The only non-profit and volunteer based publication in infosec, come write with us, and publish alongside your peers. #OSINT
Joined June 2016
- Tweets17
- Following408
- Followers9.5K
- Likes1.8K
Are bugs found by AI more dangerous? Oliver Jones reads Google's own report: half lead to code execution, but on its risk scale they rate High 4% of the time against 3% for everyone else's.
secjuice.com/googles-own-tab…
A side-by-side guide to attacking Active Directory as a pentester and as a red team, with the Elastic queries that catch each step. Same domain takeover: 12+ prebuilt rules fired for the pentest, 4 for the C2 run.
secjuice.com/red-team-vs-pen…
A hands-on teardown of Salat Stealer, a Go infostealer sold as a service. Adithya V unpacks it, finds a keylogger in its function names and watches it call two TON blockchain gateways it can use to find new C2 servers.
secjuice.com/practical-malwa…
How to test an AI OSINT agent before you trust its sources. Ollie South builds a ten-task known-answer test, because only one OSINT agent has ever had its hallucination rate measured.
secjuice.com/how-to-test-an-…
A test of the free radar method behind Bellingcat's war damage map. At Borisoglebsk air base NetSniffer found it scored the runway above the strike site, then reversed itself a week later.
secjuice.com/a-free-radar-da…
Why patching FortiManager in 2024 did not end the FortiJump attacks. Unit 42 traced stolen keys for 500+ FortiGates to a firewall implant that leaves no file, no open port and no beacon. What to rotate and check now.
secjuice.com/peerstitch-why-…
How to turn a records dump built to be unreadable into a searchable database with free tools. Chaz Stevens did it to 3,100 sideways Broward Sheriff's Office payroll scans and found a jail sergeant paid $457,000. secjuice.com/they-sent-3100-…
How to check when a real, unedited screenshot was actually taken. Dan Parks shows how responders test a leak-site breach claim against file metadata, web archives and their own logs. secjuice.com/the-screenshot-…
What free satellite data can and can't prove about Ukraine's claimed strike on six Su-34s at Borisoglebsk. NetSniffer finds NASA's fire map caught three earlier attacks on the base, and nothing this time. secjuice.com/nasas-fire-sate…
New on Secjuice: a first malware analysis of a live sample, start to finish. Adithya V works an unknown file blind from strings to detonation, unmasks the LokiBot password stealer and lists the four things missed. secjuice.com/my-first-real-m…
New on Secjuice: how one prompt to an AWS AgentCore agent could unlock every other agent in the region. AWS has tightened the default role, but roles already in your account keep the old, broad policy. How to find and fix them. secjuice.com/agentcorruption…
New on Secjuice: how to check whether a war video was made with AI. NetSniffer shows why the hidden AI labels are usually gone by the time a clip reaches you, and which free checks still work. secjuice.com/ai-war-videos-w…
New on Secjuice: how to decrypt files hit by DoNex ransomware without paying. Andy From Italy finds the sample reuses one Salsa20 keystream for every file, so one known file and its encrypted copy unlock all the rest. secjuice.com/artificial-inte…
New on Secjuice: what the "Verified" label on UK company directors at Companies House proves, and what it doesn't. Ollie South explains it, then walks through a free check of any UK company. secjuice.com/what-companies-…
