BackBox News
Latest news and insights on Security
Company Blogs
Hacking Tools
- SafeLine - Serve As A Reverse Proxy To Protect Your Web Services From Attacks And Exploits
- PolyDrop - A BYOSI (Bring-Your-Own-Script-Interpreter) Rapid Payload Deployment Toolkit
- Secator - The Pentester'S Swiss Knife
- Damn-Vulnerable-Drone - An Intentionally Vulnerable Drone Hacking Simulator Based On The Popular ArduPilot/MAVLink Architecture, Providing A Realistic Environment For Hands-On Drone Hacking
- File-Unpumper - Tool That Can Be Used To Trim Useless Things From A PE File Such As The Things A File Pumper Would Add
- Mass-Assigner - Simple Tool Made To Probe For Mass Assignment Vulnerability Through JSON Field Modification In HTTP Requests
- Imperius - Make An Linux Kernel Rootkit Visible Again
- BYOSI - Evade EDR's The Simple Way, By Not Touching Any Of The API's They Hook
- Psobf - PowerShell Obfuscator
- ModTracer - ModTracer Finds Hidden Linux Kernel Rootkits And Then Make Visible Again
Exploit DB
- [webapps] dizqueTV 1.5.3 - Remote Code Execution (RCE)
- [webapps] openSIS 9.1 - SQLi (Authenticated)
- [webapps] reNgine 2.2.0 - Command Injection (Authenticated)
- [dos] Windows TCP/IP - RCE Checker and Denial of Service
- [webapps] Gitea 1.22.0 - Stored XSS
- [webapps] Invesalius3 - Remote Code Execution
- [webapps] NoteMark < 0.13.0 - Stored XSS
- [webapps] Elber ESE DVB-S/S2 Satellite Receiver 1.5.x - Authentication Bypass
- [webapps] Elber ESE DVB-S/S2 Satellite Receiver 1.5.x - Device Config
- [webapps] Elber Wayber Analog/Digital Audio STL 4.00 - Authentication Bypass
IT Security Centralization Makes the Use of Industrial Spies More Profitable
/in General NewsAs organizations centralize IT security, the risk of espionage is silently becoming a more profitable threat.
darkreading – Read More
Preying on Misconfigurations: EMERALDWHALE Operation Steals 15K Cloud Credentials
/in General NewsWe are becoming accustomed to attackers gaining the upper hand due to basic security oversights. We already know that phishing tactics as unsophisticated as they look became one of the most effective one. Now, in the web, we have different basic security oversights. But the most prevalent is exposing private files, mainly ones that contain various credentials or API keys.
Source
TechSplicer – Read More
EMERALDWHALE Steals 15,000+ Cloud Credentials, Stores Data in S3 Bucket
/in General NewsEMERALDWHALE operation compromises over 15,000 cloud credentials, exploiting exposed Git and Laravel files. Attackers use compromised S3 buckets…
Hackread – Latest Cybersecurity, Tech, Crypto & Hacking News – Read More
NCSC Details ‘Pygmy Goat’ Backdoor Planted on Hacked Sophos Firewall Devices
/in General NewsA stealthy network backdoor found on hacked Sophos XG firewall devices is programmed to work on a broader range of Linux-based devices.
The post NCSC Details ‘Pygmy Goat’ Backdoor Planted on Hacked Sophos Firewall Devices appeared first on SecurityWeek.
SecurityWeek – Read More
Inside Iran’s Cyber Playbook: AI, Fake Hosting, and Psychological Warfare
/in General NewsU.S. and Israeli cybersecurity agencies have published a new advisory attributing an Iranian cyber group to targeting the 2024 Summer Olympics and compromising a French commercial dynamic display provider to show messages denouncing Israel’s participation in the sporting event.
The activity has been pinned on an entity that’s known as Emennet Pasargad, which the agencies said has been operating
The Hacker News – Read More
GreyNoise Credits AI for Spotting Exploit Attempts on IoT Livestream Cams
/in General NewsGreyNoise Intelligence says an internal AI tool captured attempts to exploit critical vulnerabilities in commercial livestream IoT cameras.
The post GreyNoise Credits AI for Spotting Exploit Attempts on IoT Livestream Cams appeared first on SecurityWeek.
SecurityWeek – Read More
Developer Velocity & Security: Can You Get Out of the Way in Time?
/in General NewsWhen a CISO can articulate risk in context to the business as a whole, development teams can better prioritize their activities.
darkreading – Read More
In Other News: FBI’s Ransomware Disruptions, Recall Delayed Again, CrowdStrike Responds to Bloomberg Article
/in General NewsNoteworthy stories that might have slipped under the radar: FBI conducted over 30 ransomware disruption operations this year, Windows Recall delayed until December, CrowdStrike responds to a Bloomberg article.
The post In Other News: FBI’s Ransomware Disruptions, Recall Delayed Again, CrowdStrike Responds to Bloomberg Article appeared first on SecurityWeek.
SecurityWeek – Read More
Young people’s data feared stolen in cyberattack on French government contractor
/in General NewsThe French government said an incident directly impacted an unnamed service provider used by the network of “Local Missions” — places that offer advice and support to people between the ages of 16 and 25 about work and training.
The Record from Recorded Future News – Read More
US, Israel Describe Iranian Hackers’ Targeting of Olympics, Surveillance Cameras
/in General NewsThe US and Israel have published an advisory describing the latest activities of Iranian cyber firm Emennet Pasargad, now called Aria Sepehr Ayandehsazan.
The post US, Israel Describe Iranian Hackers’ Targeting of Olympics, Surveillance Cameras appeared first on SecurityWeek.
SecurityWeek – Read More