𝙍𝙤𝙤𝙩𝙎𝙚𝙘
Open in Telegram
Free content of OFF-SEC, SANS, ec-council, INE, eLearnSecurity, udemy coupons and many more #Malware_analysis #RootSec
Show more1 773
Subscribers
+224 hours
+127 days
+2830 days
Posts Archive
1 773
#exploit
#AppSec
1⃣ CVE-2026-25755:
PDF Object Injection in jsPDF (addJS Method)
// Upgrade jsPDF to version >= 4.1.0
2⃣ CVE-2026-26064:
Calibre Path Traversal Leading to Arbitrary File Write and Potentially Code Execution
]-> CVE-2026-26065
3⃣ CVE-2026-20841:
Arbitrary Code Execution in the Windows Notepad
// The flaw allows attackers to craft malicious Markdown links that, when clicked, execute arbitrary commands via ShellExecuteExW()
1 773
#exploit
#NetSec
#WLAN_Security
"AirSnitch: Demystifying and Breaking Client Isolation in Wi-Fi Networks", 2026.
// The study reveals that Wi-Fi client isolation is vulnerable to sophisticated attacks due to implementation flaws, rendering current protections inadequate for ensuring network security
1 773
#Tech_book
#Cloud_Security
"Learning Serverless Security:
Hacking and Securing Serverless Cloud Applications on AWS, Azure, and Google Cloud", 2026.
// This book is for security engineers, cloud engineers, developers, security architects, and penetration testers responsible for managing, auditing, and securing their cloud infrastructure
1 773
#OpSec
#Red_Team_Tactics
1⃣ Initial Access. The Art of Getting In
// Payload Development (DLL Sideloading, Shellcode Loaders, Syscalls), HTML Smuggling, Phishing (QR Code Quishing, Teams Phishing), AitM/MFA Bypass (Evilginx, Device Code Phishing), Psw Spraying, Exploiting Public-Facing Apps, Vishing, Physical Access (Rubber Ducky, Bash Bunny), Supply Chain attacks with real-world APT case studies
2⃣ Red Team Infrastructure. The Full Picture: From Domain to Beacon
// C2 Frameworks, Redirectors, CDN Relays (Azure, AWS, GCP), Serverless Lambda, Cloudflare Tunnels, Phishing Infrastructure, Mail Servers, Malleable Profiles, and full OPSEC hardening
3⃣ Persistence: The Art of Staying In
// 50+ techniques across Windows, Scheduled Tasks, WMI, Services, DLL/COM/AppDomainManager, UEFI Bootkits, Active Directory, Linux, macOS, and Cloud (Azure/AWS/GCP, Kubernetes)
1 773
#OSINT
#Infographics
"The Intelligence Analyst’s Playbook", Feb. 2026.
// This intelligence analyst resource provides a field-ready framework for structuring OSINT reports with analytical rigor and clarity
1 773
#exploit
#AppSec
1⃣ CVE-2026-25506:
Pwning Supercomputers - A 20yo vulnerability in Munge
// Exploitation involved heap spraying, tcache poisoning, and crafting fake chunks to leak internal addresses and ultimately retrieve the Munge secret key
2⃣ ClickOnce + AppDomainManager Injection + ProxyBlob SOCKS5 -> Initial Access
// It automates the process of patching, compiling, and manifest updating, allowing attackers to embed malicious DLLs into legitimate, signed ClickOnce apps without breaking their signatures or raising suspicion
3⃣ CVE-2025-59793:
From Pre-Auth SSRF to RCE in TRUfusion Enterprise
// Exploit chains the path traversal with the previously described SSRF (CVE-2025-32355)
1 773
#NetSec
#Threat_Research
TURN Security Threats
https://www.enablesecurity.com/blog/turn-server-security-threats
// TURN relay abuse, DoS and TURN software vulnerabilities
1 773
#tools
#Offensive_security
#Red_Team_Tactics
1⃣ Automating the Pass-The-Ticket attack
https://ricardojoserf.github.io/autoptt
]-> AutoPtT in C++ and Python
2⃣ Linux Shared Library to Shellcode Loader
https://github.com/sliverarmory/malasada
3⃣ GhostLocker: AppLocker-Based EDR Neutralization
https://github.com/zero2504/EDR-GhostLocker
4⃣ MSSQL Silver Tickets and Token Privileges
https://vuln.dev/silver-ticket-mssql-clr
]-> Token handles abuse
5⃣ LOLRMM tools
https://lolrmm.io
1 773
#Analytics
#Research
#MLSecOps
"Trojans in Artificial Intelligence. Final Report",
IARPA, Jan. 2026.
// This report synthesizes the TrojAI program's key findings, including methodologies for detection through weight analysis and trigger inversion, as well as approaches for mitigating Trojan risks in deployed models. Comprehensive test and evaluation results highlight detector performance, sensitivity, and the prevalence of "natural" Trojans. The report concludes with lessons learned and recommendations for advancing AI security research
1 773
#Tech_book
#Cloud_Security
"Learning Kubernetes Security, 2nd Edition: A practical guide for secure and scalable containerized environments", Packt Publishing, 2025.
// This book was written to help administrators, developers, architects, and security professionals to understand the evolving landscape of Kubernetes security. The book begins with foundational concepts, such as architecture and networking, to give you a strong technical background. From there, we introduce the threat model, giving you the ability to detect risks and threat actors
1 773
#Research
#Offensive_security
The Phantom File System:
Inside the Windows ProjFS
https://www.huntress.com/blog/windows-projected-file-system-mechanics
// Architecture and use cases
