Pages

▼
▼

Mitre D3fend Framework - Att&ck from a defenders perspective

›
Mitre published another awesome framework called d3fend.mitre.org It is using the att&ck framework but from a defenders perspective :-)...

Confluence behind LoadBalancer with another domain results in XSRF error

›
If you have an atlassian confluence running, which is published by a loadbalancer or reverse proxy using another domain, you might run into...

Splunk Enterprise update plan

›
Splunk published this awesome Splunk Enterprise update plan: https://docs.splunk.com/images/d/d3/Splunk_upgrade_order_of_ops.pdf  Regardless...

Phishing using @-URL trick in DNS .zip domains

›
With Googles release of the DNS top-level-domains .zip and .mov a new phishing (mitre att&ck T1566) trick is possible as bobbyrsec wr...

Mini/Reverse/Web-Shells explained

›
The website  explainshell.com  explains Mini/Reverse/ Web-Shells  (T1505.003):  Example 1: https://explainshell.com/explain?cmd=file%3D%24%2...

Overview of public interfaces for SOC/IT-Security staff

›
In case of an IT-security incident, emergency oder if a new critical vulnerability (like log4j in December 2021) arises, it is good to be pr...

Windows fileless persistence local privilege escalation using sc.exe sdset

›
Alh4zr3d and Grzegorz Tworek wrote about a fileless, local privilege escalation backdoor in order to gain persistence ( TA0003 ) using the ...

Fix blocked ldap user in GitLab container using GitLabs shell

›
If you are running GitLab in a docker container and your are using some directory service, for example ActiveDirectory with LDAPS for authen...

New LAPS version explained

›
Microsoft will release a new version of Local Administrator Password Solution (LAPS), which   provides new Azure AD features as well as new ...

Paessler PRTG 22.4.81.1532 security fix for Cross Site Scripting XSS

›
Paessler PRTG released version 22.4.81.1532 (stable) in which a PRTG the tag handling system was fixed regarding tag parameters to avoid th...

Security Testing - Review LAPS

›
It is a good idea to review your companys Microsoft's Local Administrator Password Solution LAPS installation. Leo Loobeek published a ...

Microsoft Windows Defender AntiVirus Performance analysis

›
When you suspect your Microsoft Defender Antivirus to be a bottleneck for your Windows performance, then you may use Microsofts Defender Ant...

FortiGate admin interface authentication bypass

›
There are rumors about a vulnerability in Fortinets FortiGate firewalls where you may bypass authentication on their admin interfaces. Affec...

Mitre Att&ck Micro Emulations - Test your own security

›
It is a very good idea to test your own IT-security systems and processes, if they detect something and what level of detail they provide. M...

Windows Persistence Scheduled Tasks Obfuscation

›
In the great article „Securonix Threat Labs Security Advisory: Detecting STEEP#MAVERICK“ D. Iuzvyk, T. Peck, O. Kolesnikov reverse engineer ...

Paessler PRTG fixes OpenSSL vulnerability CVE-2022-1292

›
Paesslers PRTG version 22.3.79 will update its internal OpenSSL libraries to 1.0.2ze in order to address and fix CVE-2022-1292 . CVE-2022-...

Citrix ICA SSO saved credentials in XOR obfuscated readable storage

›
The Citrix ICA application stores user credentials for its SingleSignOn SSO functionality in readable form using XOR obfuscation with the ke...

Quick win securing Azure AD

›
An easy quick win for securing Azure Active Directory passwords is the feature " Azure AD Password Protection ". This helps you in...

Decrypt TLS sessions of Chrome & Firefox

›
How to decrypt TLS Sessions of browsers like Chrome and Firefox without Man-in-the-Middle MitM/Adversary-in-the-Middle AitM ( Att&ck T15...

Nextcloud Security & setup warning php-imagick svg support

›
 When running nextcloud, in the administration overview you might find the error: " Module php-imagick in this instance has no SVG supp...

Myths of IT Security

›
I recently saw Linus Neumann from the Chaos Computer Club in a video talking about IT security myths which I try to explain all time, howev...

Linux persistence techniques as a map

›
Pepe Berba has created a nice overview of linux persistence techniques as a map :  https://pberba.github.io/security/2021/11/22/linux-thre...

Git for Windows - Git uses certificate from internal PKI

›
If you initially want to git clone a repository from an internal git system from a windows system and the internal git system uses a certifi...

Azure CLI - list ip-addresses & show Azure Network Security Group & create Azure NSG rule

›
A few basic tasks in Microsoft Azure via CLI.  In order to use microsegmentation or zero-trust-networking in Azure (which I highly recommend...