فیشینگ با ساب دامنه واقعی BMW
بدلیل آسیب پذیری نسخه SAP
#آکادمی_روزبه
https://cybernews.com/security/bmw-affected-by-redirect-vulnerability-research/?utm_source=linkedin&utm_medium=social&utm_campaign=bmw-affected-by-redirect-vulnerability-research_csh&utm_term=LIN-404&source=linkedin&medium=social&campaign=bmw-affected-by-redirect-vulnerability-research_csh&term=LIN-404
بدلیل آسیب پذیری نسخه SAP
#آکادمی_روزبه
https://cybernews.com/security/bmw-affected-by-redirect-vulnerability-research/?utm_source=linkedin&utm_medium=social&utm_campaign=bmw-affected-by-redirect-vulnerability-research_csh&utm_term=LIN-404&source=linkedin&medium=social&campaign=bmw-affected-by-redirect-vulnerability-research_csh&term=LIN-404
Cybernews
Don’t trust links with known domains: BMW affected by redirect vulnerability | Cybernews
Cybernews researchers have discovered two BMW subdomains that were vulnerable to SAP redirect vulnerability.
بازسازی کد Vbscript با سایبر شف
#آکادمی_روزبه
https://www.securityinbits.com/tools/cyberchef/deobfuscate-script-using-cyberchef-recipe-3/
#آکادمی_روزبه
https://www.securityinbits.com/tools/cyberchef/deobfuscate-script-using-cyberchef-recipe-3/
Securityinbits
Deobfuscate Script using CyberChef – Recipe 0x3 - Securityinbits
Explore Deobfuscation with CyberChef as we decode VBScript used in the RedLine stealer infection chain. We’ll explore the various CyberChef operations e.g Subsection, From Base, Fork etc.
ردپاهایی که در ویندوز باقی میماند و شما بعنوان جرم شناس میتوانید به آنها تکیه کنید
#آکادمی_روزبه
https://medium.com/@peace_o_O/introduction-to-windows-artifacts-your-gateway-to-effective-incident-response-cc39172af3a3
#آکادمی_روزبه
https://medium.com/@peace_o_O/introduction-to-windows-artifacts-your-gateway-to-effective-incident-response-cc39172af3a3
Medium
Introduction to Windows Artifacts : Your Gateway to Effective Incident Response
https://pixabay.com/photos/code-hacker-data-security-707069/
شاید وصله کردن دوا نکند !!
در مثال زیر پس از وصله مجددا سیستم دچار آسیب پذیری شده
#آکادمی_روزبه
https://www.darkreading.com/vulnerabilities-threats/apache-erp-0day-underscores-dangers-of-incomplete-patches
در مثال زیر پس از وصله مجددا سیستم دچار آسیب پذیری شده
#آکادمی_روزبه
https://www.darkreading.com/vulnerabilities-threats/apache-erp-0day-underscores-dangers-of-incomplete-patches
Dark Reading
Apache ERP Zero-Day Underscores Dangers of Incomplete Patches
Apache fixed a vulnerability in its OfBiz enterprise resource planning (ERP) framework last month, but attackers and researchers found a way around the patch.
وقتی پلاگین بک آپ گیری ورد پرس هم دردسر ساز می‌شود
#آکادمی_روزبه
https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/50k-wordpress-sites-exposed-to-rce-attacks-by-critical-bug-in-backup-plugin/amp/
#آکادمی_روزبه
https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/50k-wordpress-sites-exposed-to-rce-attacks-by-critical-bug-in-backup-plugin/amp/
www-bleepingcomputer-com.cdn.ampproject.org
50K WordPress sites exposed to RCE attacks by critical bug in backup plugin
A critical severity vulnerability in a WordPress plugin with more than 90,000 installs can let attackers gain remote code execution to fully compromise vulnerable websites.
آشنایی با یک اسکنر متن باز
و نمونه گزارشات
#آکادمی_روزبه
https://cert.pl/en/posts/2024/01/artemis-security-scanner/
و نمونه گزارشات
#آکادمی_روزبه
https://cert.pl/en/posts/2024/01/artemis-security-scanner/
cert.pl
The Artemis security scanner
Artemis is an open-source security vulnerability scanner developed by CERT PL. It is built to look for website misconfigurations and vulnerabilities on a large number of sites. It automatically prepares reports that can be sent to the affected institutions.…
تحلیل ترافیک Trickbot
#آکادمی_روزبه
https://unit42.paloaltonetworks.com/wireshark-tutorial-examining-trickbot-infections/
#آکادمی_روزبه
https://unit42.paloaltonetworks.com/wireshark-tutorial-examining-trickbot-infections/
Unit 42
Wireshark Tutorial: Examining Trickbot Infections
A tutorial offering tips on how to identify Trickbot, an information stealer and banking malware that has been infecting victims since 2016.
تحلیل بدافزار بانکی
#آکادمی_روزبه
https://unit42.paloaltonetworks.com/wireshark-tutorial-examining-ursnif-infections/
#آکادمی_روزبه
https://unit42.paloaltonetworks.com/wireshark-tutorial-examining-ursnif-infections/
Unit 42
Wireshark Tutorial: Examining Ursnif Infections
Ursnif is banking malware sometimes referred to as Gozi or IFSB. The Ursnif family of malware has been active for years, and current samples generate distinct traffic patterns.This tutorial reviews packet captures (pcaps) of infection Ursnif traffic using…
و اینهم یک تحلیل دیگر از فعالیت های بدافزاری
#آکادمی_روزبه
https://unit42.paloaltonetworks.com/wireshark-tutorial-examining-ursnif-infections/
#آکادمی_روزبه
https://unit42.paloaltonetworks.com/wireshark-tutorial-examining-ursnif-infections/
Unit 42
Wireshark Tutorial: Examining Ursnif Infections
Ursnif is banking malware sometimes referred to as Gozi or IFSB. The Ursnif family of malware has been active for years, and current samples generate distinct traffic patterns.This tutorial reviews packet captures (pcaps) of infection Ursnif traffic using…
تحلیل بد افزار
How Pikabot obfuscates and decrypts strings.
How Pikabot retrieves API addresses.
How Pikabot slows down the analysis process.
How Pikabot generates victim uuid.
Collecting information from the victim’s machine.
How Pikabot decrypts C2 addresses.
How Pikabot utilizes Syscall.
#آکادمی_روزبه
https://kienmanowar.wordpress.com/2024/01/06/quicknote-technical-analysis-of-recent-pikabot-core-module/
How Pikabot obfuscates and decrypts strings.
How Pikabot retrieves API addresses.
How Pikabot slows down the analysis process.
How Pikabot generates victim uuid.
Collecting information from the victim’s machine.
How Pikabot decrypts C2 addresses.
How Pikabot utilizes Syscall.
#آکادمی_روزبه
https://kienmanowar.wordpress.com/2024/01/06/quicknote-technical-analysis-of-recent-pikabot-core-module/
0day in {REA_TEAM}
[QuickNote] Technical Analysis of recent Pikabot Core Module
1. Overview In early February 2023, cybersecurity experts on Twitter issued a warning about a new malware variant/family being distributed by the #TA577 botnet (associated with the same group from …
آکادمی آموزش روزبه 📚
تحلیل بد افزار How Pikabot obfuscates and decrypts strings. How Pikabot retrieves API addresses. How Pikabot slows down the analysis process. How Pikabot generates victim uuid. Collecting information from the victim’s machine. How Pikabot decrypts C2…
کتابهای پیشنهادی در مسیر انجام تحلیل بدافزار
#آکادمی_روزبه
https://blog.securitybreak.io/my-top-books-to-learn-malware-analysis-and-reverse-engineering-2ae1c6e209b9
#آکادمی_روزبه
https://blog.securitybreak.io/my-top-books-to-learn-malware-analysis-and-reverse-engineering-2ae1c6e209b9
Medium
My Top Books to Learn Malware Analysis and Reverse Engineering
I often get messages from people wanting to learn more about reverse engineering and malware. I always refer to the same books and I though…
ترجمه کامل مقاله روزنامه هلندی
درخصوص اولین مرحله از حضور اکستاکس نت در ایران
#آکادمی_روزبه
https://onhexgroup.ir/stuxnet-erik-van-sabben/
درخصوص اولین مرحله از حضور اکستاکس نت در ایران
#آکادمی_روزبه
https://onhexgroup.ir/stuxnet-erik-van-sabben/
ONHEXGROUP
ابعاد جدیدی از ویروس استاکس نت منتشر شد
در این پست گزارش روزنامه ی هلندی Volkskrant در خصوص نحوه ی ورود ویروس استاکس نت به تاسیسات هسته ای ایران ، توسط یه مهندس هلندی رو بررسی کردیم.