Fgsec

[mayllart @ThiagoMayllart]

In case you guys are fans of the amazing job done by @_RastaMouse and @cobbr_io in Covenant C2 just like me. I've added Reverse Port Forward functionality to it in this fork: https://t.co/Fub1D5Tpp8. Just use the new Grunt: GruntHTTPPortForward and the command: rportfwd.

[Fgsec @Felipegaspar]

From CSRF to RCE (CVE-2019-10874) - Bolt CMS - https://t.co/q8aPkM2NnV

[Florian Roth ⚡️ @cyb3rops]

Cheat Sheets for developers on how to prevent typical vulnerabilities in web applications

[CVE @CVEnew]

CVE-2019-10874 Cross Site Request Forgery (CSRF) in the bolt/upload File Upload feature in Bolt CMS 3.6.6 allows remote attackers to execute arbitrary code by uploading a JavaScript file to include executable extensions in the file/edit/config/config.ym... https://t.co/sOAHjieWBV

[Giorgio Bonfiglio @g_bonfiglio]

I’ve got a confession: it wasn’t easy to come up with the decision to share with you all, but...

I use ‘nano’.

[x0rz @x0rz]

Interesting backdoor C2 channel to be used here, especially combined with a malicious browser extension for instance. I urge you to look at the current workers running on your browser, you'll be amazed.

[The Hacker News @TheHackersNews]

Tampering with Windows Event Tracing: Background, Offense, and Defense by Palantir
https://t.co/2lzrJE1LNR

[Emad Shanab - أبو عبد الله @Alra3ees]

Active Directory Security For Red & Blue Team.

-Discovery
-Privilege Escalation
-Defense Evasion
-Credential Dumping
-Lateral Movement
-Persistence
-Defense & Detection https://t.co/miggsqVngk

[Marius Avram @securityshell]

WAF/IPS/DLP bypass Cheat Sheet https://t.co/B8OADy08x2 by @i_bo0om

[Nicolas Krassas @Dinosn]

Office 365 and Azure AD vulnerable to brute-force and password spray attacks
https://t.co/58aqNqFpnp

[D3fa1t @D3fa1t_]

https://t.co/75V9K6gmQe

An intro into hardware security.
Part 1: cache side channel Flush+reload.

[Fabio Assolini @assolini]

Cisco zero-day exploited in the wild to crash and reload devices https://t.co/AsRqwE7KYt

[x0rz @x0rz]

Oh, a new #Phrack paper is out: (De)coding an iOS Kernel Vulnerability (CVE-2018-4109), by @doadam 👍 https://t.co/1Z1OoKAZEY #iOS #vulnerability

[x0rz @x0rz]

Detecting the jQuery File Upload plugin vulnerability (CVE-2018-9206) exploit using Falco https://t.co/3TIYN8IB4a #DFIR #apache #detection

[x0rz @x0rz]

Nginx off-by-slash vulnerability, cool trick presented by @orange_8361 at #hacklu

[r2tips @r2tips]

Hello World! In this shared account we will provide tips and tricks for radare2. Follow us if you are interested in learning more about it!

[cpl @cpl3h]

Leveraging WSUS – Part One https://t.co/ER2GqyINZZ

[Paul Melson @pmelson]

If you wanted to know what the absolute bottom of the malware food chain looks like, this is it; a Windows batch file that uses certutil to drop and run MEMZ. https://t.co/jlnDg9wCtG

[Stan Hegt @StanHacked]

.CSV plain text remote code execution abusing SYLK on Office 2011 for Mac. No warnings, direct execution after opening. Product is EOL, so a fix won’t be issued by @microsoft.

[Baptiste Robert @fs0c131y]

One of my math teacher told me that a long time ago. This is so true.