Open in app
Home
Notifications
Lists
Stories

Write
Youssef ENNACIRI
Youssef ENNACIRI

Home

Jan 23

Bypass JA3

JA3 fingerprints are now used by web servers to identify clients based on thier TLS ClientHello packets. when servers identify clients as malicious tools such as Brup, Nessus, Nexpose, … they get blocked. How JA3 fingerprinting works ? if you don’t know about JA3 please refer to this artcile to understant the concept and how…

Ja 3

3 min read

Bypass JA3
Bypass JA3

Jan 12

C2 Malware Identification with browsing history

There are many C2 Frameworks that use popular legitimate domains such as google, twitter, github, discord, … in order to fly undetected under SOC’s radar. The complete list of these domains can be found here : https://lots-project.com/ Here is an example of a such frameworks : GitHub - 3ct0s/disctopia-c2: Windows Backdoor that is controlled through Discord Disctopia Command and Control Disctopia is an open source Python Discord Bot that works as a backdoor that you can…github.com

Blue Team

3 min read

C2 Malware Detection with browing history
C2 Malware Detection with browing history
Youssef ENNACIRI

Youssef ENNACIRI

Help

Status

Writers

Blog

Careers

Privacy

Terms

About

Knowable