FreshRSS

πŸ”’
❌ Secure Planet Training Courses Updated For 2019 - Click Here
☷
β–³ πŸ”ƒ
There are new available articles, click to refresh the page.
Before yesterdayYour RSS feeds

The Notorious Lockbit Ransomware Gang Has Been Disrupted by Law Enforcement

By: Matt Burgess
LockBit’s website, infrastructure, and data have been seized by law enforcementβ€”striking a huge blow against one of the world’s most prolific ransomware groups.

Congress Sure Made a Lot of Noise About Kids’ Privacy in 2023β€”and Not Much Else

By: Matt Laslo
Members of the US Congress touted improvements to children’s privacy protections as an urgent priority. So why didn’t they do anything about it?

Forbidden-Buster - A Tool Designed To Automate Various Techniques In Order To Bypass HTTP 401 And 403 Response Codes And Gain Access To Unauthorized Areas In The System

By: Zion3R


Forbidden Buster is a tool designed to automate various techniques in order to bypass HTTP 401 and 403 response codes and gain access to unauthorized areas in the system. This code is made for security enthusiasts and professionals only. Use it at your own risk.

  • Probes HTTP 401 and 403 response codes to discover potential bypass techniques.
  • Utilizes various methods and headers to test and bypass access controls.
  • Customizable through command-line arguments.

Install requirements

pip3 install -r requirements.txt

Run the script

python3 forbidden_buster.py -u http://example.com

Forbidden Buster accepts the following arguments:

fuzzing (stressful) --include-user-agent Include User-Agent fuzzing (stressful)" dir="auto">
  -h, --help            show this help message and exit
  -u URL, --url URL     Full path to be used
  -m METHOD, --method METHOD
                        Method to be used. Default is GET
  -H HEADER, --header HEADER
                        Add a custom header
  -d DATA, --data DATA  Add data to requset body. JSON is supported with escaping
  -p PROXY, --proxy PROXY
                        Use Proxy
  --rate-limit RATE_LIMIT
                        Rate limit (calls per second)
  --include-unicode     Include Unicode fuzzing (stressful)
  --include-user-agent  Include User-Agent fuzzing (stressful)

Example Usage:

python3 forbidden_buster.py --url "http://example.com/secret" --method POST --header "Authorization: Bearer XXX" --data '{\"key\":\"value\"}' --proxy "http://proxy.example.com" --rate-limit 5 --include-unicode --include-user-agent

  • Hacktricks - Special thanks for providing valuable techniques and insights used in this tool.
  • SecLists - Credit to danielmiessler's SecLists for providing the wordlists.
  • kaimi - Credit to kaimi's "Possible IP Bypass HTTP Headers" wordlist.


Crimeware server used by NetWalker ransomware seized and shut down

By: Paul Ducklin
The site was running from 2014 and allegedly raked in more than $20m, which the DOJ is seeking to claw back...

NYPD Body Cam Data Shows the Scale of Violence Against Protesters

By: Dhruv Mehrotra， Andrew Couts
A landmark $13 million settlement with the City of New York is the latest in a string of legal wins for protesters who were helped by a video-analysis tool that smashes the β€œbad apple” myth.

Silk Road’s Second-in-Command, Variety Jones, Gets 20 Years in Prison

By: Andy Greenberg
Roger Thomas Clark, also known as Variety Jones, will spend much of the rest of his life in prison for his key role in building the world’s first dark-web drug market.

Gozi banking malware β€œIT chief” finally jailed after more than 10 years

By: Paul Ducklin
Gozi threesome from way back in the late 2000s and early 2010s now all charged, convicted and sentenced. The DOJ got there in the end...

History revisited: US DOJ unseals Mt. Gox cybercrime charges

By: Naked Security writer
Though the mills of the Law grind slowly/Yet they grind exceeding small/Though with patience they stand waiting/With exactness grind they all...

S3 Ep137: 16th century crypto skullduggery

By: Paul Ducklin
Lots to learn, clearly explained in plain English... listen now! (Full transcript inside.)

s3-ep137-feat-1200

Ransomware tales: The MitM attack that really had a Man in the Middle

By: Paul Ducklin
Another traitorous sysadmin story, this one busted by system logs that gave his game away...

Phone scamming kingpin gets 13 years for running β€œiSpoof” service

By: Naked Security writer
Site marketing video promised total anonymity, but that was a lie. 170 arrested already. Potentially 1000s more to follow.

ispoof-1200

Google wins court order to force ISPs to filter botnet traffic

By: Naked Security writer
CryptBot criminals are alleged to have plundered browser passwords, illicitly-snapped screenshots, cryptocurrency account data, and more.

Ex-CEO of breached pyschotherapy clinic gets prison sentence for bad data security

By: Paul Ducklin
Did the sentence fit the crime? Read the backstory, and then have your say in our comments! (You may post anonymously.)

DoppelPaymer ransomware supsects arrested in Germany and Ukraine

By: Naked Security writer
Devices seized, suspects interrogated and arrested, allegedly connected to devastating cyberattack on University Hospital in DΓΌsseldorf.

BEC fraudster and romance scammer sent to prison for 25 years

By: Paul Ducklin
Two years of scamming + $10 million leeched = 25 years in prison. Just in time for #Cybermonth.

rs-1200

Last member of Gozi malware troika arrives in US for criminal trial

By: Paul Ducklin
His co-conspirators went into and got out of prison years ago, while he remained free. Now the tables have turned...

Interpol busts 2000 suspects in phone scamming takedown

By: Paul Ducklin
Friends don't let friends get scammed. Not everyone knows how typical scams unfold, so here are some real-world examples...

SSNDOB Market domains seized, identity theft β€œbrokerage” shut down

By: Paul Ducklin
The online identity "brokerage" SSNDOB Market didn't want people to be in any doubt what it was selling.

He sold cracked passwords for a living – now he’s serving 4 years in prison

By: Paul Ducklin
Crooks don't need a password for every user on your network to break in and wreak havoc. One could be enough...

US cryptocurrency coder gets 5 years for North Korea sanctions busting

By: Naked Security writer
Cryptocurrency expert didn't take "No" for an answer when the US authorities said he couldn't pursue cryptocoin opps in North Korea.

LAPSUS$ hacks continue despite two hacker suspects in court

By: Paul Ducklin
Do you know where in your company to report security anomalies? If you receive such reports, do you have an efficient way to process them?

UK police arrest 7 hacking suspects – have they bust the LAPSUS$ gang?

By: Naked Security writer
Seven alleged hackers have been arrested in the UK. But who are they, and which hacking crew are they from?

Alleged Kaseya ransomware attacker arrives in Texas for trial

By: Naked Security writer
The US Independence Day weekend of 2021 wasn't much of a holiday for cybersecurity staff. That was when the Kaseya attack unfolded...

Alleged carder gang mastermind and three acolytes under arrest in Russia

By: Naked Security writer
The motto of the gang was "In Fraud We Trust", and they went by a dizzying range of online nicknames.

❌