International Cyber Digest
intcyberdigest.bsky.social
International Cyber Digest
@intcyberdigest.bsky.social
360 followers 230 following 130 posts
Your weekly go-to cybersecurity newsletter, curated and commented on by our senior analysts, in your mailbox soon... https://x.com/IntCyberDigest https://infosec.exchange/@InternationalCyberDigest
Posts Media Videos Starter Packs
The process includes analysis, threat modeling, attack vector mapping, exploitation, and a list of discovered vulnerabilities. This is reportedly the first public pentest of an airport X-ray scanner.

Read the article: kth.diva-portal.org/smash/get/di...
kth.diva-portal.org
🚨 Hacking the Airport X-Ray Machine: 11 Vulnerabilities in a Popular Scanner

Security researcher Felix Zuber shares his findings from penetration testing the populair Smiths Detection HI-SCAN 6040i X-ray machine.
🛠️ dw_deanon — de-anonimize a domain in the Dark Web

Use: correlate identities across onion markets and leak datasets for OSINT.

TRY: github.com/bash-bunny/d...
🛠️ svg_phishing_tools — phishing in SVG attachments are sneaky. This toolkit helps you analyze SVG attachment in phishing e-mails

Try: github.com/HackingLZ/sv...
🛠️ google-redirector — A lightweight HTTP/HTTPS redirector designed for Google Cloud Run that exploits remaining domain fronting capabilities in Google's infrastructure

Try: github.com/praetorian-i...
🛠️ rustnet — A cross-platform network monitoring tool built with Rust. RustNet provides real-time visibility into network connections with detailed state information, connection lifecycle management, deep packet inspection, and a terminal user interface.

Try: github.com/domcyrus/rus...
🛠️ hopgoblin — a scanner for Adobe Experience Manager (AEM) instances.

Try: github.com/assetnote/ho...
📚 From MCP to Shell —
Earlier this year, MCP introduced an OAuth standard to authenticate clients
Many MCP clients did not validate the authorization URL passed by a malicious MCP server
Researchers were able to exploit this bug to achieve Remote Code Execution (RCE) in popular tools
🛠️ REGEXSS — who knew a sloppy regex could be worth $6k? This write-up walks through regex bugs that paid out big. Great story + lessons for bug hunters on how to use regex for XSS.
Try: sec.stealthcopter.com/regexss/
Stealthcopter
Overly-greedy regex replacements can break HTML sanitisation and lead to XSS. I’ve already pulled in over $6k from this bug class, and there are plenty mo
sec.stealthcopter.com
🛠️ FindMy[.]py — query Apple’s FindMy network with just Python. Neat for OSINT experiments or DFIR cases (watch the legal lines).

Try: github.com/malmeloo/Fin...
What do you think? Is he brave for standing up?