Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
ioc.exchange is one of the many independent Mastodon servers you can use to participate in the fediverse.
INDICATORS OF COMPROMISE (IOC) InfoSec Community within the Fediverse. Newbies, experts, gurus - Everyone is Welcome! Instance is supposed to be fast and secure.

Administered by:

Server stats:

1.6K
active users

ioc.exchange: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.4

#http

10 posts9 participants1 post today
Public
OTX Bot

CrushFTP CVE-2025-31161 Auth Bypass and Post-Exploitation

A critical vulnerability (CVE-2025-31161) in CrushFTP managed file transfer software allows attackers to bypass authentication and gain admin-level access. Affecting versions 10.0.0-10.8.3 and 11.0.0-11.3.0, the flaw enables unauthorized actions, including data retrieval and administrative control. Exploitation has been observed since March 30, 2025, with ~1,500 vulnerable instances exposed. Post-exploitation activities include creating backdoor accounts, deploying MeshCentral agents, and using AnyDesk for remote access. A Telegram bot-based malware was also identified. The vulnerability stems from improper S3 authorization header processing and can be exploited with a simple HTTP request. Immediate patching to versions 11.3.1+ or 10.8.4+ is strongly recommended.

Pulse ID: 67f0e1f9e7eb1709fa231134
Pulse Link: otx.alienvault.com/pulse/67f0e
Pulse Author: AlienVault
Created: 2025-04-05 07:55:37

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

LevelBlue Open Threat ExchangeLevelBlue - Open Threat ExchangeLearn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.
#AnyDesk#BackDoor#CyberSecurity
Public
iX Magazin

iX-Workshop: API-Design und -Entwicklung mit HTTP, REST und OpenAPI

Lernen Sie, wie man effiziente und benutzerfreundliche APIs entwickelt, HTTP- und REST-Standards anwendet und standardisierte Referenzdokumentationen erstellt.

heise.de/news/iX-Workshop-API-

heise online · iX-Workshop: API-Design und -Entwicklung mit HTTP, REST und OpenAPIBy Ilona Krause
#API#HTTP#IT
Public
Felix Palmen :freebsd: :c64:

Trying to come up with my own little self-hosted #http #authentication #daemon to work with #nginx' "authentication request" facility ... first step done! 🥳

Now I have a subset of HTTP 1.x implemented in #C, together with a dummy handler showing nothing but a static hello-world root document.

I know it's kind of stubborn doing that in C, but hey, #coding it is great fun 🙈

github.com/Zirias/swad

Simple Web Authentication Daemon. Contribute to Zirias/swad development by creating an account on GitHub.
GitHubGitHub - Zirias/swad: Simple Web Authentication DaemonSimple Web Authentication Daemon. Contribute to Zirias/swad development by creating an account on GitHub.
Public
Max Resing

Posted about it yesterday already. But it looks like archive.today shows the default page of #Apache #webserver on #Ubuntu. The alternative domain name archive.is instead redirects with a 301 - Moved Permanently to a new domain krola.org, a website apparently comparing pet rabbit species?? It's also interesting, that the redirect to the new domain responds with an #HTTP header server: nginx/1.18 (Ubuntu). Apparently, the default Apache landing page also returns the same HTTP header information on the server. Perhaps the landing page is a decoy/deflection?

Anyone on #infosecexchange has any speculations on the website?

#InternetArchive#ArchiveOrg#ArchiveToday
Public
OTX Bot

CoffeeLoader: A Brew of Stealthy Techniques

CoffeeLoader is a sophisticated malware family discovered in September 2024, designed to download and execute second-stage payloads while evading detection. It employs numerous techniques to bypass security solutions, including a GPU-utilizing packer, call stack spoofing, sleep obfuscation, and Windows fibers. The malware uses HTTPS for command-and-control communications with certificate pinning to prevent man-in-the-middle attacks. It supports various commands for injecting and running shellcode, executables, and DLLs. CoffeeLoader shares similarities with SmokeLoader, which has been observed distributing it. The loader implements advanced features beneficial for evading detection by antivirus, EDRs, and malware sandboxes, making it a formidable threat in the crowded market of malware loaders.

Pulse ID: 67e5309946530b6bf94aabf8
Pulse Link: otx.alienvault.com/pulse/67e53
Pulse Author: AlienVault
Created: 2025-03-27 11:03:53

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

LevelBlue Open Threat ExchangeLevelBlue - Open Threat ExchangeLearn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.
#CyberSecurity#EDR#HTTP
Public
OTX Bot

A Practical Guide to Uncovering Malicious Infrastructure With Hunt.io

This guide demonstrates how to use Hunt.io to investigate and track malicious infrastructure. Starting with a single suspicious IP address, the process involves analyzing hosting providers, domain information, open ports, HTTP responses, and TLS certificates. The investigation reveals connections to potential cryptocurrency fraud and malware operations. By leveraging Hunt's scan data and SQL queries, a small cluster of related servers is identified, possibly linked to Latrodectus malware. The guide emphasizes the importance of persistence, pattern recognition, and correlating data from multiple intelligence sources to effectively track threat actor operations.

Pulse ID: 67e342d7a17ba37eb960497a
Pulse Link: otx.alienvault.com/pulse/67e34
Pulse Author: AlienVault
Created: 2025-03-25 23:57:11

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

LevelBlue Open Threat ExchangeLevelBlue - Open Threat ExchangeLearn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.
#CyberSecurity#HTTP#InfoSec
Public
OTX Bot

Chinese APT’s Stealthy Web Shell & HTTP Tunneling Campaign in Telecom Networks

The Weaver Ant threat actor maintained four-year persistent access in an Asian telecom network by deploying stealthy web shells.

Pulse ID: 67e31944a2fbedb7ff514ec0
Pulse Link: otx.alienvault.com/pulse/67e31
Pulse Author: cryptocti
Created: 2025-03-25 20:59:48

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

LevelBlue Open Threat ExchangeLevelBlue - Open Threat ExchangeLearn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.
#Asia#Chinese#CyberSecurity
Public
madiator2011

From: blenderdumbass . org

The multiplayer, or the lack there of, at the moment is so utterly broken and so lacking of being properly made that for a long time, I was just not bothering with it. Seeing it as something unnecessary. Something that does not need to be touched, because other things, like the...

Read or listen: https://blenderdumbass.org/articles/a_rant_about_making_a_multiplayer_game

#Gamedev #DanisRace #Networking #Multiplayer #TCP #HTTP #Programming #Python #UPBGE #Blender3d #GNU #Linux #GamingOnLinux #FreeSoftware #OpenSource

blenderdumbass . orgA Rant About Making a Multiplayer Game
More from Blender Dumbass ( J.Y.Amihud )
Public
OTX Bot

Weaver Ant, the Web Shell Whisperer: Tracking a China-Nexus Cyber Operation

Sygnia uncovered a sophisticated China-nexus threat actor, Weaver Ant, targeting a major Asian telecom company. The group employed web shells and tunneling techniques for persistence and lateral movement, maintaining access for over four years. They utilized encrypted China Chopper and custom 'INMemory' web shells, along with a recursive HTTP tunnel tool for internal network access. Weaver Ant demonstrated advanced evasion techniques, including ETW patching, AMSI bypassing, and 'PowerShell without PowerShell' execution. The operation involved extensive reconnaissance, credential harvesting, and data exfiltration. Despite eradication attempts, the group showed remarkable persistence, adapting their tactics to regain access.

Pulse ID: 67e2ab375298346f9c281119
Pulse Link: otx.alienvault.com/pulse/67e2a
Pulse Author: AlienVault
Created: 2025-03-25 13:10:15

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

LevelBlue Open Threat ExchangeLevelBlue - Open Threat ExchangeLearn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.
#Asia#China#CredentialHarvesting
Public
Michael Horowitz

Should you ever run across an article that says you don't need a VPN because most every website use HTTPS, be aware that you can not see the encryption, or the lack of it, in mobile apps. Thus, things like this happen - Apple did not bother to upgrade their own software from HTTP to HTTPS.

9to5mac.com/2025/03/18/apples-
Apple’s Passwords app was vulnerable to phishing attacks for nearly three months after launch
#vpn #http #https #encryption

9to5Mac · Apple's Passwords app was vulnerable to phishing attacks for nearly three months after launch - 9to5MacIn iOS 18, Apple spun off its Keychain password management tool—previously only tucked away in Settings—into a standalone app called...
Public
Fedi:Tagestipp/tröt

Mastodon-Client-API

Auch wenn sich im #Fediverse viel um #ActivityPub dreht und hier durchaus auch eine #Client-Schnittstelle skizziert ist, nutzt #Mastodon eine eigene Client-API, die (zumindest teilweise) auch von anderer fediversaler Serversoftware unterstützt wird (z.B. #Friendica, #Firefish, #Mammuthus).

Diese #API (application programming interface, eine #Schnittstelle zur #Programmierung von Anwendungen) dient Apps und Clients dazu, entsprechende Funktionen auf einer #Instanz durchzuführen. Diese API ermöglicht die Entwicklung von Apps wie #Tusky, #Fedilab & Co.

Man kann diese API auch nutzen, um Konten etwa (teil)automatisiert zu betreiben.

Oder Statistiken zu sammeln... oder... oder... ;-)

Die API ist soweit öffentlich dokumentiert und steht frei zur Verfügung.

Allgemeine Dokumentation zu #Mastodon (auf Englisch):
https://docs.joinmastodon.org/

"Getting started with the API":
https://docs.joinmastodon.org/client/intro/

Wer mit dem Gedanken spielt, die API zu nutzen, sollte sich mit #HTTP, #JSON & Co. anfreunden können. Und Englischkenntnisse sind in diesem Bereich grundsätzlich von Vorteil...

docs.joinmastodon.orgMastodon documentationWelcome to the Mastodon documentation!
Public
Anthony Accioly

Quick question for folks who understand HTTP caching on reverse proxies like Squid or Cloudflare. If I have a GET REST endpoint responding with 200 OK and the following headers:

Cache-Control: public, max-age=3600  
ETag: "123-a"

The proxy should cache and serve the response without hitting the underlying server more than once for the first hour, then send a request with If-Match: "123-a" when the cache goes stale, right? Is there any reason why it wouldn’t?

#http#caching#etag
Public
Blender Dumbass ( J.Y.Amihud )

From: blenderdumbass . org

The multiplayer, or the lack there of, at the moment is so utterly broken and so lacking of being properly made that for a long time, I was just not bothering with it. Seeing it as something unnecessary. Something that does not need to be touched, because other things, like the...

Read or listen: blenderdumbass.org/articles/a_

blenderdumbass . orgA Rant About Making a Multiplayer Game
More from Blender Dumbass ( J.Y.Amihud )
#Gamedev#DanisRace#Networking
ExploreLive feeds
About