This blog introduces foundational cybersecurity concepts such as the OSI model, TCP/IP stack, subnetting, CIDR, and DNS, shared through a beginner’s personal learning journey. It emphasizes the importance of understanding these principles for building a solid cybersecurity knowledge base. #OSIModel #TCPIPStack #Subnetting #DNS
Category: Interesting Stuff
This article describes a detailed journey of identifying and exploiting an SSRF vulnerability in a cloud environment, ultimately leading to the extraction of Azure Managed Identity tokens. It emphasizes the importance of persistence, asking the right questions, and paying attention to seemingly insignificant details in bug hunting. #Azure #SSRF #ManagedIdentity
This article details the discovery and remediation of a pervasive supply chain vulnerability in the Java ecosystem caused by insecure dependency resolution over HTTP. It highlights collaborative efforts among artifact hosts, build tools, and open source projects to eliminate the risk. #JavaSupplyChain #DependencyVulnerability
Blind Eagle, also known as APT-C-36, has been targeting Colombian organizations and other Latin American sectors since 2018 using phishing campaigns and Remote Access Trojans with sophisticated methods to evade detection. A recent 2024-2025 campaign exploited a Microsoft Windows vulnerability via malicious URLs and leveraged WebDAV protocol for payload delivery and data exfiltration, with Darktrace detecting suspicious activity and highlighting the need for autonomous response capabilities. #BlindEagle #APT-C-36 #Remcos #CVE-2024-43451
Hands-on security training platforms are essential in 2025 to develop real-world skills for detecting and mitigating cyber threats, surpassing traditional methods like slide decks. Among the top providers, Hack The Box Enterprise stands out for its deep technical labs and enterprise support, especially for large organizations. #HackTheBox #TryHackMe
This article details an in-depth exploration of Blind SQL Injection techniques used to identify and exploit vulnerabilities in Oracle databases. It emphasizes troubleshooting methods, such as error-based signals and conditional queries, to extract sensitive information securely. #BlindSQLInjection #OracleDatabase
A critical vulnerability has been discovered in Notepad++ v8.8.1, allowing attackers to gain system-level access through malicious manipulation of executable files during installation. This exploit involves binary planting of a malicious regsvr32.exe, which can lead to arbitrary code execution and full system compromise. #NotepadPlusPlus #CVE-2025-49144
This article explores how threat actors use layered XOR obfuscation techniques, combining bitshifts, Base64, and dynamic logic to evade static analysis tools. Such techniques transform simple encoding into a complex fortress that bypasses signature-based detection and reverse engineering efforts. #XORception #YARASignatures
ESC11 is a sophisticated attack targeting Active Directory Certificate Services (AD CS), exploiting vulnerabilities in RPC encryption enforcement and NTLM relay techniques. It enables attackers to escalate privileges within Active Directory by abusing certificate templates and relaying NTLM authentication. #ESC11 #ActiveDirectory #NTLMRelay #ADCS #Kerberos
This article explains how AWS-LC uses AVX-512 optimizations to enhance cloud cryptography performance, particularly in AES-GCM and AES-XTS modes. These improvements significantly boost encryption throughput, reduce CPU utilization, and support scalable, high-speed data security in cloud environments. #AVX512 #AWSLC #AESGCM #AESXTS #cloudcryptography
This article explains the various DNS record types, including A, AAAA, CNAME, MX, TXT, NS, SOA, SRV, and PTR, and their roles in domain name resolution and email authentication. It also highlights how DNS queries are used in cybersecurity for verifying email sources and domain legitimacy. #DNSRecords #EmailAuthentication
KeySentry is an open-source CLI tool designed to detect leaked API keys and sensitive files in GitHub repositories and local projects, helping prevent account compromises and financial losses. It uses regex patterns, filename flags, and JSON logging to identify secrets such as AWS keys, API tokens, and private keys before they are exploited. #APILeaks #GitHubSecrets #CyberSecurityTools
PhishHound is an open-source Python tool designed to help analysts quickly triage suspicious email headers, focusing on common authentication failure indicators. It enhances phishing detection by providing customizable rules, heuristic scoring, and clear risk assessments, aiding security teams in identifying malicious emails early. #PhishHound #EmailHeaderAnalysis
TTL (time-to-live) is a crucial network parameter that limits the lifespan of data packets and helps prevent routing loops. It is also utilized in tools like traceroute and by security analysts for OS fingerprinting. #ICMP #Nmap
This article explores methodologies for detecting fileless malware that leverages the Windows Registry for staging payloads and persistence, focusing on analytics using Microsoft Defender for Endpoint (MDE). It emphasizes identifying registry-based anomalies through behavioral and statistical techniques, especially involving LOLBins and indirect execution chains. #FilelessMalware #RegistryThreats