awesome-csirt
Awesome CSIRT is an curated list of links and resources in security and CSIRT daily activities.
https://github.com/Spacial/awesome-csirt
Last synced: 16 days ago
JSON representation
Archs
ARM
- Understanding the Glibc Heap Implementation
- Heap Exploit Development - the-wild iOS 0-day. thread
- ARM Instruction Set + Simple Heap Overflow
- Use After Free
- A Simple ROP Chain
- AZM Online Arm Assembler
- Understanding the GLIBC Heap Implementation
- ARM64 Reversing and Exploitation
- ARM64 Reversing and Exploitation
- ARM Instruction Set + Simple Heap Overflow
- Use After Free
- A Simple ROP Chain
CTFs tools
- Hacker Finds Hidden 'God Mode' on Old x86 CPUs - rosenbridge: Hardware backdoors in some x86 CPUs
- Patching Binaries with Radare2 - ARM64
- USBHarpoon
- Lexra - bit variant of the MIPS architecture.
- Potential candidate for open source bootloaders? Complete removal of Intel ME firmware possible on certain Intel HEDT/Server platforms
- Dragonblood
- Something about IR optimization
- Unfixable Seed Extraction on Trezor - A practical and reliable attack. An attacker with a stolen device can extract the seed from the device. It takes less than 5 minutes and the necessary materials cost around 100$.
- Extracting seed from Ellipal wallet
- Breaking Trezor One with Side Channel Attacks
- Rewriting Functions in Compiled Binaries
- Deep Dive
- LAB ENVIRONMENT
- A 2018 practical guide to hacking RFID/NFC
- Saleae
- Osiris
- One Glitch to Rule Them All: Fault Injection Attacks Against AMD's Secure Encrypted Virtualization
- IDA-scripts
- The Hacker's Hardware Toolkit
- HUB
- arm vm working out of the box for everyone
- riscv-ida - V ISA processor module for IDAPro 7.x
- mac-age
- IntelTEX-PoC
- me_cleaner
- wacker
- Deep Dive
- Statically compiled ARM binaries for debugging and runtime analysis.
- IDA-scripts
- Saleae
- A 2018 practical guide to hacking RFID/NFC
Hardware
- Hacker's guide to deep-learning side-channel attacks: the theory
- Guarding Against Physical Attacks: The Xbox One Story
- BrakTooth
- Breaking the Bluetooth Pairing: Fixed Coordinate Invalid Curve Attack
- The Practical Guide to Hacking Bluetooth Low Energy
- A Practical Guide to BLE Throughput
- SkyJack
- Hacking Printers Wiki
- Full key extraction of NVIDIA™ TSEC
- The x86 architecture is the weirdo, part 2
- USB Attacks: Past, Present and Future - VTYuo&feature=youtu.be) - P4wnP1 is below on pentesting section. wrap-up here
- PLATYPUS - based power side-channel attacks on Intel server, desktop and laptop CPUs.
- VoltPillager - based fault injection attacks against Intel SGX Enclaves using the SVID voltage scaling interface
- ToorCon 14 Badge
- Evil Logitech - erm I ment USB cable. USB Samurai For Dummies
- Common BMC vulnerabilities and how to avoid repeating them - 18/Wed-August-8/us-18-Waisman-Soler-The-Unbearable-Lightness-of-BMC.pdf) Perilous Peripherals: The Hidden Dangers Inside Windows & Linux Computers
- Exploiting IoT enabled BLE smart bulb security
- Cracking WiFi at Scale with One Simple Trick
- Car hijacking swapping a single bit
- Hacking a VW Golf Power Steering ECU - Part 1, Part 2 Part 3 and Part 4. VW PQ35 EPS flasher
- Reverse Engineering Yaesu FT-70D Firmware Encryption
- Reverse-engineering an airspeed/Mach indicator from 1977
- Breaking the Bluetooth Pairing: Fixed Coordinate Invalid Curve Attack
- hcxdumptool
- Wifi-Ducky-ESPUSB
- Analyzing a buffer overflow in the DLINK DIR-645 with Qiling framework, Part I
- HammerKit - source library for inducing and characterizing rowhammer that provides out-of-the-box support for Chrome OS platforms.
- BLEAH
- ESP8266 Deauther Version 2
- Airspy-Utils
- infernal-twin - This is automated wireless hacking tool
- SkyJack
- eaphammer - Enterprise networks. Indirect wireless pivots using hostile portal attacks.
- whereami
- Hacking Kia: Remotely Controlling Cars With Just a License Plate
- BMC-Tools
- Hacking Printers Wiki
- awesome flipper
- Dark Flipper
- My Flipper Shits
- Unlocking free WiFi on British Airways
- Valetudo - only operation. repo
- USB Attacks: Past, Present and Future - VTYuo&feature=youtu.be) - P4wnP1 is below on pentesting section. wrap-up here
Articles
Sans
- [1808.00659
- [1809.08325
- DeepMasterPrints: Generating MasterPrints for Dictionary Attacks via Latent Variable Evolution
- Stealing Webpages Rendered on Your Browser by Exploiting GPU Vulnerabilities
- The Hunt for 3ve
- Page Cache Attacks - agnostic side-channel attack that targets one of the most fundamental software caches in modern computer systems: the operating system page cache.
- Identification and Illustration of Insecure Direct Object References and their Countermeasures
- China’s Maxim
- Listen to Your Key: Towards Acoustics-based Physical Key Inference
- Mailto: Me Your Secrets. On Bugs and Features in Email End-to-End Encryption
- Everything Old is New Again: Binary Security of WebAssembly
- Discovering Suspicious APT Behaviors by Analyzing DNS Activities
- Harvard Belfer National Cyber Power Index 2020
- Quantum Blockchain using entanglement in time
- Reflections on Trusting Trust
- I See Dead µops: Leaking Secrets via Intel/AMD Micro-Op Caches
- BIAS: Bluetooth Impersonation AttackS
- LOKI: Hardening Code Obfuscation Against Automated Attacks
- FPGA-Based Near-Memory Acceleration of Modern Data-Intensive Applications
- China’s Maxim
- The Accidental Altruist: Inferring Altruism from an Extraterrestrial Signal
- Interstellar communication. IX. Message decontamination is impossible
- The Accidental Altruist: Inferring Altruism from an Extraterrestrial Signal
- Quantum Blockchain using entanglement in time
- LOKI: Hardening Code Obfuscation Against Automated Attacks
- The Accidental Altruist: Inferring Altruism from an Extraterrestrial Signal
- The Accidental Altruist: Inferring Altruism from an Extraterrestrial Signal
- Discovering Suspicious APT Behaviors by Analyzing DNS Activities
- Harvard Belfer National Cyber Power Index 2020
- Reflections on Trusting Trust
- I See Dead µops: Leaking Secrets via Intel/AMD Micro-Op Caches
Blue Team
IoCs
- CVE-2020-1472 Zerologon IoCs
- Ryuk Speed Run, 2 Hours to Ransom
- What did DeathStalker hide between two ferns?
- Yikes, Microsoft have signed multiple rootkits (which allow kernel drivers) and reach out to a remote IP
- Netfilter Rootkit Samples
- There are evil packages on the npm registry that deploy XMRIG
- 238 Cobalt Strike stage 2 IP's, with 238 unique configurations, identified today.
- IcedID | 31.08.2022 | Campaign 2786525712
- Feodo Tracker
- Emotet 2022 | epoch4 | 22.04.2022 |
- sophos labs IoCs - originated indicators-of-compromise from published
- DailyIOC
- iocs
- Threat intelligence and threat detections
- APT_Digital_Weapon - AnXin.
- malware-IoC
- Yikes, Microsoft have signed multiple rootkits (which allow kernel drivers) and reach out to a remote IP
- There are evil packages on the npm registry that deploy XMRIG
- 238 Cobalt Strike stage 2 IP's, with 238 unique configurations, identified today.
- malware-IoC
SIEM
- Suspicious Use of Procdump
- KrbRelayUp local privilege escalation.
- Events Heatmap
- Heatmaps Make Ops Better
- Auditing Continuously vs. Monitoring Continuously
- Auditing Continuously vs. Monitoring Continuously
- Logsspot
- Scalable Logging and Tracking
- Scalable Logging and Tracking
- Logs were our lifeblood. Now they're our liability.
- Using Flume to Collect Apache 2 Web Server Logs
- spectx
- The log/event processing pipeline you can't have
- Building a SIEM: combining ELK, Wazuh HIDS and Elastalert for optimal performance
- Building a SIEM: combining ELK, Wazuh HIDS and Elastalert for optimal performance
- Here's a Splunk way to score behaviors that are derived from detections
- The Log Pile
- Part of my role is ensuring we're *not* EDR-centric. We have to be able to detect threats w/o OS-level viz (e.g., control plane only), using auth/net events, or whatever data is in a SIEM
- Shipping to Elasticsearch Microsoft DNS Logs
- Auditing Continuously vs. Monitoring Continuously
- Scalable Logging and Tracking
- Using Flume to Collect Apache 2 Web Server Logs
- Building a SIEM: combining ELK, Wazuh HIDS and Elastalert for optimal performance
- Log Parser Lizard
- Auditing Continuously vs. Monitoring Continuously
- Scalable Logging and Tracking
- Building a SIEM: combining ELK, Wazuh HIDS and Elastalert for optimal performance
- Auditing Continuously vs. Monitoring Continuously
- Scalable Logging and Tracking
- Building a SIEM: combining ELK, Wazuh HIDS and Elastalert for optimal performance
- Auditing Continuously vs. Monitoring Continuously
- Scalable Logging and Tracking
- Auditing Continuously vs. Monitoring Continuously
- Scalable Logging and Tracking
- Auditing Continuously vs. Monitoring Continuously
- Scalable Logging and Tracking
- Auditing Continuously vs. Monitoring Continuously
- Scalable Logging and Tracking
- Auditing Continuously vs. Monitoring Continuously
- Scalable Logging and Tracking
- Auditing Continuously vs. Monitoring Continuously
- Scalable Logging and Tracking
- Auditing Continuously vs. Monitoring Continuously
- Scalable Logging and Tracking
- Auditing Continuously vs. Monitoring Continuously
- Scalable Logging and Tracking
- Auditing Continuously vs. Monitoring Continuously
- Scalable Logging and Tracking
- Auditing Continuously vs. Monitoring Continuously
- Scalable Logging and Tracking
- Building a SIEM: combining ELK, Wazuh HIDS and Elastalert for optimal performance
- Auditing Continuously vs. Monitoring Continuously
- Scalable Logging and Tracking
- Building a SIEM: combining ELK, Wazuh HIDS and Elastalert for optimal performance
- Auditing Continuously vs. Monitoring Continuously
- Scalable Logging and Tracking
- Building a SIEM: combining ELK, Wazuh HIDS and Elastalert for optimal performance
- Auditing Continuously vs. Monitoring Continuously
- Scalable Logging and Tracking
- Building a SIEM: combining ELK, Wazuh HIDS and Elastalert for optimal performance
- Auditing Continuously vs. Monitoring Continuously
- Scalable Logging and Tracking
- Building a SIEM: combining ELK, Wazuh HIDS and Elastalert for optimal performance