Vulnerabilities
Blue Team - RegreSSHion (CVE-2024-6387)- OpenSSH Vulnerability
Unauthenticated Remote code Execution in OpenSSH Server on glibc-based Linux Systems (RegreSSHion)
Santhosh Baswa
2 July 2024, 4 min read
zer0trustsec: Red team, blue team and everything between — write-ups from real incidents.
Blue Team
Detect, investigate, respond.
Microsoft Defender Endpoint | Unmanaged Devices - Detection | Not Onboarded Devies
3 June 2021
Solarigate/Sunburst Incident Response Playbook & Investigation/Hunting/MindMap for CSIRT/SOC/InfoSec/SecOps Teams
22 December 2020
BlueTeam - Bug Bounty Triage - Challenges & Triage Workflow for CSIRT teams
19 September 2020
Security Admin Tip- Enable terminal history logging
22 November 2016
Red Team
Attack paths, tooling and tradecraft.
Extract stored passwords from browser using Powershell
15 September 2020
RedTeam Tip - Change MAC address in endpoint
12 September 2020
Windows Defender official backdoor - Download files from Internet using "MpCmdRun.exe".
4 September 2020
Redteam Tip - Google dork for .git folder exposure
11 March 2017
Latest write-ups
All 19 postsMicrosoft Defender Endpoint | Unmanaged Devices - Detection | Not Onboarded Devies
Rogue Devices detecting by Microsoft Defender Endpoint
3 June 2021, 2 min read
Solarigate/Sunburst Incident Response Playbook & Investigation/Hunting/MindMap for CSIRT/SOC/InfoSec/SecOps Teams
Solarigate/Sunburst IR plan & Investigation Strategy
22 December 2020, 5 min read
OSINT - SynapsInt Unified Research Tool
Validate the emails on multiple websites
5 October 2020, 1 min read
BlueTeam - Bug Bounty Triage - Challenges & Triage Workflow for CSIRT teams
Workflow for Bug Bounty Submissions
19 September 2020, 6 min read
OSINT - Email validation using forget-password functionality (Python).
Validate the emails on multiple websites
15 September 2020, 1 min read
Extract stored passwords from browser using Powershell
Stealing saved passwords using Powershell
15 September 2020, 1 min read
Vulnerability watch
All vulnerabilities- CVE-2024-6387
- CVE-2020-1472
Zerologon (CVE-2020-1472) <-> Red|Blue Teams
14 September 2020
Ticketbleed - Scan whole internet using massscan tool
10 February 2017
DirtyCow Vulnerability Detection
24 October 2016