habib26-14

Could an LLM end up being the core part of a dangerous computer worm?

How would we neutralize such a thing if this happened?

Some virus and worm background

https://en.wikipedia.org/wiki/Timeline_of_computer_viruses_and_worms

There is a hilarious story from https://users.cs.utah.edu/~elb/folklore/xerox.txt about an early computer virus called robin hood and friar tuck. This was basically just two programs running on a UNIX system that would look out for each other and reboot the other process if it was killed. It's interesting to note that since computer programs run thousands of times faster than humans, a human can't type kill -9 robinhood then type kill -9 friartuck in time. The computer is faster so it always wins if you try this. To defeat this you need to take a different approach than speed.

The Top Hacker Methodologies & Tools Notes

By Chase. ** *

Nuclei Templates

Concrete5 CMS : Identification, Mass Hunting, Nuclei Template Writing & Reporting

My Methodology

SIEM Training

ATTENTION, THIS GIST ISN'T FREQUENTLY UPDATED

MAIN SOURCE: https://github.com/isaqueprofeta/cybersec-path

General

Jose Bravo - What is a SIEM? (5 Vídeos): https://www.youtube.com/watch?v=MtqFMe4zSpQ&list=PLHh9jhztlMyp8lyKXt9orVM57ygW_ihPS
IPPSec - PowerSIEM Analyzing Sysmon Events with PowerShell: https://www.youtube.com/watch?v=MvfhIydxFmw

	<a[1]href[2]=[3]"[4]java[5]script:[6]alert(1)">

	[1]
	Bytes:
	\x09 \x0a \x0c \x0d \x20 \x2f

	<a/href="javascript:alert(1)">
	<a\x09href="javascript:alert(1)">

	[2,3]

	- name: awss3
	type: regex
	regex:
	- '[a-zA-Z0-9.-]+\.s3\.amazonaws\.com'
	- 's3://([^/]+)'
	- '[a-zA-Z0-9.-]+.s3\.[a-zA-Z0-9.-]+\.amazonaws\.com'
	- '[a-zA-Z0-9.-]+\.s3-website-[a-z0-9-]+\.amazonaws\.com'
	- '[a-zA-Z0-9.-]+\.s3\.amazonaws\.com'

	- name: awsapps

	package org.mapleir;

	import org.mapleir.app.client.SimpleApplicationContext;
	import org.mapleir.app.service.ApplicationClassSource;
	import org.mapleir.app.service.InstalledRuntimeClassSource;
	import org.mapleir.asm.ClassHelper;
	import org.mapleir.asm.ClassNode;
	import org.mapleir.asm.MethodNode;
	import org.mapleir.context.AnalysisContext;
	import org.mapleir.context.BasicAnalysisContext;

	<!--
	This was a sandboxing challenge where the JS language is presenteded in the form of exotic, made-up language.
	It's almost properly sandboxed but there is one bug that players needed to find.
	The bug I found was to construct HTML comment (<!--) that is understood by JS and which makes it possible to ignore one semicolon
	and then to concat array expression with variable name, like $var$['eval']. To get reference to eval we used DOM clobbering
	and defined <iframe name=$win$>
	-->

	<iframe name=$win$></iframe>
	<x-program>

	<#
	Meta
	Date: 2022 March 28th
	Updated: 2023 October 6th
	Authors: Dray Agha (Twitter @purp1ew0lf), Dipo Rodipe (Twitter @dipotwb)
	Company: Huntress Labs
	Purpose: Automate setting up Sysmon and pulling Ippsec's sysmon IoC streamliner. Great for malware lab.
	#>

	################################################################################################################