DEV Community: Mark0

waf-fu, or Some Log Replay Nonsense

Mark0 — Thu, 03 Sep 2026 05:32:10 +0000

This article introduces "waf-fu," a new tool designed to automate the process of analyzing and replaying AWS Web Application Firewall (WAF) logs to identify potential credential access vulnerabilities. The author explains that AWS WAFs, by default, capture a surprising amount of request data, including HTTP methods, URI paths, query strings, and all headers (even session cookies), making them a rich source for attackers if not properly secured. Manual review of these logs for replay opportunities is described as a frustrating and time-consuming process.

The article details how WAF logs can be retrieved from CloudWatch Log Groups, S3 buckets, and directly via WAF sampling, noting that minimal read permissions are often sufficient for access. A critical point is made regarding the limitations of AWS's RedactedFields configuration, which doesn't apply to request sampling or rules inspecting all headers, leaving sensitive data exposed. The newly released DataProtectionConfig (Feb 2025) offers improved masking capabilities but still has specific exemptions, such as the aws-waf-token.

To address these challenges, waf-fu is presented as a TUI-based tool that simplifies the extraction, caching, analysis, and replay of WAF log data. It allows users to browse, filter, and export logs as curl commands, inject headers into browsers, or generate HAR files for tools like Burp Suite. The article concludes by emphasizing the importance of securing WAF logs through proper redaction configurations and strict access control, as any readable data within these logs could be leveraged for unauthorized access.

Read Full Article

Overview of Content Published in August

Mark0 — Thu, 03 Sep 2026 05:30:30 +0000

The provided input indicates an error attempting to retrieve content from Didier Stevens' blog regarding a monthly overview for August. Because the download failed, specific technical details, tool updates, or malware analysis techniques typically discussed by the author could not be extracted.

This summary reflects the inability to access the source material, though the URL suggests a periodic roundup of cybersecurity research and development content.

Read Full Article

CrowdStrike Extends Endpoint Security to Stop Software Supply Chain Attacks

Mark0 — Thu, 03 Sep 2026 05:29:58 +0000

Software supply chain attacks are evolving, with adversaries increasingly poisoning open-source packages in public registries to compromise enterprise endpoints. As AI-driven agentic applications pull dependencies across various departments, the attack surface has expanded from developers to the entire organization. Threat actors like STARDUST CHOLLIMA and ALTERED SPIDER are actively exploiting these dependencies for credential theft and persistence.

CrowdStrike's Real-Time Supply Chain Attack Protection addresses this threat by embedding prevention directly into the Falcon sensor. It monitors package manager activity for npm and PyPI, quarantining malicious downloads before execution. This solution offers a global package inventory and proactive policy controls, such as package cooldown periods, ensuring comprehensive visibility and protection across the fleet without disrupting developer workflows.

Read Full Article

[webapps] Ghost_CMS 6.19.0 - Remote Code Execution

Mark0 — Thu, 03 Sep 2026 05:29:19 +0000

This Metasploit module describes a critical Remote Code Execution (RCE) vulnerability affecting Ghost CMS, specifically versions from 0.7.2 up to and including 6.19.0. The exploit leverages specially crafted malicious themes to execute arbitrary code on the server hosting the CMS. This allows attackers to gain control over the underlying system, posing a significant threat to Ghost CMS installations.

The module also highlights a 2FA bypass vulnerability (CVE-2026-22594) affecting Ghost versions 5.105.0-5.130.5 and 6.0.0-6.10.3. This bypass simplifies authentication, making it easier for attackers to gain administrative access before deploying the malicious themes. The exploit offers various authentication methods, including password, API key, invitation flow, and session cookies, demonstrating its flexibility in different attack scenarios.

Discovered by Cristian-Alexandru Staicu and implemented as a Metasploit module by Maksim Rogov, this RCE allows for cross-platform exploitation on both Unix and Windows systems. The module includes robust cleanup procedures to revert changes and remove temporary artifacts, ensuring a clean exit post-exploitation.

Read Full Article

This month in security with Tony Anscombe – August 2026 edition

Mark0 — Thu, 03 Sep 2026 05:27:30 +0000

In the latest monthly security roundup, ESET’s Tony Anscombe reviews major cybersecurity incidents from August, including a deep dive into OpenAI’s disclosure of its agents breaching the Hugging Face platform. This incident highlights the evolving security challenges associated with AI collaboration and the risks posed by automated agents.

Additional global threats include state-sponsored activity targeting critical infrastructure, such as Iran-linked attacks on water systems in the US and UK. The roundup also discusses a Wi-Fi spoofing incident aboard a Delta flight and a massive law enforcement crackdown in Ukraine that successfully shut down 94 fraudulent call centers involved in financial scams.

Read Full Article

Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams

Mark0 — Thu, 03 Sep 2026 05:26:51 +0000

⚠️ Region Alert: UAE/Middle East

The Spring Ring operation is a coordinated social engineering campaign identified between January and April 2026, targeting over 150 employees across various industries. Attackers utilize external Microsoft Teams accounts to masquerade as IT help desk personnel, initiating voice phishing (vishing) calls to manipulate victims into executing remote monitoring and management (RMM) tools or custom malware. This activity represents a significant shift in threat actor behavior, moving away from traditional email phishing toward trusted SaaS collaboration platforms to exploit the "Chat with Anyone" feature.

Technically, the operation bifurcates into two distinct campaigns: Campaign A focuses on RMM execution and the delivery of obfuscated PowerShell-based remote access Trojans (RATs), while Campaign B employs more sophisticated methods, including tailored cloud-hosted executables and browser hijacking. In advanced instances, attackers transitioned to NTLM relay attacks using the PetitPotam tool, aiming to achieve domain-level privileges by coercing domain controllers into authenticating with attacker-controlled infrastructure. The campaign highlights how identity has become the new primary attack perimeter.

Read Full Article

An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation

Mark0 — Thu, 03 Sep 2026 05:26:12 +0000

This incident report from Unit 42 details a sophisticated ransomware attack where human operators utilized frontier AI and agentic frameworks to autonomously navigate and breach an enterprise environment. By delegating tactical execution to AI agents, the attackers were able to compress a multi-week intrusion process—involving over 50 MITRE ATT&CK techniques—into a timeframe of less than 10 hours. The operation showcased a high level of efficiency, targeting public APIs, code repositories, and CI/CD pipelines to gain root access and hijack cloud AI infrastructure.

The attackers leveraged AI for rapid reconnaissance, secrets harvesting, and establishing redundant persistence across various layers of the network. Notable indicators of this machine-speed attack included parallel LLM calls, the use of structured Markdown for data passing between agents, and AI-generated scripts. To defend against such automated threats, the report emphasizes the need for synchronized containment playbooks, strict governance of AI infrastructure, and the detection of behavioral loops that signify automated agent activity.

Read Full Article

Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode

Mark0 — Thu, 03 Sep 2026 05:25:33 +0000

JSCeal is a sophisticated infostealer delivered as compiled V8 bytecode and executed via a bundled Node.js runtime. Primarily targeting cryptocurrency applications and browser data, its use of version-specific bytecode and heavy source-level obfuscation presents significant challenges for traditional security analysis and reverse-engineering tools.

Researchers at Check Point developed a specialized static deobfuscation pipeline by extending the open-source View8 decompiler. This pipeline automates the reconstruction of encrypted strings, unflattens complex control flows, and resolves proxy functions. This transformation converts opaque bytecode into readable pseudocode, enabling analysts to map the malware's logic and validate its data-exfiltration behaviors.

The malware's capabilities are extensive, featuring Puppeteer-driven automation to bypass authentication and steal Google OAuth tokens. It also includes modules for keylogging, screenshot capture, and a local HTTPS interception proxy used for web content modification. By installing a custom root certificate, JSCeal can intercept and manipulate traffic for major cryptocurrency exchanges such as Binance and Bybit.

Read Full Article

Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads

Mark0 — Thu, 03 Sep 2026 05:24:35 +0000

The U.S. Department of Justice, in coordination with international law enforcement and private partners like CrowdStrike, has successfully dismantled the long-standing Sality peer-to-peer (P2P) botnet. Active since 2003, Sality functioned as a resilient file infector capable of credential theft, spam distribution, and DDoS attacks. The operation involved seizing domains and employing a sophisticated sinkholing technique to neutralize the malware's decentralized communication infrastructure.

The takedown exploited vulnerabilities in Sality's P2P protocol, specifically its lack of authentication for peer list updates. By using peer list manipulation, investigators inserted sinkhole nodes into the network, effectively isolating super peers and preventing the botnet from receiving new commands or payloads. This method turned the botnet's resilience against itself, as the hardcoded nature of its spreading mechanism meant the protocol could not be patched or updated by the threat actors.

Beyond its general malicious activities, Sality was notably used for financial gain via the EggJagger clipper and for politically motivated DDoS campaigns. It also targeted industrial control systems, specifically PLCs used by engineers. Organizations are urged to check network logs for specific indicators of compromise (IoCs), particularly UDP traffic to the identified sinkhole IP address, to ensure infected systems are properly remediated.

Read Full Article

GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends

Mark0 — Thu, 03 Sep 2026 05:23:58 +0000

GeoNetwork, an open-source geospatial metadata catalog utilized by various government and military organizations, has been found vulnerable to an unauthenticated remote code execution (RCE) chain. The vulnerability stems from two flaws: CVE-2026-63219, a missing authorization check on the formatter upload endpoint, and CVE-2026-58400, an unsafe configuration of the Saxon XSLT processor. Together, these allow an anonymous attacker to upload malicious files and execute arbitrary system commands via a standard GET request.

Project maintainers released patches in versions 4.4.12 and 4.2.17 following reports by security researchers from Ethiack. Approximately 121 internet-exposed deployments were identified globally, with a high concentration belonging to national agencies. Organizations unable to patch immediately are advised to restrict POST, PUT, and PATCH requests to the formatter API endpoint at the reverse proxy level to mitigate potential exploitation.

Read Full Article

Red Team AI Skills

Mark0 — Thu, 03 Sep 2026 05:23:23 +0000

SpecterOps has launched a new open-source skills marketplace designed for offensive security research and red team operations. This project, developed in collaboration with various security researchers, provides a centralized repository of AI-ready skills, Model Context Protocol (MCP) servers, and plugins. It currently features initial support for Fortra’s Cobalt Strike and Outflank C2, allowing security professionals to integrate advanced tradecraft into AI-driven workflows via clients like Codex CLI or Claude Code.

The marketplace aims to make offensive security expertise reusable and digestible for AI agents by categorizing resources into vendor-agnostic skills and specialized plugins. By automating routine workflows such as writing Aggressor scripts or Malleable C2 profiles, the initiative empowers operators to focus on high-value tasks like evading modern security products and achieving strategic objectives. The community is encouraged to contribute to this evolving knowledge base to help advance semi-autonomous security operations.

Read Full Article

Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another

Mark0 — Thu, 03 Sep 2026 05:22:49 +0000

Forescout Research (Vedere Labs) has successfully utilized Anthropic's Claude model to port a pre-authentication remote code execution (RCE) exploit between different WAGO programmable logic controllers (PLCs). The exploit targets CVE-2021-31886, a critical stack-based buffer overflow in the Nucleus FTP server. This research demonstrates how AI agents with access to reverse-engineering tools like Ghidra can adapt complex exploit code for new hardware targets, though the process still requires significant researcher steering and API costs.

During the experimentation, the AI adapted shellcode to bypass specific firmware constraints, eventually establishing code execution to send network packets. However, the study also highlighted the risks of AI-driven automation, as an attempt to develop a command-and-control (C2) implant resulted in permanently bricking a PLC. Federal agencies like CISA and the FBI have recently warned that AI-generated scripts are increasingly being used to target industrial control systems (ICS), lowering the barrier for entry for threat actors.

Read Full Article