GHK Security Solutions’ Post

Web Shells Gain Sophistication for Stealth, PersistenceA favorite post-exploitation tool continues to gain sophistication, with one recent example adding disguised log-in pages, credential stealing, and information gathering via services such as VirusTotal.

dnsReaper web has had an update! By replacing dnspython with our own low-level dns resolver, and a few other cheeky upgrades, we've squeezed a lot more performance! Instead of checking 100 subdomains at a time, we now scan 2000! Please give it a spin and drop us some feedback 👇 The way this works is you provide a domain, such as punksecurity.co.uk, and we query the wonderful database provided by ProjectDiscovery. For some domains, this list can be huge (100k+ records), and we then randomly select up to 2000 of those records for you. These records then get fed into reapers dns resolution and subdomain signature checking engine. At this point, all those optimisations kick in! Also, courtesy of a report from our friends at Perspective Intelligence, we've added a new signature for Wix! https://lnkd.in/ekpbsTak

#day13 #100dayschallenge #cybersecurity Just concluded an intensive study on HTTP, and the insights gained are nothing short of illuminating! 🌐📚 🚀 What I Explored: 🌐 Understanding the Basics: Dived deep into the foundations of HTTP, grasping its role as the backbone of data communication on the World Wide Web. 🔄 Request-Response Lifecycle: Unveiled the intricacies of the client-server interaction, exploring how HTTP requests and responses traverse the digital landscape. 🔒 Security Protocols: Explored HTTPS, understanding the encryption mechanisms that ensure secure data transmission over the web. 📈 Performance Optimization: Delved into strategies for optimizing HTTP, from caching mechanisms to compression techniques. 💡 Key Insights: HTTP is more than just a set of rules; it's the language that powers our online experiences. The more we understand it, the better we can optimize, secure, and innovate in the digital realm! 🚀💬

https://lnkd.in/gaSgPpTj To address our requirements, the internal security team at OryxLabs decided to create PolarDNS – a tool that could provide a more comprehensive and versatile set of capabilities. Some of the unique features include: Ability to act as a rogue authoritative DNS server for server-side attack scenarios Ability to craft custom DNS responses Ability to have complete control over the DNS layer as well as the underlying UDP and TCP protocols to have a comprehensive coverage of the essential functionalities There are many built-in features and modifiers to produce various DNS responses. Combining them makes it possible to produce countless variants of a given response. These features allow PolarDNS to produce highly unusual, abnormal, and even malformed DNS responses, enabling the operators to see how the receiving side handles such situations and whether the receiving side is technically robust and mature. #dns

Let us know if you want help with this new vulnerability with NGINX!

Marking our last #CVEoftheWeek in 2023, CVE-2023-45849 definitely deserves its display in our series. CVE-2023-45849 is among four vulnerabilities found by Microsoft researchers in #Perforce Helix Core Server, a popular source code management and version control platform. 🎮 As the product is widely used in the game development industry, when Microsoft's researchers conducted a security review of the solution used by their own studios as well, the researchers found several vulnerabilities. Three of them - CVE-2023-5759, CVE-2023-35767 and CVE-2023-45319 - are unauthenticated denial of service type vulnerabilities, but the fourth is a remote code execution, clocking a 9.8/10 on the CVSS scale (9.0 according to the vendor, 10.0 according to Microsoft). 💣 CVE-2023-45849 allows unauthenticated parties to execute code remotely in the context of the special, high-privileged user "LocalSystem", which, as the name suggests, has access to all local resources, including files, registry, system files, etc. The blogpost details the process of successful exploitation, which boils down to unsecure default configuration and missing authentication of the "user-bgtask" RPC command. Analyzing the software using its debug symbols, static analysis and reverse engineering uncovered a valid chain of function calls from user-bgtask to CreateProcess() API call in WinAPI, allowing a specially crafted payload to execute arbitrary commands without authentication. 🛡 The responsible disclosure process started in August 2023 and the latest version with the proper fixes has been available since November 2023, we recommend patching or securing the server instance according to the vendor's guidance:  https://lnkd.in/dYmQrkQF 👉 For the very detailed technical blogpost, please refer to: https://lnkd.in/eey5fqBz #WhiteHatSeries #informationsecurity

Just in: Escape's 2024 API Secret Sprawl research report 🧐 We've just released our research revealing over 18,000 exposed API secrets, including $20 million in vulnerable Stripe tokens (owners were alerted 🚨), across 1 million popular domains. This study highlights a critical challenge in digital security and underscores the need for better API secret management strategies. Dive into our detailed analysis and learn about the potential financial risks and security implications 👇 #apisecurity #cybersecurity

🔥 Last week, we announced Rad Security! The goal of the RAD security standard is to reverse the balance of power in software supply chain security. If development teams can compare a verified, clean runtime fingerprint against the same image running in their environment, they have a real chance in defending against the next zero day attack! ☠ Sign up for early access here: https://lnkd.in/e7-F3Zad #zeroday #runtime # #softwaresupplychainsecurity

Hello Connections..!! This is DAY-22/100 of  #vrushali100daysofhacking Challenge 🚀. Happy to share that ,I've just completed the HTTP in Detail room on TryHackMe! Here's a brief overview of the tasks I've accomplished: 🤹♀️ Task 1: What is HTTP(S)? HTTP stands for Hypertext Transfer Protocol, defining how information is exchanged on the World Wide Web. HTTPS is the secure version of HTTP, using encryption to protect data during transfer. 🤹♀️Task 2: Requests And Responses URL basics, including components like scheme, user authentication, host, port, path, query string, and fragment. Making requests, which can be as simple as "GET / HTTP/1.1" and can include additional data as headers. 🤹♀️Task 3: HTTP Methods Common HTTP methods: 1. GET: Retrieve information from a web server. 2. POST: Submit data to create new records. 3. PUT: Submit data to update information. 4. DELETE: Delete information/records. 🤹♀️Task 4: HTTP Status Codes HTTP status codes and their meanings, including common ones like 200 (OK), 404 (Page Not Found), and 500 (Internal Service Error). 🤹♀️Task 5: Headers Headers, which are additional pieces of data sent to a web server when making requests. 🤹♀️Task 6: Cookies Cookies, small pieces of data stored on a user's browser. 🤹♀️Task 7: Making Requests Making requests using various HTTP methods learned in Task 3 in short forms. #TryHackMe #ITSkills #Cybersecurity #ContinuousLearning #iAspire100 #security #webapplications #protocol #websecure

Here in this article, we explain deeply how our #SKUDONET reverse proxy manages the 100-Continue Headers. Do you manage large Web Services? Then you can't skip this quick read.