The vulnerability exploits a Use-After-Free (UAF) memory corruption bug that has existed for approximately 13 years in the Redis source code

Коннект до Redis
Отправка вредоносного Lua скрипта через Eval
Триггерим Use-After-Free
Выход из Lua песочницы
Выполнение кода за пределами песочницы
Получаем полный доступ

Redis 8.2.2
Redis 8.0.4
Redis 7.4.6
Redis 7.2.11

Singularity is a Loadable Kernel Module (LKM) rootkit developed for Linux 6.x kernels that demonstrates advanced evasion and persistence techniques

Gain insights into MS-RPC implementations that may be vulnerable using an automated approach and make it easy to visualize the data

Import-Module .\MS-RPC-Fuzzer.psm1
Get-RpcServerData -target "C:\Windows\System32\efssvc.dll" -OutPath .\output

#Fuzzing
'.\output\rpcServerData.json' | Invoke-RpcFuzzer -outpath .\output\ -minStrLen 100 -maxStrLen 1000 -minIntSize 9999 -maxIntSize 99999

#Analysis
'.\output\Allowed.json' | Import-DatatoNeo4j -Neo4jHost 192.168.178.89:7474 -Neo4jUsername neo4j

# Host A
ft.exe -L 5000:127.0.0.1:3389 --write "\\server\share\1.dat" --read "\\server\share\2.dat"

# Host B
ft.exe --read "\\server\share\1.dat" --write "\\server\share\2.dat"

# Host A
ft.exe -L 5000:192.168.1.50:8888 --write "C:\Temp\1.dat" --read "C:\Temp\2.dat"

# Host B
ft.exe --read "\\tsclient\c\Temp\1.dat" --write "\\tsclient\c\Temp\2.dat"

scmr - Service Control Manager (MS-SCMR)
tsch - Task Scheduler (MS-TSCH)
dcom - Distributed Component Object Model (MS-DCOM)
wmi - Windows Management Instrumentation (MS-WMI)

CGO_ENABLED=0 go install -ldflags="-s -w" github.com/FalconOpsLLC/goexec@latest

curl -LsSf https://astral.sh/uv/install.sh | sh

powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"

Plugin: PPOM for WooCommerce
Affected Versions: <= 33.0.15
Patched Version: 33.0.16
Vulnerability Type: Unauthenticated Time-Based Blind SQL Injection
CVE ID: CVE-2025-11391

function get_product_meta( $meta_id ) {
    // ...
    global $wpdb;
    $qry = 'SELECT * FROM ' . $wpdb->prefix . PPOM_TABLE_META . " WHERE productmeta_id = $meta_id";
    $res = $wpdb->get_row( $qry );
    return $res;
}

GenericAll - полные права на объект
GenericWrite - редактировать атрибуты объекта
WriteOwner - изменить владельца объекта
WriteDACL - редактировать ACE объекта
AllExtendedRights - расширенные права на объект
ForceChangePassword - сменить пароль объекта
Self - возможность добавить себя в группу

Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/canix1/ADACLScanner/refs/heads/master/ADACLScan.ps1' -OutFile ADACLScan.ps1

.\ADACLScan.ps1

.\ADACLScan.ps1 -Base (Get-ADRootDSE).defaultNamingContext -Owner -Scope subtree -Filter '(objectClass=*)' | Where-Object {$_.Access -eq 'Owner'}

FuzzForge helps security researchers and engineers automate application security and offensive security workflows with the power of AI and fuzzing frameworks

git clone https://github.com/fuzzinglabs/fuzzforge_ai.git
cd fuzzforge_ai

uv tool install --python python3.12 .

Temporal: Workflow orchestration (UI at http://localhost:8080)
MinIO: File storage for targets (Console at http://localhost:9001)
Backend API: FuzzForge REST API (http://localhost:8000)

Небезопасная десериализация данных AuthorizationCookie посредством BinaryFormatter в методе EncryptionHelper.DecryptData()

23 октября 2025 года выпущено внеплановое (OOB) обновление, устраняющее данную проблему. Это накопительное обновление, поэтому перед его установкой не требуется применять предыдущие обновления — оно заменяет все ранее выпущенные исправления для затронутых версий. Если вы еще не установили октябрьское обновление безопасности Windows 2025, мы рекомендуем установить именно это внеплановое обновление

Yara
Sigma
Zeek
Suricata
Crs
Nova
Elastic

title: Encoded or Base64 Payload in HTTP POST to F5 Management API
id: f5-base64-upload-2025
description: Detects long base64 strings in HTTP POST body to management or shared endpoints.
author: abdulmyid@gmail.com
status: experimental
logsource:
  product: webproxy
  service: http
detection:
  selection:
    http.method: POST
    url|contains:
      - '/mgmt'
      - '/shared'
    http.request.body|contains_regexp: '[A-Za-z0-9+/]{200,}={0,2}'
  condition: selection
level: medium
falsepositives:
  - Legitimate encoded payloads (token exchanges, APIs).

iwr https://github.com/itm4n/PrivescCheck/releases/latest/download/PrivescCheck.ps1 -OutFile PrivescCheck.ps1

#Базовые проверки
powershell -ep bypass -c ". .\PrivescCheck.ps1; Invoke-PrivescCheck"

#Расширенные
powershell -ep bypass -c ". .\PrivescCheck.ps1; Invoke-PrivescCheck -Extended -Audit -Report PrivescCheck_$($env:COMPUTERNAME) -Format TXT,HTML,CSV,XML"

EDR-Redir uses a Bind Filter (mini filter bindflt.sys) and the Windows Cloud Filter API (cldflt.sys) to redirect the Endpoint Detection and Response (EDR) 's working folder to a folder of the attacker's choice. Alternatively, it can make the folder appear corrupt to prevent the EDR's process services from functioning

A service trigger is a configuration option for a Windows service that allows that service to be started when some other activity or condition is met. Some of these conditions are largely static, for example the computer being domain joined or having an IP address allocated. Other conditions are more dynamic in nature, for instance receiving a connection request for a given named pipe or processing a specific trace message