VP Cyber Resiliency Strategy | UK South West Tech Cluster Advisory Board Member | Security BSides London Co-Founder | Regional Chair NCSC Cyber information Sharing Partnership | Forbes Technology Council Member
Introducing a New Vulnerability Class: False File Immutability https://lnkd.in/egUMC4dm
A Proof-of-Concept (PoC) exploit has been publicly released for a high-severity vulnerability in the popular file archiver 7-Zip. https://lnkd.in/dhXSevr2
Often, the easiest way to break kill chains is to block the opening of untrusted files. https://lnkd.in/gGCfeeu4
Lab 6 Completed on File Path Traversal: Null Byte Bypass ✅ Just completed another fascinating lab! This time, I bypassed a flawed file extension validation mechanism using a null byte injection. Here's a breakdown of my approach: 1️⃣ Analyzed File Extension Validation: Observed that the server restricted file uploads or access to specific extensions like .png or .jpg. 2️⃣ Identified the Weakness: Found that the application only checked the file extension at the end of the input, without properly sanitizing the entire path. 3️⃣ Exploited with Null Byte Injection: Appended a null byte (%00) after a malicious payload, such as /etc/passwd%00.png, to bypass the file extension check. 4️⃣ Verified Exploitation: Successfully retrieved the sensitive /etc/passwd file, confirming the vulnerability. 5️⃣ Completed the Challenge: Extracted the required data to complete the lab. This lab underscored the dangers of incomplete input validation, especially when relying solely on file extensions for security. A key takeaway is to implement stricter checks at the server level, ensuring all inputs are sanitized and validated comprehensively!
A high-severity vulnerability in the 7-Zip file archiver allows attackers to bypass the Mark of the Web
Security, risk, privacy, technology leader and board member. Experience in multiple verticals including banking, finance, insurance, telecomm, life science, manufacturing & healthcare. Security and DEI evangelist!
CrushFTP File Transfer Vulnerability Lets Attackers Download System Files
Experienced Website & Software Company Director Helping Companies with Professionally Designed Websites That Attract Their Ideal Customers × Simple Pixels × Web & App Development & Design × SEO Ads × Logo Design
Nerd Alert! Below is a demo hack to take control of a website with a security vulnerability. This is so common! Problem with plugins is, they need updating most days. Need a solution, we can help! https://lnkd.in/gEYSFJbb?
Chief Architect at Garantir specializing in enterprise digital signature and asymmetric cryptography applications.
These types of attacks can get very sophisticated and can spread like wildfire. It is critical to ensure the code you are releasing is what you intend to release (i.e., matches what is in your source code repository), is high quality (i.e., passes testing, static/dynamic analysis, etc), and can be automatically remotely verified at runtime, install time, and download time (i.e., is properly signed). Garantir can help with this. https://lnkd.in/gbVg9ZYp
0patch Blog: URL File NTLM Hash Disclosure Vulnerability (0day) - and Free Micropatches for it
🚨 Bug #5: X-Forwarded Header Injection 🚨 "Ab toh trust issues ho rahe hain!" 😂 While diving deep into server misconfigurations, I stumbled upon an interesting vulnerability: X-Forwarded Header Injection. This bug occurs when a server blindly trusts user-supplied headers like X-Forwarded-For without proper validation. By manipulating this header, I was able to bypass certain security checks and influence server behavior in unexpected ways. Imagine a server saying, “Jo dikhta hai, woh hamesha sach nahi hota!” 😅
There are numerous key loggers available on GitHub, but most are designed to log keystrokes to a file, which makes the program more vulnerable to detection by Windows Defender. What if we instead log the keystrokes to a memory region? Through my research, this approach works flawlessly on a Windows virtual machine without being flagged as a malicious file with all the Windows Defender security measurements turned on. https://lnkd.in/gM92bWYv
