Cyber Research #54

Mert Coskuner

2 min readSep 24, 2022

Articles

Prompt injection attacks against GPT-3

Riley Goodside, yesterday: Exploiting GPT-3 prompts with malicious inputs that order the model to ignore its previous…

simonwillison.net

What's Inside Of a Distroless Container Image: Taking a Deeper Look

GoogleContainerTools' distroless base images are often mentioned as one of the ways to produce small(er), fast(er), and…

iximiuz.com

Kelly Shortridge

The Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Office of the…

swagitda.com

mr.d0x

Dumping tokens from Microsoft Office desktop applications' memory Update: This seems to only work against Desktop…

mrd0x.com

How to hire and build your cybersecurity team

A founder knows building real traction for their business means cybersecurity and data protection are table stakes-and…

www.bvp.com

Caching the Un-cacheables - Abusing URL Parser Confusions (Web Cache Poisoning Technique)

Here is how I was able to poison the cache of thousands of pages in Glassdoor with reflected & stored XSS Imagine you…

nokline.github.io

THREAT ANALYSIS REPORT: Abusing Notepad++ Plugins for Evasion and Persistence

Cybereason GSOC team analysts have analyzed a specific technique that leverages Notepad++ plugins to persist and evade…

www.cybereason.com

Google completes acquisition of Mandiant | Google Cloud Blog

Security leaders and their teams often lack the resources and expertise required to keep pace with today's ever…

cloud.google.com

Tools

GitHub - microsoft/oss-ssc-framework: Open Source Software Secure Supply Chain Framework

This guide outlines and defines how to securely consume Open Source Software (OSS) dependencies into the developer's…

github.com

GitHub - Ge0rg3/requests-ip-rotator: A Python library to utilize AWS API Gateway's large IP pool as…

A Python library to utilize AWS API Gateway's large IP pool as a proxy to generate pseudo-infinite IPs for web scraping…

github.com

GitHub - google/magic-github-proxy: An access-limiting stateless GitHub API Proxy

This is a stateless GitHub API proxy that allows creation and use of access-limited GitHub API tokens. Basically, it's…

github.com

GitHub - Velocidex/cloudvelo: An experimental Velociraptor implementation using cloud…

This version of Velociraptor depends on the open source codebase as used on GitHub. The GitHub repo is included as a…

github.com

GitHub - xRET2pwn/Teamsniper: Teamsniper is a tool for fetching keywords in a Microsoft Teams such…

Teamsniper is a tool for fetching keywords in a Microsoft Teams such as (passwords, emails, database, etc.). Help…

github.com

adversary_emulation_library/micro_emulation_plans at v4.0 ·…

This collection expands the impact of the Adversary Emulation Library by developing easy-to-execute adversary emulation…

github.com

Thank you for reading!

If you find this newsletter useful and know other people who would too, forward it to them to help spread the knowledge. If you have questions, comments or feedback, reach out via /in/mcoskuner.

Cyber Research #54

Articles

Prompt injection attacks against GPT-3

Riley Goodside, yesterday: Exploiting GPT-3 prompts with malicious inputs that order the model to ignore its previous…

What's Inside Of a Distroless Container Image: Taking a Deeper Look

GoogleContainerTools' distroless base images are often mentioned as one of the ways to produce small(er), fast(er), and…

Kelly Shortridge

The Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Office of the…

mr.d0x

Dumping tokens from Microsoft Office desktop applications' memory Update: This seems to only work against Desktop…

How to hire and build your cybersecurity team

A founder knows building real traction for their business means cybersecurity and data protection are table stakes-and…

Caching the Un-cacheables - Abusing URL Parser Confusions (Web Cache Poisoning Technique)

Here is how I was able to poison the cache of thousands of pages in Glassdoor with reflected & stored XSS Imagine you…

THREAT ANALYSIS REPORT: Abusing Notepad++ Plugins for Evasion and Persistence

Cybereason GSOC team analysts have analyzed a specific technique that leverages Notepad++ plugins to persist and evade…

Google completes acquisition of Mandiant | Google Cloud Blog

Security leaders and their teams often lack the resources and expertise required to keep pace with today's ever…

Tools

GitHub - microsoft/oss-ssc-framework: Open Source Software Secure Supply Chain Framework

This guide outlines and defines how to securely consume Open Source Software (OSS) dependencies into the developer's…

GitHub - Ge0rg3/requests-ip-rotator: A Python library to utilize AWS API Gateway's large IP pool as…

A Python library to utilize AWS API Gateway's large IP pool as a proxy to generate pseudo-infinite IPs for web scraping…

GitHub - google/magic-github-proxy: An access-limiting stateless GitHub API Proxy

This is a stateless GitHub API proxy that allows creation and use of access-limited GitHub API tokens. Basically, it's…

GitHub - Velocidex/cloudvelo: An experimental Velociraptor implementation using cloud…

This version of Velociraptor depends on the open source codebase as used on GitHub. The GitHub repo is included as a…

GitHub - xRET2pwn/Teamsniper: Teamsniper is a tool for fetching keywords in a Microsoft Teams such…

Teamsniper is a tool for fetching keywords in a Microsoft Teams such as (passwords, emails, database, etc.). Help…

adversary_emulation_library/micro_emulation_plans at v4.0 ·…

This collection expands the impact of the Adversary Emulation Library by developing easy-to-execute adversary emulation…

Thank you for reading!

Written by Mert Coskuner

No responses yet