Arafat Bique

OSCP+ and Sushi

[Jai Minton @CyberRaiju]

Axios Supply Chain Compromise:

IOCs -
All
sfrclak[.]com

Windows
Disk C:\ProgramData\wt.exe
Network packages[.]npm[.]org/product1

MacOS
Disk /Library/Caches/com.apple.act.mond
Network packages[.]npm[.]org/product0

Linux
Disk /tmp/ld.py
Network packages[.]npm[.]org/product2

[Arafat Bique @B1qu3]

After #blackhat and #defcon, is time to say bye bye Sin City :)

[Arafat Bique @B1qu3]

@_xpn_ lol 😜

[Arafat Bique @B1qu3]

@TheMsterDoctor1 @elvtnx Follow

[Anton @therceman]

Bug Bounty Tip

You can ask #ChatGPT to prepare a report for your vulnerability with auto-generated description, impact, remediation steps, and recommendations.

Prompt Example:
write a bugbounty report about XSS as follows http://website/?q=<script>alert(1337)</script>

Cheers!

[Arafat Bique @B1qu3]

Peritos e especialistas,,, anda em voga :)

[PT SWARM @ptswarm]

🔥 Veeam fixed an Unauth RCE (CVE-2022-26500, CVE-2022-26501) in Veeam Backup & Replication and a Local Privilege Escalation (CVE-2022-26503) in Veeam Agent for Microsoft Windows found by our researcher @ultrayoba.

Advisory: https://t.co/tRYsKBn3HD

[Arafat Bique @B1qu3]

The dark side of security isn't evaluated by someone who dresses better or has the tie of the company's reputation

[Arafat Bique @B1qu3]

after incident, trying to get log event :)

[Jeremy Long @ctxt]

@owasp dependency-check 7.0.0 was just released! Note that there are breaking changes in this release - https://t.co/16kPxjFm6S

[Arafat Bique @B1qu3]

Beat CRISC :)

[Arafat Bique @B1qu3]

Sunday day, I beat CRISC :)

[Arafat Bique @B1qu3]

Se fosse em África seríamos incompetentes nem…

[CrowdSec @Crowd_Security]

❗Check the world's Log4j Threat Tracker in real-time reported by the CrowdSec Community:

▶️ Visualize critical data
▶️ Find out more about attackers
▶️ Access the list of spotted IPs trying to exploit the Log4j vulnerability

[Arafat Bique @B1qu3]

@d4rckh 🤣🤣🤣🤣

[Andrei @handrei_1]

Someone is angry #log4j

[SANS.edu Internet Storm Center @sans_isc]

Log4j / Log4Shell Followup: What we see and how to defend #log4shell #log4j #log4js https://t.co/Po5PiIQjJG

[Cube0x0 @cube0x0]

Scanner and automated exploitation of the CVE-2021-42287/CVE-2021-42278.
Yet another low effort domain user to domain admin exploit
https://t.co/9M5YbPIyaP

[Deutsche Telekom CERT @DTCERT]

🚨⚠️New #0-day vulnerability tracked under "Log4Shell" and CVE-2021-44228 discovered in Apache Log4j 🌶️‼️ We are observing attacks in our honeypot infrastructure coming from the TOR network. Find Mitigation instructions here: https://t.co/tUKJSn8RPF