Vulnerability report written by the TA team by analyzing “Malicious AI Tools: HackerGPT”     HackerGPT is an ethical hacking AI model with an extensive database of hacking techniques, tools, and strategies for web applications and networks to provide comprehensive support and answer hacking-related questions, and unlike other GPTs, it is a hacking-only GPT that Read more about [2024.05 Vulnerability Report] Malicious AI Tools : HackerGPT[…]

1. What is AST? Application security testing (AST) is an important component of IT security that focuses on identifying and mitigating vulnerabilities and weaknesses within software applications. AST encompasses a variety of techniques and tools designed to assess the security posture of applications, including web and mobile applications. The primary goal of an AST is Read more about [2024.04 Vulnerability Report] OAST Application Security Testing Techniques[…]

1. Overview TeamCity is JetBrains’ build management and continuous integration server, and this article summarizes our analysis of the authentication bypass vulnerabilities, CVE-2024-27198 and CVE-2024-27199, that were recently discovered in the service. Source : https://www.helpnetsecurity.com/2024/03/21/exploiting-cve-2024-27198/ 2. Attack Type In March 2024, JetBrains released patches for CVE-2024-27198 and CVE-2024-27199, which were discovered in TeamCity, and Rapid7 Read more about [2024.04 Vulnerability Report] JetBrains TeamCity Authentication Bypass Vulnerability[…]

1. Overview The BlueShell vulnerability is a backdoor malware developed in the Go language. A simple form of backdoor, the BlueShell vulnerability supports TLS encryption for communication with C&C servers to bypass network detection and execute attacker commands (remote command execution, file download/upload, Socks5 proxy). Source: GitHub https://github.com/restran/BlueShell 2. Attack Process BlueShell has three configuration Read more about [2024.03 Vulnerability Report] BlueShell Malware Vulnerability[…]

Ivanti Connect Secure and Policy Secure Multiple Vulnerability 1. Overview Ivanti’s Connect Secure and Policy Secure are SSL VPN solutions and IPS solutions, and we have analyzed CVE-2023-46805, CVE-2024-21887, CVE-2024-21888, and CVE-2024-21893 that were recently discovered in these platforms. 2. Attack Types In January 2024, Ivanti released patches for vulnerabilities found in its Connect Secure Read more about [2024.02 Vulnerability Report] Ivanti Connect Secure & Policy Secure Vulnerability[…]

Server Side Template Injection Overview Server Side Template Injection (SSTI) vulnerability occurs when templates are structured on the server side and user input values are inserted into existing templates. Attackers exploit template syntax to insert malicious payloads, enabling them to perform actions desired by the attacker. Attack Process SSTI vulnerabilities vary across servers and templates, Read more about Server Side Template Injection[…]

Overview : HTTP/2 utilizes the “Stream multiplexing” feature, unlike HTTP/1.1, allowing multiple streams to be opened and closed within a single TCP connection. We have compiled an analysis of CVE-2023-44487, a denial of service (DoS) vulnerability recently discovered in this protocol.   Attack Type : CVE-2023-44487 targets all web services supporting the HTTP/2 protocol, primarily Read more about HTTP/2 Rapid Reset attack[…]

Major Vulnerabilities and Signature Pattern Response in 2023 Overview : MONITORAPP’s web firewall prevents and blocks attacks on web applications by integrating various security technologies. These technologies identify major vulnerabilities and provide effective responses to maintain the integrity and availability of web applications. To enhance the security of web applications, regularly updated signature patterns quickly Read more about Major Vulnerabilities in 2023[…]

2023.11 – Adobe ColdFusion Adobe ColdFusion Multiple vulnerability   1. Overview : Adobe ColdFusion is a web application development platform provided by Adobe. This summary compiles the analysis of recently discovered remote code execution (RCE) vulnerabilities on this platform, namely CVE-2023-26360, CVE-2023-26361, CVE-2023-29298, and CVE-2023-38205.     2. Attack Types : Adobe announced patches for Read more about Adobe ColdFusion Vulnerability Report[…]

2023.10 – ProxyShell MS Exchange Server ProxyShell 1.Overview : The ProxyShell vulnerability comprises SSRF (Server Side Request Forgery) and RCE (Remote Code Execute) vulnerabilities that can occur in MS Exchange Server, consisting of multiple CVEs. 2.Attack Process : This is an analysis of how three CVEs related to the ProxyShell vulnerability are interconnected and used. Read more about ProxyShell Vulnerability Report[…]