Resources

Datasheet

Core Access

Product Overview Core Access is a centralized access request management solution that simplifies the access request and approval process in your organization, all within a single interface. Using a shopping cart approach, Core Access provides a convenient web portal where end users and managers can request access and managers or application owners can review, approve, or deny access. Plus...
Datasheet

Core PDNS

By mapping the current and historical activity of domains and IPs, Core’s Passive DNS (PDNS) provides Incident Response, Fraud, and Security Operation Center teams the richest source of contextual, factual DNS activity data to investigate, mitigate, and protect against cyber threats. Core’s PDNS database is the industry’s largest, mapping 93 billion domains to IPs with trillions of DNS queries...
Datasheet

Event Manager

Turn Cybersecurity Data into Insight in Real-Time Event Manager is a cybersecurity insight and response platform that ensures critical events get the attention they require. Events are translated into an easy-to-interpret format, and critical events are separated from the noise in real time. This enables security analysts to act quickly and decisively, even without specialized knowledge of every...
Datasheet

Secure and Convenient Password Reset

Ineffective password management is a significant burden to organizations, resulting in increased costs and security vulnerabilities. But companies that use a strong self-service password management solution can decrease service desk call volume by up to 80 percent. Core Security provides a complete, integrated solution for secure telephone-based password resets. Core Password and Secure Reset...
Datasheet

Core Impact

Solution and Vendor Background Core Impact is the most comprehensive multi-vector solution for assessing and testing security vulnerabilities throughout your organization. Leveraging commercial-grade exploits, users can take security testing to the next level when assessing and validating security vulnerabilities. Core Impact is a product that is built and supported by Core Security, a Fortra...
Datasheet

Core Privileged Access Manager (BoKS)

Centralized Linux and UNIX Access Management for On-Premises and Cloud Environment Core Privileged Access Manager (BoKS) transforms your multi-vendor Linux and UNIX server environment into one centrally managed security domain. BoKS simplifies your ability to enforce security policies and features a simple configuration framework for streamlined, robust administration. Easily control access to...
Datasheet

Core Compliance

Identity and access management has become a complex Big Data problem for IT departments. The world of users, identities and access creates a continual demand for identity and access changes throughout the organization as employees move from new hire status to transfer, promotion and termination. So what happens when the auditors come in for access certification reviews? Are you sure your...
Datasheet

Core Provisioning

Provisioning is Core Security’s user provisioning solution for organizations seeking to improve alignment with business goals; cut costs; enforce compliance with internal security policies, industry standards and government regulations; and reduce the risk of security incidents. Part of Core Security’s Enterprise Suite of products, Core Provisioning delivers these benefits by accelerating the...
Datasheet

Core Impact

Core Impact empowers organizations to proactively minimize risk and protect critical assets by using the same techniques as today’s threat actors to assess their infrastructure’s security posture. This powerful platform provides a unified environment for managing all phases of the penetration testing process, from reconnaissance to reporting. Intuitive User Interface Core Impact features a...
Article

How to Phish with Core Impact

Core Impact 18.1 release brought a ton of streamlined enhancements and new capabilities to the client-side vector in general, and phishing in particular. To be clear on terms, I consider phishing to be inducing a target to follow a link presented in an email for the purposes of capturing credentials for some system or another. Using an email to get a user to overtly run a compromised attachment...
Article

The Unpatched LSASS Remote Denial of Service (MS16-137)

In November 8, 2016 Microsoft released a security update for Windows Authentication Methods (MS16-137) which included 3 CVEs: Virtual Secure Mode Information Disclosure Vulnerability CVE-2016-7220 Local Security Authority Subsystem Service Denial of Service Vulnerability CVE-2016-7237 Windows NTLM Elevation of Privilege Vulnerability CVE-2016-7238 Talking specifically about CVE-2016-7237, this…
Article

Getting Physical: Extreme abuse of Intel based Paging Systems - Part 3 - Windows HAL's Heap

Continuing with my Getting Physical blog posts series (CanSec2016’s presentation), in this third episode I’m going to talk about how Windows Paging is related to the HAL's heap and how it can be abused by kernel exploits. This is probably the simplest way of abusing Windows paging structures, because deep knowledge about how Intel paging works is not necessary to implement the attack.
Article

Abusing GDI for ring0 exploit primitives

Every once in a while I get to work on something special, something that leaves me with the keys to open new doors. Introduction: Not long ago I came across a certain font related vulnerability, it was a 0day being exploited in the wild...
Article

Early Release Exploit for MS14-068 Vulnerability (Affecting Kerberos)

A few weeks ago a critical vulnerability (MS14-068) affecting Windows environments was published by Microsoft (credited to Tom Maddock and team). Specifically, the vulnerability affects Kerberos. [The vulnerability will] allow an attacker to elevate unprivileged domain user account privileges to those of the domain administrator account.
Article

Exploiting CVE-2015-0311: A Use-After-Free in Adobe Flash Player

At the end of January, Adobe published the security bulletin APSA15-01 for Flash Player, which fixes a critical use-after-free vulnerability affecting Adobe Flash Player 16.0.0.287 and earlier versions. This vulnerability, identified as CVE-2015-0311, allows attackers to execute arbitrary code...