F.P.W Library Sec [ CyberSecurity Book ]

درود بدلیل مشغله کاری از تمامی دوستان فعال در حوزه های سایبری دعوت میشود به آیدی زیر پیام داده و در صورت تایید به عنوان مدیر و ویراستار جدید کانال انتخاب شوند @Offensive01Bot

"A unit-based symbolic execution method for detecting memory corruption vulnerabilities in executable codes", 2022. Memory corruption vulnerabilities are prevalent and detrimental software weaknesses, which potentially occur when programming with low-level languages (usually C and C++). ]-> Tool: https://github.com/SoftwareSecurityLab/UbSym 📚 T.me/Library_Sec

please share our posts with your friends! 🥰

Our programming channel has been launched, you can follow programming resources and books from our channel: @FpwProgramming

​​Musort Ogranize your music library. A Python3 program that renames all selected music/audio files in a folder with a specified naming convention. Names are generated from the metadata (ID3) from the audio files. Before using this program, use a metadata editor like MusicBrainz Picard, Beets or EasyTAG to add the correct metadata to the audio files. https://github.com/tdeerenberg/Musort #music #library #python @FpwProgramming

Some useful Telegram channels @OsintBlackBox If you are interested in OSINT, the content here will be useful for you. @BlackBoxOsint If you are interested in OSINT, the content here will be useful for you. @PfkGit If you are looking for penetration testing tools, find them here. @pfk_git If you are looking for penetration testing tools, find them here. @Netpentesters ( English ) If you want to become a Pinterester, join this channel. @Netpentester (Iranian) If you want to become a Pinterester, join this channel. @BlueTeamKit Blue Team specialized reference.( GitHub ) @BlueRedTeam Red Team specialized reference.( GitHub ) @Pfk_0Day ( we channel ) Learn Cyber Security( Free ) @pfkSecurity Refrence Pentest & Red Team @iotpenetrationTesting IoT Hacking

Feeding Gophers to Ghidra #Ghidra 📚 T.me/Library_Sec

SMART SPEAKER SHENANIGANS: MAKING THE SONOS ONE SING ITS SECRETS 📚 T.me/Library_Sec

Catalyzer, Small Tool For Incident Responders and SOC Analysts https://github.com/Almorabea/Catalyzer 🎞 @Library_Sec

​​Hiding Shellcode In Plain Sight This technique is very simple, a RW memory region 2048 the size of the shellcode is allocated. This region is then filled with randomized data data (RtlGenRandom), the shellcode is then placed randomly somewhere within this massive region each time. This makes it hard for an AV/EDR solution, or an analyst, to simply see where the shellcode is in-memory. To summarize: ▫️ Allocate a large PAGE_READWRITE region, 2048 * size of the target shellcode, and align to 0x1000 ▫️ Fill this allocated region with random data ▫️ Write the shellcode to a random location within this region, save position ▫️ Change the page permissions to PAGE_EXECUTE ▫️ Execute the shellcode (page + position) ▫️ Zero the memory where the entire large region is to ensure the data does not persist after being freed, using the RtlZeroMemory macro ▫️ Free the region of memory https://github.com/LloydLabs/shellcode-plain-sight

Some useful Telegram channels @OsintBlackBox If you are interested in OSINT, the content here will be useful for you. @BlackBoxOsint If you are interested in OSINT, the content here will be useful for you. @PfkGit If you are looking for penetration testing tools, find them here. @pfk_git If you are looking for penetration testing tools, find them here. @Netpentesters ( English ) If you want to become a Pinterester, join this channel. @Netpentester (Iranian) If you want to become a Pinterester, join this channel. @BlueTeamKit Blue Team specialized reference.( GitHub ) @BlueRedTeam Red Team specialized reference.( GitHub ) @Pfk_0Day ( we channel ) Learn Cyber Security( Free ) @pfkSecurity Refrence Pentest & Red Team @iotpenetrationTesting IoT Hacking

📚 T.me/Library_Sec

Hands-On Security in DevOps. #DevOps #Security 📚 @Library_Sec

#Fuzzing "L2Fuzz: Discovering Bluetooth L2CAP Vulnerabilities Using Stateful Fuzz Testing", 2022. Bluetooth is a wireless communication technology that al￾lows users to exchange various data in a short range, including Bluetooth Basic Rate/Enhanced Data Rate (BR/EDR) and Bluetooth Low Energy (BLE). Owing to their convenience, billions of devices have adopted Bluetooth technologies . ]-> A stateful fuzzer to detect vulnerabilities in Bluetooth BR/EDR LLC/L2CAP: https://github.com/haramel/l2fuzz 📚 @Library_Sec

#Sec_code_review "LibDB: An Effective and Efficient Framework for Detecting Third-Party Libraries in Binaries", 2022. Third-party libraries (TPLs) are important components of modern software systems. They are reused frequently during software de velopment . Open-source repository platforms and package management systems are the major sources of third-party libraries. However, security issues of the third-party code continue to arise. Vulnerabilities in well-known third-party libraries, such as the Heartbleed bug, could bring security threats to millions of devices. In addition, non-compliant reuse, which is a violation of legal software licenses, could lead to costly commercial disputes. Unfortunately, many developers do not pay sufficient attention to the code that is imported from third-party libraries. ]-> Datasets and source code: https://github.com/DeepSoftwareAnalytics/LibDB 📚 @Library_Sec

"How security professionals are being attacked: A study of malicious CVE proof of concept exploits in GitHub", 2022. CVE, which stands for Common Vulnerabilities and Expo￾sures1, is a list of publicly disclosed security flaws in software or systems, which have been assigned individual CVE IDs. ]-> Tool: https://github.com/SoftwareSecurityLab/UbSym 📚 @Library_Sec

📚 T.me/Library_Sec

Кибербезопасность стратегии атак и обороны 2020 . 📚 @Library_Sec

#tools #Offensive_security "Exploring Widevine for Fun and Profit", 2022. ]-> Widevine Key Ladder Script (Python3): https://github.com/Avalonswanderer/widevine_key_ladder ]-> A tool to trace Widevine execution in Android and dump buffers: https://github.com/Avalonswanderer/wideXtractor Nowadays, people prefer media consumption on over-the￾top platforms (OTT), such as Netflix and Amazon Prime, that distribute multimedia content over the Internet, allowing users to play them whenever they wish. Such ease of viewing the same videos across devices creates challenges for content producers and owners. @Library_Sec

#Mobile_Security #Sec_code_review "Demystifying Hidden Sensitive Operations in Android apps", 2022. ]-> FlowDroid Static Data Flow Analysis Tool: https://github.com/secure-software-engineering/FlowDroid Android is the most adopted mobile operating systems in terms of users, applications and developers . However, its popularity means that legitimate developers must co-exist with malware writers. @Library_Sec