PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Reports from the Field: Part 1

bishopfox.com | blog | #data-exposure | #wordpress | #incident-analysis | #attack-chaining | #credential-reuse | #email-marketing
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Real-world attack chaining: credentials recovered from a WordPress backup were reused across systems, ultimately unlocking an email marketing platform with 1.7 million subscribers.
Published
Collected

Related coverage

blog · bishopfox.com
Reports from the Field: Part 3
Reports from the field: an open-source URL tool surfaced leaked VPN credentials, which combined with social media reconnaissance and microservice discovery enabled deep internal access.
blog · bishopfox.com
Reports from the Field: Part 2
Four ways an exposed .git/config file can be exploited: rebuilding repository contents, recovering hardcoded credentials, and finding vulnerabilities like PHP eval() issues leading to shell access.
blog · blog.trailofbits.com
How Threat Modeling Could Have Prevented the $1.5B Bybit Hack
Trail of Bits argues the $1.5B Bybit hack stemmed from operational failures—compromised signer devices and manipulated transaction UIs—that threat modeling could have exposed.
blog · about.gitlab.com
A sandbox is only as closed as what an AI agent can reach
This coverage gives security teams current context for monitoring, validation, and remediation.
blog · hackenproof.com
Maiar DEX went offline. Bug in Elrond smart contract a reason
Analysis of the Maiar DEX exploit: a callback flaw in Elrond's new VM function let an attacker drain over 1.6M EGLD, forcing an emergency shutdown and a 95% price crash in half an hour.
blog · aikido.dev
How a startup’s cloud got taken over by a simple form that sends emails
An SSRF bug in a PHP email form let attackers fetch EC2 IMDSv1 credentials and pivot to S3 buckets and CloudFormation templates with API keys; the walkthrough covers the chain and IMDSv2 mitigation.
Back