6 min
Haxmas
Happy HaXmas! Year-End Internet Scanning Observations
As we wrap up 2018 and forge ahead into 2019, let's reflect on some of the key observations we made through our internet scanning with Project Sonar.
7 min
Haxmas
Santa's ELFs: Running Linux Executables Without execve
Santa's ELFs do not get a post-holiday break, since the Executable and Linkable Format (ELF) is the base of numerous Unix-like operating systems.
25 min
Haxmas
The Ghost of Exploits Past: A Deep Dive into the Morris Worm
In this post, we will dive into the exploit development process for the three modules we created in honor of the 30th anniversary of the Morris worm.
5 min
Haxmas
HaXmas Review: 12 Patch Tuesdays a-Patching
Another year, another 701 patched Microsoft vulnerabilities: just a 2% increase from 2017's count of 686.
4 min
Haxmas
The Layer 8(th) Day of Christmas: Rapid7 Pen Testers Reveal Social Engineering Insights at Recent Conference
Four Rapid7 pen testers recently gathered at the brand-new Layer 8 conference in Rhode Island to present on social engineering and open source intelligence (OSINT) gathering.
5 min
Haxmas
Advice for the Lazy Family Sysadmin
With some careful choices, you can be a lazy family system administrator this holiday. Here’s my experience, along with some tips.
4 min
Haxmas
Once a Haxer, Always a Haxor
Like most hackers, I liked to take apart my holiday gifts as a kid. In this blog, I take apart Amazon's voice-controlled microwave oven to see how it works.
7 min
Haxmas
The New Shiny: Memorable Metasploit Moments of 2018
Happy HaXmas, friends. Metasploit turned 15 this year, and by all accounts, 2018 was pretty epic.
3 min
Haxmas
R7-2018-52: Guardzilla IoT Video Camera Hard-Coded Credential (CVE-2018-5560)
Most HaXmas posts are full of fun and frivolity, but this one is a routine vulnerability disclosure in a piece of IoT gear that you should know about.
4 min
Haxmas
The Return of Snapid Kevin to the North Pole
Santa has once again enlisted the help of his security consultant, Snapid Kevin, to evaluate his physical security. What will Snapid turn up?
3 min
Haxmas
The 12 Days of HaXmas: A Festive Blog Series Recapping Security in 2018
It’s the waning days of 2018, so it’s time to usher in our traditional end-of-year blog series, the 12 Days of HaXmas.
2 min
Metasploit Weekly Wrapup
Metasploit Wrapup 12/21/18
Safari Proxy Object Type Confusion
Metasploit committer timwr recently added a macOS
Safari RCE exploit module
based on a solution
that saelo
developed and used successfully at Pwn2Own 2018
.
saelo's exploit is a three-bug chain: a Safari RCE (CVE-2018-4233), a sandbox
13 min
Research
Rsunk your Battleship: An Ocean of Data Exposed through Rsync
Rapid7 Labs recently decided to take a fresh look at rsync, this time focusing on exposure of rsync globally on the public internet.
3 min
InsightVM
How to Use the InsightVM Policy Compliance Status Report to Measure Benchmark Configurations
Reports within InsightVM can help you demonstrate whether your systems stand up against compliance requirements.
3 min
AWS
Rapid7 Partners with AWS Security Hub for Deeper Vulnerability Reporting
Last month, we were thrilled to announce our integration with AWS Security Hub at AWS re:Invent.