@BushidoToken Threat Intel

  On 13 March, SanSec disclosed a new Magecart domain used to host malicious JavaScript (.js) files that can collect credit card information from ecommerce site checkout pages. The site (jquerycdn[.]at) that hosted the scripts was present on at least 299 different victim stores. The most commonly attacked platform is Magento 1 ecommerce platform. Notably, support for Magento 1 ended on 30 June 2020, meaning that it will no longer receive security updates. How does the web skimmer work? “Web skimmers are loaded on the checkout page of a typical store. It lives in the browser of an unsuspecting online customer. Whenever he or she enters her payment information, the private data is siphoned off to an offshore server. Usually, this data is then sold on the dark web within 2-10 weeks.” - SanSec.  In this blog, I analysed the JavaScript Skimmers connected to jquerycdn[.]at in an ongoing campaign :  knockout-fast-foreach.js 46fa357596e58272e6e2865c8b80bb96eb910c577267ce64bcada7...

Initial Disclaimer:  I have focused on using open source tools for this blog due to their accessibility and general ease of use. I have purposely not included premium tools like Spiderfoot HX, Nessus, Burp Suite, or others I have used in the past, or more invasive ones like FOCA, NMAP/Zenmap and Dirb, because it’s not the focus of this blog. Those tools also require permission use to before scanning any site. Further, that I am not, or ever have been, a scout sniper or in the military, but I have always admired military ethos and the focus on decision making skills. Although, I do know someone who is. ︻デ═一 If you are a website owner or on the security team of an organisation, it’s always worth seeing through the eye of a potential attacker to scout your perimeter and check your defenses. Another reason to use OSINT tools is because most threat actors will not typically be using enterprise-grade tools either - other than APTs. The general idea is to self-footprin...