Finding SOCKS with Proxywatch
TL;DR: Adversaries use SOCKS proxy tunnels to pivot within environments and to execute code against compromised systems without bringing tools to the system. Defenders often lack reliable guidance to detect proxying behavior, falling back to preset rules based on static indicators or process-port baselines. This blog post highlights Proxywatch, a proof-of-concept release by SpecterOps, to […] The post Finding SOCKS with Proxywatch appeared first on SpecterOps.
🎯 Vulnerability: Web Security Vulnerability
💡 Defense Fix: Implement strict input validation, contextual output encoding, and enforce least-privilege authorization controls.