Pentest.blog

"Inn for security folks. We just want to give back and help people learn. That’s all." pentest team of INVICTUS / PRODAFT.

[Pentest.blog @pentestblog]

Ladies and Gentlemen, Let me introduce https://t.co/R6oZTUTySD 🎉🎊🎈.

[Mehmet INCE @mdisec]

📢📢📢Update your Roxy-WI asap now! 📢📢📢

CVSS : 10.0 🔥

Our beloved researcher @ncilengir from @PRODAFT found an authentication bypass and multiple RCEs.

Here is the @pentestblog technical write-up👇

https://t.co/O2iriYRJXM

PS: Metasploit module merged to the master 😇

[Pentest.blog @pentestblog]

Advisory Alert | GLPI Project Remote Code Execution ! Update your GLPI asap 📢

Our beloved vulnerability researcher @der3ctus has released a write-up 🎉🤘

https://t.co/IrhGfac6rl

[Pentest.blog @pentestblog]

Advisory Alert | GLPI Project Remote Code Execution ! Update your GLPI asap 📢

Our beloved vulnerability researcher @der3ctus has released a write-up 🎉🤘

https://t.co/IrhGfac6rl

[PRODAFT @PRODAFT]

PRODAFT Threat Intelligence (PTI) team has issued a new report on the inner workings of the notorious #Conti ransomware group which is currently recognized as the most dangerous #ransomware operation in terms of its revenue and target selection.
https://t.co/EcqR8sgCxX

[Mehmet INCE @mdisec]

LiderAhenk 0day – All your PARDUS Clients Belongs To Me

https://t.co/7Brs5w67zq

[Pentest.blog @pentestblog]

🤘🤘♥️

[Mehmet INCE @mdisec]

Pardus 21 Linux Distro – Remote Code Execution 0day 2021

https://t.co/ctgXxcjcOL

[ege @egeblc]

Amber v3.0 is out !! 🎉🥳 Here is the changelog;
- Entire codebase rewritten from scratch
- No external dependency O_O
- Much more evasive PE loader
- New generation SGN encoder
- New CRC32 based API resolvers
- Much smaller C++ stub
- Simplified usage

https://t.co/dGusahoExU

[Threat Intelligence Blog @threatintelblog]

The second part of our Article Series: "OpBlueRaven: Unveiling Fin7/Carbanak" has just been published! In the second article; we are deailing with BadUSB attacks carried out by these threat actors!
https://t.co/eftajqcfzb

[Pentest.blog @pentestblog]

Please follow our threat intel team twitter account 🚀

[Threat Intelligence Blog @threatintelblog]

The second part of our Article Series: "OpBlueRaven: Unveiling Fin7/Carbanak" has just been published! In the second article; we are deailing with BadUSB attacks carried out by these threat actors!
https://t.co/eftajqcfzb

[PRODAFT @PRODAFT]

Our latest initiative, Threat Intelligence Blog is live at https://t.co/QEwL2HUe5z . You'll want to see what we have to share.

[GitHub Security Lab @GHSecurityLab]

Take a deep dive into command injection vulns with @mdisec's talk at the GitHub Security meetup. Tune in Wednesday July 15, 2020, at 5pm CET (Central Europe) - 8am PDT (Pacific Time) https://t.co/hoxPRJu3uc

[Mehmet INCE @mdisec]

👀👀👀
ZDI-20-676
ZDI-20-677
ZDI-20-678

[PRODAFT | Türkiye @PRODAFT_TR]

[EN] We would like to thank @yeswehack for their support and sponsorship in https://t.co/pU6mKjC0Ff event! Thanks guys, this means a lot!

[Mehmet INCE @mdisec]

[EN] - https://t.co/TyID03JGL9 is a live cyber security conference, which is going to be free for everyone, at 22nd of May 2020, 9:59 GTM+3 !

CFP is open 🤘🏻

[ZeroSecurity @Zer0Security]

Vesta Control Panel Second Order Remote Code Execution 0day Step-by-Step Analysis https://t.co/jX2qjptwL7

[Nicolas Krassas @Dinosn]

Vesta Control Panel Second Order Remote Code Execution 0day Step-by-Step Analysis

https://t.co/wW7ND4btWv

[Mehmet INCE @mdisec]

Quarantine day 5.

Vesta Control Panel Second Order Remote Code Execution 0day Step-by-Step Analysis

https://t.co/Mfix2Pje4q

[RIVER @wugeej]

[PoC] Seagate Central Storage Remote Code Execution 0day

#NAS
#Seagate

no longer 0-day, But Seagate NAS not safety

./cirrus/application/core/MV_BaseController.php -> set_start_info function -> sets the device state -> open the service of ssh

https://t.co/G0bazifBFs

[Darren Martyn @_darrenmartyn]

So Seagate mark this persons finding (preauth RCE) as a WONTFIX, EOL and then ask them to STFU about it (after denying the issue a bit).

"Lastly, Seagate asks the submitter, EgeBalci, to abide by the Bugcrowd Nondisclosure policy"

Fuck that noise.

https://t.co/lWE1q9YRSj

[Pentest.blog @pentestblog]

Advisory | Seagate Central Storage Remote Code Execution 0day from @egeblc https://t.co/HfsHbmsBoa