clearing IRM_HostedServiceUrl, restarting the service, and upcoming localhost-only binding.

deep valeBOT
#

🌐 eSIM | 💉 Type Confusion | 🛠️ Toolkit | 🎁 PoC

🔗 Original article: https://security-explorations.com/esim-security.html

Security Explorations exploited a Java Card VM type-confusion flaw in Kigen eUICC to gain arbitrary memory R/W, extract the GSMA ECC private key, and download plaintext eSIM profiles via SMS-PP OTA APDUs. Profiles were modified, cloned across eUICCs, and used to hijack calls/SMS (including OTPs). A custom toolkit automates discovery and exploitation. Kigen’s partial patch and GSMA TS.48 update mitigate only test-profile installation but leave core VM flaws unaddressed.

#

🛠️ Tool | 📡 IoT | 🐍 Python | 🌐 Network

🔗 Original article: https://github.com/7h30th3r0n3/Raspyjack

RaspyJack is an offensive network toolkit for Raspberry Pi Zero 2 W with a Waveshare 1.44″ LCD HAT. It offers interactive Nmap scans, one-click reverse shells, credential-capture via Responder/ARP MITM/DNS spoofing, on-device log/file browsing, system controls and extensibility through custom Python scripts.

#

⚙️ Firmware | 🖥️ Hardware | 🛡️ BIOS | 🎁 PoC

🔗 Original article: https://www.pentestpartners.com/security-blog/framework-13-press-here-to-pwn/

  • The Framework 13 chassis intrusion switch can be abused via a timed press-release pattern (2 s on/2 s off × 10) to reset BIOS settings.
  • This clears the admin password, disables Secure Boot and intrusion detection, and restores defaults.
  • An attacker can then boot external media (e.g., Kali Linux) for arbitrary code execution.
  • No vendor patch exists; enforce physical security and tamper-evident measures.
deep valeBOT
#

📱 Mobile | 🔒 Evasion | 🛠️ Obfuscation | 📶 C2

🔗 Original article: https://zimperium.com/blog/konfety-returns-classic-mobile-threat-with-new-evasion-techniques

Konfety is an Android malware that evades analysis by abusing ZIP header flags (fake encryption, unsupported BZIP), uses dual-app deception (identical package names), dynamically loads an encrypted secondary DEX via DexClassLoader, hides its icon, applies geofencing, and leverages the CaramelAds SDK plus browser redirects for ad fraud and payload delivery.

#

📡 RPC | 🛠️ Tool | 🧪 Fuzzing | 📈 Analysis

🔗 Original article: https://github.com/warpnet/MS-RPC-Fuzzer

MS-RPC-Fuzzer is a PowerShell module that leverages NtObjectManager to dynamically inventory and fuzz Microsoft RPC interfaces. It supports static and dependency-sorted fuzzing, logs each call to identify crashes, outputs results in allowed/denied/error JSON, and imports data into Neo4j for graph-based vulnerability analysis.

#

🌐 Web | 🛡️ CVE | 💣 RCE | 🎁 PoC

🔗 Original article: https://www.thezdi.com/blog/2025/7/14/cve-2025-4919-corruption-via-math-space-in-mozilla-firefox

CVE-2025-4919 is a critical JIT bug in Firefox’s IonMonkey. A flawed bounds-check elimination misclassifies wrapping additions in <code>Modulo</code> math space, merging checks on (i+5)|0 and (i+10)|0 over a 2^32-length Uint8Array, enabling controlled OOB access. A PoC reads/writes OOB, then uses standard addrOf/fakeObj primitives and WASM shellcode injection to achieve RCE. Patched in Firefox 138.0.4.

#

⚙️ RPC | 🛠️ Tool | 🔍 Fuzzing | 🎁 PoC

🔗 Original article: https://www.incendium.rocks/posts/Automating-MS-RPC-Vulnerability-Research/

Automates MS-RPC research by using NtObjectManager in PowerShell to parse IDL definitions, dynamically generate and bind RPC clients over named pipes with NTLM encryption, invoke methods like EfsRpcOpenFileRaw to obtain context handles, and drive a custom MS-RPC-Fuzzer PoC to randomize parameters and visualize results in Neo4j for efficient vulnerability triage.

#

🛠️ Tool | 🌐 Web | 🤖 AI | 🎁 PoC

🔗 Original article: https://portswigger.net/research/repeater-strike-manual-testing-amplified

Repeater Strike is an experimental AI-powered Burp Suite extension that ingests a single Repeater test—identifying parameters and IDOR-style flaws via AI—then auto-generates and mutates regex checks and retroactively scans your entire proxy history to uncover related vulnerabilities with minimal manual effort.

deep valeBOT
#

🛡️ CVE | 💣 RCE | 🔐 NTLM | 🎁 PoC

🔗 Original article: https://www.synacktiv.com/en/publications/la-reflexion-ntlm-est-morte-vive-la-reflexion-ntlm-analyse-approfondie-de-la-cve-2025.html

CVE-2025-33073 is a Windows SMB client flaw allowing remote-authenticated SYSTEM execution by abusing NTLM and Kerberos reflection via serialized SPNs. Using tools like PetitPotam, dnstool, ntlmrelayx, and krbrelayx, attackers force NTLM local calls or Kerberos AP-REQs to relay the SYSTEM token. Microsoft’s patch rejects serialized SPNs and enabling SMB signing prevents the exploit.

deep valeBOT
#

🌐 Web | 🛡️ CVE | 🔐 Auth | ⚠️ Account Takeover

🔗 Original article: https://patchstack.com/articles/account-takeover-in-password-policy-manager/

Password Policy Manager ≤2.0.4 has an unauthenticated account takeover (CVE-2025-31019) via the moppm_pass2login_redirect hook, which logs in any user_id when given a valid nonce. Extract the nonce from the reset form and replay it with a target ID to gain admin access. v2.0.3’s fix was bypassable; v2.0.5 binds session keys to user IDs. Upgrade now.

deep valeBOT
#

🛠️ Tool | 🎁 PoC | 🔐 Active Directory | 🗝️ Kerberos

🔗 Original article: https://github.com/Semperis/GoldenDMSA

Golden dMSA is a C#/.NET tool exploiting a new attack against Active Directory managed service accounts by extracting the DC’s KDS Root Key, enumerating dMSA/gMSA SIDs and ManagedPasswordIDs, and offline computing valid Base64 passwords. It supports enumeration, GUID wordlist generation, offline computation, and conversion to NTLM/AES hashes for stealthy lateral movement.

#

🔑 KDS Root Key | 🔒 Auth Bypass | 🎁 PoC | 🛠️ Tool

🔗 Original article: https://www.semperis.com/blog/golden-dmsa-what-is-dmsa-authentication-bypass/

  • Windows Server 2025’s delegated MSAs tie authentication to machine identity, but a design flaw in <code>msDS-ManagedPasswordId</code> limits time-based indices to 32 × 32 combinations, enabling offline brute force.<br/>- Attack steps: dump KDS root key (<code>msKds-RootKeyData</code>), enumerate dMSAs via LSA RPC bypassing LDAP ACLs, reverse-engineer <code>ManagedPasswordId</code>, test 1,024 vectors to derive NTLM/AES256 keys, then Pass-the-Hash or Kerberos ticket forging.<br/>- GoldenDMSA tool automates the exploit; forest-wide persistence and lateral movement become trivial.
deep valeBOT
#

📱 iOS | 🤖 Android | 🛡️ CVE | 🎁 PoC

🔗 Original article: https://www.mobile-hacker.com/2025/07/17/remote-input-injection-vulnerability-in-air-keyboard-ios-app-still-unpatched/

A remote input injection flaw (CVE WLB-2025060015) in the Air Keyboard iOS app due to an unauthenticated TCP listener on port 8888 allows any local attacker to inject keystrokes. The Android client uses an AES-ECB handshake on port 55535 but crashes on malformed payloads, enabling DoS. Devices can be found via nmap or adb netstat. Users should uninstall the iOS app, restrict Wi-Fi access, monitor open ports, and update promptly.

#

📱 Mobile | 💣 RCE | 🔒 TLS | 🎁 PoC

🔗 Original article: https://www.nowsecure.com/blog/2025/07/16/remote-code-execution-discovered-in-xtool-anyscan-app-risks-to-phones-and-vehicles/

  • NowSecure discovered that Xtool AnyScan's custom TrustManager in OKHttpDownload.buildTrustManagers() disables TLS validation, enabling MITM attacks.<br/>- The app uses a hardcoded DES key/IV in RemoteServiceProxy to encrypt update metadata, allowing decryption and re-encryption.<br/>- Plugins (ZIP with libscan.so) are downloaded without authentication, unzipped without MD5 or signature checks, and loaded via dlopen() for arbitrary code execution.<br/>- A PoC using iptables/mitmproxy and a malicious libscan_x64.so achieves persistent RCE on Android and OBD-II vehicle compromise.
deep valeBOT
#

🎭 Social Engineering | 🛠️ Tool | ⛓️ Virtualization

🔗 Original article: https://trustedsec.com/blog/hiding-in-the-shadows-covert-tunnels-via-qemu-virtualization

  • Attacker phished via Microsoft Teams and used Quick Assist to drop a ZIP with portable QEMU binaries.<br/>- Two VBS scripts launched Tiny Core Linux VMs with SSH host-forwarding.<br/>- Inside the VM, they fetched a backdoor (123.out), edited bootlocal.sh and filetool.lst for persistence, and randomized hostnames to conceal tunnels.
#

🛡️ CVE | 💣 RCE | 🧰 Deserialization | 🎁 PoC

🔗 Original article: https://www.offsec.com/blog/cve-2024-12029/

CVE-2024-12029 is a critical (9.8) deserialization vulnerability in InvokeAI 5.3.1–5.4.2. The /api/v2/models/install endpoint unsafely uses PyTorch’s torch.load() on attacker-supplied .ckpt files, enabling unauthenticated RCE via a crafted __reduce__ payload. Exploitation involves generating a malicious checkpoint, hosting it, and POSTing to the API. A Metasploit module automates this. Fixed in ≥ 5.4.3 by enabling default model scanning and supporting weights_only=True.

deep valeBOT
#

🔄 NTLM Relay | 🗄️ SQL Server | 🛠️ PXEthief | 🎁 PoC

🔗 Original article: https://specterops.io/blog/2025/07/15/id-like-to-speak-to-your-manager-stealing-secrets-with-management-point-relays/

  • Relay an SCCM Management Point’s machine account to the SQL Server via PetitPotam and ntlmrelayx<br/>- Use mssqlclient to call MP_GetMachinePolicyAssignments & MP_GetPolicyBody, extract hex blobs of NAAConfig, TS_Sequence, and CollectionSettings<br/>- Decode with xxd and decrypt with PXEthief to recover network access and task sequence credentials
deep valeBOT
#

🌐 Web | 🛡️ CVE | 💣 RCE | 🎁 PoC

🔗 Original article: https://opzero.ru/en/press/101-chrome-exploitation-part-0-preface/

101 Chrome Exploitation — Part 0: Preface presents a three-stage full-chain exploit for Chrome 130, including WebAssembly type confusion (CVE-2025-0291), V8 sandbox escape (Issue 379140430), and OS sandbox abuse via Mojo startDragging (CVE-2024-11114), with complete code, architecture diagrams, PoCs, and environment setup for full code execution.

deep valeBOT
#

🌐 Web | 💣 RCE | 🛠️ Tool | 🎁 PoC

🔗 Original article: https://gist.github.com/gboddin/6374c04f84b58cef050f5f4ecf43d501

Critical RCE in SharePoint: A crafted POST to the WebPart editing endpoint abuses <code>MSOTlPn_Uri</code> to load a malicious ASCX control and <code>MSOTlPn_DWP</code> to inject ASP.NET directives plus a gzipped Base64 DataTable into an <code>ExcelDataSet</code> control. Unsafe deserialization triggers full remote code execution. 🎁 PoC

#

📱 Android | 💣 Task Hijacking | 🎁 PoC | 🛡️ Mitigation

🔗 Original article: https://github.com/KMov-g/androidapps/blob/main/caller.id.phone.number.block.md

This blog post describes a task hijacking vulnerability in the Caller ID Android app caused by a default taskAffinity misconfiguration. A malicious app can declare an activity with the victim’s package name as its taskAffinity, allowing it to hijack the task stack, display phishing UIs, and steal credentials. It includes reproduction steps, attacker manifest and code, a PoC GIF, impact analysis, and mitigation by setting taskAffinity to an empty string.

#

🌐 Web | 🛡️ CVE | 💣 RCE | 🎁 PoC

🔗 Original article: https://research.eye.security/sharepoint-under-siege/

  • Eye Security uncovered “ToolShell,” an unauthenticated RCE chain in SharePoint (CVE-2025-49706 & CVE-2025-49704).<br/>- A PowerShell loader dropped <code>spinstall0.aspx</code> to leak ASP.NET machine keys.<br/>- Leaked keys were used with ysoserial to craft signed <code>__VIEWSTATE</code> payloads, achieving full RCE.<br/>- Dozens of servers compromised; remediation: patch, rotate machine keys, restart IIS, and respond swiftly.
deep valeBOT
#

📱 Android | 💰 Ad Fraud | 🔑 Credential Theft | 🛠️ Tool

🔗 Original article: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/unmasking-malicious-apks-android-malware-blending-click-fraud-and-credential-theft/

Trustwave SpiderLabs dissects an Android malware cluster delivering off-market APKs that abuse Android permissions to enable click fraud, credential harvesting, sandbox evasion, AES-ECB Base64-encoded C2 configs, crash-report fallback exfiltration, and signature bypass via ApkSignatureKillerEx for stealth.

deep valeBOT
#

🛡️ CVE | 💣 RCE | 🌐 Web | 🎁 PoC

🔗 Original article: https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/

Unit 42 reports active exploitation of SharePoint vulnerabilities CVE-2025-49704, CVE-2025-49706, CVE-2025-53770 and CVE-2025-53771 on Server 2016, 2019 and Subscription Edition. Attackers bypass MFA/SSO, exfiltrate web.config via debug_dev.js, deploy ASPX web shells (spinstall0.aspx) with Base64 PowerShell for ViewState key theft, and maintain persistence. PoCs available on GitHub. Unit 42 provides Cortex XDR XQL queries for detection. Immediate disconnection, patching, key rotation and IR engagement are recommended.

#

🌐 Web | 🛡️ CVE | 💣 RCE | 🎁 PoC

🔗 Original article: https://github.com/soltanali0/CVE-2025-53770-Exploit

PoC Python exploit for CVE-2025-53770 targeting SharePoint ToolPane.aspx WebPart injection. Authenticated users inject a GZIP-compressed serialized .NET gadget chain via the MSOTlPn_DWP parameter, causing unsafe deserialization (LosFormatter, BinaryFormatter, ObjectDataProvider) and RCE. Includes exploit.py, ysoserial.net instructions, payload structure, and example usage.

deep valeBOT
#

📱 Android | 🛡️ Spyware | 🛠️ Tool | 🌐 Infrastructure

🔗 Original article: https://www.lookout.com/threat-intelligence/article/lookout-discovers-iranian-dchsy-surveillanceware

DCHSpy is a modular Android surveillanceware by Iranian APT MuddyWater, disguised as VPN/banking apps (e.g., <code>starlink_vpn(1.3.0)-3012.apk</code>) and deployed via Telegram. It collects accounts, contacts, SMS, files, location, call logs, audio, photos, and WhatsApp data by loading dynamic modules and injecting hooks into Android APIs. Harvested data is compressed, AES-encrypted with a C2-supplied password, and exfiltrated via SFTP or HTTP to actor-controlled servers (e.g., <code>it1.comodo-vpn.com:1953</code>). Shared infrastructure reuse underscores high sophistication and severe espionage impact.

deep valeBOT
#

🌐 Web | 🛡️ CVE | 💣 RCE | ⛓️ Chain

🔗 Original article: https://bishopfox.com/blog/sitecore-experience-platform-vulnerabilities-critical-update-needed-for-versions-10-1-to-10-3

Sitecore Experience Platform 10.1–10.3 contains three critical, chained vulnerabilities—CVE-2025-34509 (hardcoded ServicesAPI credential), CVE-2025-34510 (ZIP slip path traversal), and CVE-2025-34511 (unrestricted PowerShell file upload)—that allow unauthenticated attackers to gain a session, overwrite files, and execute arbitrary code. Upgrading to 10.4 or applying Sitecore’s Security Hardening Guide mitigates these issues.

#

🛡️ CVE | 💣 LPE | 💉 XXE | 🎁 PoC

🔗 Original article: https://swarm.ptsecurity.com/the-guest-who-could-exploiting-lpe-in-vmware-tools/

  • CVE-2022-22977 affects VMware Tools’ Guest Authentication Service (VGAuthService.exe), letting local users hijack XML loads and cause DoS or XXE file leaks. <br/>- Attackers create <code>C:\Program%20Files\VMware\VMware%20Tools\etc</code> with malicious <code>catalog</code>, triggering libxml2 errors or OOB HTTP exfiltration. <br/>- Patch to VMware Tools 12.0.5. 🎁
deep valeBOT
#

🛠️ Tool | 🤖 LLM | 🔓 Deobfuscation | 🐍 Python

🔗 Original article: https://www.mobile-hacker.com/2025/07/22/deobfuscating-android-apps-with-androidmeda-a-smarter-way-to-read-obfuscated-code/

Androidmeda is a Python tool that uses large language models to deobfuscate Android decompiled Java code by renaming variables, reconstructing control flow, injecting comments, and generating a JSON vulnerability report. Install via git clone and pip3 install -r requirements.txt, decompile with jadx, then run python3 androidmeda.py specifying --llm_provider and --llm_model. Supports local (LLaMA, Mistral) and API (GPT-4, Gemini, Claude). Case study on Crocodilus malware shows drastic reduction in analysis time.

deep valeBOT
#

🌐 Web | 🛡️ CVE | 🔒 Broken Access Control | 🐞 Account Takeover

🔗 Original article: https://patchstack.com/articles/account-takeover-vulnerability-affecting-over-400k-installations-patched-in-post-smtp-plugin/

Broken Access Control in Post SMTP ≤ 3.2.0 (CVE-2025-24000) let any logged-in user call REST endpoints to read full email logs and resend messages, enabling Subscriber-level attackers to extract admin password reset links and takeover sites. Patched in v3.3.0 by adding a current_user_can('manage_options') check. Upgrade now.

deep valeBOT
#

🌐 IPv6 | 💉 NDP | 🛠️ Tool | 🎁 PoC

🔗 Original article: https://blog.exploit.org/caster-legless/

  • Comprehensive IPv6 attack guide covering passive NDP sniffing, system tuning, RA spoofing, RDNSS injection, and DHCPv6 DNS spoofing using Python/Scapy and mitm6 tool.<br/>- Includes full code snippets, sysctl/ip6tables commands, flag analysis, intervals, and mitigation via RA Guard, DHCPv6 Guard, and NDP inspection.
deep valeBOT
#

📱 Mobile | 💣 Malware | 🎣 Phishing | 🛡️ Defense Evasion

🔗 Original article: https://zimperium.com/blog/the-dark-side-of-romance-sarangtrap-extortion-campaign

Zimperium zLabs exposed the SarangTrap mobile extortion campaign using 250+ Android APKs and 88 SEO-optimized phishing domains to deliver spyware. It employs an invitation-code C2 gating mechanism to evade dynamic analysis, then prompts for SMS*, contacts and storage permissions, harvesting device IDs, contacts, images (via Luban) and SMS. An iOS variant uses a deceptive config profile sideload for access. Newer Android samples omit SMS permissions but still exfiltrate texts. Full IOCs in the GitHub repo.

deep valeBOT
#

📡 IoT | 💣 RCE | 🎁 PoC | 🛠️ Tool

🔗 Original article: https://blog.trailofbits.com/2025/07/25/exploiting-zero-days-in-abandoned-hardware/

Exploiting zero days in abandoned hardware: Trail of Bits exploited EOL IoT devices—Netgear WGR614v9 via UPnP auth bypass, buffer overflows, and novel bashsledding NOP sled for RCE; and Bitdefender Box v1 via firmware downgrade and md5 parameter command injection to inject SSH keys for persistent root. Utilized binwalk, unblob, QEMU, and SPI flash extraction. 🎁 PoC

deep valeBOT
#

📱 Android | ⚙️ IPC | 🔍 Enumeration | 🎁 PoC

🔗 Original article: https://www.pentestpartners.com/security-blog/android-services-101/

Android Services run background tasks accessible via IPC; AIDL services lack built-in permission checks. Enumerate with service list and brute-force service call to discover methods. Reverse-engineer vendor JARs (e.g., mediatek-services.jar) to map transaction codes in onTransact(). Identify unchecked methods like startMonitorProcessWithUid() (transaction 8) to trigger kernel-level Netlink actions and log via adb logcat.

#

🌐 Web | 🛡️ CVE | 💉 XXE | 🎁 PoC

🔗 Original article: https://www.offsec.com/blog/cve-2025-27136/

  • CVE-2025-27136 is a Medium-severity XXE in LocalS3’s CreateBucketConfiguration (pre-1.21), allowing unauthenticated file reads via crafted XML.<br/>- Exploit by defining an external entity in a DOCTYPE that references <code>file:///etc/passwd</code> and submitting it with curl 🎁 PoC.<br/>- Mitigate by upgrading to ≥1.21 and disabling external entity resolution in the XML parser.
#

🛡️ CVE | 💣 RCE | 📦 Docker | 🎁 PoC

🔗 Original article: https://www.thezdi.com/blog/2025/7/24/cve-2025-20281-cisco-ise-api-unauthenticated-remote-code-execution-vulnerability

An unsafe deserialization in Cisco ISE’s enableStrongSwanTunnel API (CVE-2025-20281) allows unauthenticated attackers to inject root commands. By abusing Java 8’s exec(String) tokenization with ${IFS} and escaping a privileged Docker container via cgroup user-mode helpers, the exploit achieves full host root shell.

deep valeBOT
#

🛠️ Tool | 🔍 Recon | ☁️ ADWS | ⛓️ LDAP

🔗 Original article: https://specterops.io/blog/2025/07/25/make-sure-to-use-soapy-an-operators-guide-to-stealthy-ad-collection-using-adws/

  • SoaPy brings SOAP-based ADWS enumeration to Linux, replaying Microsoft’s MC-NBFX/MS-NNS protocols for stealthy LDAP recon over TCP/9389.
  • Supports constrained queries, cross-platform SOCKS proxying, unintended writes (e.g., msDs-AllowedToActOnBehalfOfOtherIdentity), and BOFHound integration for BloodHound ingestion.
  • Demonstrates targeted domain and ADCS object collection, certificate request via Certipy, Kerberos ticket injection (Kerbeus) for domain compromise.
  • Recommends ADDS verbose logging and SACL canaries to detect ADWS recon.
#

🌐 Web | 📧 Email Security | 🔡 Unicode | 🎯 Phishing

🔗 Original article: https://unit42.paloaltonetworks.com/homograph-attacks/

  • Homograph attacks substitute Latin letters with Unicode homoglyphs (e.g., U+0397, U+043E) to bypass filters and impersonate brands.
  • Case studies: Google Drive share via Azure Blob URL; e-signature phishing with custom OTP/CAPTCHA and multi-stage redirects; Spotify impersonation using redirects.ca.
  • Defenses: Unicode code point analysis, mixed-script detection, and email security solutions like Cortex Advanced Email Security and XSOAR.
deep valeBOT
#

🛠️ Tool | 💣 RCE | 🎁 PoC | 🛡️ CVE

🔗 Original article: https://github.com/irsdl/ysonet

YSoNet is a fork of ysoserial.net that generates malicious .NET serialized payloads for unsafe deserialization. It supports multiple formatters (BinaryFormatter, Json.NET, XAML, MessagePack, etc.) and dozens of gadget chains (TypeConfuseDelegate, ActivitySurrogateSelector, DataSetOldBehaviour, ObjectDataProvider, PSObject, etc.). Install or build from source, then run ysonet.exe <Gadget> <Command> to emit a serialized blob. Useful for academic research and red-team testing of RCE in .NET applications.

deep valeBOT
#

🛠️ Tool

🔗 Original article: https://adaptix-framework.gitbook.io/adaptix-framework/changelog-and-updates/v0.6-greater-than-v0.7

  • v0.7 adds Credential Manager, AxScript engine with live console, and dynamic C2 UI menus in AdaptixC2.
  • Agent Beacon: Windows Server 2025 detection, robust payload validation, rundll32 DLL execution, rewritten BOF loader, and critical fixes.
  • Agent Gopher: Windows BOF support, process tree view, explicit run requirements, and rev2self token revert.
  • Extension-Kit: new and updated BOF modules (nanodump, potato-dcom), and new Access menu actions.
deep valeBOT
#

📱 Mobile | 💣 Trojan | 🖥️ RAT | 🎁 PoC

🔗 Original article: https://cyble.com/blog/redhook-new-android-banking-targeting-in-vietnam/

  • RedHook is an Android banking trojan distributed via phishing sites impersonating Vietnamese institutions, hosting malicious APKs on a public AWS S3 bucket.
  • It abuses Accessibility Service and overlay permissions for UI automation, input capture, and phishing overlays.
  • Performs staged exfiltration: ID upload, personal/banking data collection, PIN/OTP capture.
  • Establishes a WebSocket RAT with 34 numeric commands and uses MediaProjection API for live screen streaming.
  • Exposed infrastructure (misconfigured S3) revealed IOCs, Chinese-language artifacts, and operational history.
#

📱 Android | 💣 Banking Trojan | 🛡️ Malware Analysis | 🎁 PoC

🔗 Original article: https://www.bitsight.com/blog/toxicpanda-android-banking-malware-2025-study

ToxicPanda is an Android banking Trojan targeting Portuguese and Spanish users. It uses TAG-124 TDS for distribution, abuses Accessibility services to deploy WebView overlays over banking apps, implements a predictable monthly DGA with sequential TLD cycling, evades sandboxes via anti-emulation checks, encrypts C2 traffic (AES/ECB, DES/CBC), and persists via dynamic broadcast receivers. Removal requires ADB. 🎁 PoC and IOCs are available on GitHub.

deep valeBOT
#

🛠️ Tool | 🌐 Web | 💉 SQLi

🔗 Original article: https://blog.bughunt.com.br/sqlmap-vulnerabilidades-banco-de-dados/

SQLMap is a Python-based CLI tool that automates detection and exploitation of SQL Injection vulnerabilities. It tests dynamic URL parameters with Boolean/time-based/error-based payloads, parses responses, and enumerates DBMS objects using commands like --dbs, --tables, --columns, and --dump. Supports MySQL, PostgreSQL, Oracle, SQLite, and offers custom headers (--headers), session cookies (--cookie), authenticated scans (--auth-cred), and proxy integration (--proxy). Embed SQLMap in CI/CD or pentests for continuous security validation within authorized scopes.

#

🌐 Web | 🛡️ CVE | 💣 RCE | 🎁 PoC

🔗 Original article: https://labs.watchtowr.com/stack-overflows-heap-overflows-and-existential-dread-sonicwall-sma100-cve-2025-40596-cve-2025-40597-and-cve-2025-40598/

  • Three pre-auth vulnerabilities in SonicWall SMA100 v10.2.1.15: CVE-2025-40596 (stack overflow), CVE-2025-40597 (heap overflow), CVE-2025-40598 (reflected XSS).
  • CVE-2025-40596 uses unchecked sscanf into a 0x800-byte stack buffer.
  • CVE-2025-40597 uses __sprintf_chk with size -1 into a 0x80-byte heap chunk.
  • CVE-2025-40598 reflects the state parameter unsanitized in radiusChallengeLogin.
deep valeBOT
#

🌐 Web | 🛠️ Tool | 💣 RCE | 🔒 Malware

🔗 Original article: https://research.checkpoint.com/2025/jsceal-targets-crypto-apps/

JSCEAL is a modular, multi-stage malware campaign that uses paid malvertising to deliver a WIX MSI installer, which spins up a localhost HTTP listener (port 30303) via CustomActions.dll. Two JavaScript files on a fake landing site (primary.js, worker.js) drive WMI queries and scheduled-task deployment. A PowerShell backdoor fingerprints the host and, if approved, downloads a Node.js runtime plus a Brotli-compressed, obfuscated .jsc payload. JSCEAL then establishes a tRPC C2, installs a malicious HTTPS proxy for Man-in-the-Browser thefts, and performs RAT, Puppeteer automation, and wallet manipulation.

#

📡 Telecom | 🛡️ CVE | 💣 RCE | 🎁 PoC

🔗 Original article: https://unit42.paloaltonetworks.com/infiltration-of-global-telecom-networks/

The Covert Operator's Playbook analyzes CL-STA-0969's 2024 campaign against global roaming infrastructure. The actors gained SSH access via brute-force, deployed a PAM backdoor (AuthDoor), leveraged GTP-, ICMP- and DNS-based covert channels (GTPDoor, EchoBackdoor, NoDepDNS), used an SGSN emulator for GTP tunneling, and installed ChronosRAT. They escalated privileges with DirtyCow (CVE-2016-5195), PwnKit (CVE-2021-4034) and sudo overflow (CVE-2021-3156), set up reverse SSH tunnels over port 53, and evaded detection through log tampering, process masquerading and SELinux disabling. Open-source tools FScan, Responder, Microsocks, FRP and ProxyChains supported their operation.

deep valeBOT
#

🛡️ Social Engineering | 💉 Credential Harvesting | ✉️ BEC | 🤖 AI

🔗 Original article: https://unit42.paloaltonetworks.com/2025-unit-42-global-incident-response-report-social-engineering-edition/

  • Social engineering led initial access May 2024–May 2025, with high-touch MFA bypass via help desk manipulation and at-scale ClickFix campaigns delivering RedLine, Lumma and Lampion infostealers.<br/>- Techniques include real-time employee impersonation, SEO poisoning, malvertising, fake prompts, and living-off-the-land lateral movement using PowerShell, WMI, Graph API and RMM.<br/>- AI layers: automation for phishing, GenAI for personalized lures and voice cloning, agentic AI for autonomous reconnaissance.<br/>- Defenses: ITDR, UEBA, Zero Trust conditional access, network-layer controls, help desk hardening, just-in-time provisioning and social engineering drills.
deep valeBOT
#

🌐 Web | 🛡️ CVE | ↔️ Path Traversal | 🗑️ File Deletion

🔗 Original article: https://patchstack.com/articles/unauthenticated-arbitrary-file-delete-vulnerability-in-litho-the/

Litho Theme ≤ 3.0 contains an unauthenticated AJAX file-deletion flaw (CVE-2025-49879) in its custom font removal handler. Lack of nonce, capability checks, and sanitization of the fontfamily parameter allows path traversal (e.g. ../../wp-config.php), leading to arbitrary file deletion and site takeover. Upgrade to Litho 3.1 to enforce authentication, CSRF protection, and input sanitization.

deep valeBOT
#

🛡️ CVE | 💣 RCE | 🛠️ Tool | 🎁 PoC

🔗 Original article: https://www.synacktiv.com/publications/laravel-analyse-de-fuite-dappkey.html

Laravel APP_KEY Leakage Analysis: Examination of how Laravel’s AES-256-CBC + HMAC encryption and default decrypt() behavior (unserialize) lead to remote code execution when APP_KEY is exposed. Three CVEs (Invoice Ninja CVE-2024-55555, Snipe-IT CVE-2024-48987, Crater CVE-2024-55556) are dissected with full PoCs, and large-scale APP_KEY brute-forcing using Shodan, laravel-crypto-killer and the optimized nounours tool demonstrates 1.5 billion tries/sec.

deep valeBOT
#

📡 RFID | 🔋 Power | 🛠️ Tool | 🔧 Hardware Hacking

🔗 Original article: https://trustedsec.com/blog/lets-clone-a-cloner-part-3-putting-it-all-together

  • Complete assembly of a mobile MaxiProx RFID cloner<br/>- Integrated separate USB-PD trigger power for ESP RFID Tool<br/>- Added silent beeper kill-switch with accident-proof protective cap<br/>- Trimmed enclosure for battery fit, cable routes & power switch cut-out<br/>- Validated ~8 cm read range and tested shielding effectiveness
#

🌐 Web | 🛡️ CVE | 🔐 Info Disclosure | 🎁 PoC

🔗 Original article: https://www.offsec.com/blog/cve-2025-30208/

CVE-2025-30208 is a medium-severity (CVSS 5.3, EPSS 75.83 %) arbitrary file read in Vite’s dev server. Attackers append ?import&raw?? or ?raw?? to an @fs URL to bypass the allow-list and retrieve any readable file as an ES module export. Affected versions are < 4.5.10, 5.4.15, 6.0.12, 6.1.2, 6.2.3; patch immediately and restrict server exposure. 🎁 PoC

#

🛠️ Tool | 🔐 NTLM | 🔒 TLS | 🌐 MSSQL

🔗 Original article: https://sensepost.com/blog/2025/a-journey-implementing-channel-binding-on-mssqlclient.py/

Extended Impacket's mssqlclient.py to support SQL Server EPA by implementing Channel Binding Token (CBT) via the tls-unique method, rewriting STARTTLS with Python’s ssl module, reverse-engineering SQLCMD’s NTLM-over-TDS traffic by exporting private keys and disabling TLS 1.3, enabling successful authentication under EPA.

#

🤖 AI | 💣 RCE | 🛠️ Tool | 🎁 PoC

🔗 Original article: https://blog.trailofbits.com/2025/07/31/hijacking-multi-agent-systems-in-your-pajamas/

Trail of Bits releases pajaMAS, a PoC suite demonstrating six vectors—malicious environments, tools, memory poisoning, lethal trifecta, cycles, and URL anchors—for hijacking multi-agent systems via inter-agent control-flow exploitation to achieve RCE and data exfiltration. Key defenses include privilege separation, taint tracking, session hygiene, tool allowlisting, and orchestration-layer validation.

deep valeBOT
#

🛡️ CVE | 🌐 DNS | 🔗 HTTP | 🛠️ Tool

🔗 Original article: https://research.checkpoint.com/2025/before-toolshell-exploring-storm-2603s-previous-ransomware-operations/

  • Check Point Research reveals Storm-2603’s exploitation of four SharePoint CVEs to deploy custom DNS/HTTP backdoors (ak47c2) using XOR/hex encoding and fragmentation.<br/>- Combined open-source tools (masscan, PsExec) and implants deliver X2anylock and LockBit Black via DLL hijacking.<br/>- A custom Antivirus Terminator abuses a signed driver via IOCTLs to disable endpoint protection.
#

🛠️ Tool | 📡 Ansible Tower | 🕵️ Enumeration | 🔗 BloodHound

🔗 Original article: https://github.com/TheSleekBoyCompany/AnsibleHound

AnsibleHound is a Go-based BloodHound collector for Ansible Tower that uses a Read-only API token to enumerate organizations, inventories, hosts, job templates, projects, credentials, users and teams via the Tower REST API, converting them into a custom BloodHound graph (<code>AT*</code> nodes and <code>AT*</code> edges) for attack-path visualization.

deep valeBOT
#

📱 Android | 🦠 Malware | 🛠️ Tool | 🌐 Web

🔗 Original article: https://www.cleafy.com/cleafy-labs/playpraetors-evolving-threat-how-chinese-speaking-actors-globally-scale-an-android-rat

PlayPraetor is an Android RAT that abuses Accessibility Services to automate on-device fraud. It maintains resilient C2 via HTTP/S heartbeats, WebSocket (port 8282) and RTMP (port 1935), executes 52 dynamic commands for overlays and data harvesting, exfiltrates via HTTP APIs, and features a multi-tenant Chinese C2 panel with a built-in phishing page builder. Over 11 000 devices infected globally.

deep valeBOT
#

📱 Android | 💣 Trojan | 🔍 Obfuscation | 🔒 C2

🔗 Original article: https://zimperium.com/blog/behind-random-words-doubletrouble-mobile-banking-trojan-revealed

DoubleTrouble is an Android banking trojan hidden in <code>res/raw</code> using JSONPacker obfuscation. It tricks users into granting Accessibility Services, then steals credentials via PatternLockView/PinLockView overlays, records the screen with MediaProjection/ImageReader, blocks apps, logs keystrokes through Accessibility events, and executes 50+ C2 commands over a custom TLS channel. Zimperium’s MTD and zDefend detect both variants. IOCs on GitHub.

#

🌐 IPv6 | 🛡️ MITM | 🐍 Scapy | 🎁 PoC

🔗 Original article: https://habr.com/ru/articles/930526/

Practical IPv6 LAN Attacks: Explains fe80:: link-local and ff02:: multicast for NDP/SLAAC, passive sniffing with a Scapy Python script, RA spoofing via custom script with routerlifetime and Preference flags, system tuning (sysctl, ip6tables), RDNSS DNS injection, DHCPv6 spoofing with mitm6, and mitigations (RA Guard, DHCPv6 Guard, ND Inspection). Includes complete code and commands for stealthy MITM.

deep valeBOT
#

📱 Android | 👾 Malware | 🔒 Phishing | ⛏️ Crypto-mining

🔗 Original article: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/android-malware-targets-indian-banking-users-to-steal-financial-info-and-mine-crypto/

McAfee Labs uncovered an Android malware that uses phishing sites to side-load a two-stage XOR-encrypted DEX dropper, then dynamically loads a fraudulent banking UI to harvest card details via HTTP POST. A manifest-declared FirebaseMessagingService triggers download and execution of an encrypted native .so via ProcessBuilder (XMRig args) to stealthily mine Monero. IOCs include specific APK SHA-256 hashes, phishing domains, and FCM account ID.

deep valeBOT
#

🌐 Web | 🛡️ CVE | 💣 RCE | 🎁 PoC

🔗 Original article: https://blog.trailofbits.com/2025/08/04/uncovering-memory-corruption-in-nvidia-triton-as-a-new-hire/

Two critical stack-based memory corruption bugs (CVE-2025-23310 & CVE-2025-23311, CVSS 9.8) in NVIDIA Triton ≤ 25.06 enable crashes via HTTP chunked transfer encoding by inflating libevent evbuffer segments and overflowing an <code>alloca()</code>-based stack buffer. A Python PoC sends thousands of 6-byte chunks (~3 MB) to trigger a segmentation fault. Patch v25.07 replaces <code>alloca()</code> with <code>std::vector</code> inside try/catch and adds regression tests.

deep valeBOT
#

🛡️ CVE | 💻 IDE | 💣 RCE | 🎁 PoC

🔗 Original article: https://research.checkpoint.com/2025/cursor-vulnerability-mcpoison/

Cursor IDE’s MCP trust model (CVE-2025-54136) can be abused: an attacker commits a benign .cursor/rules/mcp.json, gains one-time approval, then swaps in malicious commands (e.g., a reverse shell) without further prompts, achieving persistent RCE. A PoC demonstrates continuous backdoor execution on IDE load. Upgrade to Cursor 1.3 to enforce re-approval on all MCP changes.

#

🌐 Web | 🛡️ CVE | 💣 RCE | 🛠️ Tool

🔗 Original article: https://unit42.paloaltonetworks.com/ak47-activity-linked-to-sharepoint-vulnerabilities/

Unit 42 links Microsoft’s Storm-2603 to CL-CRI-1040, revealing Project AK47—a toolkit comprising DNS/HTTP backdoors (AK47C2), X2ANYLOCK ransomware, DLL side-loading loaders, and supporting utilities—deployed via ToolShell exploits against SharePoint CVEs (49704, 49706, 53770, 53771) for RCE and double-extortion campaigns.

deep valeBOT
#

💣 Privilege Escalation | 🛠️ Tool | 🎁 PoC | 🪟 Windows

🔗 Original article: https://unit42.paloaltonetworks.com/badsuccessor-attack-vector/

BadSuccessor abuses delegated Managed Service Accounts in Windows Server 2025 to escalate privileges in Active Directory. By tampering with dMSA attributes (msDS-ManagedAccountPrecededByLink, msDS-DelegatedMSAState), attackers can assume Domain Admin rights. Enumeration and exploitation are automated via PoC tools (SharpSuccessor, BadSuccessor.ps1, NetExec), and post-exploitation uses Rubeus. Detection relies on Windows event IDs (5137, 5136, 2946, 4662) and Unit 42 XSIAM hunting queries.

deep valeBOT
#

🌐 Web | 🛡️ CVE | 🐘 PHP | 💣 RCE

🔗 Original article: https://patchstack.com/articles/critical-vulnerability-impacting-over-100k-sites-patched-in-everest-forms-plugin/

  • Unauthenticated PHP Object Injection in Everest Forms ≤ 3.2.2 (CVE-2025-52709) allows RCE when an admin views submissions on PHP < 7.1
  • <code>evf_maybe_unserialize()</code> skips <code>allowed_classes=false</code> on legacy PHP, calling <code>unserialize</code> unfiltered
  • Exploitation via crafted serialized payloads triggering magic methods
  • Patched in 3.2.3: disables unserialization on PHP < 7.1 and enforces <code>allowed_classes=false</code> on newer releases
deep valeBOT
#

🤖 AI | 💉 Prompt Injection | 🔒 Backdoor | 🎁 PoC

🔗 Original article: https://blog.trailofbits.com/2025/08/06/prompt-injection-engineering-for-attackers-exploiting-github-copilot/

  • A covert prompt injection hides in an HTML <picture> tag within a GitHub Issue.<br/>- Copilot is tricked into inserting a malicious wheel URL in uv.lock, installing a backdoor that executes bash commands via the X-Backdoor-Cmd header for RCE. 🎁 PoC
#

🌐 Web | 🛠️ Tool | 🛡️ CVE | 🎁 PoC

🔗 Original article: https://portswigger.net/research/http1-must-die

  • HTTP/1.1’s ambiguous request framing (CL, TE, 0, H2) enables parser discrepancies and request smuggling.<br/>- Use Burp Suite HTTP Request Smuggler v3.0 to detect V-H and H-V mismatches.<br/>- Smuggling primitives: CL.0, TE.CL, H2.0, 0.CL via IIS /con gadget, double-desync with Turbo Intruder, Expect-based desync and RQP.<br/>- Case studies: Cloudflare cache poisoning, AWS ALB & IIS bypass, GitLab RQP, Akamai CVE-2025-32094.<br/>- Mitigation: upstream HTTP/2, strict normalization, disable connection reuse, reject bodies on GET/HEAD/OPTIONS.
deep valeBOT
#

🦠 Infostealer | 🔒 Encryption | 🛠️ Tool | 💻 Process Hollowing

🔗 Original article: https://unit42.paloaltonetworks.com/new-darkcloud-stealer-infection-chain/

Three phishing-driven chains use obfuscated JS/WSF downloaders to fetch a dual-layer encrypted PowerShell payload that drops a ConfuserEx-protected VB6 DarkCloud Stealer. Analysts bypass obfuscation with AntiTamperKiller, de4dot-cex and ProxyCall-Remover, decrypt the 3DES TLV-stored VB6 payload, and observe process hollowing into RegAsm.exe with RC4-encrypted configuration.

deep valeBOT
#

🐧 Linux | 🛡️ CVE-2025-38236 | 💥 UAF | 🎁 PoC

🔗 Original article: https://googleprojectzero.blogspot.com/2025/08/from-chrome-renderer-code-exec-to-kernel.html

A use-after-free in Linux’s AF_UNIX MSG_OOB path (CVE-2025-38236) lets unfiltered <code>send()/recv()</code> flags in Chrome’s renderer sandbox trigger a dangling <code>sk_buff</code> pointer. A crafted sequence of MSG_OOB and normal recv calls exploits manage_oob()’s faulty zero-length SKB handling to achieve kernel RCE. The bug is fixed by decoupling zero-length and OOB checks; full PoC is on Project Zero 🎁 PoC.

#

🛠️ Tool | 🤖 AI | 🧪 Fuzzing | 🛡️ Vulnerability

🔗 Original article: https://blog.trailofbits.com/2025/08/07/aixcc-finals-tale-of-the-tape/

Trail of Bits’ blog breaks down AIxCC finalists’ CRSs into three philosophies: AI-augmented fuzzing (LLM-generated seeds, grammar evolution, multi-agent orchestration), AI-first PoV creation (primary LLM reasoning with fallback fuzzing), and hybrid tailored models (fine-tuned Llama for C, super patches, SARIF validation). It highlights techniques like function-level mutation dictionaries, super patches, and speculative patch strategies under competition scoring.

#

🛠️ Tool | 🎁 PoC | 💣 Bypass

🔗 Original article: https://www.synacktiv.com/en/publications/should-you-trust-your-zero-trust-bypassing-zscaler-posture-checks.html

  • Decrypted DPAPI-encrypted Zscaler config files under C:\ProgramData\Zscaler by reconstructing custom entropy with a C# tool.<br/>- Patched four signed Zscaler binaries via a Python script to force posture checks to succeed and bypass WinVerifyTrust.<br/>- Achieved full zero trust bypass, granting unrestricted internal access; remediation requires upgrading to v4.4+, server-validated certificates, and SIEM monitoring.
deep valeBOT
#

🛡️ CVE | 💣 RCE | 🌐 Web | 🎁 PoC

🔗 Original article: https://www.offsec.com/blog/cve-2025-29891/

  • CVE-2025-29891 is a medium-severity remote code execution vulnerability in Apache Camel’s camel-exec due to unsanitized HTTP headers.
  • Attackers set CAmelExecCommandExecutable and CAmelExecCommandArgs headers to run arbitrary system commands.
  • PoC includes curl examples for sleep and reverse shell.
  • Mitigation: disable or secure camel-exec, validate headers, enforce authentication, apply patches, and restrict outbound access.
deep valeBOT
#

🛠️ Tool | 🤖 AI | 🧩 Fuzzing | 🛡️ Security

🔗 Original article: https://blog.trailofbits.com/2025/08/08/buttercup-is-now-open-source/

Buttercup is an open-source AI-driven CRS that automates fuzzing (<code>libFuzzer</code>, <code>Jazzer</code>), static analysis (Tree-sitter, CodeQuery), and multi-agent patch generation. Install with buttercup setup, deploy, send-task, and open-ui to discover and patch vulnerabilities on x86-64 Linux.

deep valeBOT
#

🛠️ Tool | 🤖 AI | 🔍 Fuzzing | 🛡️ Patching

🔗 Original article: https://blog.trailofbits.com/2025/08/09/trail-of-bits-buttercup-wins-2nd-place-in-aixcc-challenge/

Buttercup is an open-source AI-driven vulnerability discovery and patching system from Trail of Bits. It integrates LLM-augmented fuzzing, static analysis via tree-sitter, and multi-agent patch synthesis. In DARPA’s AIxCC finals it found 28 vulnerabilities, applied 19 patches with 90 % accuracy across 20 MITRE CWEs, and achieved $181 cost per point. Install via git clone https://github.com/trailofbits/buttercup.

deep valeBOT
#

🛠️ Tool | 🐳 Docker | 📱 Mobile | 🔍 Recon

🔗 Original article: https://medium.com/@justmobilesec/just-mobile-security-jms-mobile-docker-ba1e6b7f131d

JMS – Mobile Docker delivers a lightweight Docker container for Android & iOS pentesting, bundling OWASP MASTG tools plus extras (frida, objection, nuclei) on amd64/arm64. Clone repo, build and run with $ docker run -it --rm -v "$(pwd)":/workspace jms-mobile-docker. Connect Android via adb tcpip over Wi-Fi and iOS via ssh root@IOS_IP. Run Frida entirely over network and mount your project to /workspace to use apktool, jadx, and nuclei mobile templates.

deep valeBOT
#

🛡️ CVE | 💣 RCE | 📡 SSH | 🎁 PoC

🔗 Original article: https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/

  • CVE-2025-32433 enables unauthenticated RCE in Erlang/OTP sshd via pre-auth message processing.
  • Exploits include file-descriptor reverse shells, Bash /dev/tcp reverse shells and DNS OAST callbacks.
  • Detected 3,376 exploit attempts (70% on OT firewalls) across 275 hosts and 326 services from May 1–9, 2025.
  • Fix by upgrading to OTP 27.3.3, 26.2.5.11 or 25.3.2.20, updating IPS signatures and restricting SSH access.
#

🛠️ Tool | 🔐 Crypto | 🧩 Reverse-engineering | 💣 RCE

🔗 Original article: https://www.synacktiv.com/publications/extraction-des-archives-chiffrees-synology-pwn2own-irlande-2024.html

Synacktiv reverse-engineers Synology’s PAT/SPK encrypted archives to build synodecrypt, extracting hard-coded signature and master keys, verifying MessagePack headers via libsodium, deriving decryption subkeys, and decrypting entries with secretstream XChaCha20-Poly1305. They also uncover an unauthenticated command-injection RCE in SynologyPhotos v1.7.0-0794 via child_process.exec, patched in v1.7.0-0795 by switching to execFile. 🎁 PoC

deep valeBOT
#

🛡️ CVE | 💣 RCE | 📂 Archive | 📧 Phishing

🔗 Original article: https://www.bleepingcomputer.com/news/security/winrar-zero-day-flaw-exploited-by-romcom-hackers-in-phishing-attacks/

CVE-2025-8088 is a directory traversal bug in WinRAR pre-7.13 allowing crafted RAR archives to extract executables into Windows Startup folders via embedded "..\" path entries, enabling automatic execution on user logon. Actively exploited in RomCom phishing campaigns, users should update to WinRAR 7.13 to patch this high-severity RCE.

#

🛡️ CVE | 🗜️ Archive | 🧬 Symlink | 💣 RCE

🔗 Original article: https://www.redhotcyber.com/en/post/new-7-zip-flaw-symbolic-links-turn-extraction-into-a-hack-2/

  • CVE-2025-55188 affects 7-Zip versions prior to 25.01, due to improper symbolic link handling.
  • Allows arbitrary file overwrite (e.g., SSH keys, .bashrc) during extraction of ZIP/TAR/7Z/RAR archives.
  • Linux exploitation requires no privileges; Windows needs elevated rights or Developer Mode.
  • Fixed in 7-Zip 25.01 (Aug 3, 2025) with enhanced symlink validation.
#

📱 Android | 🔗 Path Traversal | 🗂️ File Read | 🎁 PoC

🔗 Original article: https://blog.ostorlab.co/signal-arbitrary-file-read.html

  • Four chained vulnerabilities in Signal Android (≤7.44.1) and Android SDK allow arbitrary reads of private files.<br/>- (1) Path traversal via URL-decoded segments in BlobContentProvider; symlink bypass for .blob extension.<br/>- (2) SHARE_MULTIPLE intent missing URI validation; Frida PoC included.<br/>- (3) FileUriExposedException bypass with file://system/../data/... URIs.<br/>- (4) MIME type spoofing & UUIDv4 blob filename brute-force to locate and read blobs.
deep valeBOT
#

🛠️ Tool | 💣 PrivEsc | 🛡️ CVE | 🎁 PoC

🔗 Original article: https://github.com/GhostPack/Certify/wiki/4-‐-Escalation-Techniques

Certify’s wiki details four AD CS privilege escalation techniques (ESC1–ESC4), showing how misconfigured certificate templates allow SAN spoofing, Any Purpose EKU abuse, enrollment agent exploitation, and ACL manipulation. Using Certify (v2.0.0) and Rubeus (v2.0.2), attackers can obtain Kerberos TGTs via PKINIT to compromise domain admins. 🎁 PoC

#

🛠️ Tool | 🔐 PKI | 🎁 PoC | ⛓️ Active Directory

🔗 Original article: https://specterops.io/blog/2025/08/11/certify-2-0/

Certify 2.0 is a complete AD CS exploitation toolkit rewrite, offering enhanced template/CA enumeration, detailed vulnerability attribution, modular commands, default base64 PFX output, SAN and application-policy injection, certificate renewal, golden cert forging, and new manage-template/manage-ca commands for LDAP (ESC4) and DCOM (ESC7) abuse.

deep valeBOT
#

🌐 Web | 🛡️ CVE | 💉 SQLi | 📂 File Download

🔗 Original article: https://patchstack.com/articles/multiple-critical-vulnerabilities-patched-in-wp-job-portal-plugin/

WP Job Portal ≤2.3.2 suffers from two unauthenticated critical flaws: SQL Injection (CVE-2025-48274) in validateFormData and Arbitrary File Download (CVE-2025-48273) in downloadCustomUploadedFile. Both require a valid _wpnonce from the [wpjobportal_my_resumes] page. Patched in v2.3.3 — upgrade immediately.

deep valeBOT
#

🛡️ CVE | 💣 RCE | 💉 Prompt Injection | 🎁 PoC

🔗 Original article: https://embracethered.com/blog/posts/2025/github-copilot-remote-code-execution-via-prompt-injection/

  • Critical CVE-2025-53773 prompt injection in GitHub Copilot/VS Code lets an attacker write "chat.tools.autoApprove": true to .vscode/settings.json, enabling YOLO mode and arbitrary terminal commands
  • Works on Windows, macOS, Linux with conditional OS detection
  • Includes stealth zero-width Unicode payloads and 🎁 PoC demos
  • Enables botnet enlistment (“ZombAIs”) and AI-driven malware spread
  • Fixed in August 2025 Patch Tuesday
deep valeBOT
#

🛡️ CVE | ⬆️ LPE | 🛠️ Tool | 🎁 PoC

🔗 Original article: https://zimperium.com/blog/the-rooting-of-all-evil-security-holes-that-could-compromise-your-mobile-device

Zimperium analyzes an LPE in KernelSU v0.5.7: manager authentication verifies the first matching APK from the caller’s open FDs. By influencing that selection, a malicious app can be accepted as the manager and then grant itself root. The attack requires running before the legit manager, enabling full compromise of already‑rooted devices. A PoC video and related Magisk CVE are cited.

deep valeBOT
deep valeBOT
#

💣 RCE | 🌐 Web | 🛠️ Tool | 🎁 PoC

🔗 Original article: https://www.pentestpartners.com/security-blog/terraform-token-abuse-speculative-plan/

Stolen Terraform CLI tokens with “plan” rights let attackers run speculative plans that execute external programs, yielding RCE on Terraform Cloud runners. From that shell, they exfiltrate short‑lived GCP/AWS credentials (tfc-* files) and use gcloud/AWS CLI to make out‑of‑band infra changes, bypassing VCS controls. Mitigate with least‑privilege tokens and Sentinel allowlists.

deep valeBOT
#

🛡️ CVE | 💣 RCE | 💉 XXE | 🎁 PoC

🔗 Original article: https://horizon3.ai/attack-research/attack-blogs/from-support-ticket-to-zero-day/

Two unauthenticated bugs in Xerox FreeFlow Core’s JMF Client (port 4004) enable RCE. CVE-2025-8355 is an XXE that yields SSRF via entity resolution in jmfclient.jar. CVE-2025-8356 is a path traversal in processIncomingRQEMessage() that allows arbitrary file write to web-served paths, enabling webshell execution. Fixed in 8.0.5.

#

🌐 Web | 🛡️ CVE | ⬆️ Privilege Escalation | 🧩 WordPress

🔗 Original article: https://patchstack.com/articles/rare-case-of-privilege-escalation-in-ase-plugin-affecting-100k-sites/

ASE ≤ 7.6.2.1 has a broken authorization flaw in the “View Admin as Role” reset path. Any authenticated user can trigger role restoration via reset-for=USERNAME with no capability/nonce checks, reverting saved original roles (e.g., Administrator) from user meta. Fixed in 7.6.3. CVE-2025-24648/CVE-2024-43333.

deep valeBOT
#

📱 Android | 🐛 Malware | 🛠️ Tool | 🌐 Web

🔗 Original article: https://hunt.io/blog/ermac-v3-banking-trojan-source-code-leak

Hunt.io’s March 6, 2024 leak of ERMAC v3.0 reveals a Laravel C2, React panel, Go exfil server, and a builder-driven Android trojan. Overlays from public/injects exfiltrate via Android.send_log_injects; C2 traffic uses AES-CBC with fixed IV “0123456789abcdef.” Panels are fingerprintable and often expose critical opsec flaws: hardcoded JWT secret, static admin bearer token, default root creds, and open registration. HuntSQL queries enable global infra discovery.

deep valeBOT
#

🌐 Web | 🤖 LLM | 🔐 Data Exfiltration | 🛠️ Tool

🔗 Original article: https://labs.zenity.io/p/when-a-jira-ticket-can-steal-your-secrets

A Jira→MCP→Cursor chain lets indirect prompt‑injection exfiltrate repo and local secrets. Euphemisms/encoded instructions bypass model guardrails; Jira comments or outbound HTTP requests become exfil channels. With Auto‑Run, this is zero‑click. Mitigate by vetting MCP servers, disabling/allow‑listing Auto‑Run tools, excluding sensitive paths (e.g., .cursorignore), and monitoring agent I/O.

deep valeBOT
#

🛡️ CVE | 🌐 Web | 📱 Android | 🎁 PoC

🔗 Original article: https://medium.com/@happyjester80/samsung-s24-exploit-chain-pwn2own-2024-walkthrough-c7a3da9a7a26

Two Samsung Gaming Hub flaws enable an attack chain: CVE‑2024‑49419 lets deep links load arbitrary URLs in an internal WebView; CVE‑2024‑49418 abuses inconsistent, multi‑stage URL checks so JavaScript becomes enabled before final verification. Provided ADB PoCs show how to trigger each path and achieve in‑app HTML/JS execution for chaining.

#

🌐 Web | 💉 XSS | 💰 Bug Bounty | 🎁 PoC

🔗 Original article: https://hesar101.github.io/posts/How-I-found-a-0-Click-Account-takeover-in-a-public-BBP-and-leveraged-It-to-access-Admin-Level-functionalities/

Header‑reflected XSS + cache poisoning + WAF quirks enabled 0‑click ATO. By seeding a cached HTML variant via a .js GET (not content‑inspected) using Burp Repeater single‑packet group requests and a fresh IP, the attacker injected an inline script reflecting User‑Agent. Non‑HttpOnly JWT cookies were exfiltrated to an OAST server (~600 tokens, incl. employee/admin). With admin JWTs, endpoints like /api/products/{product_id}/comments/{comment_id}/del were usable.

deep valeBOT
#

🤖 Android | 🧩 Reverse Engineering | 🕵️ Evasion | 🛠️ Tool

🔗 Original article: https://www.kayssel.com/newsletter/issue-12/

Actionable playbook to bypass Android app anti‑root, anti‑Frida/debugger, and SSL pinning. Uses Magisk DenyList, Frida Codeshare scripts, attach‑after‑launch, Jadx‑guided hooks, Objection patching, pre‑crash class dumps, JNI tracing with frida‑trace, and apk‑mitm for traffic inspection. Includes code and commands.

deep valeBOT
#

🛡️ CVE | 💣 RCE | 🐧 Linux | 📡 C2

🔗 Original article: https://redcanary.com/blog/threat-intelligence/dripdropper-linux-malware/

Actor exploits Apache ActiveMQ CVE‑2023‑46604 on cloud Linux, deploys Sliver/Cloudflare tunnels, drops a password‑protected PyInstaller ELF (DripDropper) that uses a hardcoded Dropbox bearer token, persists via cron by editing /etc/cron.*/0anacron, and tweaks SSH (root login, games→/bin/sh). They then self‑patch ActiveMQ by replacing vulnerable JARs from repo1.maven.org to hide entry while keeping access.

#

🌐 Web | 💣 RCE | 🛠️ Tool | 🎁 PoC

🔗 Original article: https://research.kudelskisecurity.com/2025/08/19/how-we-exploited-coderabbit-from-a-simple-pr-to-rce-and-write-access-on-1m-repositories/

A malicious PR abused Rubocop’s repo-controlled config to load an attacker extension and achieve RCE on CodeRabbit’s production runner. The payload exfiltrated env vars including the GitHub App private key. With that key, the researchers minted installation tokens and listed/cloned or wrote to repositories (~1M in review). PoCs show JWT creation, token minting, and x-access-token cloning. CodeRabbit fixed it in January 2025 by isolating tools and rotating secrets.

#

🌐 Web | 🔐 Auth | 🛠️ Tool | 🎁 PoC

🔗 Original article: https://blog.doyensec.com/2025/08/19/trivial-exploit-on-C-random.html

A password-reset flow used C#’s time-seeded Random().Next(...) to make tokens. By sending two HTTP/2 reset requests in a single-packet Burp race, the author hit the same 1 ms seed window and received identical tokens (victim + attacker), achieving account takeover. A Python library models/inverts C# Random as modular equations and reveals underflow-based collisions. Fix by using System.Security.Cryptography.RandomNumberGenerator.

#

🌐 Web | 🛠️ Tool | 🔀 Request Smuggling

🔗 Original article: https://portswigger.net/research/how-to-distinguish-http-pipelining-from-request-smuggling

How to tell HTTP/1.1 pipelining artifacts from real request smuggling. Shows a CL.0 false positive, provides litmus tests (disable reuse, HTTP/2 nested-response, partial requests, state probes), and outlines exploitation for connection‑locked/state/client‑side desync via cache poisoning, internal header leaks, FE control bypass, and host‑header abuse. Tools: HTTP Hacker, Turbo Intruder, HTTP Request Smuggler, and a “Smuggling or pipelining?” custom action.

deep valeBOT
#

🌐 Web | 💣 RCE | 🛡️ CVE | 🎁 PoC

🔗 Original article: https://blog.trailofbits.com/2025/08/20/marshal-madness-a-brief-history-of-ruby-deserialization-exploits/

Trail of Bits chronicles a decade of Ruby Marshal deserialization leading to RCE via gadget chains. It shows a vulnerable Rails path, a RubyGems‑based payload with $(id>/tmp/marshal-poc), and a timeline (incl. CVE‑2019‑5420 and Ruby 3.1–3.4 era patches). Modern discovery uses Semgrep and CodeQL with public PoCs. Audit all Marshal usage, switch to safer serializers, and push for a safe_load/unsafe_load split.

deep valeBOT
#

📡 IoT | 💣 RCE | 🎁 PoC

🔗 Original article: https://r0ny.net/FiberGateway-GR241AG-Full-Exploit-Chain/

Full exploit chain on MEO’s FiberGateway GR241AG: recover the admin password from firmware, log into the IPv6‑reachable restricted shell over the public “MEO WiFi” SSID, then exploit a tcpdump wrapper argument injection to run a post‑rotate payload (−G/−z) and gain root. The router’s changing IPv6 is revealed via NDP (ff02::2). Impact: critical pre‑auth RCE within Wi‑Fi range; DNS hijack, key exfil, LAN access. Bonus: nslookup arbitrary write, wget overflow.

#

🛡️ CVE | 💣 RCE | 🎁 PoC | 💰 Bug Bounty

🔗 Original article: https://blog.huntr.com/hunting-vulnerabilities-in-keras-model-deserialization

Explains Keras .keras internals and deserialization flow, shows Lambda-layer RCE via base64+marshal (CVE-2024-3660), and arbitrary module import in Keras ≤3.8 (CVE-2025-1550). Details new defenses (allowlist, safe_mode, type checks) and a PoC using keras.utils.get_file as a gadget despite safe mode. Provides practical steps to discover/test gadgets across Keras variants and formats.

#

Android | Malware | Banking | Phishing

🔗 Original article: https://www.cyfirma.com/research/lazarus-stealer-android-malware-for-russian-bank-credential-theft-through-overlay-and-sms-manipulation/

Analysis of an Android stealer that impersonates a utility app, abuses powerful roles and permissions, overlays fake banking screens to harvest credentials, intercepts SMS including OTPs, and communicates with hard coded C2 over plaintext HTTP. Includes high level behaviors and key indicators to aid detection, with implementation specifics removed for safety.

#

📱 Android | 🎣 Phishing | 🐛 Malware | 📡 C2

🔗 Original article: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/android-malware-promises-energy-subsidy-to-steal-financial-data/

Android campaign targets Indian users with a fake energy subsidy. A GitHub-hosted dropper (PMBY) installs an embedded payload (PMMBY) after telling users to disable network. PMMBY requests SMS/contacts/call/notification access, loads a fake UPI PIN page from Replit, and POSTs phone/bank/UPI PIN to addup.php. It mass-sends smishing SMS, uploads incoming SMS/OTP to addsm.php, and takes Firebase commands via a _type field. Google blocked the FCM account; GitHub removed the repo.

#

📱 iOS | 🛠️ Tool | 🔓 Jailbreak | 🧪 Pentest

🔗 Original article: https://infosecwriteups.com/step-by-step-complete-beginners-guide-of-ios-penetration-testing-17092c0e0dc7

Beginner iOS pentest guide: explains jailbreak types and risks, shows workflows (Checkra1n; semi‑untethered with AltStore) and a Windows demo using 3uTools + Dopamine. Covers post‑jailbreak package managers/repos, then a static analysis pipeline for Diva.ipa with MobSF, Class‑Dump, Hopper/Ghidra, strings, and otool, plus Burp CA/proxy setup to intercept HTTPS for dynamic testing.

deep valeBOT
#

🌐 Web | 💣 RCE | 🛡️ CVE | 🎁 PoC

🔗 Original article: https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/

Two pre-auth RCE chains in Commvault 11.38.20. Chain 1: argument injection in /Login forges a SYSTEM-backed localadmin token via qlogin “-localadmin”, then writes a JSP webshell using QCommand’s -file path traversal. Chain 2: pre-auth GUID leak logs in as _+PublicSharingUser, decrypts an unchanged built-in admin password via a hard-coded key, then reuses the same webroot write for RCE. Includes concrete PoCs.

deep valeBOT
#

🛠️ Tool | 🎁 PoC | 🌐 Web

🔗 Original article: https://blog.trailofbits.com/2025/08/21/weaponizing-image-scaling-against-production-ai-systems/

Trail of Bits shows that image downscaling can reveal hidden instructions only the model sees, enabling prompt-injection exfiltration on Gemini CLI and other production surfaces. They fingerprint resamplers, then use Anamorpher to inverse-design bicubic/bilinear payloads. Unsafe defaults (e.g., MCP trust:true) let tools run without confirmation. Mitigate by avoiding silent resizing, previewing transformed inputs, and gating tool actions.

#

🛡️ CVE | 💉 XSS | 💣 RCE | 🎁 PoC

🔗 Original article: https://medium.com/@happyjester80/xiaomi-13-pro-code-execution-via-getapps-dom-cross-site-scripting-xss-6590cf35fb27

CVE-2024-4406 in Xiaomi GetApps lets an attacker abuse an exported deep link to load local HTML (file://web-res-xxxx) into a privileged WebView, then exploit a DOM XSS in integral-dialog-page.html via the integralinfo JSON parameter. Researchers used this XSS to achieve code execution on Xiaomi 13 Pro. Includes a working intent:// PoC and debugging via chrome://inspect.

#

🌐 Web | 🧪 Clickjacking | 🛡️ CVE | 🎁 PoC

🔗 Original article: https://socket.dev/blog/password-manager-clickjacking

Socket recaps DEF CON research showing DOM-based clickjacking in major password managers. By hiding the extension’s autofill UI and luring a click, attackers exfiltrate credit cards, PII, logins, TOTP, and sometimes passkeys. Demos prove one‑click theft. Socket lists affected versions (as of Aug 19, 2025) and Bitwarden’s Aug 20 fix. Mitigations: style‑tamper detection, top‑layer checks, closed shadow roots, or user confirmation dialogs; users can disable manual autofill or set site access to “On click.”

#

🌐 Web | 🛡️ CVE | 💉 SQLi

🔗 Original article: https://patchstack.com/articles/sql-injection-vulnerability-found-in-lifterlms-plugin-affecting-10k-sites/

Unauthenticated SQLi in LifterLMS (≤8.0.6) via the voucher code during registration. Untrusted $code is concatenated in get_voucher_by_code(), and sanitize_text_field() is insufficient. Fixed in 8.0.7 by switching to $wpdb->prepare() and proper typing. Impact: high (CVSS 9.3). Update immediately and review logs for suspicious voucher inputs.

#

📡 IoT | 🛠️ Tool

🔗 Original article: https://www.pentestpartners.com/security-blog/start-hacking-bluetooth-low-energy-today-part-1/

Capture Android↔BLE traffic via BTsnoop/Wireshark, filter GATT writes to find the command toggling a key-finder’s beeper. Confirm the target in jadx (Alert Level 0x2a06 under Immediate Alert 0x1802). Reproduce from Linux with gatttool/bluetoothctl (handle ≈0x0a/0x0b) or from Android with LightBlue/nRF Connect by writing 0x01/0x00.

#

🌐 Web | 🛡️ CVE | 💣 RCE

🔗 Original article: https://unit42.paloaltonetworks.com/attackers-sell-your-bandwidth-using-sdks/

Unit 42 observed attackers exploiting CVE‑2024‑36401 (GeoServer, CVSS 9.8) to obtain RCE, then deploy a legit SDK and a Dart‑based app that quietly sells victims’ bandwidth. Exploits traverse GeoTools→JXPath (extension functions) to a Runtime.exec sink. Two stages: download z593 from self‑hosted Transfer.sh (37.187.74[.]75, 64.226.112[.]52) and execute it, which fetches z401/z402 for stealth and launch. Campaign active since March 2025.

deep valeBOT
#

🛡️ CVE | 💣 RCE | 🎁 PoC | 🐳 Docker

🔗 Original article: https://blog.qwertysecurity.com/Articles/blog3.html

CVE-2025-9074: Docker Desktop for Windows exposed the Docker Engine API at http://192.168.65.7:2375 to containers without auth. With two POSTs (/containers/create then /containers/{id}/start), attackers bind-mounted C: and achieved full host compromise—even via SSRF. Fixed per blog in 4.44.x. PoC provided.

#

🌐 Web | 🛡️ CVE | 🎁 PoC | 🧱 WAF

🔗 Original article: https://patchstack.com/articles/hosting-security-tested-87-percent-of-vulnerability-exploits-bypassed-hosting-defenses/

Patchstack ran 11 real WordPress/plugin exploits against five identically built sites across five hosts. Despite Cloudflare, ModSecurity, ConfigServer, Monarx, and Imunify360, 87.8% of attacks bypassed hosting defenses and were only stopped by Patchstack. A simple WooCommerce Payments REST PoC using X‑Wcpay header spoofing created an admin. Results show generic WAFs miss WordPress‑specific logic/auth flaws; plugin‑aware, vulnerability‑specific virtual patches are required.

#

🌐 Web | 🎁 PoC | 💰 Bug Bounty | ☁️ Azure

🔗 Original article: https://binarysecurity.no/posts/2025/08/azures-weakest-link-part2

Undocumented ARM DynamicInvoke lets Contributors craft APIM requests using a connection’s metadata. By building a Custom Connector with a string path parameter and injecting ../../.., ARM’s internal APIM call normalizes to another tenant’s connection path, executing actions as that victim. This enables global cross-tenant data access (e.g., Key Vault) and RBAC bypass. Microsoft blacklisted ../ in April 2025.

deep valeBOT
#

⛓️ Web3 | 🌐 Web | 🔁 AMM | 📈 Price Manipulation

🔗 Original article: https://www.quillaudits.com/blog/hack-analysis/how-odinfun-lost-58-3BTC-to-worthless-liquidity

On Aug 12, 2025, Odin.fun lost 58.2 BTC after an attacker added liquidity with worthless tokens, self-traded to inflate in-pool prices, then withdrew liquidity to redeem disproportionate BTC across SATOSHI/BTC and ODINPEPE/BTC pools. Root cause: AMM trusted internal reserve ratios without external price checks or value parity enforcement. Mitigations: oracles, parity checks, slippage limits, minimum liquidity thresholds, monitoring, and audits.

#

🌐 Web | 🎁 PoC | 💰 Bug Bounty | 🔗 Supply Chain

🔗 Original article: https://medium.com/@justas_b1/a-simple-supply-chain-bug-worth-11-850-how-gitlab-reinforces-trust-in-open-source-424585c79074

GitLab fixed a supply-chain gap where the main app didn’t verify Runner binary integrity before sending CI/CD secrets. The PoC adds a Go function to Docker executor (docker.go) to POST all variables from e.Build.GetAllVariables() to an attacker, then packages it as a Docker image and registers it. Any executor could be tampered. Impact: exfiltration of cloud creds, tokens, and full supply-chain compromise. Fix: backend whitelists official Runner SHAs pre-dispatch.

deep valeBOT
#

💣 RCE | 🧠 Technique | 🧷 DLL Sideloading | 🎁 PoC

🔗 Original article: https://www.hexacorn.com/blog/2025/08/19/dll-forwardsideloading/

Technique: abuse forwarded exports to force the loader to pull a non‑KnownDLL by name from the attacker’s directory. PoC: copy keyiso.dll to C:\test, add malicious NCRYPTPROV.dll, then run rundll32.exe C:\test\keyiso.dll, KeyIsoSetAuditingInterface. Loader resolves the forward and executes the attacker DLL’s DllMain before any missing‑export error.

deep valeBOT
#

🪟 Windows | 🛠️ Tool | 🛡️ EDR Evasion

🔗 Original article: https://www.zerosalarium.com/2025/08/countering-edrs-with-backing-of-ppl-protection.html

The post explains how to abuse Windows PPL by launching a signed system binary (ClipUp.exe) as a protected process and using its logging parameter to write into Defender’s protected directory during boot, corrupting MsMpEng.exe so Defender cannot start. It details PPL requirements (EKU, CreateProcess flags), introduces the CreateProcessAsPPL tool, and discusses constraints, impact, detection, and mitigations.

#

🛠️ Tool | 🖥️ Windows | 🔒 PPL

🔗 Original article: https://github.com/2x7EQ13/CreateProcessAsPPL

C++ tool that spawns a target as a Windows PPL. CLI maps modes 0–4 to PROTECTION_LEVEL_* and sets PROC_THREAD_ATTRIBUTE_PROTECTION_LEVEL via STARTUPINFOEX before CreateProcess. Works only with appropriately signed PPL‑eligible images; otherwise returns INVALID_IMAGE_HASH. Useful for testing PPL hardening or research with signed binaries.

#

🛠️ Tool | 🛡️ CVE | 💣 RCE

🔗 Original article: https://www.msuiche.com/posts/elegantbouncer-when-you-cant-get-the-samples-but-still-need-to-catch-the-threat/

ELEGANTBOUNCER is a Rust tool that detects 0‑click iOS exploit files via structural analysis, not signatures. It scans PDF/JBIG2 (CVE‑2021‑30860), WebP/VP8L (CVE‑2023‑4863), TrueType (CVE‑2023‑41990), and DNG/TIFF (CVE‑2025‑43300), integrates iOS backup reconstruction, and batch‑scans messaging attachments with fast, parallel TUI/CLI.

deep valeBOT
#

🛠️ Tool

🔗 Original article: https://github.com/sikumy/spearspray

SpearSpray is an AD-focused, policy-aware Kerberos spraying framework that fuses LDAP user intel, a template-driven password generator, throttled validation, and Neo4j/BloodHound enrichment. It emphasizes low-noise operation, lockout avoidance, and structured results. This summary highlights architecture, defensive signals, and hardening guidance without step‑by‑step misuse instructions.

deep valeBOT
#

📱 Android | 🦠 Malware | 🌐 Web | 🔬 Reverse Eng

🔗 Original article: https://dti.domaintools.com/spynote-malware-part-2/

SpyNote RAT is delivered via cloned Play Store pages whose Install button forces an APK download using a hidden iframe + javascript: URI. The dropper concatenates assets/base/000+001, derives a 16‑byte AES key from the package name, AES‑decrypts, GZIP‑inflates, then DEX‑injects SpyNote. SpyNote loads a second DEX with obfuscated WebSocket C2 and rotating domains. The post includes hashes, full IOCs, Shodan queries, and MITRE mapping.

deep valeBOT
#

🌐 Web | 💰 Bug Bounty | 🎁 PoC | 💣 RCE

🔗 Original article: https://shubhamchaskar.com/defcon-bbv-ctf/

Realistic bug-bounty CTF write-up with 14 web vulns: dir brute-force to internal config, cookie-based debug leak, timing user enum, live legacy API, localhost bypass via X-Forwarded-For, admin 403 bypass, Host-header reset poisoning → ATO, hidden signup, mass assignment (balance), blind XSS via PATCH → JWT theft, broken authz on admin API, and JSON cmd RCE in a debug endpoint.

#

🌐 Web | 💉 XSS | 💣 RCE | 🎁 PoC

🔗 Original article: https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/

Research on VTENEXT 25.02 found three auth-bypass paths to account takeover and post‑auth RCE. Chains exploit a reflected JSON→HTML XSS, CSRF bypass via method tampering, Touch module session leakage, SQLi in Fax/EditView, and a pre‑auth arbitrary password reset in rpwd.php (patched in 25.02.1). Authenticated RCE is reached via multiple LFIs (optionally leveraging pearcmd.php) or by importing a custom module with a web shell. PoCs, code paths, and exact requests are provided.

deep valeBOT
#

🌐 Web | 💉 XSS | 🛠️ Tool | 🎁 PoC

🔗 Original article: https://portswigger.net/research/inline-style-exfiltration

Inline CSS-only exfiltration: use attr() to read an attribute into a CSS variable, compare with if(style(--val:"...")) using double quotes, and trigger image-set(url()) to leak which candidate matched. Chain nested if() to enumerate values. Works on Chromium; Burp action automates payload generation.

#

🎯 Phishing | 🌐 Web | 💣 RCE | 🧭 TTPs

🔗 Original article: https://research.checkpoint.com/2025/zipline-phishing-campaign/

ZipLine flips phishing flow: contact-form bait → weeks-long legit emails → Heroku-hosted ZIP with LNK that extracts a hidden PowerShell via marker xFIQCV, bypasses AMSI, persists via COM TypeLib hijack, and runs MixShell in memory. C2 uses DNS TXT (HTTP fallback), supports pipes, file ops, and a reverse proxy. A PS variant adds heavy sandbox checks and scheduled-task persistence.

deep valeBOT
#

🛠️ Tool | 🔐 AD CS | ⬆️ Privilege Escalation | 🎁 PoC

🔗 Original article: https://github.com/GhostPack/Certificates

Certify is a GhostPack tool to find and exploit AD CS misconfigurations (ESC1/ESC4/ESC7). It enumerates CAs/templates, requests malicious SAN/SID certs, supports on‑behalf‑of issuance, and exports JSON. Issued certs are converted to PFX and used with Rubeus for PKINIT (TGT). Includes build steps, in‑memory execution, and YARA/IOC details.

deep valeBOT
#

🌐 Web | 💉 XSS | 💰 Bug Bounty | 🎁 PoC

🔗 Original article: https://r3verii.github.io/bugbounty/2025/08/25/rxss-credential-stealer.html

Reflected XSS in a JS-in-JS sink on a login page is escalated to credential theft by breaking a JS string, bypassing filters with Unicode escapes, and injecting a script that defines const DoLogin to exfiltrate creds. Payload delivery uses Unicode-escaped eval(atob(base64)) and relies on execution order to preempt the legitimate handler.

deep valeBOT
#

🛡️ CVE | 💣 RCE | 🌐 Web | 🎁 PoC

🔗 Original article: https://0xdf.gitlab.io/2025/08/23/htb-thefrizz.html

Exploit Gibbon LMS (CVE-2023-45878) on a Windows DC for unauthenticated arbitrary file write and pre-auth RCE. Drop a PHP webshell, pivot to a PowerShell reverse shell, harvest DB creds from config.php, extract salted SHA-256 user hash, and crack it (Hashcat -m 1420) to get f.frizzle. In a Kerberos-only AD, fix clock skew, use Kerberos for SMB and SSH (GSSAPI), and ensure hosts order is correct. Tools: nmap, feroxbuster, curl, netexec, hashcat, revshells.com.

#

🌐 Web | 💣 RCE | ⬆️ PrivEsc | 🎁 PoC

🔗 Original article: https://0xdf.gitlab.io/2025/08/07/htb-rainbow.html

Custom Windows webserver (Rainbow 0.1) is vulnerable to a POST-body SEH overflow, enabling unauthenticated RCE. Using x32dbg + ERC, the author finds nSEH/SEH offsets (660/664), a POP-POP-RET at 0x4094d8, and chains a short and near jmp to a NOP sled + msfvenom x86 shellcode. A Python/pwntools HTTP POST delivers the payload. Initial shell is admin-group but medium integrity; bypass UAC via fodhelper registry hijack to get High Integrity and read root.

#

🌐 Web | 🎁 PoC | 💣 RCE | 🛠️ Tool

🔗 Original article: https://0xdf.gitlab.io/2025/08/12/htb-zero.html

Tenant .htaccess control enabled an ErrorDocument 404 %{file:/path} LFI to read web sources and leak DB creds. Those creds worked for SSH (user zroadmin). pspy revealed a root cron that turns apache2 process command lines into root-executed apache2ctl -t. By forging a matching argv and overloading -f/-d, Apache tested attacker-controlled config, enabling root code execution. Python+Paramiko PoC automates the LFI.

#

🌐 Web | 💣 RCE | 🛠️ Tool

🔗 Original article: https://0xdf.gitlab.io/2025/08/21/htb-lock.html

HTB “Lock”: A leaked Gitea PAT in commit history grants write access to a CI/CD-backed website repo. Pushing an ASPX webshell to IIS yields RCE as lock\ellen.freeman. An mRemoteNG config leaks Gale’s RDP creds, enabling desktop access. Finally, abusing PDF24’s elevated repair (by locking its log file) produces a hung elevated cmd that’s leveraged to spawn a SYSTEM shell.

#

💣 RCE | 🎁 PoC | 🛠️ Tool

🔗 Original article: https://0xdf.gitlab.io/2025/08/26/htb-reaper.html

Custom Windows service on TCP/4141 has a format‑string in _snprintf and a stack buffer overflow. Leak a code pointer with “%p” to defeat ASLR, then ROP into VirtualAlloc to mark stack RWX and pivot to shellcode for unauthenticated RCE. Privilege escalate by abusing a kernel driver with arbitrary read/write to steal a SYSTEM token.

#

🌐 Web | 💣 RCE | 🛠️ Tool | 🎁 PoC

🔗 Original article: https://0xdf.gitlab.io/2025/08/14/htb-sweep.html

Windows DC with Lansweeper. Null/guest SMB + RID cycling gives users. A weak Kerberos spray yields a login. Inside Lansweeper, map scanning creds to an attacker IP and capture the Linux scanner password with an SSH honeypot. Use AD ACLs (GenericAll over Lansweeper Admins) to add the account, then WinRM in. Priv-esc via: (1) decrypt Lansweeper DB secrets using Encryption.txt and SharpLansweeperDecrypt to obtain an admin service account, or (2) run a Deployment package to execute as SYSTEM.

deep valeBOT
#

📡 IoT | 🛠️ Tool | 🎁 PoC

🔗 Original article: https://www.pentestpartners.com/security-blog/start-hacking-bluetooth-low-energy-today-part-2/

Use a £20 Sonoff (CC26x2) with Sniffle to sniff unencrypted BLE from devices without pairing/bonding, find GATT Write Commands (e.g., 0x01/0x00 to handle 0x0b), then use a £10 Nordic nRF52 with nRF Connect or Python (blatann) to send the same writes. Includes exact install/flash commands, Wireshark filters, CLI helpers, and a PoC script.

deep valeBOT
#

🌐 Web | 🛡️ CVE | 💣 RCE | 🎁 PoC

🔗 Original article: https://0xdf.gitlab.io/2025/08/16/htb-nocturnal.html

Chain: IDOR in /view.php enumerates users/files, leaking Amanda’s password. In admin backup, newline/tab bypass in cleanEntry leads to command injection via proc_open, giving www-data shell. SQLite users table stores unsalted MD5; crack tobias → SSH. ISPConfig 3.2 on 127.0.0.1:8080 vulnerable to CVE‑2023‑46818; language editor lets admin write a PHP webshell and execute as root. Public PoC available.

#

🌐 Web | 🛡️ CVE | 💣 RCE | 🎁 PoC

🔗 Original article: https://0xdf.gitlab.io/2025/08/09/htb-university.html

Exploit CVE-2023-33733 in ReportLab/xhtml2pdf via a crafted Bio payload in the profile PDF export to get RCE, validate with ICMP, then stage a PowerShell reverse shell as university\wao on the DC. Loot Django config, CA private key, and db.sqlite3; analyze backups and sessions; enumerate users, dual-homed networking, and AD hosts (WS-3, LAB-2). The post later chains cert abuse, WPAD/NTLM relay, RBCD, unconstrained delegation, and gMSA to DA.

#

🌐 Web | 💣 RCE | 🛠️ Tool

🔗 Original article: https://0xdf.gitlab.io/2025/08/02/htb-code.html

HTB Code: A Flask-based Python editor uses a naive substring blacklist. Bypass with globals()+getattr()+string concat to call os.popen().read(), get a reverse shell, and persist. Dump SQLite unsalted MD5 hashes, crack, and pivot to martin. Priv-esc to root via sudo NOPASSWD backy.sh by using /var/....//root traversal or, in /dev/shm, rely on fs.protected_regular to skip sanitization entirely, then archive/exfiltrate /root (SSH key/flag).

deep valeBOT
#

🌐 Web | 💣 RCE | 🛠️ Tool

🔗 Original article: https://0xdf.gitlab.io/2025/08/07/htb-rainbow.html

HTB Rainbow exposes a custom HTTP server on 8080 (“Rainbow 0.1”). Manual URI-length fuzzing crashes it. Pulling rainbow.exe from anonymous FTP enables x32dbg analysis to prove EIP control and build a single-request RCE for a reverse shell. The shell is admin but medium integrity; a fodhelper UAC bypass via HKCU ms-settings hijack yields high integrity to complete compromise.

#

🌐 Web | 💣 RCE | 🛠️ Tool

🔗 Original article: https://0xdf.gitlab.io/2025/08/14/htb-sweep.html

Windows DC running Lansweeper. Enumerate users via SMB RID cycling, then Kerberos username=password spray to get intern. Abuse Lansweeper: map Linux creds to your IP, run sshesame on port 2022, click Scan to capture svc_inventory_lnx. BloodHound shows GenericAll → add self to “Lansweeper Admins” and get WinRM. PrivEsc 1: decrypt web.config with Key/Encryption.txt via SharpLansweeperDecrypt to recover svc_inventory_win (admin). PrivEsc 2: use Lansweeper Deployment to execute as SYSTEM.

#

🌐 Web | 💣 RCE | 🛠️ Tool | 🎁 PoC

🔗 Original article: https://0xdf.gitlab.io/2025/08/21/htb-lock.html

Leaked Gitea PAT in a prior commit enabled API access to a private website repo. Because CI/CD auto-deployed on push, an ASPX webshell was published, giving RCE. An mRemoteNG config leaked RDP creds for gale.dekarios, allowing RDP access. Finally, abusing PDF24’s installer repair by locking its log file yielded a hung elevated cmd, leveraged to get SYSTEM.

#

🌐 Web | 📄 LFI | 🛠️ Tool | 🎁 PoC

🔗 Original article: https://0xdf.gitlab.io/2025/08/12/htb-zero.html

Abuse Apache twice: 1) Replace a root-owned but renamable .htaccess to set ErrorDocument 404 %{file:/path}, turning 404s into arbitrary file reads and leaking DB creds from stats.php. 2) Use pspy to find a root cron that transforms and executes matching apache2 processes as apache2ctl -t. Forge a process argv to inject flags (e.g., -f /tmp/evil.conf), coercing root to parse attacker-controlled config and gain root.

#

💣 RCE | 🎁 PoC | 🛠️ Tool

🔗 Original article: https://0xdf.gitlab.io/2025/08/26/htb-reaper.html

Custom Windows key service (TCP 4141) has a format-string bug in log_key and a stack buffer overflow when decoding long Base64 comments. Use “%p” in a valid key to leak a module pointer and compute the base, then exploit an 88-byte RIP overwrite with a ROP chain that calls VirtualAlloc to mark stack RWX and jump to shellcode for RCE. Kernel privesc steals a SYSTEM token via an arbitrary R/W driver.

#

🌐 Web | 🛡️ CVE | 💣 RCE | 🎁 PoC

🔗 Original article: https://0xdf.gitlab.io/2025/08/09/htb-university.html

Compromise a Django site by abusing ReportLab/xhtml2pdf (CVE‑2023‑33733) in the Profile PDF export to run OS commands via a crafted color attribute. Land a shell as university\wao, loot the app (DB, CA keys), and enumerate the internal AD network. Forge a client cert for Professor access, weaponize a .url in lecture bundles, coerce WPAD and relay NTLM to LDAP to set RBCD, abuse unconstrained delegation to steal tickets, and read a gMSA secret to escalate to Domain Admin.

#

🛡️ CVE | 💣 RCE | 🌐 Web | 🎁 PoC

🔗 Original article: https://0xdf.gitlab.io/2025/08/23/htb-thefrizz.html

Exploit Gibbon LMS (v25.0.00) CVE‑2023‑45878 to write a PHP webshell and gain RCE. Dump DB creds from config.php, extract a salted SHA‑256 hash and crack it (hashcat -m 1420) to get AD user creds. In a Kerberos‑only domain, fix time skew, kinit, and SSH with GSSAPI. Recover a deleted WAPT backup from Recycle Bin, decode wapt_password to pivot to m.schoolbus. Abuse Group Policy Creator Owners via SharpGPOAbuse to push an immediate Scheduled Task and get SYSTEM.

#

🏰 Active Directory | 🔐 Kerberos | ⬆️ PrivEsc | 🛠️ Tool

🔗 Original article: https://0xdf.gitlab.io/2025/08/19/htb-phantom.html

Guest SMB access exposed a PDF with the default password. RID cycling built a user list; Kerberos spray hit ibryant. A VeraCrypt backup on an SMB share was cracked with a tiny wordlist and rules, revealing a VyOS config with a plaintext password reused by svc_sspr. With WinRM shell, a BloodHound-identified path enabled RBCD by creating a machine account, setting AllowedToAct, forging S4U tickets, and executing as DA on the DC.

#

🌐 Web | 💣 RCE | 🛡️ CVE | 🎁 PoC

🔗 Original article: https://0xdf.gitlab.io/2025/08/16/htb-nocturnal.html

HTB Nocturnal chain: abuse an IDOR in view.php to enumerate users and read files, stealing Amanda’s password. Use a newline/tab command injection in the backup utility (proc_open) to gain RCE as www-data, then crack unsalted MD5s in SQLite to become tobias. Discover a root-run ISPConfig on 127.0.0.1:8080 and exploit CVE-2023-46818 (language editor PHP injection) to write a webshell and get root.

#

📱 Android | 💳 Banking Trojan | 🕵️ Spyware | 🧩 Overlay

🔗 Original article: https://zimperium.com/blog/hook-version-3-the-banking-trojan-with-the-most-advanced-capabilities

Hook v3 is an Android banking trojan abusing Accessibility to automate UI, steal credentials/MFA, and control devices via VNC/HVNC. It adds ransomware and NFC overlays, PIN/pattern theft plus programmatic unlock, transparent gesture capture, and dynamic phishing injections. WebSocket C2 is active; RabbitMQ/Telegram are hinted but not enabled. Distributed via phishing and GitHub. High impact: ATO, crypto theft, call/SMS control.

#

🌐 Web | 💣 RCE | 🛠️ Tool | 🎁 PoC

🔗 Original article: https://0xdf.gitlab.io/2025/08/05/htb-build.html

Public rsync leaked a full Jenkins backup including master keys. Decrypting a stored credential yielded Gitea login (buildadm/Git1234!). Editing the Jenkinsfile triggered a multibranch build and a root shell in the Jenkins container. Pivoting with chisel exposed PowerDNS‑Admin and MariaDB (root/no password), enabling DNS tampering. By creating A/PTR so our IP = admin.build.vl, we abused root’s .rhosts + exposed r-commands to rlogin as root on the host—full compromise.

deep valeBOT
#

🌐 Web | 💣 RCE | 🛠️ Tool | 🎁 PoC

🔗 Original article: https://0xdf.gitlab.io/2025/08/21/htb-lock.html

Leaked Gitea token grants access to a private website repo with CI/CD. Pushing an ASPX webshell yields IIS RCE as ellen.freeman. An mRemoteNG config.xml is decrypted to recover Gale.Dekarios’ RDP password, enabling RDP. Finally, abusing PDF24’s installer repair by locking its log file leads to an elevated hung cmd.exe and SYSTEM.

#

🌐 Web | 💣 RCE | 🛠️ Tool

🔗 Original article: https://0xdf.gitlab.io/2025/08/14/htb-sweep.html

Enumerate a DC running Lansweeper, RID-cycle users, and Kerberos-spray to get intern. Use Lansweeper to scan an attacker SSH honeypot and capture svc_inventory_lnx. Abuse BloodHound-identified ACL (GenericAll → Lansweeper Admins) to enable WinRM. Path 1: decrypt Lansweeper secrets (web.config + Key/Encryption.txt) with SharpLansweeperDecrypt to recover svc_inventory_win and pwn DC. Path 2: use Deployment packages for SYSTEM RCE.

#

🌐 Web | 💣 RCE | 🛠️ Tool | 🎁 PoC

🔗 Original article: https://0xdf.gitlab.io/2025/08/07/htb-rainbow.html

Custom Windows “Rainbow 0.1” webserver has an SEH-based buffer overflow when parsing POST bodies. Using x32dbg + ERC, the offset (660) and a POP‑POP‑RET in rainbow.exe enable a short‑then‑long jmp trampoline back to msfvenom x86 shellcode delivered via raw HTTP, yielding an unauthenticated reverse shell. A watchdog script auto‑restarts the service after crashes. Privilege is escalated by hijacking HKCU ms‑settings and launching fodhelper.exe for a high‑integrity shell.

#

🌐 Web | 💣 RCE | 🛠️ Tool | 🎁 PoC

🔗 Original article: https://0xdf.gitlab.io/2025/08/12/htb-zero.html

HTB Zero: Abuse Apache twice. 1) Gain arbitrary file read via .htaccess ErrorDocument %{file:/path}, automated with a Paramiko+Requests script, to steal DB creds from stats.php and SSH as zroadmin. 2) Privesc: spoof a process argv so a root cron runs apache2ctl -t on attacker config, then use piped logs (ErrorLog/CustomLog) for reliable root RCE.

#

🌐 Web | 🛡️ CVE | 💣 RCE | 🎁 PoC

🔗 Original article: https://0xdf.gitlab.io/2025/08/09/htb-university.html

Student account triggers ReportLab/xhtml2pdf RCE (CVE‑2023‑33733) by injecting a [[[...]]] payload into Profile→Bio, then exporting to PDF. ICMP confirms execution; a two‑stage PowerShell payload downloads and runs rev.ps1 for a reverse shell as WAO on the DC. Loot includes CA keys, sqlite DB, and a backup script leaking the 7‑Zip password. Internal/AD recon identifies WS‑3 and LAB‑2 for next steps.

#

🌐 Web | 💣 RCE | 🛡️ CVE | 🎁 PoC

🔗 Original article: https://0xdf.gitlab.io/2025/08/16/htb-nocturnal.html

HTB Nocturnal: Abuse an IDOR in /view.php to enumerate users and steal a password. Exploit a newline/tab bypass in the admin backup’s proc_open zip command to get www-data. Dump SQLite MD5 hashes, crack tobias, and SSH/su. Port-forward local ISPConfig (root-run PHP) and use CVE‑2023‑46818 (language editor PHP injection) to drop a webshell and get root.

deep valeBOT
#

💣 RCE | 🎁 PoC | 🎮 Game Security | 🧩 Lua

🔗 Original article: https://appsec.space/posts/aion-housing-exploit/

AION’s housing Lua sandbox (v3.0+) exposes dangerous globals, including the full io package. Using the Butler as stdout (H.PlaySound → H.Say), the author enumerates _G, finds io.popen(), and achieves client-side RCE (e.g., calc.exe). On private servers, scripts are auto-sent and OnInit() runs on entry, enabling zero‑click compromise. Retail still has housing but the simple payload reportedly doesn’t work; Classic lacks housing. Severity: critical.

#

🌐 Web | 🛡️ CVE | 🔓 Auth Bypass | 🎁 PoC

🔗 Original article: https://labs.watchtowr.com/the-one-where-we-just-steal-the-vulnerabilities-crushftp-cve-2025-54309/

CVE‑2025‑54309 is an auth bypass in CrushFTP: the AS2 path trusts AS2‑TO to set the session user. Firing two near‑simultaneous POSTs to /WebInterface/function/ with shared cookies—one with AS2‑TO:\crushadmin, one without—races the server so admin RPCs run as crushadmin. Most attempts 404; a win returns 200/OK and creates an admin user. Fixed in 10.8.5/11.3.4_23. PoC safely extracts the user list.

deep valeBOT
#

🏢 Active Directory | 🔐 Kerberos | 🛠️ Tool | 🧪 PrivEsc

🔗 Original article: https://0xdf.gitlab.io/2025/08/28/htb-sendai.html

HTB Sendai: Use guest/Null SMB to enumerate, RID-brute users, then spray empty passwords to find expired accounts. Change one via SAMR, harvest MSSQL creds from a share, and use BloodHound to map Support → AdmSvc (GenericAll) → MGTSVC$ (ReadGMSAPassword). Dump the gMSA NTLM and WinRM in as mgtsvc$. From there: either abuse AD CS ESC4 via service creds or tunnel to MSSQL, forge a Silver Ticket, and use SeImpersonate to reach SYSTEM.

#

🧩 BYOVD | 🪟 Windows | 🎁 PoC | 🕵️ APT

🔗 Original article: https://research.checkpoint.com/2025/silver-fox-apt-vulnerable-drivers/

Silver Fox APT abuses a Microsoft‑signed WatchDog driver (amsdk.sys v1.0.600) and legacy Zemana driver (ZAM.exe) to kill PP/PPL EDR/AV and deploy ValleyRAT. Root cause: missing FILE_DEVICE_SECURE_OPEN lets low‑priv users reach privileged IOCTLs (terminate/open process, raw disk R/W). Patch (wamsdk.sys v1.1.100) fixes LPE but not PP/PPL kills; attackers flip one byte in the RFC 3161 timestamp to evade hash blocklists. Includes PoC, IOCTLs, loader/persistence, XOR key, C2s, and YARA.

deep valeBOT
#

🌐 Web | 🔐 OAuth | 💰 Bug Bounty | ⚙️ Misconfiguration

🔗 Original article: https://medium.com/@KhaledAhmed107/how-i-found-5-oauth-misconfigurations-leading-to-pre-account-takeover-in-public-bug-bounty-programs-021d4c8c6954

Multiple bug bounty targets allowed pre‑account takeover by auto‑linking OAuth logins to unverified local accounts using only email matching. An attacker pre‑registers the victim’s email (no verification), then signs in with Google/Facebook for the same email, gaining control. Classified as Bugcrowd VRT P2. Mitigate by enforcing email verification and avoiding email‑only account linking.

#

🌐 Web | 🛡️ CVE | 🗄️ SQLi

🔗 Original article: https://patchstack.com/articles/sql-injection-vulnerability-patched-in-paid-membership-subscriptions-plugin/

Paid Membership Subscriptions ≤2.15.1 has an unauthenticated SQL injection (CVE-2025-49870, CVSS 7.5) in the PayPal IPN webhook. POST parameter custom is used as a payment ID and concatenated into a SELECT query in PMS_Payment::get_data(), enabling injection. Version 2.15.2 fixes this by casting IDs and using $wpdb->prepare(). Update now and monitor IPN traffic for suspicious custom values.

deep valeBOT
#

🛡️ CVE | 🔑 SSH | 🌐 Web | 🎁 PoC

🔗 Original article: https://blog.silentsignal.eu/2025/06/14/gitblit-cve-CVE-2024-28080/

CVE-2024-28080 is an SSH auth bypass in Gitblit (<1.10.0). Gitblit’s public-key authenticator binds a user to the session before signature verification; the password authenticator then trusts that state and accepts any password. With only a username and the victim’s public key, attackers can log in by triggering fallback to password and pressing Enter. Fixed in v1.10.0.

#

📱 Android | 🧪 Malware | 🧩 Obfuscation | 🔍 Reverse Engineering

🔗 Original article: https://shindan.io/blog/godfather-part-1-a-multistage-dropper

Part 1 dissects a GodFather dropper that sabotages APK parsing: it sets ZIP GPBF bit 0 (fake encryption), injects big Extra blocks (JADXBLOCK), and uses file/dir name collisions to hide core files. After normalizing flags, analysts can extract and review the manifest showing a custom Application, exported launcher, and permissions for session-based sideloading on Android 13+. Includes concrete headers, commands, and detection heuristics.

#

🌐 Web | 🛡️ CVE | 💣 RCE | 🎁 PoC

🔗 Original article: https://labs.watchtowr.com/cache-me-if-you-can-sitecore-experience-platform-cache-poisoning-to-rce/

Pre-auth cache poisoning in Sitecore XP (CVE-2025-53693) abuses XAML reflection to call WebControl.AddToCache and overwrite HTML cache entries. ItemService exposure (CVE-2025-53694) reveals or leaks cache-key components, enabling targeted poisoning. A post-auth sink (CVE-2025-53691) deserializes Base64 via BinaryFormatter in the convertToRuntimeHtml pipeline, triggerable by the FixHtml dialog. Chaining yields full server compromise.

deep valeBOT
#

🌐 Web | 💣 RCE | 🎁 PoC | 🛠️ Tool

🔗 Original article: https://blog.orange.tw/posts/2025-08-the-art-of-php-ch/

CTF-hardened PHP exploitation: format-string RCE via PHP Bug #71105 + arbitrary class instantiation, CSP bypass with max_input_vars warnings, WordPress serialize-then-replace and double-prepare→SQLi→OI chains, __wakeup bypasses, Windows path/ADS tricks, Defender side‑channel (AVOracle), and LFI→RCE via php://filter prefix injection. Includes PoCs and mitigations.

deep valeBOT
#

🌐 Web | 💣 RCE | 🛠️ Tool

🔗 Original article: https://0xdf.gitlab.io/2025/08/30/htb-eureka.html

Exposed Spring Boot Actuator (heapdump) leaked live secrets, including DB creds (oscar190/0sc@r190_S0l!dP@sswd) and Eureka Basic auth. Using these, SSH access as oscar190 was obtained. On-box, Spring Cloud Gateway and other services ran as www-data, with nginx proxying 8080. A login simulator generated traffic; gateway/logging was abused to capture miranda-wise’s creds. Finally, a root cron log analyzer with Bash arithmetic injection was exploited via crafted log lines to achieve root.

#

🛡️ CVE | ⬆️ LPE | 🛠️ Tool | 🎁 PoC

🔗 Original article: https://blog.amberwolf.com/blog/2025/august/advisory---netskope-client-for-windows---local-privilege-escalation-via-rogue-server/

CVE-2025-0309 in Netskope Windows Client (< R129) lets a local user force enrollment into a rogue server via IPC command 148 with a crafted JWT (alg=None, AddonUrl=attacker). The service installs an attacker CA and executes a malicious MSI as SYSTEM. Caller checks, IPC encryption, and Tamper Proof are bypassed. PoCs: NachoVPN plugin and UpSkope.

deep valeBOT
#

🛠️ Tool | 📱 Android | 🔐 SSL/TLS | 🔎 Static Analysis

🔗 Original article: https://petruknisme.medium.com/sslpindetect-advanced-ssl-pinning-detection-for-android-security-analysis-1390e9eca097

SSLPinDetect is a Python tool that decompiles Android APKs with apktool and scans Smali for SSL/TLS pinning patterns (OkHttp, custom X509TrustManager, Network Security Config, custom SSLContext). It uses multithreading, memory‑mapped I/O, and pre‑compiled regex, outputting file paths, line numbers, and snippets. Install via git/pip; run with -f and -a flags; -v enables verbose details. Patterns are extensible via JSON or the smali-sslpin-patterns repo.

#

📱 Android | 🦠 Malware | 🏦 Banking Fraud | 🕵️ Social Engineering

🔗 Original article: https://cyble.com/blog/sikkahbot-malware-defrauds-students-in-bangladesh/

SikkahBot is an Android banking-fraud malware (active since July 2024) targeting Bangladeshi students via fake Education Board scholarship apps. It steals PII and payment data, intercepts bank SMS, abuses Accessibility to auto-fill credentials in BKash/Nagad/DBBL, and automates USSD transactions via Firebase C2. The post lists smishing links, APK URLs, hashes, and Firebase endpoints; newer variants (Aug 2025) add full automation.

#

🛠️ Tool | 📱 Mobile | 🔍 Reverse Engineering | 🎁 PoC

🔗 Original article: https://github.com/aancw/SSLPinDetect

SSLPinDetect statically scans decompiled Smali to find SSL pinning and custom trust logic in Android apps. It decompiles with Apktool, uses multi-threaded, memory-mapped scanning with precompiled patterns (e.g., OkHttp CertificatePinner, X509TrustManager), and reports file, line, and code preview. Includes a PoC GIF and extensible patterns.

deep valeBOT
deep valeBOT
#

🌐 Web | 🛡️ CVE | 💣 RCE | 🎁 PoC

🔗 Original article: https://0xdf.gitlab.io/2025/09/02/htb-race.html

Walkthrough of HTB “Race”: leak a long password from phpSysInfo to log into Grav as backup, generate a backup to steal a live reset token and take over patrick. Get RCE via CVE-2024-28116 (Twig SSTI) or a proxyed malicious theme. Pivot to user max using credentials in a root-owned script, then exploit a cron TOCTOU with FIFOs to win root.

deep valeBOT
#

⛓️ Web3 | 🌐 Web | 💰 Bug Bounty

🔗 Original article: https://quillaudits.medium.com/bunni-v2-exploit-8-3m-drained-50acbdcd9e7b

Bunni V2 (a Uniswap v4 hook) was drained for ~$8.3M due to a rounding/precision bug in its Liquidity Distribution Function. The attacker used flash loans (3M USDT on Ethereum; 2000 WETH on UniChain) and carefully sized exact‑input swaps to accrue unearned credits, then withdrew inflated balances, bridged funds, and moved proceeds via Aave. Withdrawals were halted and a 10% bounty offered.

#

🌐 Web | 💉 XSS | 🎁 PoC | 🛠️ Tool

🔗 Original article: https://portswigger.net/research/cookie-chaos-how-to-bypass-host-and-secure-cookie-prefixes

Exploits show how Unicode whitespace smuggling and legacy $Version=1 parsing let attackers forge/overwrite __Host- and __Secure- cookies from subdomains. Backends (e.g., Django, ASP.NET, Tomcat/Jetty) normalize or legacy‑parse bytes the browser sent, so an attacker’s duplicate often wins, enabling XSS, CSRF bypass, or session fixation. A Burp Custom Action is provided for detection.

#

🧪 Fuzzing | 🛡️ CVE | 🛠️ Tool | 💣 RCE

🔗 Original article: https://blog.doyensec.com/2025/09/02/ksmbd-2.html

How Doyensec expanded ksmbd fuzzing: enable more SMB features, patch auth/credits, build a stateful harness, translate SMB2 specs into a grammar, bias mutations with FocusAreas, seed ANYBLOB corpora from pcaps, and use sanitizers beyond KASAN. Achieved ~60/70% coverage and reported 23 ksmbd CVEs, with CVE-2025-37947 exploitation coming next.

#

🌐 Web | 🛡️ CVE | 🔑 Auth Bypass | ⬆️ PrivEsc

🔗 Original article: https://patchstack.com/articles/unpatched-privilege-escalation-in-service-finder-bookings-plugin/

Critical unauthenticated privilege escalation (CVE-2025-23970) in Service Finder Bookings ≤6.1. A public init-hooked handler trusts a client cookie (original_user_id) in service_finder_switch_back() and calls wp_set_auth_cookie() without checks, letting anyone log in as any user, including admin. No patch as of 2025‑09‑03. Deactivate the plugin immediately.

#

💣 RCE | ☁️ Cloud | 🌐 Web | 🔗 Supply Chain

🔗 Original article: https://unit42.paloaltonetworks.com/model-namespace-reuse/

Unit 42 shows that deleted or transferred Hugging Face namespaces can be re-registered and abused to hijack model paths. Cloud catalogs and OSS that fetch models by name may deploy attacker models, enabling RCE on Vertex AI and Azure AI Foundry endpoints. Google added daily scans (Feb 2025 disclosure). Mitigate with commit pinning, internal mirroring, and scanning for reusable model references.

deep valeBOT
#

🛡️ CVE | 💣 RCE | 🛠️ Tool | 🎁 PoC

🔗 Original article: https://blog.trailofbits.com/2025/09/03/subverting-code-integrity-checks-to-locally-backdoor-signal-1password-slack-and-more/

CVE-2025-55305: Electron’s integrity fuses didn’t cover V8 heap snapshots. By replacing v8_context_snapshot.bin (using electron-mksnapshot), attackers clobber builtins (e.g., Array.isArray) to run code across main, preload, and renderer—backdooring Signal, 1Password, Slack, and even Chrome installs in user-writable paths. Post shows crash, main-process probe, and a Slack keylogger PoC, plus mitigations.

deep valeBOT
#

📶 5G | 🛠️ Tool | 🎁 PoC | 📡 IoT

🔗 Original article: https://bishopfox.com/blog/demystifying-5g-security-understanding-the-registration-protocol

The article breaks down 5G UE registration and shows how to test and exploit the unauthenticated NAS window before Security Mode Command. It demonstrates SUPI leaks (SUCI failures), downgrade to EEA0/EIA0 via capability tampering, and replay of Registration Requests using a 5GReplay rule. Tools: Open5GS, Wireshark, 5GReplay, Sni5Gect, and a “snoopy” sniffer. Mitigate by enforcing SUCI, rejecting null algorithms except for emergency, and monitoring for rogue RAN/core.

#

🌐 Web | 💣 RCE | 🛠️ Tool | 🎁 PoC

🔗 Original article: https://0xdf.gitlab.io/2025/09/04/htb-media.html

Chain on a Windows web app: upload a WMP .wax/.asx that references a UNC path to coerce Net‑NTLMv2, crack enox’s hash, SSH in, then swap the per‑upload md5 folder with an NTFS junction to C:\xampp\htdocs and re‑upload a PHP webshell for RCE. Restore SeImpersonate with FullPowers and escalate to SYSTEM using GodPotato.

deep valeBOT
deep valeBOT
#

💰 Bug Bounty | 🛠️ Tool | 📱 Mobile | 🎁 PoC

🔗 Original article: https://www.yeswehack.com/learn-bug-bounty/android-lab-mobile-hacking-tools

Hands‑on Android bug bounty lab: set up Genymotion/AVD or a Magisk‑rooted device, route traffic to Burp, then bypass SSL pinning, root checks, and emulator detection with Frida/Medusa. Includes exact CLI/GUI steps, snapshot persistence, Magisk/Zygisk modules, and copy‑paste Frida hooks.

deep valeBOT
#

🌐 Web | 🛡️ CVE | 💣 RCE | 🎁 PoC

🔗 Original article: https://0xdf.gitlab.io/2025/09/06/htb-environment.html

Chained two Laravel CVEs to gain RCE, then privesc to root. Used CVE-2024-52301 to set APP_ENV via ?--env=preprod and bypass login. Abused UniSharp Filemanager CVE-2024-21546 by uploading 0xdf.php. (trailing dot) to bypass filters and get a webshell, then a bash reverse shell. Decrypted a GPG vault with copied .gnupg to pivot to user. Finally, escalated via sudo env_keep of BASH_ENV to root.

deep valeBOT
#

🌐 Web | 🛡️ CVE | 💣 RCE | 🎁 PoC

🔗 Original article: https://0xdf.gitlab.io/2025/09/06/htb-environment.html

HTB Environment chains three issues: CVE‑2024‑52301 lets you flip Laravel’s env via “?--env=preprod” to bypass login; CVE‑2024‑21546 in UniSharp LFM accepts “.php.” filenames, enabling a PHP webshell and reverse shell; sudo preserves BASH_ENV for /usr/bin/systeminfo, so a sourced script yields root. GPG keyvault decryption provided user creds. All steps, payloads, and commands are included.

deep valeBOT
#

🌐 Web | 💣 RCE | 🎁 PoC

🔗 Original article: https://binarysecurity.no/posts/2025/08/securing-gh-actions-part1

Explains how GitHub Actions expression rendering enables script injection leading to runner RCE, shows PoCs to exfiltrate all repo/org secrets as a collaborator, and details why YAML‑only defenses fail. It then prescribes robust branch protections, environment gating (with reviewers and branch/tag restrictions), and tag protections to enforce a four‑eyes principle.

deep valeBOT
#

🛡️ CVE | 🐧 Linux | ⚙️ Kernel | ⏱️ Race

🔗 Original article: https://streypaws.github.io/posts/Race-Against-Time-in-the-Kernel-Clockwork/

CVE-2025-38352 is a TOCTOU race in Linux/Android posix-cpu-timers. When an exiting task handles timer expiry in IRQ context and a sibling deletes the same timer, the delete path can miss the in‑flight “firing” state, corrupting kernel timer state and crashing. A patch adds an early tsk->exit_state check.

#

📱 Android | 🕵️ RAT | ⛓️ Web3 | 💳 NFC

🔗 Original article: https://www.threatfabric.com/blogs/the-rise-of-raton-from-nfc-heists-to-remote-control-and-ats

ThreatFabric unveils RatOn, an Android banker/RAT active July–August 2025. Delivered via adult-themed sites, it uses a WebView–JS bridge to sideload a payload, abuses Accessibility and Device Admin, performs ATS in George Česko (with limit changes), steals crypto wallet seeds (EN/RU/CZ/SK UIs), and can deploy NFSkate for NFC relay. Includes extensive bot commands and IoCs.

deep valeBOT
#

🌐 Web | ⛓️ Web3 | 🎣 Phishing | 🔗 Supply Chain

🔗 Original article: https://www.bleepingcomputer.com/news/security/hackers-hijack-npm-packages-with-2-billion-weekly-downloads-in-supply-chain-attack/

Phishing via npmjs[.]help let attackers hijack maintainer qix’s npm account and publish trojanized package updates. Injected index.js code hooks fetch/XMLHttpRequest and wallet APIs (window.ethereum, Solana) to rewrite crypto destinations before signing. Risk mainly affects fresh installs between ~09:00–11:30 AM ET (Sep 8, 2025) that ship these libs to browsers. npm removed some versions; check lockfiles, versions, and built assets.

deep valeBOT
#

🛠️ Tool | 🌐 Web | 💣 RCE

🔗 Original article: https://unit42.paloaltonetworks.com/adaptixc2-post-exploitation-framework/

Unit 42 analyzes AdaptixC2, an open-source C2 used in May 2025 intrusions. They document the RC4-packed beacon config schema, show default and in-the-wild HTTP profiles, and detail two chains: Teams social engineering with a fileless PowerShell loader, and an AI-generated PowerShell installer with DLL hijacking and Run-key persistence. Includes defender-focused config extraction steps and detection ideas.

deep valeBOT
#

🌐 Web | 🔐 Auth Bypass | 🎁 PoC | 💰 Bug Bounty

🔗 Original article: https://s41n1k.medium.com/how-i-found-a-critical-password-reset-bug-in-the-bb-program-and-got-4-000-a22fffe285e1

A hidden registration endpoint allowed overwriting passwords for existing users by POSTing {email, password} with no verification. Discovered via Burp+FFUF, a GET revealed “Only POST,” and POST with JSON returned success:1, enabling full account takeover. Critical auth/logic flaw: OWASP A01/A07, CWE‑287/640. Includes a minimal PoC request.

deep valeBOT
deep valeBOT
#

📡 IoT | 💣 RCE | 🌐 Web | 🛠️ Tool

🔗 Original article: https://palant.info/2025/09/08/a-look-at-a-p2p-camera-lookcam-app

LookCam P2P cameras are broadly insecure: fake auth (commands work without LoginDev), arbitrary file read, reliable stack overflow RCE with DEP/ASLR off, and plaintext, device‑ID–only cloud. PPPP crypto is weak/disabled; server IPs/keys live in app init strings. IDs are easily leaked or brute‑forced (22^5 verifier, no rate limits). Attackers can control devices, geolocate them via Wi‑Fi scans, and silently enable/read cloud uploads.

deep valeBOT
#

🛠️ Tool | 🎁 PoC | 💣 RCE

🔗 Original article: https://0xdf.gitlab.io/2025/09/12/htb-delegate.html

Guest SMB access leaked a password in SYSVOL. With A.Briggs, BloodHound showed GenericWrite over N.Thompson. A targeted Kerberoast (SPN add → TGS-REP etype 23 → crack) yielded KALEB_2341 and WinRM. Using SeEnableDelegationPrivilege, MAQ=10, and LDAP signing disabled, an attacker-made computer with unconstrained delegation plus PrinterBug captured the DC’s TGT. With that ccache, DCSync dumped hashes, and PTH to WinRM achieved Administrator.

#

🔁 NTLM Relay | 🛠️ Tool | 🌐 Web | 🎁 PoC

🔗 Original article: https://trustedsec.com/blog/wsus-is-sus-ntlm-relay-attacks-in-plain-sight

The post demonstrates abusing WSUS HTTP traffic for NTLM relay. It explains WSUS keys, ports, SOAP endpoints, and check-in cadence, then shows discovery (Nmap, GPO parsing, wsusniff.py), ARP spoofing, iptables redirect, and ntlmrelayx (PR #2034) to relay machine auth to LDAP/SMB/AD CS (ESC8). HTTPS blocks passive interception unless clients trust an attacker cert. Includes commands, tools, links, and mitigations.

deep valeBOT
#

🌐 Web | 🛡️ CVE | 💣 RCE | 🎁 PoC

🔗 Original article: https://0xdf.gitlab.io/2025/09/13/htb-planning.html

Exploit Grafana 11.0.0 (CVE-2024-9264) via SQL Expressions and DuckDB’s shellfs to get root in the Grafana container. Dump env vars to recover GF_SECURITY_ADMIN creds, SSH to the host as enzo, SSH-tunnel to a loopback-only Crontab UI, derive Basic auth from a backup job password, create a cron that drops a SUID bash, and run it for host root.

deep valeBOT
#

🌐 Web | 🎁 PoC | 💰 Bug Bounty

🔗 Original article: https://zere.es/posts/cache-deception-cspt-account-takeover/

CSPT in the SPA let attacker-controlled path segments steer an authenticated fetch (with X-Auth-Token) to /v1/token.css. The .css suffix triggered Web Cache Deception: the CDN cached the sensitive token JSON as public. The attacker then fetched /v1/token.css unauthenticated to obtain the victim’s token, achieving ATO.

deep valeBOT
#

🛠️ Tool | 💣 RCE | 🎁 PoC | 🧩 Injection

🔗 Original article: https://reversing.codes/posts/PlayStation-5-ELF-Injection/

Step-by-step PS5 usermode ELF injection: enumerate processes from kernel .data (allproc), elevate your process by writing ucred Authority ID at offset 0x58 to 0x4800000000010003, flip PROT_EXEC on target pages by patching vm_map entries, map the ELF with a ptrace-driven elfldr call, start it via a stager that pthread_create’s a new thread and hits int3. NineS server + Python client provide an end-to-end PoC.

deep valeBOT
#

🌐 Web | 💰 Bug Bounty | 🛠️ Tool

🔗 Original article: https://youtu.be/NI-eXMlXma4

The episode dissects a real Supabase misconfiguration in getDisclosed: UI‑only signup removal left Auth signup open, and an exposed Postgres view bypassed intended RLS, enabling unauthenticated mass edits. It also covers scalable Salesforce Aura hunting, GMSGadget for CSP/sanitizer bypasses, and Bug Bounty Village’s realistic training format.

#

☁️ Cloud | 🔐 CI/CD | 🌐 Web | 🎁 PoC

🔗 Original article: https://binarysecurity.no/posts/2025/09/securing-gh-actions-part2

Deep dive into GitHub Actions ↔ Azure OIDC. Shows how weak FIC subjects (e.g., pull_request) and insecure workflows let collaborators mint Azure tokens and exfiltrate them from ~/.azure/msal_token_cache.json. Demonstrates safer job_workflow_ref scoping, warns about cross‑repo bypass if repo claim is omitted, shows script‑injection in reusable inputs, and abuses terraform plan for exfil/RCE. Includes PoCs, commands, and hardening: protect refs/envs, include repo+job_workflow_ref, least privilege, and SHA pinning.

deep valeBOT
#

🎣 Prompt Injection | 🧠 LLM | 💣 RCE | 🛠️ Tool

🔗 Original article: https://unit42.paloaltonetworks.com/code-assistant-llms/

Unit 42 shows IDE code assistants can be hijacked via indirect prompt injection in attached context, leading to hidden backdoors (e.g., a function that fetches obfuscated C2 commands and executes them). It also demonstrates moderation bypass via autocomplete seeding (prefix like “Step 1:”), risks from direct model invocation, and LLMJacking using stolen tokens and reverse proxies. Impact: silent codebase compromise and developer RCE.

deep valeBOT
#

🛠️ Tool | 💣 RCE | 🤖 AI/ML

🔗 Original article: https://blog.trailofbits.com/2025/09/16/ficklings-new-ai/ml-pickle-file-scanner/

Trail of Bits added an import-allowlist to Fickling that hooks Python’s pickle unpickler and blocks non-approved imports during ML model loading. Built from ~3,000 Hugging Face pickles and validated on a clean/malicious benchmark, it detected 100% of injected malicious files while allowing ~99% of clean ones. Enable with a one-liner at startup.

#

📱 Android | 🧪 Malware | 🎭 Phishing | 🧲 Social Engineering

🔗 Original article: https://www.ibm.com/think/news/phantomcall-antidot-variant-in-fake-chrome-apps

PhantomCall, an Antidot variant, spreads via fake Chrome apps. A WebView + @JavascriptInterface lures users to grant “Install unknown apps,” then the payload installs via PackageInstaller.Session. A loop checks Accessibility via AccessibilityManager; if disabled, startActivity() foregrounds a prompt until enabled. With Accessibility active, PhantomCall silently sets call forwarding (USSD) and uses CallScreeningService with C2 postfix matching to block callbacks—isolating victims and enabling high‑impact banking fraud.

#

🛠️ Tool

🔗 Original article: https://revflash.medium.com/strategies-for-analyzing-native-code-in-android-applications-combining-ghidra-and-symbolic-aaef4c9555df

Ghidra + angr workflow to statically execute a native string decoder in an Android .so when RASP blocks Frida. Load the .so in angr at base 0x00100000, wrap FUN_00100e10 with project.factory.callable, allocate an out buffer in a blank state, call with (enc_ptr, buf, len), concretize memory via solver.eval, stop at \x00, and auto‑annotate Ghidra call sites with decoded JNI names/signatures.

#

📡 C2 | 🧪 DFIR | 🛠️ Tool | 🎁 PoC

🔗 Original article: https://www.pentestpartners.com/security-blog/discord-as-a-c2-and-the-cached-evidence-left-behind/

Abuses Discord webhooks as a lightweight C2 for beaconing and exfiltration via a full PowerShell PoC, then shows how Discord’s Chromium Simple Cache preserves rich evidence (attachments, webhooks, timestamps). A dedicated Discord Forensic Suite (CLI/GUI) parses cache artifacts, carves files, and generates HTML/CSV timelines to reconstruct attacker activity—even after channels are deleted.

deep valeBOT
#

📡 IoT | 🛠️ Tool | 🎁 PoC

🔗 Original article: https://kennedn.com/blog/posts/tapo/

Cloudless TP‑Link Tapo onboarding via MITM and APK reversing: bypass TLS pinning with Frida, capture with mitmproxy, extract the default admin password (<code>encrypt_type:3 → TPL075526460603</code>), derive session keys from <code>cnonce/nonce/device_confirm</code> to decrypt <code>securePassthrough</code>, map calls, and automate with a Bash PoC.

#

🛡️ CVE | 📡 IoT | 🛠️ Tool

🔗 Original article: https://sec-consult.com/vulnerability-lab/advisory/nfc-card-vulnerability-exploitation-leading-to-free-top-up-kiosoft-payment-solution/

CVE-2025-8699: KioSoft “Stored Value” uses MiFare Classic cards with broken Crypto1. Balance and a simple XOR-based checksum are stored on-card, enabling offline tampering. With Proxmark (hf mf autopwn → edit dump/checksum → hf mf cload → hf mf csetuid) attackers set balances up to $655.35 and pay at terminals. Vendor claims firmware detection and plans secure-card hardware; no fixed version numbers. Workaround: migrate to Online Payment System.

#

🛠️ Tool | 🌐 Web | ⛓️ Web3

🔗 Original article: https://research.checkpoint.com/2025/under-the-pure-curtain-from-rat-to-builder-to-coder/

Check Point details an 8‑day ClickFix campaign deploying a Rust DLL loader (via regsvr32) that decrypts/executes PureHVNC. It documents loader anti‑analysis, AMSI bypass, persistence, PureHVNC’s protobuf config, TLS‑pinned protocol, registry‑stored plugins, and a full command set (HVNC/HRDP, shell, keylog, clipper, DDoS, etc.). A Sliver stage steals creds. Hardcoded GitHub URLs in the PureRAT builder tie repos to “PureCoder” (UTC+0300).

deep valeBOT
#

🌐 Web | 💣 RCE | 🎁 PoC | 🛠️ Tool

🔗 Original article: https://0xdf.gitlab.io/2025/09/16/htb-forgotten.html

A public, uninitialized LimeSurvey 6.3.7 let the attacker complete setup, create a superadmin, and upload a PHP plugin webshell for RCE. They gained a container shell, found LIMESURVEY_PASS in env, used it for container sudo and SSH to the Ubuntu 22.04 host, then abused a bind mount to drop a SUID bash and pop host root.

#

🌐 Web | 💉 XSS | 🎁 PoC

🔗 Original article: https://zoozoo-sec.github.io/blogs/PwningWasm-BreakingXssFilters/

A WASM chat app has an unchecked memcpy in editMsg(), enabling a linear‑memory heap overflow. After grooming realloc() to place the msg array (s->mess) next to a user buffer, the attacker overwrites msg_data pointers and the in‑memory HTML template. Replacing “<p>%.*s</p>” with “<img onerror=%.*s>” turns sanitized text into JS, yielding stored DOM XSS via the ?s= URL. Includes DevTools workflow, helper code, structs, and a copy‑paste PoC.

deep valeBOT
#

🌐 Web | 👾 Malware | 🕵️ Threat Intel | 🧩 Steganography

🔗 Original article: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-slopads-covers-fraud-with-layers-of-obfuscation/

SlopAds is a large Android ad‑fraud scheme across 224+ Play apps (38M installs). Apps fetch an encrypted Firebase config, gate activation to paid‑attributed installs, download a steganographic APK (FatModule) hidden in four PNGs, and run hidden WebViews that collect device data, pass anti‑analysis checks, follow redirect chains, and auto‑click viewable ads on actor‑owned H5 sites. Infra pivots on ad2[.]cc with 300+ promo domains. Google removed apps; Play Protect blocks behavior.

deep valeBOT
#

🛠️ Tool | 🌐 Web | 💥 DoS | 🎁 PoC

🔗 Original article: https://portswigger.net/research/websocket-turbo-intruder-unearthing-the-websocket-goldmine

Burp’s WebSocket Turbo Intruder adds Python-driven, high‑speed WebSocket fuzzing, robust filtering, a WS⇄HTTP middleware, and a CLI. It handles Socket.IO (EIO=4, Ping/Pong, “40” handshake), enables threaded race‑condition testing, and ships a Java WS DoS PoC by abusing payload length for OOM. Includes a WS logger and ID controls for debugging.

deep valeBOT
#

🌐 Web | 💣 RCE | 🔑 Credential Theft | 🪱 Worm

🔗 Original article: https://unit42.paloaltonetworks.com/npm-supply-chain-attack/

Unit 42 details “Shai‑Hulud,” a self‑replicating npm worm abusing postinstall hooks for RCE. It targets Linux/macOS, steals npm/GitHub/cloud secrets, exfiltrates to webhook.site, creates a public “Shai‑Hulud” GitHub repo with the loot, then republishes tainted packages using stolen tokens. Over 180 packages (incl. @ctrl/tinycolor) affected. Queries and IOCs provided.

deep valeBOT
#

🪟 Windows | 🔗 Symlink | 🛡️ EDR Evasion | 🚫 AV Tampering

🔗 Original article: https://www.zerosalarium.com/2025/09/Break-Protective-Shell-Windows-Defender-Folder-Redirect-Technique-Symlink.html

The post shows how to hijack Windows Defender’s execution folder. Create a higher-version directory symlink under ProgramData\Microsoft\Windows Defender\Platform pointing to an attacker-writable path (e.g., C:\TMP\AV). After reboot, WinDefend runs from that folder, enabling DLL sideloading or disabling Defender by deleting the link. Requires admin. High impact for evasion/disruption; no privesc.

#

🛠️ Tool | ⛓️ Web3

🔗 Original article: https://blog.trailofbits.com/2025/09/18/use-mutation-testing-to-find-the-bugs-your-tests-dont-catch/

Trail of Bits shows why high coverage is not enough and how mutation testing with Slither’s slither-mutate uncovers blind spots. It provides commands, output interpretation, common mutators, performance tips, and a DeFi case study (Arkis) where a surviving mutant led to a high‑severity fund‑drain bug due to trusting a user parameter over actual transfers.

#

🛠️ Tool | 📱 Android | 🛡️ CVE | 🎁 PoC

🔗 Original article: https://www.mobile-hacker.com/2025/09/18/automating-android-app-component-testing-with-new-apk-inspector/

APK Components Inspector auto-enumerates Android exported components, reads Smali to infer required Intent extras, and prints type-correct ADB commands. A companion script parses the output (adbcommands.txt) and interactively executes each command. The post explains setup, usage, on-device operation, related tools, and dives into Intent Redirection (CWE‑926) with real CVEs and mitigations.

deep valeBOT
#

🌐 Web | 🛡️ CVE

🔗 Original article: https://patchstack.com/articles/unauthenticated-broken-authentication-vulnerability-in-wordpress-jobmonster-theme/

Jobmonster ≤4.7.9 has an unauthenticated auth bypass (CVE-2025-54738). A social-login AJAX handler trusts POSTed id as email and calls wp_set_auth_cookie(), granting a valid session for any existing user. Exploit by POSTing action=<vulnerable_social_login_action>, using=bogus, id=<victim email>. Fixed in 4.8.0 by removing the POST fallback and only accepting validated provider data.

#

💣 RCE | 🛠️ Tool

🔗 Original article: https://0xdf.gitlab.io/2025/09/19/htb-baby.html

HTB Baby (Windows AD): Anonymous LDAP allows full user/group discovery. A default credential is identified in directory data and safely sprayed to gain a domain login. The compromised context has SeBackupPrivilege, enabling backup-mode/VSS reads of NTDS.dit + SYSTEM. secretsdump.py extracts Administrator’s hash, which is used for Pass‑the‑Hash over WinRM to obtain a DA shell (full domain takeover).

deep valeBOT
#

🛡️ CVE | 🛠️ Tool | 💣 RCE

🔗 Original article: https://0xdf.gitlab.io/2025/09/20/htb-fluffy.html

Assume-breach AD chain on DC01.fluffy.htb. Abuse CVE‑2025‑24071/24055 (ZIP‑embedded .library‑ms) to coerce NTLM and crack NetNTLMv2. BloodHound shows GenericWrite over a service account; reset its password and get a WinRM shell. From that foothold, exploit AD CS ESC16 with Certipy to obtain an Administrator‑usable certificate and achieve DA.

deep valeBOT
#

🎣 Phishing | 🧩 DLL Hijacking | 🔐 Malware | ☁️ Cloud C2

🔗 Original article: https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/

Iran-linked Nimbus Manticore uses career-themed spear‑phishing to deliver a multi‑stage DLL sideloading chain that abuses the undocumented DllPath in RTL_USER_PROCESS_PARAMETERS. A signed Microsoft binary (SenseSampleUploader.exe) is coerced to load attacker xmllite.dll, persisting MiniJunk and MiniBrowse. MiniJunk supports file ops, process exec via named pipes, and DLL loading; MiniBrowse steals Chrome/Edge credentials. Heavy LLVM-like obfuscation, size inflation, SSL.com code-signing, and Cloudflare/Azure C2 minimize detection. A related dxgi.dll cluster shares the code base but is simpler.

#

🛡️ CVE | 💣 RCE | 💉 XSS | 🎁 PoC

🔗 Original article: https://blog.securelayer7.net/electron-app-security-risks/

The post shows how Electron misconfigurations let renderer XSS become OS RCE. It reproduces Notable CVE‑2020‑15174 via nodeIntegration:true and a markdown XSS spawning Calculator, and VS Code 1.63 CVE‑2021‑43908 via webview CSP (‘unsafe-inline’), postMessage trust, vscode-file path rewriting, and Node APIs. Includes mitigations and a public PoC.

deep valeBOT
#

🌐 Web | 🦠 Malware | 🕵️ Threat Intel | 🧩 IIS

🔗 Original article: https://unit42.paloaltonetworks.com/operation-rewrite-seo-poisoning-campaign/

Unit 42 details “Operation Rewrite,” an SEO‑poisoning campaign by Chinese‑speaking actors (CL‑UNK‑1037) using BadIIS implants on IIS and a PHP front controller. Implants hook IIS (OnBeginRequest/OnSendResponse), XOR‑decrypt config, serve C2 SEO pages to crawlers, and proxy/redirect real users. Variants include an ASP.NET Page_Load gateway, a managed C# IIS module (404 hijacking + crawler‑only injection), and a PHP sitemap/content‑rewriter. Extensive IoCs and overlaps with Group 9 are provided.

deep valeBOT
#

🌐 Web | 🛠️ Tool | 💣 RCE

🔗 Original article: https://www.synacktiv.com/en/publications/the-phantom-extension-backdooring-chrome-through-uncharted-pathways.html

Shows how to stealthily load arbitrary Chromium extensions on Windows by editing Preferences/Secure Preferences and forging HMACs using a seed from resources.pak. Covers extension ID derivation, seed extraction (file 146), MAC formulas for settings and developer_mode (≥134), policy bypasses (ID spoofing, stomping, HKCU edits), and noisy CLI fallback (≥137). High impact: full in‑browser code execution and persistence.

deep valeBOT
#

🛠️ Tool | 🛡️ CVE | 💣 RCE | 🎁 PoC

🔗 Original article: https://androidoffsec.withgoogle.com/posts/binder-fuzzing/

Guide to fuzz Android’s Binder using LKL with a stateful, multi‑client grammar and a randomized scheduler to simulate thread interleavings. It explains why syzkaller’s high coverage can still miss Binder logic/race bugs, details the CVE‑2020‑0423 race sequence, and provides a public fuzzer, plus a CVE‑2023‑20938 seed and reproduction steps.

#

🛡️ CVE | 📱 Android | 🧪 SQLi | 🎁 PoC

🔗 Original article: https://www.rapid7.com/blog/post/cve-2025-10184-oneplus-oxygenos-telephony-provider-permission-bypass-not-fixed/

CVE-2025-10184 lets any app on OxygenOS 12–15 OnePlus devices bypass READ_SMS by abusing OEM-added Telephony providers with no writePermission and an injectable update() WHERE. Via blind SQLi (unicode(substr()) + BETWEEN) and insert()-seeded rows, attackers infer-read the sms table (e.g., MFA codes). A permissionless PoC app targets content://service-number/service_number and related URIs.

deep valeBOT
#

🛡️ CVE | 💣 RCE | 🎁 PoC

🔗 Original article: https://www.thezdi.com/blog/2025/9/23/cve-2025-23298-getting-remote-code-execution-in-nvidia-merlin

CVE-2025-23298 in NVIDIA Merlin Transformers4Rec is an unsafe pickle deserialization bug in the checkpoint loader. A crafted checkpoint embeds an object whose reduce executes commands (e.g., via os.system) when torch.load() runs, yielding RCE—often as root in ML pipelines. NVIDIA patched by replacing raw torch.load with an allow-listed loader and added validation (PR #802). Use weights_only, safer formats (Safetensors/ONNX), signing, and sandboxed loads. 🎁 PoC and pre/post-patch gists are included.

#

🌐 Web | 🤖 AI | 🎣 Phishing | 🎁 PoC

🔗 Original article: https://redcanary.com/blog/threat-detection/ai-agent-mode/

Red Canary shows how “agent mode” can be socially engineered to run an AI‑in‑the‑Middle phish. A shared prompt drives the agent’s hosted browser to an attacker site, then the UX’s “Take over Browser” gets the user to enter credentials. Logins appear from Cloudflare IPs with UA Chrome/138 on macOS 10.15.7. Identity‑centric detections and restricting agent mode are recommended.

deep valeBOT
#

🛠️ Tool | 🌐 Web | 💰 Bug Bounty | 💉 XSS

🔗 Original article: https://portswigger.net/blog/welcome-to-ai-pentesting-add-on-demand-ai-assistance-directly-to-your-workflow-with-new-agentic-burp-ai-capabilities

PortSwigger’s Burp AI embeds an agentic assistant directly in Burp Repeater. Using natural‑language prompts, it surfaces leads, automates stored XSS/CSRF checks, generates filter‑bypass payloads (XSS/SQLi/template injection), and turns PoCs into impactful demos—while you stay in control. Includes AI recorded logins, data‑handling assurances, and 10k free credits.

#

🛠️ Tool | 🧪 Static Analysis | 💻 C/C++ | 🧵 Taint Tracking

🔗 Original article: https://blog.trailofbits.com/2025/09/25/taming-2500-compiler-warnings-with-codeql-an-openvpn2-case-study/

Trail of Bits built a CodeQL pipeline to triage implicit integer conversions in C. On OpenVPN2, it cut ~2.5k compiler warnings to 20 tainted, high-priority cases using alteration-type filtering, constant checks, (IR) range analysis, domain models, and taint tracking. Code, query snippets, and function models are provided; no exploitable issues were found.

#

🌐 Web | 📱 Android | 🧪 Malware | 🕵️ Threat Intel

🔗 Original article: https://dti.domaintools.com/banker-trojan-targeting-indonesian-and-vietnamese-android-users/

Since Aug 2024, BankBot variants target Indonesian/Vietnamese Android users via fake Play pages. Key tradecraft: Socket.IO/WebSocket “APK smuggling” streams chunks, assembles an APK Blob client-side, and auto-triggers download—evading static-URL and extension filters. Includes concrete IOCs (domains, hashes, C2s), open directory staging, and infra patterns (Alibaba/Gname/share-dns, nginx, R10/R11/WE1).

#

🛠️ Tool | 🛡️ CVE | 🎁 PoC | 🔓 LPE

🔗 Original article: https://github.com/Skorpion96/unisoc-su/tree/main

Exploit chain and scripts to pivot from EngineerMode’s system shell (CVE-2025-31710) to root on Unisoc devices by racing cmd_services: enable via setprop, then immediately connect with cli-pie to the abstract socket cmd_skt. Relay a local shell with nc and source unisoc-su.sh to complete the root pivot. Works up to Android 13; Android 14/15 usually blocked unless OEM exceptions or tool_service. Includes GhostRoot RAM channel.

#

🛠️ Tool

🔗 Original article: https://www.synacktiv.com/publications/appledbrs-un-outil-daide-a-la-recherche-sur-plateformes-apple.html

appledb_rs is a Rust tool that mounts IPSWs, parses Mach‑O LC_CODE_SIGNATURE → CS_SuperBlob → CSMAGIC_EMBEDDED_ENTITLEMENTS, extracts entitlements and framework imports, and stores them in a normalized DB (SQLite/PostgreSQL) browsable via a React UI and OpenAPI API. It details sea_orm DB‑agnostic design, a SQLite AUTOINCREMENT/i32→i64 workaround, example SQL, ipsw commands, and research use cases (search, diff, dependency mapping).

deep valeBOT
#

🛡️ CVE | 🌐 Web | 💣 RCE | 🧩 Deserialization

🔗 Original article: https://labs.watchtowr.com/is-this-bad-this-feels-bad-goanywhere-cve-2025-10035/

CVE-2025-10035 is a critical flaw in GoAnywhere MFT’s License Servlet. A logic bug lets unauthenticated users generate a session token via an error handler, then reach a deserialization sink that unwraps a SignedObject. RCE would require a valid signature over a malicious inner object; researchers couldn’t bypass verification. Patch 7.8.4/7.6.3 hardens deserialization and removes the unauthenticated token path.

#

🎲 PRNG | 🎁 PoC | 🛠️ Tool | 🔍 Reverse Engineering

🔗 Original article: https://blog.doyensec.com/2025/09/25/yet-another-random-story.html

VBScript’s PRNG seeds from the system clock at 64 Hz and narrows to Single, collapsing entropy. No-arg Randomize and Randomize <seed> use different seed paths, so you must craft a Double whose high dword matches Timer()’s float32 to emulate implicit seeding. A VBS+Python PoC brute-forces 0.015625 s steps to recover a 32-char token.

#

🌐 Web | 🛡️ CVE | 🎁 PoC | 🕵️ InfoLeak

🔗 Original article: https://exploit.az/posts/wor/

Abuses MySQL FTS Boolean operators to keep a trailing wildcard inside quoted MATCH…AGAINST(), bypassing MyBB’s keyword cleaning via a two‑token trick. A redirect‑vs‑error oracle then reveals whether titles start with a probed prefix, leaking deleted/hidden thread names (CVE‑2025‑48941). Includes Go ReDoS demo and a Go fuzzer PoC.

deep valeBOT
#

🛡️ CVE | 💣 RCE | 🌐 Web

🔗 Original article: https://labs.watchtowr.com/it-is-bad-exploitation-of-fortra-goanywhere-mft-cve-2025-10035-part-2/

watchTowr reports in-the-wild exploitation of Fortra GoAnywhere MFT CVE-2025-10035 starting 2025-09-10. A pre-auth deserialization bug enables RCE, creation of a backdoor admin (admin-go), provisioning of a web user, and upload/exec of payloads (zato_be.exe, SimpleHelp jwunst.exe). IoCs include two SHA-256 hashes, actor IP 155.2.190.197, and whoami/groups output redirected to C:\Windows\test.txt.

#

🔓 Infoleak | 🍎 Apple | 🧬 Serialization | 🧠 Technique

🔗 Original article: https://googleprojectzero.blogspot.com/2025/09/pointer-leaks-through-pointer-keyed.html

Project Zero shows a deterministic remote pointer leak via NSKeyedUnarchiver→NSKeyedArchiver. By mixing crafted colliding keys with a pointer‑hashed singleton (e.g., NSNull) in NSDictionary, the re‑serialized output order reveals bucket placement and leaks dyld shared cache address bits, enabling ASLR bypass without timing or memory‑safety bugs. Fixed by Apple on 2025‑03‑31.

#

💣 RCE | 🛠️ Tool | 🎁 PoC | 🏢 Active Directory

🔗 Original article: https://0xdf.gitlab.io/2025/09/26/htb-babytwo.html

Compromise a Windows AD domain by poisoning a writable SYSVOL logon script to gain a reverse shell as a domain user, then abuse AD ACLs (WriteOwner/WriteDacl) to seize the GPOADM service account and pave the way for GPO-based admin. Steps include SMB/LDAP recon with NetExec, .lnk analysis (LnkParse3), BloodHound CE graphing, and PowerView to modify ACLs and reset passwords. High risk: broad RCE via logon scripts and domain principal takeover.

deep valeBOT
deep valeBOT
#

🧩 AD | 🧪 DPAPI | 🛠️ Tool | 💣 RCE

🔗 Original article: https://0xdf.gitlab.io/2025/09/27/htb-puppy.html

HTB Puppy demonstrates an AD attack chain: abuse GenericWrite to join Developers and read a DEV share; crack a KeePassXC v4 (Argon2) vault with John; spray recovered passwords to pivot; use GenericAll to reset and enable a disabled user for WinRM; mine a site backup for LDAP bind creds; then decrypt DPAPI Credential Manager secrets to obtain an admin account and RCE on the DC.

deep valeBOT
#

🌐 Web | 💰 Bug Bounty | 💉 XSS | 🎁 PoC

🔗 Original article: https://marxchryz.medium.com/escalating-an-html-injection-into-1-click-account-takeover-3ba9dbf0ce5f

Chained an SSO returnUrl allow‑list with an SSRF‑powered HTML injection on a whitelisted subdomain. Despite a strict CSP (default‑src 'none'), the attacker used meta refresh plus meta referrer (unsafe‑url) to force a cross‑origin redirect that leaked the full SSO URL, including ?token=JWT, via the Referer header. Includes a Node/Express PoC and a 1‑click payload.

deep valeBOT
#

🌐 Web | 💰 Bug Bounty | 💉 XSS | 🎁 PoC

🔗 Original article: https://www.yeswehack.com/learn-bug-bounty/ultimate-guide-csrf-vulnerabilities

A practical CSRF exploitation guide with ready PoCs. Covers POST and GET CSRF, stored CSRF via embedded images and session‑agnostic tokens, and a login‑CSRF→stored‑XSS chain. Shows referrer suppression and method‑override (_method) bypasses, plus STP, Double Submit Cookies, SameSite, and user‑interaction mitigations. Includes Burp‑generated PoCs and learning resources.

#

🌐 Web | 🛠️ Tool | 🎁 PoC | 🛡️ CVE

🔗 Original article: https://www.yeswehack.com/learn-bug-bounty/ultimate-guide-race-condition-vulnerabilities

Guide to exploiting web race conditions with HTTP/1.1 last-byte sync and HTTP/2 single-packet techniques. Walkthrough of PortSwigger’s coupon multi-apply lab using Burp Turbo Intruder (engine, gate/openGate, negative timestamps), with code and links. Lists real CVEs and provides concrete mitigations (locks, transactions, idempotency, atomic ops, rate limits, testing).

#

🌐 Web | 💣 RCE | 🎁 PoC

🔗 Original article: https://www.yeswehack.com/dojo/dojo-ctf-challenge-winners-44

Ruby app logs a user-supplied script name, then loads a file built from it using Pathname.cleanpath. By injecting a newline-led Ruby payload and appending “#://../../../../logs/error.log”, the raw payload is logged while cleanpath resolves to ../logs/error.log, causing the app to load and execute the injected log line. The payload closes a dangling bracket (][0]=1) and runs arbitrary code (e.g., reading /tmp/flag*.txt). Impact: RCE. Mitigate by removing user-controlled load paths and enforcing allowlists.

deep valeBOT
#

🌐 Web | 👾 Malware | 🕵️ APT | 💣 RCE

🔗 Original article: https://unit42.paloaltonetworks.com/phantom-taurus/

Unit 42 details Phantom Taurus, a Chinese‑nexus APT, and NET‑STAR: a .NET IIS malware suite enabling in‑memory RCE, encrypted C2, DB access, and timestomping. A WMI‑delivered mssq.bat shifts collection from email to SQL databases. IIServerCore runs inside w3wp.exe, uses AES‑ECB + Gzip + Base64, cookie sessions, and rich commands. AssemblyExecuter v2 adds AMSI/ETW bypass. Full IoCs and hunt tips provided.

deep valeBOT
#

🌐 Web | 🛡️ CVE | 🎁 PoC | 💰 Bug Bounty

🔗 Original article: https://xbow.com/blog/cooking-an-sql-injection-vulnerability-in-chef-automate

XBOW found CVE-2025-8868: a time‑based blind SQL injection in Chef Automate’s /api/v0/compliance/profiles/search. Abuse of a default x-data-collector-token enabled access. Injecting via filters[].type with payloads like "name'||(SELECT pg_sleep(5))||'" produced pq-backed 500s and measurable delays, proving SQL execution. Impact: critical data compromise. Upgrade to 4.13.295+.

deep valeBOT
#

📡 IoT | 💣 RCE | 🌐 Web | 🎁 PoC

🔗 Original article: https://ssd-disclosure.com/lg-webos-tv-path-traversal-authentication-bypass-and-full-device-takeover/

Unauthenticated path traversal on LG webOS TVs (port 18888) leaks LevelDB pairing tokens from /var/db/main. Using the stolen token, an attacker bypasses secondscreen pairing, enables Dev Mode, downloads/installs a malicious IPK, and launches it for RCE. A PoC also abuses /tmp/remotelogger for likely root. Full device takeover is achievable.

#

🛡️ CVE | ⬆️ PrivEsc | 🐧 Linux | 🎁 PoC

🔗 Original article: https://blog.nviso.eu/2025/09/29/you-name-it-vmware-elevates-it-cve-2025-41244/

CVE-2025-41244: VMware service discovery runs version checks on binaries matched by overly broad regexes and executes attacker-controlled paths (e.g., /tmp/httpd) found in listening processes. A Go PoC opens a listener, then gets invoked as “-v” by the privileged collector to spawn /bin/sh -i as root. Affects open‑vm‑tools (credential‑less) and Aria SDMP (credential‑based). Detect odd children of vmtoolsd/get-versions.sh and SDMP artifacts in /tmp. Patch released 2025‑09‑29.

deep valeBOT
#

🌐 Web | 🛡️ CVE | 💣 RCE | 🛠️ Tool

🔗 Original article: https://patchstack.com/articles/q3-2025s-most-exploited-wordpress-vulnerabilities-and-how-patchstacks-rapidmitigate-blocked-them/

Q3 2025 saw active exploitation of four critical WordPress plugin bugs (CVE-2025-27007, -1562, -2011, -2294). Flaws include missing/weak auth on REST routes, unauth plugin installs, SQLi via an unsanitized search parameter, and LFI via a template parameter. Patchstack RapidMitigate shipped targeted rules that blocked hundreds to thousands of attempts while admins patched.

#

📡 IoT | 🛡️ CVE | 💣 RCE | 🌐 Web

🔗 Original article: https://unit42.paloaltonetworks.com/totolink-x6000r-vulnerabilities/

Unit 42 analyzes three unauthenticated bugs in TOTOLINK X6000R V9.4.0cu.1360_B20241207: a hyphen-driven argument injection (CVE-2025-52905), command injection in setEasyMeshAgentCfg’s agentName (CVE-2025-52906), and a sanitization bypass in setWizardCfg enabling arbitrary file writes (CVE-2025-52907). All flow through /cgi-bin/cstecgi.cgi topicurl routing. Update to V9.4.0cu.1498_B20250826.

#

🔬 Malware Analysis | 🥷 Evasion | 🧩 Obfuscation | 🛠️ Tool

🔗 Original article: https://research.checkpoint.com/2025/rhadamanthys-0-9-x-walk-through-the-updates/

Deep dive into Rhadamanthys 0.9.2 internals: XS1_B/XS2_B header churn, multilayer config (custom Base64 → ChaCha20 → XOR → LZO), checksum-addressed Stage‑2 with LFSR XOR, expanded anti‑sandbox (UUIDv1 MAC + WMI HWID), PNG‑based Stage‑3 delivery, RC4 string crypto, configurable injection targets, WebSocket C2 with NTP prechecks and cosmetic domain churn, plus new Ledger Live Lua stealer and browser fingerprinting. Updated tools and IOCs included.

#

🌐 Web | 🛡️ CVE | 🎁 PoC | 🔐 AuthZ

🔗 Original article: https://www.depthfirst.com/post/how-an-authorization-flaw-reveals-a-common-security-blind-spot-cve-2025-59305-case-study

CVE-2025-59305: Langfuse’s tRPC background-migration endpoints used AuthN-only guarded procedures, letting any logged-in user list and restart migrations. Attackers can induce data corruption (race conditions) or DoS (resource exhaustion). PoC curl calls to backgroundMigrations.all and .retry are provided. Fixed on Sep 9, 2025 by adding admin-only authorization; disclosed Sep 15, 2025.

#

📱 Android | 🧩 RAT | 💳 Banking Trojan | 📊 IoC

🔗 Original article: https://www.threatfabric.com/blogs/datzbro-rat-hiding-behind-senior-travel-scams

ThreatFabric (Sep 30, 2025) details Datzbro, an Android device‑takeover RAT spread via fake “senior travel” Facebook groups. The APK (sometimes via Zombinder) abuses Accessibility Services for remote control, black overlays, and a “schematic” UI mode, plus camera/mic, SMS/contacts/app/file ops. Hardcoded filters target banking/crypto flows; fake activities harvest Alipay/WeChat/device PINs. A leaked Chinese desktop C2/builder indicates broad actor adoption. IoCs and full bot command set are provided.

#

📱 Android | 🏦 Banking | 🧪 Malware | 🔬 Analysis

🔗 Original article: https://www.cleafy.com/cleafy-labs/klopatra-exposing-a-new-android-banking-trojan-operation-with-roots-in-turkey

Cleafy exposes Klopatra, a 2025 Android banking trojan using Virbox-protected native code, Accessibility abuse, HVNC black-screen control, and dynamic HTML overlays to steal credentials and perform real-time fraud. Two botnets (>3,000 devices) target Spain and Italy. Turkish-language artifacts and operator notes tie it to a Turkish-speaking group. Infrastructure sits behind Cloudflare with origin IPs recovered via OPSEC mistakes.

#

📡 IoT | 🌐 Web | 🛡️ CVE

🔗 Original article: https://blog.sekoia.io/silent-smishing-the-hidden-abuse-of-cellular-router-apis/

Attackers abuse Milesight cellular routers’ /cgi JSON API—often without auth—to read/send SMS for smishing. Sekoia.io honeypots (Jun–Jul 2025) saw Belgium‑focused CSAM/eBox lures; mass waves hit Sweden (42,044) and Italy (31,353). Infra clusters on Podaon SIA (AS210895) and jnsi/estrk (AS211860). Mobile‑gated kits use detect_device.js; GroozaV2 artefacts and GroozaBot aid hunting.

#

🌐 Web | 🛡️ CVE | 💣 RCE | 🎁 PoC

🔗 Original article: https://www.rcesecurity.com/2025/09/when-audits-fail-four-critical-pre-auth-vulnerabilities-in-trufusion-enterprise/

Four pre-auth flaws in TRUfusion Enterprise allow: arbitrary file read with Base64 exfil (CVE‑2025‑27222), global auth bypass by forging IDEA‑encrypted cookies with a hard‑coded key (CVE‑2025‑27223), arbitrary file write to webroot enabling JSP RCE (CVE‑2025‑27224), and unauth PII disclosure (CVE‑2025‑27225). Includes a Java PoC, exact endpoints/params, and exploit chains.

deep valeBOT
#

📶 Wi‑Fi | 🛡️ CVE | 🔏 Privacy | 🎁 PoC

🔗 Original article: https://7h30th3r0n3.fr/the-vulnerability-that-killed-freewifi_secure/

FreeWifi_secure used EAP‑SIM without identity protection, causing phones to send IMSIs in clear within EAP‑Response/Identity. A passive sniffer (airmon‑ng + Wireshark/Kismet) can capture strings like IMSI@wlan.mnc015.mcc208.3gppnetwork.org, enabling tracking and telecom‑layer abuse. Vendor disabled the SSID on legacy Freeboxes on Oct 1, 2025. Root cause: no pseudonym/TLS tunnel for EAP identity.

#

🌐 Web | 🎯 Clickjacking | 🧩 Browser Extensions | 🎁 PoC

🔗 Original article: https://marektoth.com/blog/dom-based-extension-clickjacking/#browser-extension-clickjacking

Research shows a new DOM-based extension clickjacking technique that hides password-manager autofill UI (via opacity/overlays) and redirects a user’s click to select items. One click can leak credit cards/PII; a few clicks via XSS on related subdomains can steal credentials and TOTP. Includes code snippets, PoCs, affected versions, and mitigations.

deep valeBOT
#

📡 IoT | 🛡️ CVE | 🔓 AuthZ Bypass | 🎁 PoC

🔗 Original article: https://bishopfox.com/blog/how-a-20-smart-device-gave-me-access-to-your-home

Bishop Fox demonstrates that YoLink hubs and the mobile app use plaintext MQTT on TCP/8001 and lack cross‑tenant MQTT ACLs. By deriving a per‑device config URL via MD5(deviceId||static_key), attackers harvest MQTT creds, subscribe to admin topics to steal Wi‑Fi passwords, and publish to victims’ control topics (e.g., unlock smart locks). Includes UART log capture, Ghidra findings, MQTT topic formats, and PoC commands.

#

📡 IoT | 🛡️ CVE | 🎁 PoC | 🌐 Web

🔗 Original article: https://bishopfox.com/blog/yosmart-yolink-hub-version-0382

Bishop Fox found four issues in YoLink Hub v0382: cross‑account device control via MQTT (CVE‑2025‑59449), API‑based credential harvest using MD5(deviceId+secret) (CVE‑2025‑59452), cleartext MQTT exposing creds/commands (CVE‑2025‑59448), and week‑long session persistence (CVE‑2025‑59451). Repro steps include UART/Wi‑Fi MAC discovery, API hash calc, and MQTT pub/sub to unlock locks and intercept Wi‑Fi passwords. No fixes.

deep valeBOT
#

🌐 Web | 💣 RCE | 🛠️ Tool | 🎁 PoC

🔗 Original article: https://0xdf.gitlab.io/2025/10/04/htb-certificate.html

Two ZIP-parser tricks (null-byte name inside ZIP and stacked ZIPs) bypass an allowlist to drop a PHP webshell for RCE. From RCE, leak DB creds in db.php, dump bcrypt hashes, crack “sara.b:Blink182,” and WinRM in. A workstation PCAP yields Kerberos roasting for the next user. Then AD CS ESC plus SeManageVolumePrivilege enables CA key exfil and a Golden Certificate, impersonating Administrator for full domain compromise.

deep valeBOT
#

🛡️ CVE | 💣 RCE | 🎁 PoC | 📱 iOS

🔗 Original article: https://github.com/JGoyd/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201

Two iOS 18.x bugs form a zero‑click iMessage/SMS chain: CVE‑2025‑31200 (CoreAudio/AudioConverterService heap corruption) and CVE‑2025‑31201 (PAC bypass via an RPAC path). A malicious .amr sample demonstrates the trigger. The chain claims to bypass Blastdoor, escalate to kernel, and enable keychain/CryptoTokenKit abuse. Fixed in iOS 18.4.1 (Apr 16, 2025).

#

🌐 Web | 🎣 Phishing | 🛠️ Tool | 🧪 Malware

🔗 Original article: https://unit42.paloaltonetworks.com/clickfix-generator-first-of-its-kind/

Unit 42 details a phishing-kit builder, the IUAM ClickFix Generator, that crafts fake CDN verification pages to copy hidden OS-specific commands to victims’ clipboards and coerce console execution. Campaigns showed Windows chains delivering DeerStealer via batch→MSI and macOS Base64 bash installing Odyssey (often with nohup). Pages share HTML/JS structure, use OS detection, homograph domains, and can be injected into compromised sites. Extensive hashes, C2 IPs, and domains are provided.

deep valeBOT
#

🛠️ Tool | 📡 IoT | 🎁 PoC | 💣 RCE

🔗 Original article: https://github.com/R0rt1z2/fenrir

Fenrir is a PoC that patches MediaTek’s bl2_ext to always bypass verification when seccfg is unlocked, yielding EL3 code execution and a collapsed secure boot chain. It supports Nothing Phone (2a) and partially CMF Phone 1, adds fastboot commands, lock‑state spoofing, and offers detection via expdb logs showing img_auth_required=0.

#

🛡️ CVE | 💣 RCE | 🛠️ Tool | 🎁 PoC

🔗 Original article: https://www.thezdi.com/blog/2025/10/6/crafting-a-full-exploit-rce-from-a-crash-in-autodesk-revit-rfa-file-parsing

CVE‑2025‑5037: A type confusion in Revit’s RFA deserializer lets an attacker deserialize AString (idx 0x1F) so the destructor loop executes an attacker‑chosen gadget. On Win10 a “monster gadget” pivots the stack via mov esp,eax; on Win11 two loop‑executed gadgets perform a 64‑bit pivot. A non‑ASLR DLL supplies gadgets and imports to resolve ucrtbase!system for command exec. RFA’s Global\Latest is GZIP+ECC; ECC must be recomputed. CompoundFileTool and WinDBG/IDA/TTD support the exploit.

deep valeBOT
#

🛡️ CVE | 💣 RCE | 🌐 Web | 🎁 PoC

🔗 Original article: https://0xdf.gitlab.io/2025/10/09/htb-watcher.html

Exploit Zabbix CVE‑2024‑22120 to time‑bruteforce the session_key and Admin session_id, forge an admin cookie, and execute Scripts for RCE as user zabbix. Dump DB creds, pivot via SSH port‑forward to local TeamCity, harvest a user’s password by patching Zabbix login, reuse it to log into TeamCity (running as root) and execute a build step to gain root.

deep valeBOT
#

🌐 Web | ☁️ Cloud | 🎁 PoC

🔗 Original article: https://trustedsec.com/blog/skimming-credentials-with-azures-front-door-waf

Abuses Azure Front Door WAF Custom Rules and diagnostics to log POST credentials. Create a log-only rule matching POST params (e.g., username/password), enable AFD WAF diagnostics to Log Analytics, then query AzureDiagnostics (Category=FrontDoorWebApplicationFirewallLog) and read details_matches_s to retrieve cleartext creds. Works on AFD WAF; Application Gateway WAF custom rules don’t log matched payloads.

deep valeBOT
#

🌐 Web | 🎁 PoC

🔗 Original article: https://unit42.paloaltonetworks.com/indirect-prompt-injection-poisons-ai-longterm-memory/

Unit 42 shows how indirect prompt injection can poison an LLM agent’s long‑term memory in Amazon Bedrock Agents. Malicious webpage content enters the session‑summarization prompt via the tool’s result field, gets stored as memory, then reinjected as system instructions in later sessions to silently exfiltrate data with scrape_url. Defense: Bedrock Guardrails, pre‑processing/Lambda parsing, URL allowlists, and detailed logging/trace.

deep valeBOT
#

📱 Android | 🐞 Malware | 📡 C2 | 🎣 Phishing

🔗 Original article: https://zimperium.com/blog/clayrat-a-new-android-spyware-targeting-russia

ClayRat is Android spyware spread via Telegram and phishing sites impersonating popular apps. It uses session‑based droppers with encrypted payloads in /assets, abuses the default SMS handler role for broad message control, and communicates via HTTP (base64 with marker “apezdolskynet”) or AES‑GCM. Commands cover SMS/call/notification exfiltration, camera capture, mass SMS, and WebSocket proxying. Broadcast Receivers provide event‑driven control. IOCs are published by Zimperium.

deep valeBOT
#

🛠️ Tool | 🌐 Web

🔗 Original article: https://bishopfox.com/blog/burp-variables-burp-suite-extension

Burp Variables adds Postman-like variables to Burp Suite. Define project-level pairs and reference them as ((name)) anywhere in requests; values are auto-replaced on send. Scope-aware proxy replacement prevents secret leaks. Install from the BApp Store or GitHub, verify results in Logger, and use import/export to migrate data between projects.

deep valeBOT
deep valeBOT
#

🛠️ Tool | 🎁 PoC

🔗 Original article: https://github.com/rasta-mouse/Crystal-Kit

Crystal Kit is a Cobalt Strike evasion experiment that replaces Sleepmask/BeaconGate with Crystal Palace PIC/O executed via prepend‑style UDRLs. The repo provides an Aggressor Script, a Java client extension, and UDRLs for staging/post‑ex. README notes planned hardening (no RWX, GMA/GPA patching, AMSI/ETW bypass, allocation tracking, cleanup). It shifts detection surfaces from stock CS to UDRL/PIC‑driven behaviors.

#

🛠️ Tool | 🎁 PoC

🔗 Original article: https://rastamouse.me/crystal-kit/

Crystal Kit is a PoC toolkit that replaces Sleepmask/BeaconGate by hooking a module’s IAT to route API calls into PIC that can mask memory and spoof call stacks. It adds evasion to unsupported APIs like CreateProcessA, works with BOFs and post-ex DLLs, and includes a reflective loader, a Draugr-based PIC stub, a PICO IAT hooker, and an Aggressor script.

deep valeBOT
#

🛡️ CVE | 📱 Android | 🕵️ Side-Channel | 🔒 Privacy

🔗 Original article: https://www.pixnapping.com/

Pixnapping (CVE-2025-48561) lets a zero‑permission Android app exfiltrate on‑screen secrets from other apps/websites by combining intents, a semi‑transparent overlay with window blur, and GPU.zip timing via VSync. Works on Pixel 6–9 and Galaxy S25 (Android 13–16 up to BP3A.250905.014). Google’s initial blur‑limit patch is bypassable; a further fix is slated for Dec 2025.

#

🛠️ Tool | 📱 Android | 🔬 Reverse Engineering | 📦 APK

🔗 Original article: https://github.com/AndnixSH/APKToolGUI

Windows GUI that wraps Apktool, Baksmali/Smali, APKEditor.jar, signapk, and zipalign to streamline Android APK reverse engineering. Supports decompile/rebuild, split‑APK merge, signing, zipalign, framework cleanup (removes DUMMY_APKTOOL), ADB helpers, and high‑DPI/long‑path. Requires Java 8/17 and .NET 4.8. Update by replacing jars in Resources; reset by deleting config.xml. Includes translation via .resx.

#

🛠️ Tool | 🌐 Web

🔗 Original article: https://www.pentestpartners.com/security-blog/compiling-static-nmap-binary-for-jobs-in-restricted-environments/

How-to for building a trustworthy, statically linked Nmap for restricted Linux environments. Uses Docker (Ubuntu 22.04) to compile OpenSSL 1.1.1w and PCRE2 10.43 statically, then Nmap 7.98 with included libpcap/dnet. Packages the binary with all NSE data. Includes a full one-liner, verification step, and links to sources and a helper tool.

#

🛠️ Tool | 🌐 Web | 💰 Bug Bounty

🔗 Original article: https://github.com/MrTurvey/flareprox

FlareProx deploys Cloudflare Workers as HTTP pass-through proxies for IP masking and simple rotation. Configure Cloudflare API token/account, create endpoints, then send requests via ?url= or X-Target-URL. Supports all HTTP methods, cURL usage, and a Python API. Useful for authorized testing, bug bounties, and research; free tier ~100k requests/day.

deep valeBOT
#

📱 Android | 🪲 Malware | ⛏️ Cryptominer | 🛰️ C2

🔗 Original article: https://cyble.com/blog/ghostbat-rat-inside-the-resurgence-of-rto-themed-android-malware/

GhostBat RAT uses RTO/mParivahan‑themed APKs to deploy a multi‑stage Android dropper (XOR → DexClassLoader → AES key from SHA‑1(filename)[0:16]) or a native .so packer (JNI runtime resolution). Final app phishes UPI, exfiltrates/forwards SMS/OTP, registers via Telegram bots, and can mine crypto. Distribution uses GitHub and compromised WordPress via smishing shortlinks.

#

📧 Phishing | 🛠️ Tool | 🕵️ Evasion | 🦠 Malware

🔗 Original article: https://unit42.paloaltonetworks.com/phantomvai-loader-delivers-infostealers/

Unit 42 details PhantomVAI, a C# .NET loader delivered via phishing. Obfuscated JS/VBS runs Base64 PowerShell that extracts a Base64 DLL hidden in images between markers (<<sudo_png>>…<<sudo_odt>>). The loader performs VM checks (VMDetector-based), sets persistence (scheduled tasks, wscript.exe, Run key), retrieves the payload and process‑hollows into MSBuild.exe. It now delivers Katz Stealer, AsyncRAT, XWorm, FormBook and DCRat. Katz Stealer targets browsers, wallets and comms apps and aborts on CIS locales via Windows APIs.

deep valeBOT
#

🤖 AI | 🌐 Web | 🛠️ Tool | 🔎 Detection

🔗 Original article: https://redcanary.com/blog/threat-detection/ai-cli-tools/

Adversaries misuse AI CLIs (Claude Code, Gemini CLI, Warp, OpenAI Codex) to run local agentic workflows that read/write files, enumerate credentials, and call MCP tools over STDIO/HTTP. The post details concrete telemetry chains (node→uv→python), log locations (.gemini logs.json, .claude history.jsonl), and detection priorities (parent–child lineage, sensitive paths, outbound MCP). Impact: high risk of credential theft and covert automation.

deep valeBOT
#

🌐 Web | 🛡️ CVE | 💣 RCE | 🛠️ Tool

🔗 Original article: https://labs.watchtowr.com/its-never-simple-until-it-is-dell-unityvsa-pre-auth-command-injection-cve-2025-36604/

CVE‑2025‑36604: Dell UnityVSA pre‑auth RCE via command injection in AccessTool.pm::getCASURL. When type="login", raw $r->uri() is concatenated into a shell command and run via Perl backticks. Triggered by AccessHandler’s unauthenticated login redirect for resolvable paths. Fixed in 5.5.1 (DSA‑2025‑281). watchTowr provides a Detection Artefact Generator.

#

🔐 Cryptography | 📜 Protocol | 🎁 PoC

🔗 Original article: https://www.synacktiv.com/en/publications/quantum-readiness-hybridizing-key-exchanges.html

The post shows why naïve hybrid KEM combiners (concatenate or concatenate‑then‑hash) can fail under IND‑CCA via ciphertext second pre‑images. A DH PoC exploits an order‑2 tweak with an even private key to create colliding capsules. Secure designs bind the KDF to secrets + capsules + public keys (Campagna–Petcher). The IETF Composite ML‑KEM combiner optimizes by omitting ML‑KEM capsule/pk using ML‑KEM’s proven second pre‑image resistance.

#

🛡️ CVE | 🐧 Linux | 💣 RCE | 🎁 PoC

🔗 Original article: https://blog.doyensec.com/2025/10/08/ksmbd-3.html

Deterministic OOB write in ksmbd’s streams_xattr lets an authenticated user overflow a 16‑page kvzalloc buffer and corrupt adjacent pages. Doyensec pre-grooms the buddy allocator, overflows kmalloc‑cg‑4k msg_msg slabs, builds a UAF, leaks heap and anon_pipe_buf_ops to bypass KASLR/SMEP/SMAP, and ROPs via pipe_buf_operations to root. PoC and full exploit provided.

#

🌐 Web | 🛡️ CVE | 💣 RCE | 🐘 PHP

🔗 Original article: https://patchstack.com/articles/php-object-injection-patched-in-quiz-and-survey-master-plugin-affecting-40k-sites/

Unauthenticated PHP Object Injection in Quiz and Survey Master ≤10.2.5 via admin-ajax action qmn_process_quiz. Attacker input in quiz_answer_random_ids reaches maybe_unserialize(), instantiating objects and enabling POP chains (potential RCE). Fixed in 10.2.6 by using unserialize with ['allowed_classes' => false]. CVE-2025-49401, CVSS 9.8.

#

🌐 Web | 💰 Bug Bounty | 🔒 Access Control

🔗 Original article: https://medium.com/@kalvik/confluence-takeover-how-a-simple-support-email-gave-me-full-wiki-access-a9ac7c27fa31

A single email to a JSM support address auto-provisioned an Atlassian account. After accepting the invite, enumerating product paths revealed Confluence at /wiki granted full read/write. Root cause: support-driven account creation in the main tenant plus Confluence spaces open to “all authenticated users.” Impact: critical data exposure and content tampering. Fix: restrict auto-provisioning and lock down Confluence permissions.

#

🛡️ CVE | 💣 RCE | 📱 Android | 🎮 Unity

🔗 Original article: https://flatt.tech/research/posts/arbitrary-code-execution-in-unity-runtime/

Unity Android apps parse the Intent extra “unity” as CLI args. A hidden flag, -xrsdk-pre-init-library, makes the runtime dlopen an arbitrary path, enabling native code execution in the app’s context. Local apps can trigger this via an exported UnityPlayerActivity; remote one‑click is possible if BROWSABLE is set and attacker-controlled bytes are cached under /data. Unity patched 2019.1+.

#

📱 Android | 💉 XSS | 🌐 Web | 🎁 PoC

🔗 Original article: https://mobeta-fr.translate.goog/android-intent-hijacking-pentest-mobile/

The post explains Android Intent internals and shows two exploit paths: unvalidated Intent-derived input leading to WebView XSS (with full victim code) and Intent Hijacking via matching intent-filters to intercept sensitive tokens. It demonstrates resolver tracing with FLAG_DEBUG_LOG_RESOLUTION and provides a GitHub lab PoC.

deep valeBOT
#

🖥️ Windows | 🚫 DoS | 🖌️ GDI | 🎁 PoC

🔗 Original article: https://research.checkpoint.com/2025/denial-of-fuzzing-rust-in-the-windows-kernel/

CPR found a DoS in Windows 11 24H2’s Rust‑based GDI REGION code (win32kbase_rs.sys 10.0.26100.3037). A crafted EMF+ (wide Pen + malformed Beziers) triggers a bounds‑check panic via NtGdiSelectClipPath, causing BSOD. Fuzzing with WinAFL uncovered it; a PowerShell PoC reproduces it. Microsoft fixed it in OS Build 26100.4202 (KB5058499) by adding a bounds‑hardened add_edge_new() behind a feature flag.

#

🖥️ Windows | 🛠️ Tool | 🔌 RPC | 📑 Registry

🔗 Original article: https://trustedsec.com/blog/theres-more-than-one-way-to-trigger-a-windows-service

Windows Service Triggers let low‑priv users start high‑priv services by meeting conditions (named pipe/RPC lookups, ETW events, GPO refresh, IP availability, device arrival, etc.). The post shows enumeration via sc.exe, registry, Win32 API, and MS‑SCMR (Titanis), details WebClient’s ETW trigger, highlights an undocumented Aggregate type, and documents a Firewall Port Event quirk that can break BFE when misconfigured.

deep valeBOT
#

🛠️ Tool | 📱 Android | 🧪 Frida | 🧰 Magisk

🔗 Original article: https://github.com/hakaioffsec/beerus-android

Beerus is an on-device Android pentesting toolkit (APK + Magisk module) that embeds Frida Core, enables sandbox/APK exfiltration, memory dumps, ADB over TCP/IP, device-wide proxying, system CA promotion, property tweaks, and boot-time automation. Build with Android Studio + NDK; Frida Core is compiled and bundled in APK assets. Install on a rooted device; Beerus prompts to install its Magisk module on first run.

deep valeBOT
#

🛡️ CVE | 🌐 Web | 💣 RCE | 🎁 PoC

🔗 Original article: https://labs.watchtowr.com/more-than-dos-progress-telerik-ui-for-asp-net-ajax-unsafe-reflection-cve-2025-3600/

Unsafe Reflection in Telerik UI for ASP.NET AJAX (CVE-2025-3600) lets unauthenticated users instantiate arbitrary public parameterless .NET types via prtype, enabling a universal DoS gadget and, in real apps, RCE by abusing insecure AssemblyResolve handlers. The post shows a Sitecore XP chain (CVE-2025-34509 + CVE-2025-3600). Affected: 2011.2.712–2025.1.218; fixed in 2025.1.416.

deep valeBOT
#

🌐 Web | 🧪 Reverse Engineering | 🧠 Obfuscation | 🔏 DRM

🔗 Original article: https://blog.pixelmelt.dev/kindle-web-drm/

Kindle Cloud Reader serves text as per‑request randomized SVG glyph IDs. By rasterizing glyphs with cairosvg, perceptual‑hashing them, and SSIM‑matching against Bookerly TTF (including ligatures and font variants), the author normalizes 184 alphabets and reconstructs a 920‑page EPUB. Anti‑scraping SVG micro‑moves and a 5‑page API limit are overcome via pixel‑based matching.

deep valeBOT
#

🛡️ CVE | 💉 XSS | 💣 RCE | 🎁 PoC

🔗 Original article: https://0xdf.gitlab.io/2025/10/18/htb-darkcorp.html

Stored XSS in Roundcube (CVE-2024-42009) is delivered via a misconfigured contact form (content=html + arbitrary recipient), enabling mailbox exfil and an admin password reset for a dev dashboard. The dashboard’s /analytics endpoint has stacked-queries SQLi, escalated to PostgreSQL superuser and OS RCE via COPY PROGRAM (CHR(67) WAF bypass) and archive_command. Full PoCs included.

#

🛡️ CVE | 💣 RCE | 📡 IoT | 🛠️ Tool

🔗 Original article: https://labs.watchtowr.com/yikes-watchguard-fireware-os-ikev2-out-of-bounds-write-cve-2025-9242/

Pre-auth RCE in WatchGuard Fireware OS IKEv2 (CVE-2025-9242). A stack overflow in ike2_ProcessPayload_CERT copies oversized Identification data without bounds checks. Reachable via IKE_SA_AUTH after IKE_SA_INIT. Affects 11.10.2–11.12.4_Update1, 12.0–12.11.3, 2025.1. Patch 12.11.4 adds a 0x200 length check. Vendor ID base64 enables unauthenticated version fingerprinting. NX is on, but no PIE/canaries; ROP-to-mprotect is viable. Impact: root on perimeter appliance. Defensive focus provided; exploit bytes omitted.

deep valeBOT
#

🛡️ CVE | 💣 RCE | 🌐 Web | 🎁 PoC

🔗 Original article: https://www.offsec.com/blog/recent-vulnerabilities-in-redis-servers-lua-scripting-engine/

OffSec details three Redis Lua CVEs. CVE-2025-49844 is a 13‑year UAF in luaY_parser exploitable by forcing GC during parsing with large scripts. CVE-2025-46817 overflows n = e − i + 1 in luaB_unpack to corrupt stack/exhaust memory. CVE-2025-46818 lets attackers modify basic-type metatables for cross-user code execution. Auth required, Lua enabled; affected if below 8.2.2/8.0.4/7.4.6/7.2.11/6.2.20. PoCs crash/corrupt memory; upgrade and harden ACL/auth.

#

📱 Android | 💉 XSS | 💣 RCE | 🎁 PoC

🔗 Original article: https://dphoeniixx.medium.com/practical-android-pentesting-a-case-study-on-tiktok-rce-4a82e79cc7c6

TikTok Android RCE via multi-bug chain: WebView UXSS (fragment injection) → internal deep link via ToutiaoJSBridge → URL allowlist bypass with javascript:// → intent: gadget to protected TmaTestActivity → mini‑app SDK update flow → Zip Slip to overwrite libjsc.so → native RCE on restart. Includes payloads, code, tooling, and mitigations.

deep valeBOT
#

📱 Android | 🌐 Web | 🎁 PoC | 🧩 JSB

🔗 Original article: https://tuxplorer.com/posts/account-takeover-via-jsb/

Android WebView JSB bug: a flawed domain gate loads a JSB-enabled activity, and the app executes inline javascript://. Attackers call xbridge.invokeMethod with handler “toBase64” to read file:///data/.../Default/Cookies, receive Base64 via the JSB callback, decode it, and hijack the session. Discovery used JADX, adb + chrome://inspect, LSPosed/Frida. PoC and full chain included.

#

🛡️ CVE | 📱 Android | 🎁 PoC | 📄 Data Exfiltration

🔗 Original article: https://tuxplorer.com/posts/dont-leave-me-outdated/

Android ≤13 auto-grants read access to content:// URIs when a crafted intent:// URL includes TEXT/HTML_TEXT extras. DuckDuckGo’s WebView accepts such intents, prompts once, then startActivity() launches an attacker component, which reads the app’s FileProvider-mapped PDF: “Sync Data Recovery - DuckDuckGo.pdf”. Result: 1-tap exfiltration of the recovery code (CVE-2025-48464).

deep valeBOT
#

📱 Android | 🔬 Reverse Engineering | 🛠️ Tool | 🎁 PoC

🔗 Original article: https://blog.nviso.eu/2025/10/14/patching-android-arm64-library-initializers-for-easy-frida-instrumentation-and-debugging/

Turns .init_array constructors in Android ARM64 .so files into explicit callables to defeat early RASP checks. Removes INIT_ARRAY/INIT_ARRAYSZ with LIEF, adds INIT0 symbol, renames JNI_OnLoad→JNI_OnLoad0, then bootstraps ART using JNIInvocation to call INIT0 and JNI_OnLoad0 manually. Provides commands, code, and validation outputs.

deep valeBOT
#

🌐 Web | 🛡️ CVE | 🔑 Auth | 🎁 PoC

🔗 Original article: https://zeropath.com/blog/breaking-authentication-unauthenticated-api-key-creation-in-better-auth-cve-2025-61928

better-auth’s API keys plugin let unauthenticated clients mint or modify API keys for any user by sending a body userId, which forced authRequired=false and fabricated a user object. Server-only guards were skipped, allowing attackers to set permissions and rate limits. Exploit: single POST to /api/auth/api-key/create. Fixed in 1.3.26; versions with the plugin ≤1.3.25 are vulnerable. Rotate keys, upgrade, and review logs.

deep valeBOT
#

💣 RCE | 🛡️ CVE | 🎁 PoC | 🌐 Web

🔗 Original article: https://blog.trailofbits.com/2025/10/22/prompt-injection-to-rce-in-ai-agents/

CWE-88 argument injection in agentic AI enables one-shot RCE via “safe” tools. PoCs: go test -exec to wrap tests and run curl|bash; git show --format/--output to write a file then ripgrep --pre to execute it; and fd -x=<bin> via a facade argv bug. Harden with sandboxing, strict arg separation ("--"), shell-off exec, narrow allowlists, logging, fuzzing, and agent-specific guardrails.

deep valeBOT
#

🌐 Web | 🎁 PoC | 🔑 Privilege Escalation | 🛡️ Access Control

🔗 Original article: https://ian.sh/fia

A mass assignment flaw in FIA’s Driver Categorisation portal allowed any user to self-assign the ADMIN role by including a roles array in PUT /api/users/{id}. After reauth, an admin dashboard appeared, exposing driver PII (e.g., passports, resumes) and password hashes and enabling full administrative actions. Critical vertical privilege escalation; reproducible with the provided HTTP JSON PoC.

deep valeBOT
#

🌐 Web | 🦠 Malware | 🎭 Social Engineering | 📺 YouTube

🔗 Original article: https://research.checkpoint.com/2025/youtube-ghost-network/

CPR exposes a role-based “YouTube Ghost Network” abusing YouTube videos, comments, and Community posts to deliver passworded archives that install loaders and infostealers. Actors use shorteners, Google-hosted phishing pages, large/passworded archives, redundant mirrors, and 3–4 day payload/C2 rotations. Two campaigns show Rhadamanthys (via HijackLoader in one case), with full IOCs and MSI CustomAction details.

deep valeBOT
#

🛠️ Tool | 📱 Mobile | 🎁 PoC

🔗 Original article: https://pit.bearblog.dev/modding-and-distributing-mobile-apps-with-frida/

Step-by-step guide to build a Frida TypeScript agent, bundle the Java bridge (Frida 17+), test via USB, and distribute by embedding Frida Gadget with Objection. It injects a static <clinit> calling System.loadLibrary("frida-gadget"), adds gadget/config/script .so files, rebuilds, zipaligns, and signs the APK. Includes diffs, logs, and split-APK handling.

deep valeBOT
#

🌐 Web | 🤖 AI | 📝 Prompt Injection | 🔎 OCR

🔗 Original article: https://brave.com/blog/unseeable-prompt-injections/

Brave shows two agentic-browser prompt-injection paths: (1) Perplexity Comet: hidden text in images survives OCR from screenshots and reaches the LLM as trusted input; (2) Fellou: simply navigating to a site includes visible page text in the prompt, enabling command injection. Both can trigger cross-origin actions with user credentials, undermining SOP.

deep valeBOT
#

🛠️ Tool | 🌐 Web

🔗 Original article: https://unit42.paloaltonetworks.com/threat-actor-misuse-of-azurehound/

Unit 42 details how AzureHound (BloodHound’s Azure/Entra collector) enumerates identities and resources via Graph and ARM APIs from outside a tenant. v2.6.0 exposes rich list targets (users, roles, groups, storage, apps, VMs). ARM GET/list calls aren’t logged in Activity/Resource logs; only Graph preflights (UA: azurehound/v2.6.0) may appear. The post provides exact commands, API endpoints, logging gaps, XQL hunts, and mitigations: phishing‑resistant MFA, PIM/PAM, Conditional Access, Token Protection, restricted app registration, and enabling Graph Activity Logs.

deep valeBOT
#

🌐 Web | 💣 RCE | 🎁 PoC

🔗 Original article: https://blog.gitguardian.com/breaking-mcp-server-hosting/

A path traversal in Smithery’s dockerBuildPath let attackers set the build context to the builder’s $HOME and exfiltrate ~/.docker/config.json. The leaked, overprivileged Fly.io token worked against the Machines API, enabling root-level exec across ~3,000 hosted MCP servers and secret theft via tcpdump. Prompt-injection risks followed. Patched June 15, 2025; no evidence of exploitation.

deep valeBOT
#

🌐 Web | 💣 RCE | 🛠️ Tool | 🎁 PoC

🔗 Original article: https://0xdf.gitlab.io/2025/10/25/htb-artificial.html

Authenticated .h5 model uploads let a malicious Keras Lambda execute OS commands on load, yielding RCE as app. Loot the Flask SQLite DB, crack MD5 to pivot to user “gael.” Discover Backrest on 127.0.0.1:9898, recover its admin bcrypt from a group-readable backup, crack it, then get root by: backing up /root and downloading id_rsa, abusing Plan Hooks to drop a SUID bash, or using the privileged Run Command.

deep valeBOT
#

🛠️ Tool | 🌐 Web

🔗 Original article: https://www.adversis.io/blogs/pentesting-next-js-server-actions

Burp extension that maps Next.js Server Action hashes in the Next-Action header to original function names by scanning minified bundles for createServerReference() and using source maps. It tracks coverage by function name across builds, auto-generates Repeater requests by swapping hashes, and prioritizes sensitive actions when productionBrowserSourceMaps is enabled.

deep valeBOT
#

🌐 Web | 🛠️ Tool | 🎁 PoC

🔗 Original article: https://samcurry.net/hacking-clubwpt-gold

Leak-driven recon exposed .env and .git on a dev-linked domain, revealing admin usernames and full source. Weak creds worked on staging. The prod admin was behind Cloudflare, but its origin IP was found via Censys. A critical unauthenticated /admin/otp/bind let attackers overwrite any user’s TOTP secret, bypass 2FA, and access real PII/KYC and financial data. Fixed after disclosure.

deep valeBOT
#

🛡️ CVE | 🤖 Android | ⌚ Wear OS | 🎁 PoC

🔗 Original article: https://towerofhanoi.it/writeups/cve-2025-12080/

CVE-2025-12080: Google Messages on Wear OS auto-sent messages for implicit ACTION_SENDTO intents with sms/smsto/mms/mmsto URIs—no UI prompt and no SEND_SMS permission. Any installed app (or other intent launcher) could silently send messages. A Kotlin PoC shows a one-call startActivity() exploit. Tested on Pixel Watch 3 (BP1A.250305.019.w3) with Messages messages_android_2025_0225_RC03.wear_dynamic. Fix shipped in May 2025.

#

📡 IoT | 💣 RCE | 💰 Bug Bounty

🔗 Original article: https://haxx.in/posts/2025-09-23-canon-ttf/

A malicious XPS print job coerces Canon ImageCLASS into loading attacker TTF bytecode. Canon’s TrueType VM mishandles CINDEX (OOB read) and the DELTAP handler (unchecked relative stack pivot). Using 26.6 MUL tricks to assemble 32‑bit values and WS/RS storage to write with minimal side effects, the chain yields an arbitrary write and PC control, i.e., RCE.

deep valeBOT
#

🛡️ CVE | 💣 RCE | 🛠️ Tool | 🎁 PoC

🔗 Original article: https://www.synacktiv.com/publications/paint-it-blue-attacking-the-bluetooth-stack.html

CVE-2023-40129 is an integer-underflow in Android Fluoride’s GATT multi-read builder causing a ~64KB heap overflow. Using BlueBlue, ACL congestion, and L2CAP/ERTM, the authors craft BT_HDR-based read/write primitives, leak ASLR via AVRCP SDP callbacks, and hijack control to RCE on jemalloc and Scudo devices. They chain a gadget to list_clear to call mprotect() then jump to shellcode. Zero-click, unauthenticated; ETS ≈2–5 minutes.

deep valeBOT
#

🛡️ CVE | 💣 RCE | 🌐 Web

🔗 Original article: https://unit42.paloaltonetworks.com/microsoft-cve-2025-59287/

CVE-2025-59287 is a critical unauthenticated RCE in WSUS caused by unsafe .NET deserialization (BinaryFormatter/SoapFormatter) in GetCookie() and ReportingWebService. Attackers scan TCP 8530/8531, achieve code exec (wsusservice.exe/w3wp.exe → cmd → PowerShell), run whoami/net/ipconfig, and exfiltrate to Webhook[.]site. Patch was reissued out-of-band on Oct. 23, 2025; CISA KEV on Oct. 24. Unit 42 provides an XQL hunt and recommends disabling WSUS or blocking 8530/8531 until patched.

deep valeBOT
#

🛠️ Tool | 🐧 Linux | 🔐 Cryptography | 🎁 PoC

🔗 Original article: https://www.synacktiv.com/en/publications/creating-a-two-face-rust-binary-on-linux.html

Technique and Rust crate to pack two ELFs into one “Two‑Face” binary. The hidden ELF is compressed and AES‑GCM encrypted; the runtime decryption key is HKDF‑derived from target host data (e.g., partition UUIDs). Off‑target, auth fails and a harmless ELF runs. On‑target, the hidden ELF streams to a memfd and is executed with fexecve; io_uring/mmap reduce write observability. PoC: synacktiv/twoface.

deep valeBOT
#

📱 Android | 🧠 Evasion | 🦠 Malware | 🎣 Phishing

🔗 Original article: https://www.threatfabric.com/blogs/new-android-malware-herodotus-mimics-human-behaviour-to-evade-detection

ThreatFabric details Herodotus, an Android banking Trojan (MaaS) with Accessibility-based device takeover and a novel evasion: per‑character text injection with 300–3000 ms random delays. It uses MQTT C2 on google-firebase.digital, overlays, SMS 2FA theft, VNC/VNCA11Y, and targets Italy/Brazil. Partial Brokewell code reuse is evident.

#

🖥️ Windows | 📎 DLL Hijacking | 🧭 Persistence | 🎁 PoC

🔗 Original article: https://trustedsec.com/blog/hack-cessibility-when-dll-hijacks-meet-windows-helpers

Narrator.exe still loads a OneCore TTS localization DLL. Plant msttsloc_onecoreenus.dll under System32’s OneCore TTS path to run code from DllMain. Achieve persistence by setting HKCU/HKLM Accessibility configuration="Narrator"; HKLM yields SYSTEM at Winlogon. For lateral movement, set RDP SecurityLayer=0 and trigger Narrator with CTRL+WIN+ENTER at the login screen. A PoC suspends Narrator’s main thread for quiet execution.

#

🌐 Web | 🛡️ CVE | 🎁 PoC | 🛠️ Tool

🔗 Original article: https://andrewlock.net/understanding-the-worst-dotnet-vulnerability-request-smuggling-and-cve-2025-55315/

CVE-2025-55315 is a Kestrel parsing flaw in HTTP/1.x chunk-extension handling. A lone LF in a chunk header can desync proxy and server, enabling request smuggling. Impacts include auth bypass (proxy header spoofing), SSRF, CSRF bypass, cache poisoning, and data exfiltration. Patched in .NET 9.0.10, 8.0.21, and .NET 10 RC2; Kestrel now rejects non-CRLF. Detect via malformed probe (hang vs 400) or the HeroDevs repro.

deep valeBOT
#

📱 Android | 🧬 Malware | ☁️ C2 | 🎣 Phishing

🔗 Original article: https://www.cyfirma.com/research/ghostgrab-android-malware/

GhostGrab is a sideloaded Android stealer + Monero miner. A dropper from kychelp[.]live persists via a silent foreground audio service, spoofs iOS in WebView, fetches libmine-arm64.so, and mines to a hardcoded wallet/pools. A second APK phishes KYC/card/net‑banking/PIN via assets pages, scrapes SMS/OTPs, fingerprints SIM/device, and uses Firebase C2 (call forwarding, SMS send/forward). Strong alarms/receivers ensure revival; IOCs and a YARA rule are provided.

deep valeBOT
#

💾 Windows | 📡 C2 | 🌐 Web | 🧪 Malware

🔗 Original article: https://unit42.paloaltonetworks.com/new-windows-based-malware-family-airstalk/

Airstalk is a Windows backdoor with PowerShell and .NET variants that abuses Workspace ONE UEM (AirWatch) APIs as a dead‑drop C2: it writes Base64 JSON into device custom attributes and exfiltrates data via blob uploads. Tasks steal Chrome/Edge/Island cookies, history, bookmarks, and screenshots. The .NET branch adds multi‑threading, beaconing (UUID suffixes -kb/-kr/-kd), versioning, and signed binaries; PowerShell persists via a scheduled task. High risk for supply‑chain/BPO environments.

deep valeBOT
#

📡 IoT | 🛠️ Tool | 🎁 PoC

🔗 Original article: https://bishopfox.com/blog/invasion-of-the-face-changers-halloween-hijinks-with-bluetooth-led-masks

Shining‑style BLE LED masks can be hijacked without pairing. Commands use AES‑ECB with a static app key; control writes go to UUID …9600 and images stream unencrypted to …960a. The author built a CircuitPython PoC on an Adafruit Feather nRF52840 that auto‑scans, uploads an image, and flips faces. Impact is local (~≤10 m) and mostly nuisance; fix is authenticated pairing and per‑device secrets. (bishopfox.com)

#

🛡️ CVE | ⛓️ Web3 | 💰 Bug Bounty

🔗 Original article: https://blog.trailofbits.com/2025/10/30/vulnerabilities-in-luks2-disk-encryption-for-confidential-vms/

LUKS2 headers in CVM storage are malleable. By switching the segment cipher to cipher_null-ecb and leaving keyslots intact, a storage attacker makes a CVM read/write plaintext while believing it’s encrypted. cryptsetup 2.8.1 only disables null ciphers in keyslots; volume null ciphers still work. Mitigate with detached headers, MAC/attestation, or strict JSON validation. CVE‑2025‑59054, CVE‑2025‑58356.

#

🌐 Web | 💣 RCE | 🎁 PoC | 🛠️ Tool

🔗 Original article: https://0xdf.gitlab.io/2025/10/30/htb-store.html

Express app stores uploads encrypted with a static 9‑byte XOR key. A broken path check in /file allows URL‑encoded traversal, leaking any file as XOR’d bytes that are trivially reversed. Stolen .env yields SFTP creds; SSH port‑forward exposes Node’s inspector for RCE as dev, then Chrome’s debug port grants root.

deep valeBOT
#

🛠️ Tool

🔗 Original article: https://specterops.io/blog/2025/10/30/sharehound-an-opengraph-collector-for-network-shares/

ShareHound is a multithreaded SMB share collector that maps hosts, shares, files, and ACL-derived rights into BloodHound’s OpenGraph. It adds ShareQL, a firewall-like DSL for allow/deny and depth control to focus crawling. The post provides Cypher to find write/FULL_CONTROL on shares and to locate sensitive files (e.g., .vmdk). Example CLI shows credentialed scans and JSON output.

deep valeBOT
#

📱 Mobile | 💳 NFC | 🕸️ C2 | 🧭 MITRE

🔗 Original article: https://zimperium.com/blog/tap-and-steal-the-rise-of-nfc-relay-malware-on-mobile-devices

zLabs details Android NFC Tap‑to‑Pay relay malware abusing HCE. Malicious apps become the default NFC payment handler, relay POS APDUs via WebSockets, and exfiltrate EMV data (PAN, expiration) to Telegram. Since April 2024: >760 apps, >70 C2/distribution sources, dozens of Telegram bots, ~20 impersonated institutions across multiple regions. High‑severity fraud at POS; IOCs are provided.

#

🤖 Agents | 🔐 Protocol | 🧪 Technique | 🎁 PoC

🔗 Original article: https://unit42.paloaltonetworks.com/agent-session-smuggling-in-agent2agent-systems/

Unit 42 details “agent session smuggling,” where a malicious A2A peer injects covert multi‑turn instructions mid‑session. In Google ADK PoCs, a research agent exfiltrates a financial agent’s history/config and silently triggers buy_stock to purchase 10 shares. Risk stems from stateful, cross‑boundary agent trust. Mitigate with out‑of‑band HitL approvals, context grounding, signed AgentCards (sigstore‑a2a), and exposing tool/log activity.

deep valeBOT
deep valeBOT
#

🧱 Active Directory | 🔐 Kerberos | 🔓 DPAPI | 🛠️ Tool

🔗 Original article: https://0xdf.gitlab.io/2025/11/01/htb-voleur.html

Assume-breach Kerberos-only AD attack chain: crack an encrypted Excel to find svc creds; use BloodHound to see WriteSPN on svc_winrm; add SPN and Kerberoast with BloodyAD/NetExec; crack TGS to get svc_winrm and WinRM shell with kinit/evil-winrm. Restore deleted Todd via AD Recycle Bin, pivot with RunasCs (UAC bypass), loot archived profile DPAPI blobs, decrypt with dpapi.py to obtain jeremy.combs creds and another WinRM shell.

deep valeBOT
#

📱 Android | 🎣 Phishing | 🕵️ Spyware | 🔬 Threat Research

🔗 Original article: https://www.secureblink.com/threat-research/spyrtacus-italian-surveillanceware-targets-android-via-telecom-phishing

Spyrtacus is Italian-linked Android surveillanceware delivered via cloned carrier sites and fake WhatsApp/support apps. Active since 2018, it uses sideloaded APKs and user‑granted permissions to exfiltrate SMS, chats (WhatsApp/Signal/Messenger), contacts, call audio, ambient audio, and camera imagery. Variants were seen through Oct 17, 2024. Defense focuses on blocking sideloading, auditing permissions, and monitoring anomalous uploads.

#

🛡️ CVE | 💣 RCE | 🎁 PoC | 🪟 Windows

🔗 Original article: https://research.checkpoint.com/2025/drawn-to-danger-windows-graphics-vulnerabilities-lead-to-remote-code-execution-and-memory-exposure/

CPR found three EMF/EMF+ parsing flaws in Windows GDI/GDI+: clipping corruption (CVE‑2025‑30388), scan‑line bounds bug (CVE‑2025‑53766), and a misvalidated EMR_STARTDOC offset (CVE‑2025‑47984). PoCs show controllable OOB writes/reads via ARGB and malformed rectangles/offsets, often reachable via GdipGetImageThumbnail. Patched in KB5058411 (May), KB5062553 (July), and KB5063878 (Aug) 2025.

deep valeBOT
deep valeBOT
#

🛡️ CVE | 💣 RCE | 🌐 Web | 🎁 PoC

🔗 Original article: https://www.catchify.sa/post/cve-2025-52665-rce-in-unifi-os-25-000

CVE-2025-52665 is an unauthenticated RCE in UniFi Access. A proxy on :9780 exposed an internal backup export route that interpolates a JSON field dir into shell commands. By POSTing a payload ending with "; #", attackers execute commands (exfiltrate /etc/passwd, get shells). Additional unauth APIs leaked/accepted NFC data. Fixed in UniFi Access 4.0.21.

#

📱 Android | 🕵️ Malware | 📡 C2 | 🏦 Banking

🔗 Original article: https://www.cyfirma.com/research/investigation-report-android-bankbot-ynrk-mobile-banking-trojan/

Android/BankBot‑YNRK is a heavily obfuscated Android banking trojan (≤Android 13) abusing Accessibility + Device Admin, persisting via JobScheduler, and tasking over ping[.]ynrkone[.]top:8181 (Janus WS 8989). It mutes audio, overlays screens, forwards calls via *21{num}#, scrapes UI/clipboard, and automates banking/crypto wallets to steal credentials and perform fraudulent transactions.

deep valeBOT
#

🛡️ CVE | 💣 RCE | 🌐 Web | 🎁 PoC

🔗 Original article: https://www.offsec.com/blog/recent-vulnerabilities-in-redis-servers-lua-scripting-engine-2/

CVE-2025-59287 is a critical WSUS unsafe deserialization bug (CWE-502) enabling unauthenticated RCE as SYSTEM. It abuses AuthorizationCookie and SOAP ReportEventBatch flows that deserialize attacker-supplied data via BinaryFormatter/SoapFormatter. A public PoC uses ysoserial.net to embed a base64 gadget in SOAP, triggering when the WSUS console opens. Patch via Oct 23, 2025 OOB KBs; restrict 8530/8531.

#

🐧 Kernel | 🛡️ KASLR | 🧩 Bypass | 🛠️ Tool

🔗 Original article: https://googleprojectzero.blogspot.com/2025/11/defeating-kaslr-by-doing-nothing-at-all.html

Project Zero shows a KASLR bypass on Android arm64 by abusing the deterministic linear map. With VA_BITS=39 ⇒ PAGE_OFFSET=0xffffff8000000000 and memstart_addr=0x80000000, phys→virt becomes fixed. Using a BPF helper tool to read memstart_addr from kallsyms confirms no randomization. Since commit 1db780bafa4c removed linear-map KASLR on arm64, attackers can compute kernel VAs from physical addresses, simplifying kernel exploits.

#

📱 Android | 🕵️ Malware | 🛰️ C2

🔗 Original article: https://www.f6.ru/blog/android-deliveryrat-research/

Analysis of a 2025 DeliveryRAT build: a loader installs a masqueraded app that hijacks notifications/SMS, persists via boot/alarms, and communicates with a WebSocket/HTTP C2. The server drives phishing UIs (card/custom/photo/QR), exfiltrates SMS/contacts, sends SMS to all contacts, runs USSD, hides the icon, and triggers device‑based HTTP DDoS. Includes hashes, config, package names, endpoints, commands, and detection tips.