Network Security Channel
Open in Telegram
⭕️Start Channel From 2017⭕️ ✅ Security Operation Center (SOC) ✅ Bug Bounty ✅ Vulnerability ✅ Pentest ✅ Hardening ✅ Linux ✅ Reasearch ✅ Security Network ✅ Security Researcher ✅ DevSecOps ✅ Blue Team ✅ Red Team
Show more2 884
Subscribers
+624 hours
+947 days
+13630 days
Posts Archive
Some recent lessons learned:
If something is suspicious but SQLMap “thinks” it might/might not be vulnerable, manually confirm/deny before leaving.
Payload example:
' AND extractvalue(rand(),concat(0x3a,(SELECT user()))) #
#bugbountytips #BugBounty
@Engineer_Computer
XSS WAF Bypass using location concatenation:
Payload:
"><BODy onbeforescriptexecute="x1='cookie';c=')';b='a';location='jav'+b+'script:con'+'fir\u006d('+'document'+'.'+x1+c">
#bugbounty #bugbountytips #xss #xssbypass
@Engineer_Computer
Injecting Payload In Phone Numbers field !
#infosec #bugbountytip #cybersecuritytips
@Engineer_Computer
Alert! 9 new ransomware families emerge from leaked Babuk source code, capable of targeting Linux and ESXi environments
https://thehackernews.com/2023/05/babuk-source-code-sparks-9-new.html
@Engineer_Computer
Research
Sec code review
Bug, Fault, Error, or Weakness: Demystifying Software Security Vulnerabilities", 2023
]-> NIST Vulnerability Data Ontology:
https://github.com/usnistgov/vulntology
@Engineer_Computer
Analytics
Ransomware Task Force: Gaining Ground" May 2023
@Engineer_Computer
exploit
1.CVE-2023-20052:
Information leak vulnerability in the DMG file parser of ClamAV
https://github.com/nokn0wthing/CVE-2023-25002
2. Exploits for CVE-2023-27327, CVE-2023-27328
(Parallels Desktop VM)
https://github.com/kn32/parallels-plist-escape
3. CVE-2023-28231:
DHCP Server RCE (2008 R2 SP1 - Server 2019)
https://github.com/glavstroy/CVE-2023-28231
@Engineer_Computer
#مقاله CIS در خصوص استفاده از Task Schedule ویندوز در حملات
@Engineer_Computer
🔱 FREE LABS FOR RED TEAM/BLUE TEAM - 2023 🔱
· Attack-Defense - https://attackdefense.com
· Alert to win - https://alf.nu/alert1
· Bancocn - https://bancocn.com
· CTF Komodo Security - https://ctf.komodosec.com
· CryptoHack - https://cryptohack.org/
· CMD Challenge - https://cmdchallenge.com
· Explotation Education - https://exploit.education
· Google CTF - https://lnkd.in/e46drbz8
· HackTheBox - https://www.hackthebox.com
· Hackthis - https://www.hackthis.co.uk
· Hacksplaining - https://lnkd.in/eAB5CSTA
· Hacker101 - https://ctf.hacker101.com
· Capture The Flag - Hacker Security - https://lnkd.in/ex7R-C-e
· Hacking-Lab - https://hacking-lab.com/
· HSTRIKE - https://hstrike.com
· ImmersiveLabs - https://immersivelabs.com
· NewbieContest - https://lnkd.in/ewBk6fU5
· OverTheWire - http://overthewire.org
· Practical Pentest Labs - https://lnkd.in/esq9Yuv5
· Pentestlab - https://pentesterlab.com
· Hackaflag BR - https://hackaflag.com.br/
· Penetration Testing Practice Labs - https://lnkd.in/e6wVANYd
· PentestIT LAB - https://lab.pentestit.ru
· PicoCTF - https://picoctf.com
· PWNABLE - https://lnkd.in/eMEwBJzn
· Root-Me - https://www.root-me.org
· Root in Jail - http://rootinjail.com
· SANS Challenger - https://lnkd.in/e5TAMawK
· SmashTheStack - https://lnkd.in/eVn9rP9p
· The Cryptopals Crypto Challenges - https://cryptopals.com
· Try Hack Me - https://tryhackme.com
· Vulnhub - https://www.vulnhub.com
· W3Challs - https://w3challs.com
· WeChall - http://www.wechall.net
· Zenk-Security - https://lnkd.in/ewJ5rNx2
· Cyberdefenders - https://lnkd.in/dVcmjEw8
· LetsDefend- https://letsdefend.io/
@Engineer_Computer
⭕️ Dangerous Regular Expressions
تو این پست Vickie Li از خطا های رایج در رجکس میگه و چندتا Best Practice برای رجکس های امن تر مثل اینکه:
- تا جایی که میشه برای چیزهایی مثل یوزرنیم و پسورد و ... خودتون رجکس ننویسید از رجکس های امن توی اینترنت استفاده کنید
- از Defense-in-depth استفاده کنید یعنی فقط به رجکس و اعتبار سنجی اش و ... اطمینان نکنید
- همچنین Fuzzing میتونه از اینکه رجکس شما داره درست کار میکنه یا نه اطمینان بیشتری حاصل کنه.
مطالعه بیشتر:
https://sec.okta.com/articles/2020/07/dangerous-regular-expressions
یه سری منابع هم معرفی شده برای امن تر کردن رجکس هاتون
https://owasp.org/www-community/OWASP_Validation_Regex_Repository
http://regexlib.com/DisplayPatterns.aspx
https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html
#regex #security #AppSec
@Engineer_Computer
Red Team Tactics
1. Finding 0-day vulnerabilities in apps using the Red Team approach
https://redteamrecipe.com/Finding-0-day-vulnerabilities-in-apps-using-the-Red-Team-approach
2. RUST payload toolkit for bypassing EDRs
https://github.com/optiv/Freeze.rs
@Engineer_Computer
Malware analysis
1. RecordBreaker Stealer
https://asec.ahnlab.com/en/52072
2. KEKW Malware
https://blog.cyble.com/2023/05/03/new-kekw-malware-variant-identified-in-pypi-package-distribution
@Engineer_Computer
💠 Top Resources For BugHunting - A Comprehensive Guide.
🔗 https://hacklido.com/blog/410-top-resources-for-bughunting-a-comprehensive-guide
@Engineer_Computer
If you're using the Advanced Custom Fields plugin for WordPress, make sure to update to version 6.1.6 as soon as possible!
A security flaw (CVE-2023-30777) has been discovered that could allow for reflected cross-site scripting attacks.
https://thehackernews.com/2023/05/new-vulnerability-in-popular-wordpress.html
-Cyber Security awareness-
Up2date 4 Defense Today,
Secure Tomorrow
@CisoasaService
1402.02.16
Attention writers! 📢 Hacklido's Writer's Reward Program (WRAP) is back and better than ever!
https://twitter.com/hacklido/status/1654720144575463426
-Cyber Security awareness-
Up2date 4 Defense Today,
Secure Tomorrow
@CisoasaService
1402.02.16
Available now! Telegram Research 2025 — the year's key insights 
