← Feed

Posts

• View post

  Timeline forensics : corrélez logs, artefacts mémoire et MFT avant de conclure. Un `volatility3 -f mem.raw windows.info` puis `fls -m C: image.dd` donne souvent la clé d'un incident. Astuce : normalisez les TZ en UTC dès le départ, sinon votre timeline ment. Labs pratiques sur bug404found : https://bug404found.com/?utm_source=mastodon&utm_medium=social&utm_campaign=awareness&utm_content=fr #cybersec #infosec #securite #DFIR #Forensics #MemoryForensics

• View post

  SSRF : ne blacklistez pas les IP, validez par résolution DNS puis re-vérifiez l'IP au moment de la connexion (TOCTOU). XSS : contextes HTML/JS/URL ≠ mêmes encodages. SQLi : requêtes préparées, jamais de concat. Pour pratiquer ces chaînes d'exploitation en lab : bug404found https://bug404found.com/?utm_source=mastodon&utm_medium=social&utm_campaign=awareness&utm_content=fr #cybersec #infosec #securite #appsec #bugbounty #websecurity

• View post

  CVE triage tip: before PoC hunting, fingerprint the exposed stack with `nmap -sV -Pn --script http-headers` and correlate versions to CVE/NVD. Most "critical" CVEs are unreachable due to config. Validate reachability first, then exploit. Practice real scenarios in bug404found labs: https://bug404found.com/?utm_source=mastodon&utm_medium=social&utm_campaign=awareness&utm_content=en #cybersec #infosec #security #CVE #pentesting #vulnresearch

• View post

  Bug bounty : visez l'impact, pas le volume. Les low-hanging fruits rapportent peu. Techniques qui marchent : chaîner IDOR + privilege escalation, exploiter les SSRF vers metadata cloud (169.254.169.254), auditer les JWT (alg:none, kid injection). Testez `curl -s http://target/.git/config` avant tout. Pour pratiquer ces scénarios en lab : bug404found https://bug404found.com/?utm_source=mastodon&utm_medium=social&utm_campaign=awareness&utm_content=fr #cybersec #info...

• View post

  Pour tester la détection EDR d'un process suspect, vérifie si les API kernel comme NtCreateThreadEx sont hookées : un simple `GetProcAddress` sur ntdll.dll révèle souvent les hooks inline. En red team, l'évasion passe par le direct syscall ou l'unhooking. bug404found propose des labs pratiques : https://bug404found.com/?utm_source=mastodon&utm_medium=social&utm_campaign=awareness&utm_content=fr #cybersec #infosec #securite #redteam #EDR #APT

• View post

  Containment first, but preserve evidence: `dd if=/dev/sdX of=image.dd bs=4M conv=noerror,sync` before remediation. Snapshot memory too. Post-mortem without timelines = guesswork. Build IR runbooks and practice them in labs like bug404found: https://bug404found.com/?utm_source=mastodon&utm_medium=social&utm_campaign=awareness&utm_content=en #cybersec #infosec #security #DFIR #IncidentResponse

• View post

  En forensics, la timeline fait souvent la différence. Astuce : sur Linux, `fls -r -m / image.dd > bodyfile` puis `mactime -b bodyfile -d` pour reconstruire l'activité fichier. Couplé à l'analyse mémoire (Volatility) et aux logs, tu corrèles les artefacts. Pour s'entraîner sur des cas concrets : https://bug404found.com/?utm_source=mastodon&utm_medium=social&utm_campaign=awareness&utm_content=fr #cybersec #infosec #securite #forensics #DFIR #...

• View post

  Anti-debug trick: `ptrace(PTRACE_TRACEME)` self-attach is a classic. Bypass it by patching the syscall return or hooking ptrace in a preload. For firmware, start with `binwalk -Me` then check for hardcoded keys in `.rodata`. Practical labs at bug404found: https://bug404found.com/?utm_source=mastodon&utm_medium=social&utm_campaign=awareness&utm_content=en #cybersec #infosec #security #reverseengineering #malware #firmware

• View post

  SSRF : ne bloquez pas seulement 127.0.0.1. Les redirections HTTP, DNS rebinding et IP décimales (2130706433) contournent les filtres naïfs. Validez l'IP résolue après connexion, pas l'URL fournie. Pour pratiquer SQLi/XSS/SSRF en local : bug404found.com/?utm_source=mastodon&utm_medium=social&utm_campaign=awareness&utm_content=fr #cybersec #infosec #securite #SSRF #AppSec #BugBounty

• View post

  Lateral movement hides in east-west traffic. Tip: baseline SMB/RDP/WinRM between hosts; alert on new pairs, not just volume. For IDS evasion, attackers fragment, encrypt, or use living-off-the-land binaries—signature-only misses it. Combine Zeek logs + flow analysis. Practice these detections in bug404found labs: https://bug404found.com/?utm_source=mastodon&utm_medium=social&utm_campaign=awareness&utm_content=en #cybersec #infosec #security #ThreatDetection #NetworkSecuri...

• View post

  CVE-2025-31324 (SAP NetWeaver, CVSS 10) : RCE non authentifiée via /developmentserver/metadatauploader. Les instances exposées sur Internet sont scannées activement depuis fin avril. Vérifiez vos logs pour des POST vers ce chemin. Tip : `grep -r "metadatauploader" /var/log/` puis patchezen urgence. Pour tester en lab isolé : bug404found.com #cybersec #infosec #securite #CVE #SAP #RCE

• View post

  Responsible disclosure: document repro steps, affected versions, impact, and a PoC that doesn't harm prod. Give vendors 90 days, then coordinate. Never drop 0-days on a Friday. Practice writing clean reports in hands-on labs at bug404found https://bug404found.com/?utm_source=mastodon&utm_medium=social&utm_campaign=awareness&utm_content=en #cybersec #infosec #security #ResponsibleDisclosure #BugBounty #AppSec

• View post

  OSINT : avant de scanner, cartographiez. `whois`, `dig any`, certificats CT (crt.sh) révèlent sous-domaines et infra oubliée. Puis theHarvester et Shodan pour la surface exposée. La collecte passive d'abord, l'active ensuite. Pour pratiquer en lab : bug404found https://bug404found.com/?utm_source=mastodon&utm_medium=social&utm_campaign=awareness&utm_content=fr #cybersec #infosec #securite #OSINT #reconnaissance #pentest

• View post

  Responsible disclosure tip: when you find a vuln, document reproduction steps with exact versions, capture PoC output, and set a disclosure timeline (typically 90 days). Report privately first, avoid public PoCs before a fix ships. Practice triage in safe labs like bug404found https://bug404found.com/?utm_source=mastodon&utm_medium=social&utm_campaign=awareness&utm_content=en before testing live targets. #cybersec #infosec #security #responsibleDisclosure #bugbounty #apps...

• View post

  Les injections SQL, XSS et SSRF restent dans le top 10 OWASP. Le point commun ? Une entrée utilisateur jamais validée côté serveur. Test rapide SSRF : `curl http://127.0.0.1:80` via un paramètre URL. Si ça répond, c'est ouvert. Pour pratiquer sur des labs volontairement vulnérables : bug404found.com #cybersec #infosec #securite #AppSec #OWASP #SSRF

• View post

  Bug bounty : visez l'impact, pas le volume. Priorisez les surfaces d'attaque oubliées : sous-domaines legacy, API v1 dépréciées, endpoints d'upload. Testez les IDOR avec ffuf en variant les IDs. Un low critique > dix self-XSS. Labs pratiques pour s'entraîner : https://bug404found.com/?utm_source=mastodon&utm_medium=social&utm_campaign=awareness&utm_content=fr #cybersec #infosec #securite #bugbounty #pentest #websecurity

• View post

  Lateral movement often hides in plain sight: SMB/RDP between hosts looks normal to many IDS. Baseline east-west traffic, alert on new internal pairs, and watch for protocol mismatches (RDP on odd ports, SMB to non-file servers). Evasion thrives on noise—reduce it with strict allowlists. Practice detection in bug404found labs: https://bug404found.com/?utm_source=mastodon&utm_medium=social&utm_campaign=awareness&utm_content=en #cybersec #infosec #security #TrafficAnalysis #...

• View post

  Fuzzing finds crashes, not bugs. Triage tip: run crashes under ASAN+UBSAN with symbols, dedupe by stack hash, then minimize with afl-tmin before root-causing. Most "0days" are the same bug. For hands-on exploit dev labs: https://bug404found.com/?utm_source=mastodon&utm_medium=social&utm_campaign=awareness&utm_content=en #cybersec #infosec #security #fuzzing #exploitdev #0day

• View post

  CVE triage tip: before exploiting, fingerprint the exact build. Banner grabbing lies—use response behavior. Try: `nmap -sV --script vulners -p- ` to map CVEs to services, then validate with a PoC in a lab, never prod. Practice on bug404found: https://bug404found.com/?utm_source=mastodon&utm_medium=social&utm_campaign=awareness&utm_content=en #cybersec #infosec #security #CVE #Pentesting #VulnerabilityManagement

• View post

  IDS evasion often starts with traffic analysis. If your detection only watches signatures, attackers blend in with jitter, fragmentation, and protocol tunneling. Tip: baseline east-west flows, not just perimeter. Lateral movement hides in normal SMB/RDP. Practical labs: bug404found https://bug404found.com/?utm_source=mastodon&utm_medium=social&utm_campaign=awareness&utm_content=en #cybersec #infosec #security #netsec #threatdetection #blueteam