IT Security VideoSecurity Weekly - A CRA Resource: When Does Agent Drift Become Suspicious?(25.09.2026 um 00:00 Uhr)

•

IT Security NachrichtenBetrüger phishen mit vermeintlicher Reisebestätigung - IT-Markt(24.09.2026 um 23:41 Uhr)

•

IT Security NachrichtenAFC/BVE-Risikostudie 2026 - Bundesvereinigung der deutschen Ernährungsindustrie(24.09.2026 um 23:31 Uhr)

•

Sicherheitslücken (CVE)IT Security News Daily Summary 2026-09-24(24.09.2026 um 23:55 Uhr)

•

Sicherheitslücken (CVE)IT Security News Roundup: 2026-09-24(24.09.2026 um 23:57 Uhr)

•

Sicherheitslücken (CVE)IT Security News Hourly Summary 2026-09-25 00h : 9 posts(25.09.2026 um 00:00 Uhr)

•

AI & KI NachrichtenAustralia Investigates OpenAI Agent Over Unauthorized Access to Medicare Portal(25.09.2026 um 00:01 Uhr)

•

IT NachrichtenRay-Ban Meta Gen 3 vs. Ray-Ban Meta Gen 2: How these AI glasses compare(24.09.2026 um 23:56 Uhr)

•

IT NachrichtenMicrosoft puts Brad Smith in charge of communications(25.09.2026 um 00:08 Uhr)

•

IT Nachrichten30 Jahre COMPUTER BILD: Chefredakteur und Vize blicken zurück(25.09.2026 um 00:05 Uhr)

•

IT Security VideoSecurity Weekly - A CRA Resource: When Does Agent Drift Become Suspicious?(25.09.2026 um 00:00 Uhr)

•

IT Security NachrichtenBetrüger phishen mit vermeintlicher Reisebestätigung - IT-Markt(24.09.2026 um 23:41 Uhr)

•

IT Security NachrichtenAFC/BVE-Risikostudie 2026 - Bundesvereinigung der deutschen Ernährungsindustrie(24.09.2026 um 23:31 Uhr)

•

Sicherheitslücken (CVE)IT Security News Daily Summary 2026-09-24(24.09.2026 um 23:55 Uhr)

•

Sicherheitslücken (CVE)IT Security News Roundup: 2026-09-24(24.09.2026 um 23:57 Uhr)

•

Sicherheitslücken (CVE)IT Security News Hourly Summary 2026-09-25 00h : 9 posts(25.09.2026 um 00:00 Uhr)

•

AI & KI NachrichtenAustralia Investigates OpenAI Agent Over Unauthorized Access to Medicare Portal(25.09.2026 um 00:01 Uhr)

•

IT NachrichtenRay-Ban Meta Gen 3 vs. Ray-Ban Meta Gen 2: How these AI glasses compare(24.09.2026 um 23:56 Uhr)

•

IT NachrichtenMicrosoft puts Brad Smith in charge of communications(25.09.2026 um 00:08 Uhr)

•

IT Nachrichten30 Jahre COMPUTER BILD: Chefredakteur und Vize blicken zurück(25.09.2026 um 00:05 Uhr)

•

Intelligence View

⚡ tsecurity.de Intelligence

TUI tool for generating packets of arbitrary input and monitoring packets!

Hi! Today, I have a tool that I really want to introduce to you all. It is a TUI tool that I am currently developing, and it has two functions. The repository for the tool is https://github.com/ddddddO/packemon. The first is the…

Sichere Programmierung dev.to 09.05.2025, 02:31 Uhr 2 Min. Lesezeit

↗ Quelle (dev.to)

Reagiere als Erste:r — dein Feedback zählt!

Hi! Today, I have a tool that I really want to introduce to you all.

It is a TUI tool that I am currently developing, and it has two functions.

The repository for the tool is https://github.com/ddddddO/packemon.

The first is the ability to generate and send packets!

Send generated packets to any network interfaces.
- You can specify the network interface with --interface flag. Default is eth0.

Packets of various protocols are supported.
- You can configure and generate arbitrary packets at each layer of the TCP/IP model.
- Details are in the README of the repository.

Second, you can monitor packets sent and received!

Monitor any network interfaces.
- You can specify network interface with --interface flag.

Can filter packets to be displayed.
- You can filter the values for each item (e.g. Dst, Proto, SrcIP.... . etc.) displayed in the listed packets.

Specified packets can be saved to pcapng file.

Packets of various protocols are supported.

Finally

This tool is a full scratch implementation of the protocol stack. When I tried to establish a connection with my own implementation of TCP 3-way-handshake with this tool, the kernel was sending TCP RST packets. So I have included a process to drop the RST packets sent using eBPF. Also, this is only supported on Linux.

Please see the README for more information! The README also includes instructions on how to use and install it.

If you use it I will be happy!

CTI Threat Relationship Graph2 Knoten / 1 Relationen

CVE / Incident Software MITRE ATT&CK CWE Weakness IoC

IR-PLAYBOOK-VULN-REMEDIATIONMEDIUM

Schritte anzeigen

SOC Incident Playbook: Vulnerability Remediation & Verification

Asset Inventory

Asset-Datenbank nach betroffenen Komponenten, Versionen und exposed Ports abfragen.

nmap -sV --script vuln -p- <target-network>

Exploit MonitoringSofort

SIEM-Regeln und IDS-Signaturen (Snort/Suricata) auf Angriffsversuche schärfen.

tail -f /var/log/suricata/fast.log | grep <cve>

Patch DeploymentSofort

Patch oder offiziellen Workaround gemäß Hersteller-Empfehlung einspielen.

Check Vendor Security Advisory Bulletin

1-Click Detection Engineering: Multi-Dialect SIEM Rules5 Formate

Regeln anzeigen

Syntax validiert (0 Fehler)

title: Detect Exploitation - TUI tool for generating packets of arbitrary input and monitoring packets!
id: 49942300-3b1a-42fe-84c4-afbe3fd9d560
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

Syntax validiert (0 Fehler)

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "TUI tool for generating packet" ascii wide
    condition:
        any of them
}

Syntax validiert (0 Fehler)

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("TUI tool for generating packets of arbit")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

Syntax validiert (0 Fehler)

message: "*TUI tool for generating packets of arbit*"

Syntax validiert (0 Fehler)

CommonSecurityLog
| where Message has "TUI tool for generating packets of arbit"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

🎯

MITRE ATT&CK Matrix Navigator 14 Taktiken

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

💡 Tipp: Klicken Sie auf eine TTP, um Gegenmaßnahmen und SIEM-Erkennungsregeln anzuzeigen.Enterprise Matrix v14.1

🚀 Auf tsecurity.de entdecken

◀ VORHERIGER BEITRAG 4 Min

How to Use Find Command in Bash to Search Entire Directory

Sichere Programmierung

NÄCHSTER BEITRAG 2 Min

Flip for Knowledge: Building a Flashcard Game with HTML, CSS & JavaScript

Sichere ProgrammierungWeiterlesen ▶

Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen

Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich TUI tool for generating packets of arbit.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen

1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.

🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC

Schnell-Prompts für Analysten

⚠️ DEFANGED SANDBOX VIEW (tsecurity.de): Alle Netzwerkindikatoren und URLs wurden neutralisiert (2 Indikatoren entschärft). Nur zur defensiven Analyse!

Format: python

#!/usr/bin/env python3
# Exploit Title: PoC for Target
import socket, sys
target = '192[.]168[.]1[.]10'
url = 'hxxp://target[.]local/vuln'
s = socket.socket()
s.connect((target, 80))
s.send(b'GET / HTTP/1.1\r\nHost: target.local\r\n\r\n')