Pentester

Zimbra - Remote Command Execution (CVE-2024-45519) https://blog.projectdiscovery.io/zimbra-remote-code-execution/

How hackers can exploit Wi-Fi Captive Portals to distribute Android malware all from a smartphone using WifiPumpkin on NetHunter https://www.mobile-hacker.com/2024/09/27/wifipumpkin3-integrated-into-nethunter-powerful-duo-allows-malware-distribution-via-captive-portal/

ATTACKING UNIX SYSTEMS VIA CUPS, PART I https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/

A step-by-step guide to writing an iOS kernel exploit https://alfiecg.uk/2024/09/24/Kernel-exploit.html

Bypass #LSA protection using the BYODLL technique https://github.com/itm4n/PPLrevenant

#AI has potential to automate threat detection, transform cybersecurity https://siliconangle.com/2024/09/20/red-teaming-google-mwise2024/

Splinter: New Post-Exploitation Red Team Tool https://unit42.paloaltonetworks.com/analysis-pentest-tool-splinter

Exploiting Android Client WebViews with Help from HSTS 1-click account takeover vulnerability discovered in a popular Indonesian Android Tokopedia app https://seanpesce.blogspot.com/2024/09/exploiting-android-client-webviews-with.html

Using AI-assisted decompilation of Radare2 https://cryptax.medium.com/using-ai-assisted-decompilation-of-radare2-e81a882863c9

Veeam Backup & Response — RCE (CVE-2024-40711) A critical deserialization vulnerability in .NET Remoting has been discovered in Veeam Backup & Replication, allowing unauthenticated remote code execution (RCE). The flaw affects versions 12.1.2.172 and earlier. Research: https://labs.watchtowr.com/veeam-backup-response-rce-with-auth-but-mostly-without-auth-cve-2024-40711-2/ Source: https://github.com/watchtowrlabs/CVE-2024-40711

Android Bytecode Exploitation Introduction (Part 1): https://lolcads.github.io/posts/2024/09/bytecode_exploitation_0/ Fundamentals (Part 2): https://lolcads.github.io/posts/2024/09/bytecode_exploitation_1/ Bytecode Injection (Part 3): https://lolcads.github.io/posts/2024/09/bytecode_exploitation_2/ Bytecode Reuse Attack (Part 4): https://lolcads.github.io/posts/2024/09/bytecode_exploitation_3/

Kali Linux 2024.3 Release (Multiple transitions) | Kali Linux Blog https://www.kali.org/blog/kali-linux-2024-3-release/

Web-Check - All-in-one #OSINT tool for analysing any website https://github.com/Lissy93/web-check

Veeam Backup & Response - RCE With Auth, But Mostly Without Auth (CVE-2024-40711) https://labs.watchtowr.com/veeam-backup-response-rce-with-auth-but-mostly-without-auth-cve-2024-40711-2/

How to intercepting #Android at runtime on non-rooted devices using frida-gadget https://dispatchersdotplayground.hashnode.dev/intercepting-android-at-runtime-on-non-rooted-devices

Exploiting CI / CD Pipelines for fun and profit https://blog.razzsecurity.com/2024/09/08/exploitation-research/exploiting-ci-cd-pipelines-for-fun-and-profit/

Infiltrax - post-exploitation tool to capture screenshots, retrieve clipboard contents, log keystrokes, and install AnyDesk for persistent remote access https://github.com/alexdhital/Infiltrax

Windows Wi-Fi Driver #RCE Vulnerability - CVE-2024-30078 - Crowdfense https://www.crowdfense.com/windows-wi-fi-driver-rce-vulnerability-cve-2024-30078/

Latest Nuclei Release v3.3.2! https://github.com/projectdiscovery/nuclei/releases/tag/v3.3.2

Introducing Java fuzz harness synthesis using LLMs https://blog.oss-fuzz.com/posts/introducing-java-auto-harnessing/