6

I got hired in the cyber security field and it's a break-in for me. I have many years in the IT field so I am building right off of that.

My job requires knowledge of common attack vectors/signatures, recognition of a kill chain, isolation, remediation, and research. Basic CND type stuff.

One thing I am curious about is where would a cyber defender go to learn about zero-day exploits, cutting edge exploitation/attack routines, or anything else that a typical black hat (not a script kiddie) might know and use.

The emergent problem is that I don't want to make myself vulnerable or risk tipping others off to my presence while doing info mining. Most importantly, I don't want to risk damaging my integrity by being identified or associated with black hat groups.

I'm aware of the National Vulnerability Database but I'm concerned with the delta that exists between brand new attacks or exploits and known signatures that are archived there. The larger the delta between the two (the latency between the newest entries and the trailing edge of the latest exploits/attacks not yet captured), the more that info is deprecated. I want to minimize that delta by bridging the knowledge gap between what's available in the NVD and what has yet to be recorded and documented.

There are sites like Krebs On Security and the random articles found everywhere but are there any other useful repositories, forums/discussions, or sites that have been useful to farm that kind of information?

  • Check out SANS Institute. – SDsolar Mar 23 '17 at 8:13
8

From -- https://attack.mitre.org/wiki/Main_Page

Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK™) is a model and framework for describing the actions an adversary may take while operating within an enterprise network. The model can be used to better characterize and describe post-compromise adversary behavior. It both expands the knowledge of network defenders and assists in prioritizing network defense by detailing the post-compromise (post-exploit and successful access) tactics, techniques, and procedures (TTPs) advanced persistent threats (APT) use to execute their objectives while operating inside a network.

The work is further expanded from red-team exercises in The Fort Meade eXperiment (FMX).


For on-going cyber-offensive tradecraft, please see the following resources:

Initial Entry-Point Access


Conference Material

  • irongeek.com
  • infiltratecon.com
  • blackhat.com
  • gsec.hitb.org
  • media.defcon.org
  • recon.cx

SANS

RecordedFuture

Research Labs

  • labs.mwrinfosecurity.com
  • immunityproducts.blogspot.com
  • blog.trendmicro.com
  • community.rapid7.com
  • threatpost.com
  • zscaler.com/blogs/research/
  • code.google.com/p/google-security-research/ -- security.googleblog.com -- googleprojectzero.blogspot.com
  • blog.coresecurity.com
  • contextis.com/resources/blog/
  • info.lastline.com/blog/
  • fireeye.com/blog/threat-research/
  • blog.skyboxsecurity.com
  • nccgroup.trust/uk/our-research/ -- nccgroup.trust/globalassets/our-research/
  • endgame.com/blog/
  • labs.bluefrostsecurity.de
  • signalsec.com/blog/
  • talosintel.com
  • blog.vectranetworks.com
  • blog.checkpoint.com
  • sekoia.fr/blog/
  • payatu.com
  • researchcenter.paloaltonetworks.com
  • symantec.com/connect/blogs/
  • heimdalsecurity.com/blog/
  • proofpoint.com/us/threat-insight/
  • cgsec.co.uk
  • expdev-kiuhnm.rhcloud.com
  • keenlab.tencent.com
  • blog.netspi.com
  • exploresecurity.com
  • silentbreaksecurity.com
  • sensepost.com/blog/
  • blackhillsinfosec.com
  • utkusen.com/blog/english-articles
  • blog.fortinet.com
  • blogs.mcafee.com
  • blog.morphisec.com
  • srcincite.io
  • blog.malwaretracker.com
  • nakedsecurity.sophos.com

Research Individuals

  • shellntel.com
  • cybersyndicates.com
  • rotlogix.com
  • malware.dontneedcoffee.com
  • blog.skylined.nl
  • blog.innerht.ml
  • d.uijn.nl
  • j00ru.vexillium.org
  • blog.malerisch.net
  • blog.malwareclipboard.com
  • malwarejake.blogspot.com

Access Expansion

This list probably includes some of the above, but these tend to focus on what to do after you already have access (i.e., Post-Exploitation techniques)


  • harmj0y.net/blog/
  • fuzzysecurity.com
  • breakingmalware.com
  • labofapenetrationtester.com
  • crowdstrike.com/blog/
  • blog.comae.io
  • sixdub.net
  • en.wooyun.io
  • insinuator.net
  • subt0x10.blogspot.com
  • exploit-monday.com
  • secinfodb.wordpress.com
  • moyix.blogspot.com
  • nightlionsecurity.com/blog/
  • talosintelligence.com
  • repret.wordpress.com
  • astr0baby.wordpress.com
  • woumn.wordpress.com
  • travisaltman.com
  • bhafsec.com
  • crowdshield.com/blog.php
  • labs.nettitude.com/blog/ -- nettitude.co.uk
  • carnal0wnage.attackresearch.com
  • countuponsecurity.com
  • adsecurity.org
  • clymb3r.wordpress.com
  • enigma0x3.net
  • kernelmode.info/forum/
  • labs.portcullis.co.uk/blog/
  • trustedsignal.blogspot.com
  • marcoramilli.blogspot.com
  • jumpespjump.blogspot.com
  • hexacorn.com/blog/
  • diablohorn.com
  • toshellandback.com
  • alex-ionescu.com
  • thepcn3rd.blogspot.com
  • blog.tanium.com
  • trustedsec.com
  • attactics.org
  • shelliscoming.com
  • hackerhurricane.blogspot.com
  • leeholmes.com/blog/
  • birendraraj0.blogspot.com
  • dsinternals.com
  • cyberarms.wordpress.com
  • riosec.com
  • insomniasec.com
  • darkoperator.com
  • buffered.io
  • g-laurent.blogspot.com
  • sternsecurity.com/blog/
  • xlab.tencent.com
  • bluescreenofjeff.com
  • rvrsh3ll.net/blog/
  • room362.com -- attackerkb.com -- cfdb.io
  • securitynik.blogspot.com
  • obscuresecurity.blogspot.com
  • blog.didierstevens.com
  • blog.varonis.com
  • c0d3xpl0it.blogspot.com
  • implicitdeny.org
  • cutawaysecurity.com/blog/
  • jimshaver.net
  • cyberark.com/blog/
  • binarydefense.com
4

The very nature of a zero day exploit is that it is a previously unknown vulnerability. As such, people who have or know about zero days are not likely to be discussing them in public places. High value zero days are very expensive and are only used as a last resort. Zero day attack chains make for great news, but the reality is that they are only used if absolutely necessary and spear phishing can be extremely successful.

With that said here are some potentially useful resources for you.

I could go on and on, but I think what you're really looking for is not available unless you thrust yourself into the underbelly of exploit development. There are organizations and individuals that create and sell exploits to entities for large sums of money so they are not easy to come by in the wild.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.