Aggregator

Pass the Cookie and Pivot to the Clouds

Embrace The Red
6 years ago
Web Applications and Services use cookies to authenticate sessions and users. An adversary can pivot from a compromised host to Web Applications and Internet Services by stealing authentication cookies from browsers and related processes. At the same time this technique bypasses most multi-factor authentication protocols. The reason for this is that the final authentication token that the attacker steals is issued after all factors have been validated. Many users persist cookies that are valid for an extended period of time, even if the web application is not actively used.

Quiz Phishing: One Scam, 78 Variations

The Akamai Blog
6 years ago
Over the past year, Akamai Enterprise Threat Research team monitored the usage of one particular phishing toolkit in the wild. We previously wrote about this phishing toolkit as "Three Questions Quiz". The "Quiz" toolkit is not new to the threat landscape, as its been used in many phishing campaigns in recent years. Our goal here is to present new insights on the evolution and scale of usage of the toolkit in the wild. The most surprising insight was the variety of commercial brands being abused as part of these phishing scams that were all using the same toolkit, but wearing a different face.
Or Katz

ThinkPHP5代码执行的简单分析 - 羊小弟

羊小弟
6 years ago
漏洞影响版本: ThinkPHP 5.0.5-5.0.22 ThinkPHP 5.1.0-5.1.30 漏洞复现: 一.mac的debug环境搭建。 一键化环境搭建工具: mamp pro ,调试工具 PHPstorm 打开mamp pro，设置左上角的file->Edit Template, 设置
羊小弟

Managed ad