ROSECURIFY
Subscribe
~/ seclog/ #131

Seclog - #131

23 curated links

g3n3r4l14

  1. Cloud-Attack Techniques (threats.wiz.io)

    Interactive matrix of cloud-attack techniques and mitigations.

  2. Every UUID V4 (everyuuid.com)

    Generate, decode, and validate version-4 UUIDs in one click.

  3. BloodHound Query Library (queries.specterops.io)

    Curated Cypher queries for BloodHound neo4j graphs.

  4. InfoPêxwas: How They Pick Your Digital Pockets Without You Noticing (happyhackingspace.blog)

    Modern info-stealing tactics in the wild.

  5. SugarCRM Vulnerability (karmainsecurity.com)

    SugarCRM <= 6.5.23 (SugarRestSerialize.php) PHP Object Injection Vulnerability allows unauthenticated attackers to execute arbitrary PHP code via specially crafted serialized objects.

  6. A Bit More on Twitter/X’s New Encrypted Messaging (blog.cryptographyengineering.com)

    Deeper cryptographic analysis of X’s E2EE beta.

  7. Ghidra Is Best: Android Reverse Engineering (remyhax.xyz)

    Hands-on guide to reversing Android apps with Ghidra.

  8. Escaping ‘<’ and ‘>’ in Attributes (bughunters.google.com)

    How tiny escapes thwart mutation-XSS.

  9. CVE-2025-34508: Path Traversal in ZendTo (horizon3.ai)

    End-to-end exploit walk-through and detection tips.

  10. Is b for Backdoor? Pre-Auth RCE Chain in Sitecore XP (labs.watchtowr.com)

    WatchTowr’s deep dive into a sneaky exploit chain.

  11. Defending the Internet: Cloudflare Blocks a 7.3 Tbps DDoS (blog.cloudflare.com)

    Behind the scenes of record-breaking mitigation.

  12. Cloud Hash Cracking Economics (brunoteixeira1996.github.io)

    Combines Hashtopolis and Cloudflare Tunnel for cost-effective distributed cracking without hardware investments.

  13. Go Parser Security Footguns (blog.trailofbits.com)

    Highlights unexpected risks in Go’s JSON/XML/YAML parsers, including data exposure and format confusion exploits.

  14. Insomnia API Client Template Injection (tantosec.com)

    Uncovers vulnerabilities in developer tools used during offensive security assessments.

X2

  1. Zoom Phishing via App Absence (@hosseeb)

    Warns that victims fall for impersonators directing to fake Zoom links (e.g., Z0om.com) partly due to lacking the native app, which should trigger suspicion. Watch Here

  2. Prompt Injection Mimicry Tactics (@ctbbpodcast)

    Effective prompt injection mimics the model’s training data format for higher success rates. Watch Here

y0utube2

  1. Parser Differentials: When Interpretation Becomes a Vulnerability (youtube.com)

    OffensiveCon 25 talk by Joernchen. Watch Here

  2. Google Cloud CISO: Shift Down not Left, 4 Ways Google Uses AI for Security (youtube.com)

    Phil Venables on AI-driven defense. Watch Here

g1thub5

  1. nuryslyrt/AISecTips-Tricks (github.com)

    Handy AI-powered security tips & scripts. Explore on GitHub

  2. Ghostcrew (github.com)

    Ghostcrew is an all-in-one offensive security toolbox with AI agent and MCP architecture, integrating tools like Nmap, Metasploit, and FFUF. Explore on GitHub

  3. Fakjs (github.com)

    Fakjs is a fast Go-based tool to uncover sensitive information in JavaScript files, playing a crucial role in reconnaissance during security assessments. Explore on GitHub

  4. Threat Designer (github.com)

    Threat Designer is a GenerativeAI application designed to automate and streamline the threat modeling process for secure system design. Explore on GitHub

  5. Paragon (github.com)

    Paragon is a web-based checklist-driven note-taking app following bug bounty and web app pentest methodology. Explore on GitHub

← All Seclogs