Java – Cracking the Random: CVE-2024-29868
TL;DR
If you employ a Java application with a token-based password recovery mechanism, be sure that said token isn't generated using: RandomStringUtils. Spoiler: You can crack it and predict all past and future tokens generated by the application!Some Context
During a Penetration Test I was sifting through the internet - as one often does...
Citrix ADC – Unexpected Treasure
TL;DR Setting secure rules for the RelayState parameter is a MUST when configuring Citrix Application Delivery Controller (ADC) and Citrix Gateway as SAML Service Provider, because an attacker can exploit a chain of three low-risk vulnerabilities to compromise victims’ accounts. By luring users to a malicious domain, attackers can steal session cookies and gain unauthorized...
Rhysida – Ransomware Payload Analysis
RANSOMWARE GROUP DETAILS
Ryhsida is a ransomware gang that became famous starting from May 2023 after being correlated to a series of high profile cyber attacks in west Europe, north an south America and Australia. The group seems to be linked with the known Threat Actor “Vice Society”. The team takes his name from a centipede species...
Pizza, Pasta and Red Teaming: insights and ideas for an Italian-style report
Pizza, Pasta and Red Teaming: insights and ideas for an Italian-style report
Foreword
After more than 2 years from the inauguration of Labs, made with my friend Paolo Stagno aka VoidSec, it was perhaps time for me to write something . But $whoami? Make yourself comfortable and go to the "Author" section at the end of the article.The...
GhostSec, the hacktivist collective targeting ICSs
Introduction
To be able to achieve their objectives, hacktivist groups have been traditionally employing techniques such as distributed denial of services (DDoS), website defacements, and leaks of documents. These operations are usually conducted to advocate for specific social or political causes. Recently, it has been observed that hacktivist groups have shifted towards the targeting of Industrial Control...
GIS3W: Persistent XSS in G3WSuite 3.5 – CVE-2023-29998
GIS3W: Persistent XSS in G3WSuite 3.5 – CVE-2023-29998
Overview
During an engagement on a client's public infrastructure, we detected an exposed installation of G3WSuite. Since we were asked to perform a black box pentest on the G3WSuite installation, we had to find a way to gather as much information about the target as possible. Luckily for us,...
Win$ton: a Russian-Speaking Scam Group Targeting Middle-Eastern Customers
Introduction
As Yarix Cyber Threat Intelligence (YCTI) team, we regularly monitor, track and counter phishing websites that aim to steal user-sensitive data (e.g., login credentials, phone numbers, credit cards). One of the most challenging aspect of proactively countering and tracking phishing campaigns is hunting and analyzing exposed phishing kits. The analysis of these archives enables...
Vade Secure Gateway Multiple XSS (CVE-2023-29712, CVE-2023-29713, CVE-2023-29714)
Vade Secure Gateway
During a penetration test activity, several reflected cross-site scripting (XSS) vulnerabilities were found on an application developed by the French Company Vade Secure. The vulnerable application is Vade Secure Gateway which is an email box scanning and processing tool for spam removal that can be managed via a web page. Once we identified the...