WordPress Backdoor: Unmasking the “Etomidetka” Threat

Introduction: The Stealthy Web Intruder Recently discovered a sophisticated WordPress backdoor script designed to establish persistent, hidden access. Codenamed “Etomidetka” after its creator username, this PHP malware exemplifies how threat actors exploit legitimate platform functions for nefarious purposes. Unlike noisy ransomware or destructive wipers, this threat prioritizes stealth and long-term access—making it particularly dangerous for…

Read More

Katana: Advanced Web Crawler

The Evolution of Web Crawling Modern web applications have transformed into complex ecosystems dominated by JavaScript frameworks, dynamic content, and API-driven architectures. Traditional crawlers fail to render these applications effectively, creating critical blind spots in reconnaissance. Enter Katana – Project Discovery’s next-generation crawling framework engineered to conquer modern web complexities Why Katana Revolutionizes Reconnaissance Advanced Installation &…

Read More

The Shadow Over SharePoint – CVE-2025-53770

Introduction: The Silent Siege In July 2025, a storm engulfed on-premises Microsoft SharePoint environments worldwide. CVE-2025-53770—a critical unauthenticated remote code execution (RCE) vulnerability—has been actively exploited by advanced threat actors, compromising government agencies, energy firms, and universities. This flaw isn’t just another entry in the CVE catalog; it’s a potent weapon enabling total server takeover. Here’s what…

Read More

Recon – The Information Gathering Phase

What it is:Think of “recon” like scouting or doing homework. It’s the phase where someone (an attacker or a defender) quietly gathers information about a target (like a company, website, or network) before taking any direct action. Analogy: Imagine thieves planning to rob a bank. They wouldn’t just rush in! First, they’d:✅ Watch the bank’s opening/closing times.✅ Note security guards and cameras.✅ Look…

Read More