SCANNING WEBAPP BOTNET |
| 2011-02-28 | Deborah Hale | Possible Botnet Scanning |
SCANNING |
| 2024-07-16/a> | Guy Bruneau | Who You Gonna Call? AndroxGh0st Busters! [Guest Diary] |
| 2024-03-06/a> | Bojan Zdrnja | Scanning and abusing the QUIC protocol |
| 2023-09-23/a> | Guy Bruneau | Scanning for Laravel - a PHP Framework for Web Artisants |
| 2023-08-20/a> | Guy Bruneau | SystemBC Malware Activity |
| 2022-08-26/a> | Guy Bruneau | HTTP/2 Packet Analysis with Wireshark |
| 2022-07-23/a> | Guy Bruneau | Analysis of SSH Honeypot Data with PowerBI |
| 2021-10-30/a> | Guy Bruneau | Remote Desktop Protocol (RDP) Discovery |
| 2021-10-09/a> | Guy Bruneau | Scanning for Previous Oracle WebLogic Vulnerabilities |
| 2021-08-13/a> | Guy Bruneau | Scanning for Microsoft Exchange eDiscovery |
| 2021-07-10/a> | Guy Bruneau | Scanning for Microsoft Secure Socket Tunneling Protocol |
| 2021-06-26/a> | Guy Bruneau | CVE-2019-9670: Zimbra Collaboration Suite XXE vulnerability |
| 2021-06-12/a> | Guy Bruneau | Fortinet Targeted for Unpatched SSL VPN Discovery Activity |
| 2021-05-08/a> | Guy Bruneau | Who is Probing the Internet for Research Purposes? |
| 2021-04-24/a> | Guy Bruneau | Base64 Hashes Used in Web Scanning |
| 2021-02-13/a> | Guy Bruneau | Using Logstash to Parse IPtables Firewall Logs |
| 2020-12-05/a> | Guy Bruneau | Is IP 91.199.118.137 testing Access to aahwwx.52host.xyz? |
| 2020-12-04/a> | Guy Bruneau | Detecting Actors Activity with Threat Intel |
| 2020-10-24/a> | Guy Bruneau | An Alternative to Shodan, Censys with User-Agent CensysInspect/1.1 |
| 2020-10-03/a> | Guy Bruneau | Scanning for SOHO Routers |
| 2020-08-22/a> | Guy Bruneau | Remote Desktop (TCP/3389) and Telnet (TCP/23), What might they have in Common? |
| 2020-08-08/a> | Guy Bruneau | Scanning Activity Include Netcat Listener |
| 2020-07-19/a> | Guy Bruneau | Scanning Activity for ZeroShell Unauthenticated Access |
| 2020-07-11/a> | Guy Bruneau | Scanning Home Internet Facing Devices to Exploit |
| 2020-06-13/a> | Guy Bruneau | Mirai Botnet Activity |
| 2020-05-16/a> | Guy Bruneau | Scanning for Outlook Web Access (OWA) & Microsoft Exchange Control Panel (ECP) |
| 2020-04-07/a> | Johannes Ullrich | Increase in RDP Scanning |
| 2020-03-21/a> | Guy Bruneau | Honeypot - Scanning and Targeting Devices & Services |
| 2020-02-29/a> | Guy Bruneau | Hazelcast IMDG Discover Scan |
| 2019-11-23/a> | Guy Bruneau | Local Malware Analysis with Malice |
| 2019-11-03/a> | Didier Stevens | You Too? "Unusual Activity with Double Base64 Encoding" |
| 2019-10-20/a> | Guy Bruneau | Scanning Activity for NVMS-9000 Digital Video Recorder |
| 2019-09-07/a> | Guy Bruneau | Unidentified Scanning Activity |
| 2018-12-23/a> | Guy Bruneau | Scanning Activity, end Goal is to add Hosts to Mirai Botnet |
| 2017-11-13/a> | Guy Bruneau | jsonrpc Scanning for root account |
| 2017-04-22/a> | Jim Clausing | WTF tcp port 81 |
| 2016-02-02/a> | Johannes Ullrich | Targeted IPv6 Scans Using pool.ntp.org . |
| 2014-09-19/a> | Guy Bruneau | Web Scan looking for /info/whitelist.pac |
| 2014-02-15/a> | Rob VandenBrink | More on HNAP - What is it, How to Use it, How to Find it |
| 2014-02-13/a> | Johannes Ullrich | Linksys Worm ("TheMoon") Captured |
| 2014-02-12/a> | Johannes Ullrich | Suspected Mass Exploit Against Linksys E1000 / E1200 Routers |
| 2013-12-19/a> | Rob VandenBrink | Passive Scanning Two Ways - How-Tos for the Holidays |
| 2013-12-09/a> | Rob VandenBrink | Scanning without Scanning |
| 2013-10-17/a> | Adrien de Beaupre | Internet wide DNS scanning |
| 2013-08-19/a> | Rob VandenBrink | ZMAP 1.02 released |
| 2012-11-30/a> | Daniel Wesemann | Nmap 6.25 released - lots of new goodies, see http://nmap.org/changelog.html |
| 2012-06-27/a> | Daniel Wesemann | What's up with port 79 ? |
| 2011-07-17/a> | Mark Hofman | SSH Brute Force |
| 2011-02-28/a> | Deborah Hale | Possible Botnet Scanning |
| 2010-08-10/a> | Daniel Wesemann | SSH - new brute force tool? |
| 2010-02-01/a> | Rob VandenBrink | NMAP 5.21 - Is UDP Protocol Specific Scanning Important? Why Should I Care? |
| 2010-01-09/a> | G. N. White | What's Up With All The Port Scanning Using TCP/6000 As A Source Port? |
| 2009-06-26/a> | Mark Hofman | PHPMYADMIN scans |
| 2009-06-24/a> | Kyle Haugsness | TCP scanning increase for 4899 |
| 2009-02-01/a> | Chris Carboni | Scanning for Trixbox vulnerabilities |
WEBAPP |
| 2019-08-28/a> | Johannes Ullrich | [Guest Diary] Open Redirect: A Small But Very Common Vulnerability |
| 2013-06-10/a> | Johannes Ullrich | When Google isn't Google |
| 2013-02-25/a> | Johannes Ullrich | Punkspider enumerates web application vulnerabilities |
| 2011-02-28/a> | Deborah Hale | Possible Botnet Scanning |
| 2010-03-21/a> | Scott Fendley | Skipfish - Web Application Security Tool |
| 2010-02-03/a> | Johannes Ullrich | Anatomy of a Form Spam Campaign (in progress against isc.sans.org right now) https://blogs.sans.org/appsecstreetfighter/ |
| 2010-01-25/a> | William Salusky | "Bots and Spiders and Crawlers, be gone!" - or - "New Open Source WebAppSec tools, Huzzah!" |
| 2009-12-28/a> | Johannes Ullrich | 8 Basic Rules to Implement Secure File Uploads http://jbu.me/48 (inspired by IIS ; bug) |
BOTNET |
| 2024-02-18/a> | Guy Bruneau | Mirai-Mirai On The Wall... [Guest Diary] |
| 2024-01-07/a> | Guy Bruneau | Suspicious Prometei Botnet Activity |
| 2023-12-27/a> | Guy Bruneau | Unveiling the Mirai: Insights into Recent DShield Honeypot Activity [Guest Diary] |
| 2023-11-27/a> | Guy Bruneau | Decoding the Patterns: Analyzing DShield Honeypot Activity [Guest Diary] |
| 2023-11-22/a> | Guy Bruneau | CVE-2023-1389: A New Means to Expand Botnets |
| 2023-11-09/a> | Guy Bruneau | Routers Targeted for Gafgyt Botnet [Guest Diary] |
| 2023-03-11/a> | Xavier Mertens | Overview of a Mirai Payload Generator |
| 2022-02-15/a> | Xavier Mertens | Who Are Those Bots? |
| 2021-11-26/a> | Guy Bruneau | Searching for Exposed ASUS Routers Vulnerable to CVE-2021-20090 |
| 2021-10-04/a> | Johannes Ullrich | Boutique "Dark" Botnet Hunting for Crumbs |
| 2020-06-13/a> | Guy Bruneau | Mirai Botnet Activity |
| 2019-08-14/a> | Brad Duncan | Recent example of MedusaHTTP malware |
| 2019-07-26/a> | Kevin Shortt | DVRIP Port 34567 - Uptick |
| 2018-12-23/a> | Guy Bruneau | Scanning Activity, end Goal is to add Hosts to Mirai Botnet |
| 2017-05-08/a> | Renato Marinho | Exploring a P2P Transient Botnet - From Discovery to Enumeration |
| 2016-12-07/a> | Xavier Mertens | The Passwords You Should Never Use |
| 2016-09-10/a> | Xavier Mertens | Ongoing IMAP Scan, Anyone Else? |
| 2016-07-27/a> | Xavier Mertens | Analyze of a Linux botnet client source code |
| 2014-10-09/a> | Johannes Ullrich | CSAM: My servers started speaking IRC, and that is when I started to listen! |
| 2014-01-16/a> | Kevin Shortt | Port 4028 - Interesting Activity |
| 2013-12-07/a> | Guy Bruneau | Suspected Active Rovnix Botnet Controller |
| 2011-02-28/a> | Deborah Hale | Possible Botnet Scanning |
| 2011-01-11/a> | Kevin Shortt | Spam Cannons on Holiday |
| 2010-07-29/a> | Rob VandenBrink | FBI, Slovenian and Spanish Police announce more arrests of Mariposa Botnet Creator, Operators |
| 2010-04-23/a> | Adrien de Beaupre | Shadowserver botnet rules |
| 2009-12-21/a> | Marcus Sachs | iPhone Botnet Analysis |
| 2009-11-13/a> | Deborah Hale | Pushdo/Cutwail Spambot - A Little Known BIG Problem |
| 2009-11-08/a> | Kevin Liston | FireEye takes on Ozdok and Recovery Ideas |
| 2009-10-10/a> | Tony Carothers | User Notification for Possible Infected Systems |
| 2009-09-16/a> | Raul Siles | IETF Draft for Remediation of Bots in ISP Networks |
| 2009-05-07/a> | Deborah Hale | Botnet hijacking reveals 70GB of stolen data |
| 2008-09-01/a> | John Bambenek | The Number of Machines Controlled by Botnets Has Jumped 4x in Last 3 Months |
| 2008-07-19/a> | William Salusky | A twist in fluxnet operations. Enter Hydraflux |
| 2008-07-15/a> | Maarten Van Horenbeeck | Bot controller mimicry |
| 2008-04-07/a> | John Bambenek | Got Kraken? |
| 2008-04-07/a> | John Bambenek | Kraken Technical Details: UPDATED x3 |
| 2006-08-31/a> | Swa Frantzen | NT botnet submitted |
| 2006-08-31/a> | Joel Esler | MS06-040 Worm |
