zer0trustsec https://www.zer0trustsec.com Santhosh Baswa’s field notes from the blue team and the red team. en-gb Sun, 11 Oct 2026 15:25:30 GMT Blue Team - RegreSSHion (CVE-2024-6387)- OpenSSH Vulnerability https://www.zer0trustsec.com/articles/regresshion_cve-2024-6387_openssh_vulnerability https://www.zer0trustsec.com/articles/regresshion_cve-2024-6387_openssh_vulnerability Tue, 02 Jul 2024 14:00:00 GMT Unauthenticated Remote code Execution in OpenSSH Server on glibc-based Linux Systems (RegreSSHion) Vulnerabilities Microsoft Defender Endpoint | Unmanaged Devices - Detection | Not Onboarded Devies https://www.zer0trustsec.com/articles/microsoft-defender-endpoint-rogue-devices-not-onboarding https://www.zer0trustsec.com/articles/microsoft-defender-endpoint-rogue-devices-not-onboarding Thu, 03 Jun 2021 07:00:00 GMT Rogue Devices detecting by Microsoft Defender Endpoint Blue Team Solarigate/Sunburst Incident Response Playbook & Investigation/Hunting/MindMap for CSIRT/SOC/InfoSec/SecOps Teams https://www.zer0trustsec.com/articles/blueteam_solarigate_sunburst_ir_playbook_investigation https://www.zer0trustsec.com/articles/blueteam_solarigate_sunburst_ir_playbook_investigation Mon, 21 Dec 2020 21:00:00 GMT Solarigate/Sunburst IR plan & Investigation Strategy Blue Team OSINT - SynapsInt Unified Research Tool https://www.zer0trustsec.com/articles/osint-enumeration-synapsint-unified-research https://www.zer0trustsec.com/articles/osint-enumeration-synapsint-unified-research Mon, 05 Oct 2020 12:00:00 GMT Validate the emails on multiple websites OSINT BlueTeam - Bug Bounty Triage - Challenges & Triage Workflow for CSIRT teams https://www.zer0trustsec.com/articles/blueteam-bugbounty-triage-organization https://www.zer0trustsec.com/articles/blueteam-bugbounty-triage-organization Sat, 19 Sep 2020 18:00:00 GMT Workflow for Bug Bounty Submissions Blue Team OSINT - Email validation using forget-password functionality (Python). https://www.zer0trustsec.com/articles/osint-email-validation-using-forgetpassword-function-using-python https://www.zer0trustsec.com/articles/osint-email-validation-using-forgetpassword-function-using-python Tue, 15 Sep 2020 12:00:00 GMT Validate the emails on multiple websites OSINT Extract stored passwords from browser using Powershell https://www.zer0trustsec.com/articles/extract-saved-browser-passwords-using-powershell https://www.zer0trustsec.com/articles/extract-saved-browser-passwords-using-powershell Tue, 15 Sep 2020 02:00:00 GMT Stealing saved passwords using Powershell Red Team Zerologon (CVE-2020-1472) <-> Red|Blue Teams https://www.zer0trustsec.com/articles/zerologon-domainadmin-netlogon-cryptography https://www.zer0trustsec.com/articles/zerologon-domainadmin-netlogon-cryptography Mon, 14 Sep 2020 04:00:00 GMT CVE-2020-1472 Vulnerabilities RedTeam Tip - Change MAC address in endpoint https://www.zer0trustsec.com/articles/redteam-tip-change-mac-address https://www.zer0trustsec.com/articles/redteam-tip-change-mac-address Sat, 12 Sep 2020 03:00:00 GMT Change MAC Address in endpoint machines. Red Team Windows Defender official backdoor - Download files from Internet using "MpCmdRun.exe". https://www.zer0trustsec.com/articles/windowsdefender-official-backdoor-download-files-from-internet-mpcmdrun https://www.zer0trustsec.com/articles/windowsdefender-official-backdoor-download-files-from-internet-mpcmdrun Fri, 04 Sep 2020 01:00:00 GMT Download any files from internet using "MpCmdRun.exe" Red Team Redteam Tip - Google dork for .git folder exposure https://www.zer0trustsec.com/articles/devops-redteam-git-config-googledork https://www.zer0trustsec.com/articles/devops-redteam-git-config-googledork Sat, 11 Mar 2017 03:00:00 GMT Google dork to identify the git Red Team DevOps Security - Scanning SSH keys for Weak credentials https://www.zer0trustsec.com/articles/devops-vagrant-default-cred-check https://www.zer0trustsec.com/articles/devops-vagrant-default-cred-check Tue, 21 Feb 2017 14:00:00 GMT Scanning SSH keys for Weak credentials. Red Team Ticketbleed - Scan whole internet using massscan tool https://www.zer0trustsec.com/articles/scan-whole-internet-ticketbleed https://www.zer0trustsec.com/articles/scan-whole-internet-ticketbleed Fri, 10 Feb 2017 12:00:00 GMT Ticketbleed vulnerability Vulnerabilities Is your saved passwords were safe in browser? https://www.zer0trustsec.com/articles/stealpasswords-modern-browsers-autofill-privacy https://www.zer0trustsec.com/articles/stealpasswords-modern-browsers-autofill-privacy Thu, 24 Nov 2016 02:00:00 GMT Stealing saved passwords (Autofill enabled) from browsers POC code Red Team Security Admin Tip- Enable terminal history logging https://www.zer0trustsec.com/articles/enable-terminal-history-logging https://www.zer0trustsec.com/articles/enable-terminal-history-logging Tue, 22 Nov 2016 00:50:00 GMT Lazy Linux admins should enable below history logging. Blue Team Is your browser knows about you ? https://www.zer0trustsec.com/articles/what-your-browser-knows-about-you https://www.zer0trustsec.com/articles/what-your-browser-knows-about-you Tue, 22 Nov 2016 00:00:00 GMT Browser is having capability to access system level data. Red Team Bypass WAF - Techniques https://www.zer0trustsec.com/articles/bypass-waf-blogs https://www.zer0trustsec.com/articles/bypass-waf-blogs Sun, 20 Nov 2016 02:00:00 GMT Bypass the Web Application Firewalls Red Team DirtyCow Vulnerability Detection https://www.zer0trustsec.com/articles/dirtycow-vulnerability-quickcheck https://www.zer0trustsec.com/articles/dirtycow-vulnerability-quickcheck Mon, 24 Oct 2016 04:00:00 GMT DirtyCow Detection Vulnerabilities Zer0trust Sec Blog - Introduction https://www.zer0trustsec.com/articles/welcome-to-my-tech-blog https://www.zer0trustsec.com/articles/welcome-to-my-tech-blog Sun, 19 Apr 2015 18:00:00 GMT Technical Blog Notes