How to collect malicious URLs

Question

I would like to obtain a list of malicious URLs for testing purposes and, if possible, would like to collect URLs of sites that exploit zero-day vulnerabilities.

I want to collect malicious URLs to investigate zero-day attacks.

Answer 1

This is not an answer to "How to collect malicious URLs?" but rather "How to investigate zero-day exploits?" - which is the question that is actually being asked.

First of all, the typical garden variety scammer does not actually use any exploits at all. Instead, they try to get access to your accounts, either by faking a login page (so you submit your login credentials to them) or by asking you to connect an "app" to your account (particularly social media accounts), which in turn demands complete access to your account.

Another very common vector is to offer files to download, which pose as "legitimate", but actually contain malware. P2P platforms used to be very popular for this (and probably still are), but Search Engine Optimization and "malwaretising" has become popular in recent times too. For example, if you searched for "VLC" in Germany, your first Google result would be "vlc.de", a website which is available to this day, which distributes VLC together with its own ad-ware.

Of course, there are more venues to distribute malware, but the important takeaway is that these attacks target low-hanging fruit. Attackers don't care about who installs their malware, just that they get to run their adware, ransomware, etc...

Zero-Day Exploits (Zero-Days for short) on the other hand are highly sought-after and fetch very high prices, depending on who the target is (Windows, iOS, Android, etc.), how reliable it is, how detectable it is, what capabilities you get, etc...

These Zero-Days must be used sparingly, because every use could be found, investigated and ultimately lead to a patch, which makes the Zero-Day unusable (or at least, way less impactful) and thus leading to a loss of value. This also means that attackers, who just send malicious URLs to random people, will likely not use a Zero-Day Exploit there. Why would they? They risk wasting an exploit that could be worth hundreds of thousands of dollar, just to install even more ad-ware on some grandma's laptop?

Then, how do I investigate Zero-Days?

• Google's Project Zero is a great resource, talking about zero-day exploits, explaining in detail how they work, what vulnerabilities they abuse and how they evade modern mitigation.

• Seclist's Full Disclosure mailing list is a good mailing list, where people disclose vulnerabilities. While these typically contain very little explanation other than "This is what happened", they are a good resource to look through.

• Security Companies own advisory lists. Many security companies perform vulnerability research or happen across zero-day vulnerabilities from time to time. Many will ask vendors whether or not they can publish the findings publicly after a patch has been published, and some vendors agree to that. Since I myself work for such a company, I don't want to link to it directly as not to seem like this is advertising/recruiting.

• Vendor advisory lists. Many vendors list which vulnerability any given software patches. For example, nginx has a page titled Security Advisories, which lists all security relevant findings that have been published. Often, these contain patches to source code to mitigate this vulnerability, so with some elbow grease, you can reverse engineer what the issue was and possibly how to exploit it. Furthermore, many of the advisories state who discovered the vulnerability, so contacting them may be worth a shot.

Note that this states how you can investigate already found zero-day exploits to better understand them. How to find zero-days is explained in the question How are zero days found?