3 casos · pág. 1/1
TrustedSec researcher Lilly Mayo published waf-fu, an offensive tool that pulls AWS WAF log data into a local sqlite database and enables replay of logged requests. During an engagement, the author found WAF logs in CloudWatch that captured all headers unredacted, including session cookies and other authentication material, which can be r…
TrustedSec analyzed a multi-stage malware loader that starts as obfuscated Python bytecode (.pyc, CPython 3.13) and ends in an encrypted .NET payload. The chain layers Kramer Python obfuscation, two Donut shellcode layers and a laZzzy shellcode-loader PE, so a signature for any single format misses the others. The author unpacked it with …
SentinelOne analysis argues that bring your own vulnerable driver (BYOVD) succeeds because of a signing-trust gap rather than an incomplete driver list. The Windows kernel loads drivers signed with expired or revoked certificates, and a 2026 intrusion reported by Help Net Security used a decade-old forensic driver whose certificate had lo…
