Fortech Security

[Fortech Security @SecurityFortech]

@JoeBudden Y'all are always loud and wrong. His vlogs are literally still on youtube! Nothing deleted!

[Phil Venables @philvenables]

Vulnerability Management. A thread.

I don’t see much written on vulnerability management in more holistic terms vs. patch/bug fixing. This might be ok given a lot of vuln. mgmt. should be contextualized into enterprise risk/control. But still worth a short thread.......

1/13

[Fortech Security @SecurityFortech]

@BarackObama Victony & Tempoe - Soweto

https://t.co/5WitLVaGnl

[daniel:// stenberg:// @bagder]

We are cutting the release cycle short and will release curl 8.4.0 on October 11, including a fix for a severity HIGH CVE. Buckle up.

[Today Cyber News @TodayCyberNews]

💻 What to look for on a site with IIS?

1. Use shortscan to search for short (and possibly full) filenames and extensions.

- shortscan : - https://t.co/g2EIuBES1T

2. Check for reverse proxy and try directory traversal:
/backend/ -> 10.0.0.1/api/
/backend/..%2Ftest -> 10.0.0.1/test

- You can read more here :- https://t.co/SGoeW63Rjc

3. When we can get the file expansion, we look at the keys in web.conf and try to get the RCE through deserialization.

- Read about it here :- https://t.co/RjxwZs9GKK

4. Trying to load files .asp , .aspx , .ashx and so on

- Full list here :- https://t.co/2CEhDWrUNj

👀 Check Out Old Tweets Of @TodayCyberNews

#CyberSecurity #bugbountytips #BugBounty #infosec #iis #rce

[mRr3b00t @UK_Daniel_Card]

################################
CVE-2023-38408: Remote Code Execution in OpenSSH's forwarded ssh-agent
################################

now.. first questions...

how many devices in your enterprise do you have running a vulnerable version of SSH?
How many of these are internet facing?
are there in the wild exploitation?
Do you need to patch regardless? (think cyber essentials)
are there even patches available?
At what priority should you patch this vs other vulnerabilities?

#Vulnerability #Management

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

How many of these do you know? 100 web app exploits, in case you were bored :)

Cross-Site Scripting (XSS)
SQL Injection
Cross-Site Request Forgery (CSRF)
Remote File Inclusion (RFI)
Local File Inclusion (LFI)
Server-Side Request Forgery (SSRF)
Clickjacking
Directory Traversal
XML External Entity (XXE) Injection
Command Injection
Path Traversal
Session Hijacking
Remote Code Execution (RCE)
Server-Side Template Injection (SSTI)
Insecure Direct Object References (IDOR)
Open Redirects
Server-Side Request Forgery (SSRF)
Authentication Bypass
Buffer Overflow
Insecure Deserialization
Content Spoofing
Security Misconfiguration
Unvalidated Redirects and Forwards
Insecure File Upload
Broken Authentication and Session Management
Brute Force Attacks
Server-Side JavaScript Injection
Forced Browsing
Code Injection
LDAP Injection
HTTP Response Splitting
XML Injection
JSON Injection
DOM-based XSS
HTML Injection
Phishing Attacks
Server-Side Include (SSI) Injection
Host Header Injection
FTP Injection
Email Header Injection
HTTP Verb Tampering
XML Schema Poisoning
Cross-Site Printing
XML Quadratic Blowup
Cookie Poisoning
HTTP Parameter Pollution (HPP)
Cross-Site Script Inclusion (XSSI)
LDAP Injection
XPath Injection
Unicode/UTF-8 Encoding Attacks
Session Fixation
Insufficient Transport Layer Security (TLS)
HTML5 Security Issues
Business Logic Flaws
Frame Injection
Server-Side Remote File Execution
Cross-Site Tracing (XST)
Client-Side Validation Bypass
Time-Based Blind SQL Injection
Reflected File Download
Server-Side Template Injection
WebSocket Hijacking
Cross-Site Port Attacks
DOM Clobbering
Server-Side Flash Injection
Null Byte Injection
Remote Command Execution via Shell Metacharacters
Business Process Compromise
NoSQL Injection
HTTP Host Header Attacks
Server-Side HTTP Parameter Pollution (SS-HPP)
XML Bomb
Server-Side Data Tampering
Server-Side Request Forgery (SSRF)
Padding Oracle Attacks
CRLF Injection
Server-Side JavaScript Execution
Protocol Attacks (e.g., LDAP, SMTP, DNS)
Blind SQL Injection
Server-Side Cross-Site Scripting (XSS)
Server-Side File Disclosure
Code Review Vulnerabilities
HTTP Parameter Pollution (HPP)
Cache Poisoning
Forced Click
WebSocket Vulnerabilities
Server Misconfiguration
Cross-Site Script Inclusion (XSSI)
Web Shell Upload
User Enumeration
Security Through Obscurity Vulnerabilities
Unicode Normalization Issues
Server-Side LDAP Injection
Server-Side SQL Injection
Cross-Site Printing
Server-Side Template Injection (SSTI)
HTML Injection in Error Messages
Server-Side HTTP Parameter Pollution (SS-HPP)
Server-Side DoS (Denial of Service)
Business Logic Abuse

[Dr. Simon @goddek]

#7 So what can you do?
▪️Eat saturated fats and cut out seed oils
▪️Limit carbs and sugars
▪️Grow your own food in your self-made compost
▪️Exercise at least 3 times a week
▪️Limit your screen time
▪️Enjoy the sun as much as possible
▪️Read the book 'Turtles All the Way Down'

[Ben Sadeghipour @NahamSec]

Lessons Learned From @Hacker0x01's Live Hacking Event (h1-4420)!

Shout outs to @alicanact60, @shm0ul and @ajxchapman for all their help throughout the event!

🎥👉🏼 https://t.co/s4x1qkL2QG

[Ben Sadeghipour @NahamSec]

I'm working on a talk and looking for some ideas for port scanning. I'm currently scanning ports 443,8443,8000,5000 across a set of IP addresses. What other ones would you scan and why? 8081? 3000?

[Fabian Bader @fabian_bader]

#CVE #Hunting #MDE #M365D CVE-2023-21554
Alternative to look only at process events

DeviceProcessEvents
| where Timestamp > ago(30d)
| where ProcessVersionInfoOriginalFileName has "MQSVC"
| summarize by DeviceName

[Fabian Bader @fabian_bader]

#CVE #Hunting #MDE #M365D
CVE-2023-21554

DeviceNetworkEvents
| where Timestamp > ago(30d)
| where ActionType == "ListeningConnectionCreated"
| where LocalPort == "1801"
| where InitiatingProcessVersionInfoOriginalFileName has "MQSVC"
| summarize by DeviceName

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

Cross-site scripting (XSS)
SQL injection (SQLi)
Cross-site request forgery (CSRF)
Server-side request forgery (SSRF)
Remote code execution (RCE)
File inclusion
Authentication bypass
Information disclosure
XML injection
Clickjacking
Open redirect
Directory traversal
Session hijacking
Buffer overflow
Command injection
LDAP injection
XPath injection
JSON injection
Path traversal
Broken access control
Insufficient authentication and authorization
Insecure direct object references
Insecure communications
Improper error handling
Weak cryptography
Business logic vulnerabilities
Server-side template injection (SSTI)
Server-side script injection (SSSI)
Prototype pollution
Cross-origin resource sharing (CORS) misconfiguration
HTTP response splitting
Object injection
Mass assignment vulnerabilities
Race conditions
HTML injection (also known as injection via untrusted input)
Broken cryptography
Broken authentication and session management
Server-side cache poisoning
Server-side deserialization
Websocket vulnerabilities
Information leakage vulnerabilities
Server-side subdomain takeover
Insecure file upload
Sensitive data exposure
Broken access controls
Click-to-play attacks
Authentication weaknesses
Web cache poisoning
Template injection vulnerabilities
Remote file inclusion (RFI)
Local file inclusion (LFI)
OAuth and OpenID Connect weaknesses
HTTP request smuggling
Insufficient transport layer protection
Insecure storage of sensitive information
Insecure password management
Insecure permissions
Insecure random number generation
Insufficient logging and monitoring
Mobile app vulnerabilities
API vulnerabilities
Business logic flaws
Docker and containerization vulnerabilities
Race conditions
Insecure deserialization
Subdomain takeover
Bypassing rate limits
Social engineering attacks
DNS cache poisoning
Path traversal attacks
Command injection (also known as OS command injection)
XML external entity (XXE) injection
Host header injection
Security misconfigurations
Clickjacking (also known as UI redressing)
HTML5 security issues
HTTPS stripping
DNS rebinding
Cryptographic attacks, such as Padding Oracle attacks and POODLE attacks
Side-channel attacks
Buffer overflows
Time-of-check to time-of-use (TOCTTOU) vulnerabilities
Unvalidated redirects and forwards
Broken function-level authorization
Server-side request forgery (SSRF) with DNS rebinding
Blind SQL injection
Cross-Site WebSocket Hijacking (CSWSH)
Insecure third-party dependencies
Man-in-the-middle (MITM) attacks
HTTP parameter pollution
Exploiting weak password policies
DOM-based XSS
Cross-Site WebSocket Forgery (CSWF)
Cryptographic key management issues
Security misconfigurations in serverless applications
Insecure direct object references in RESTful APIs
Insecure storage of secrets in mobile apps
Insecure deserialization in RESTful APIs
Insufficient monitoring and logging of API activities
Business process vulnerabilities in e-commerce applications
Improper certificate validation in SSL/TLS
Exploiting insecure default configurations of software components
Vulnerabilities in biometric authentication systems

[Joygasim Gamin @JoygasimG]

@NahamSec https://t.co/oniYCTz6ym

[Brandon Rossi @0xConda]

I started doing bug bounty on the side about 8 months ago. Here's what I've found 👇

[Amy Pechacek @pechacek_amy]

It feels illegal to know about these 16 websites:

[Shir @shirtamari]

Vulnerability full disclosure - New Oracle cloud vulnerability allowed users to access the virtual disks of other Oracle customers >>

[Marko Denic @denicmarko]

Stanford University offers this free course on Web Security.

The course covers:

1. HTTP, Cookies, Sessions
2. Same Origin Policy
3. Cross-Site Scripting (XSS)
4. Denial-of-service, Phishing, Side Channels
5. WebAuthn
6. Server security
and more...

Link: https://t.co/hFm55j3lYp

[TayOnTech @TayOnTech]

https://t.co/pnigbgPZjV is a great resource for learning cloud security. It’s basically a CTF for an AWS environment.