Cyber Research #44

Mert Coskuner

3 min readJul 16, 2022

Articles

Bypassing eBPF-based Security Enforcement Tools

During penetration tests and red team engagements, eBPF-based security observability and runtime enforcement tools can…

www.form3.tech

Notes on OpenSSL remote memory corruption

OpenSSL version 3.0.4, released on June 21th 2022, is susceptible to remote memory corruption which can be triggered…

guidovranken.com

Automating binary vulnerability discovery with Ghidra and Semgrep - hn security

"Some details are more important than others." - Fedor G. Pikus I've released some tools to help automate vulnerability…

security.humanativaspa.it

Update: IconBurst NPM software supply chain attack grabs data from apps and websites

Update: since publication of this blog, new, malicious packages attributable to the accounts identified in our original…

blog.reversinglabs.com

When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors

Unit 42 continuously hunts for new and unique malware samples that match known advanced persistent threat (APT)…

unit42.paloaltonetworks.com

Abusing functionality to exploit a super SSRF in Jira Server (CVE-2022-26135)

TL;DR Jira is vulnerable to SSRF which requires authentication to exploit. There are multiple ways to create user…

blog.assetnote.io

Cloud Vulnerabilities & Security Issues Database

Cloud vulnerabilities database - an open project to list all known cloud vulnerabilities and Cloud Service Provider…

www.cloudvulndb.org

Learnings from 5 years of tech startup code audits - Ken Kantzer's Blog

While I was leading PKC's security practice, we did probably 20-30 code security audits, almost of all of them for…

kenkantzer.com

From Misconfigured Certificate Template to Domain Admin

msPKI-Certificates-Name-Flag: ENROLLEE_SUPPLIES_SUBJECT field field, which indicates that the user, who is requesting a…

www.ired.team

Countering hack-for-hire groups

As part of TAG's mission to counter serious threats to Google and our users, we've published analysis on a…

blog.google

Announcing MITRE ATT&CK mappings for Google Cloud security capabilities | Google Cloud Blog

The scoring rubric is centered around the continuous cycle of Protect, Detect, and Respond. Each control has been…

cloud.google.com

Cloud Armor adds more edge security policies, proxy load balancers | Google Cloud Blog

Google Cloud expands its scope of DDoS and web application firewall protection with new edge security policies and…

cloud.google.com

Tools

GitHub - citronneur/pamspy: Credentials Dumper for Linux using eBPF

pamspy leverage eBPF technologies to achieve an equivalent work of 3snake. It will track a particular userland function…

github.com

GitHub - Nirusu/how-to-setup-a-honeypot: How to setup a honeypot with an IDS, ELK and TLS traffic…

This guide illustrates how to set up a honeypot that, next to unencrypted network traffic, is also capable of…

github.com

GitHub - firefart/hijagger: Checks all maintainers of all NPM and Pypi packages for hijackable…

This tool checks every maintainer from every package in the NPM and Python Pypi registry for unregistered domains or…

github.com

TAPIR user documentation

TAPIR (Trustable Artifacts Parser for Incident Response) documentation

tap-ir.github.io

Thank you for reading!

If you find this newsletter useful and know other people who would too, forward it to them to help spread the knowledge. If you have questions, comments or feedback, reach out via /in/mcoskuner.

Cyber Research #44

Articles

Bypassing eBPF-based Security Enforcement Tools

During penetration tests and red team engagements, eBPF-based security observability and runtime enforcement tools can…

Notes on OpenSSL remote memory corruption

OpenSSL version 3.0.4, released on June 21th 2022, is susceptible to remote memory corruption which can be triggered…

Automating binary vulnerability discovery with Ghidra and Semgrep - hn security

"Some details are more important than others." - Fedor G. Pikus I've released some tools to help automate vulnerability…

Update: IconBurst NPM software supply chain attack grabs data from apps and websites

Update: since publication of this blog, new, malicious packages attributable to the accounts identified in our original…

When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors

Unit 42 continuously hunts for new and unique malware samples that match known advanced persistent threat (APT)…

Abusing functionality to exploit a super SSRF in Jira Server (CVE-2022-26135)

TL;DR Jira is vulnerable to SSRF which requires authentication to exploit. There are multiple ways to create user…

Cloud Vulnerabilities & Security Issues Database

Cloud vulnerabilities database - an open project to list all known cloud vulnerabilities and Cloud Service Provider…

Learnings from 5 years of tech startup code audits - Ken Kantzer's Blog

While I was leading PKC's security practice, we did probably 20-30 code security audits, almost of all of them for…

From Misconfigured Certificate Template to Domain Admin

msPKI-Certificates-Name-Flag: ENROLLEE_SUPPLIES_SUBJECT field field, which indicates that the user, who is requesting a…

Countering hack-for-hire groups

As part of TAG's mission to counter serious threats to Google and our users, we've published analysis on a…

Announcing MITRE ATT&CK mappings for Google Cloud security capabilities | Google Cloud Blog

The scoring rubric is centered around the continuous cycle of Protect, Detect, and Respond. Each control has been…

Cloud Armor adds more edge security policies, proxy load balancers | Google Cloud Blog

Google Cloud expands its scope of DDoS and web application firewall protection with new edge security policies and…

Tools

GitHub - citronneur/pamspy: Credentials Dumper for Linux using eBPF

pamspy leverage eBPF technologies to achieve an equivalent work of 3snake. It will track a particular userland function…

GitHub - Nirusu/how-to-setup-a-honeypot: How to setup a honeypot with an IDS, ELK and TLS traffic…

This guide illustrates how to set up a honeypot that, next to unencrypted network traffic, is also capable of…

GitHub - firefart/hijagger: Checks all maintainers of all NPM and Pypi packages for hijackable…

This tool checks every maintainer from every package in the NPM and Python Pypi registry for unregistered domains or…

TAPIR user documentation

TAPIR (Trustable Artifacts Parser for Incident Response) documentation

Thank you for reading!

Written by Mert Coskuner

No responses yet

Cyber Research #44

Articles

Bypassing eBPF-based Security Enforcement Tools

During penetration tests and red team engagements, eBPF-based security observability and runtime enforcement tools can…

Notes on OpenSSL remote memory corruption

OpenSSL version 3.0.4, released on June 21th 2022, is susceptible to remote memory corruption which can be triggered…

Automating binary vulnerability discovery with Ghidra and Semgrep - hn security

"Some details are more important than others." - Fedor G. Pikus I've released some tools to help automate vulnerability…

Update: IconBurst NPM software supply chain attack grabs data from apps and websites

Update: since publication of this blog, new, malicious packages attributable to the accounts identified in our original…

When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors

Unit 42 continuously hunts for new and unique malware samples that match known advanced persistent threat (APT)…

Abusing functionality to exploit a super SSRF in Jira Server (CVE-2022-26135)

TL;DR Jira is vulnerable to SSRF which requires authentication to exploit. There are multiple ways to create user…

Cloud Vulnerabilities & Security Issues Database

Cloud vulnerabilities database - an open project to list all known cloud vulnerabilities and Cloud Service Provider…

Learnings from 5 years of tech startup code audits - Ken Kantzer's Blog

While I was leading PKC's security practice, we did probably 20-30 code security audits, almost of all of them for…

From Misconfigured Certificate Template to Domain Admin

msPKI-Certificates-Name-Flag: ENROLLEE_SUPPLIES_SUBJECT field field, which indicates that the user, who is requesting a…

Countering hack-for-hire groups

As part of TAG&#x27;s mission to counter serious threats to Google and our users, we&#x27;ve published analysis on a…

Announcing MITRE ATT&CK mappings for Google Cloud security capabilities | Google Cloud Blog

The scoring rubric is centered around the continuous cycle of Protect, Detect, and Respond. Each control has been…

Cloud Armor adds more edge security policies, proxy load balancers | Google Cloud Blog

Google Cloud expands its scope of DDoS and web application firewall protection with new edge security policies and…

Tools

GitHub - citronneur/pamspy: Credentials Dumper for Linux using eBPF

pamspy leverage eBPF technologies to achieve an equivalent work of 3snake. It will track a particular userland function…

GitHub - Nirusu/how-to-setup-a-honeypot: How to setup a honeypot with an IDS, ELK and TLS traffic…

This guide illustrates how to set up a honeypot that, next to unencrypted network traffic, is also capable of…

GitHub - firefart/hijagger: Checks all maintainers of all NPM and Pypi packages for hijackable…

This tool checks every maintainer from every package in the NPM and Python Pypi registry for unregistered domains or…

TAPIR user documentation

TAPIR (Trustable Artifacts Parser for Incident Response) documentation

Thank you for reading!

Written by Mert Coskuner

No responses yet

As part of TAG's mission to counter serious threats to Google and our users, we've published analysis on a…