ROSECURIFY
Subscribe
~/ seclog/ #145

Seclog - #145

29 curated links

g3n3r4l18

  1. Essential Principles for Security Professionals (hacker-laws.com)

    Hacker Laws and principles, offering insights for cybersecurity professionals. This resource provides a succinct collection of guidelines often applied in the security domain. hacker-laws.com

  2. Visualize Web Site and Cookie Scopes (google.com)

    A handy visualizer for understanding web site, origin, and cookie scopes. This interactive tool helps illustrate how different domains and paths affect cookie access and security. ukusormus.github.io

  3. InfoSec and Hacker Memorial Site (restincode.com)

    This site serves as an InfoSec and Hacker Memorial Site, honoring individuals from the cybersecurity community. It provides a dedicated space to remember and celebrate their contributions. restincode.com

  4. CISA Incident Response Lessons Learned (cisa.gov)

    CISA Shares Lessons Learned from a recent incident response engagement, providing valuable insights. This advisory outlines key takeaways to help organizations improve their cybersecurity posture.

  5. Malicious Crates on crates.io Alert (blog.rust-lang.org)

    The Rust Blog warns about malicious crates fasterlog and asyncprintln found on crates.io. Users are advised to check their dependencies and update immediately to avoid potential supply-chain attacks.

  6. Hacking Misconfigured Supabase Instances at Scale (deepstrike.io)

    A report detailing how thousands of misconfigured Supabase instances were exploited. This highlights the widespread risks of insecure configurations in cloud-hosted databases and the importance of proper hardening.

  7. Apache Druid SSRF Vulnerability via URL Parsing (xbow.com)

    XBOW reports CVE-2025-27888, a Server-Side Request Forgery vulnerability in Apache Druid's proxy endpoint. The flaw stems from URL parsing confusion, allowing attackers to bypass controls.

  8. Hunting SSRF Vulnerabilities in Next.js (intigriti.com)

    A guide to hunting for SSRF vulnerabilities specifically in Next.js targets. This research explores common patterns and techniques to identify and exploit server-side request forgery flaws in modern web applications.

  9. Postmark Backdoor Steals Emails (koi.security)

    Discovery of a malicious MCP in the wild, specifically a Postmark backdoor designed to steal emails. This incident underscores the ongoing threat of supply chain attacks targeting popular platforms.

  10. Apache Vulnerabilities That Don't Count (starlabs.sg)

    This analysis delves into Apache Vulnerabilities That Don't Count, exploring nuances in how certain flaws are assessed. It examines scenarios where issues might be overlooked or miscategorized.

  11. Hacking High-Profile Bug Bounty Targets (vitorfalcao.com)

    A deep dive into Hacking High-Profile Bug Bounty Targets through a client-side chain. This detailed write-up shares techniques and insights for chaining vulnerabilities in complex applications.

  12. Hacking Furbo: Exploiting BLE in Hardware (softwaresecured.com)

    Part 5 of a hardware research project, detailing Hacking Furbo by exploiting Bluetooth Low Energy (BLE). This segment focuses on practical vulnerabilities found in IoT devices.

  13. NCSC CTO Summary & SIM Swapping Threat (ctoatncsc.substack.com)

    The CTO at NCSC provides a weekly summary covering key cybersecurity events. This also includes a critical threat model on SIM Swapping and how individuals can protect themselves from this attack vector.

  14. Threat Model: SIM Swapping (google.com)

    A discussion on threat modeling for SIM swapping attacks and how to protect against them.

  15. Unauthenticated Access to Firebase Databases (ice0.blog)

    Report on unauthenticated access to 150+ Firebase databases, storage buckets, and secrets. This highlights critical misconfigurations exposing sensitive data in numerous applications.

  16. advisories/2020\fwupd\dangling\s3\bucket\and\CVE-2020-10759\signature\verification\bypass.md (google.com)

    An advisory regarding a dangling S3 bucket and signature verification bypass. Explore on GitHub

  17. APTs-Adversary-Simulation/Russian APT/Ember-Bear-APT (google.com)

    Resources on Russian APT (Advanced Persistent Threat) group Ember Bear for adversary simulation. Explore on GitHub

  18. OmniProx (google.com)

    IP Rotation from different providers - Like FireProx but for GCP, Azure, Alibaba and CloudFlare. Explore on GitHub

y0utube2

  1. Covert Operations and Bot Farms: Russia/Ukraine Case Study (youtube.com)

    This video explores Covert Operations and Bot Farms in the Russia/Ukraine case study. Watch Here

  2. Operation BlackEcho: Voice Phishing (youtube.com)

    Details on "Operation BlackEcho" describing voice phishing using fake financial and vaccine apps. Watch Here

g1thub9

  1. delete-from-users-where-location-iran.md (gist.github.com)

    A GitHub Gist likely related to data privacy or compliance concerning user data based on geographical location.

  2. DataDog/supply-chain-firewall (github.com)

    A tool for preventing the installation of malicious npm and PyPI packages. Explore on GitHub

  3. flareprox (github.com)

    Use Cloudflare to create HTTP pass-through proxies for unique IP rotation. Explore on GitHub

  4. SSH3 (github.com)

    Faster and rich secure shell using HTTP/3. Explore on GitHub

  5. oauth2-proxy (github.com)

    A reverse proxy that provides authentication with various identity providers. Explore on GitHub

  6. force-push-scanner (github.com)

    Scan for secrets in dangling commits on GitHub. Explore on GitHub

  7. google-redirector (github.com)

    A lightweight redirector for Google Cloud Run, enabling domain fronting. Explore on GitHub

  8. CISO Assistant Community (github.com)

    A one-stop-shop for GRC (Governance, Risk, and Compliance). Explore on GitHub

  9. Git Coin Community SPAM (github.com)

    A GitHub discussion related to community spam. Explore on GitHub

← All Seclogs