#Offensive_security
1. Fetch data (open ports, CVEs, CPEs, ...) from shodan internetDB API
https://github.com/s4hm4d/shodanidb
2. Find MS Exchange instance for a given domain and identify the exact version
https://github.com/mhaskar/ExchangeFinder
1. Fetch data (open ports, CVEs, CPEs, ...) from shodan internetDB API
https://github.com/s4hm4d/shodanidb
2. Find MS Exchange instance for a given domain and identify the exact version
https://github.com/mhaskar/ExchangeFinder
GitHub
GitHub - s4hm4d/shodanidb: Fetch data (open ports, CVEs, CPEs, ...) from shodan internetDB API
Fetch data (open ports, CVEs, CPEs, ...) from shodan internetDB API - s4hm4d/shodanidb
#Red_Team_Tactics
1. Header spoofing via a hidden parameter in Facebook Batch GraphQL APIs
https://feed.bugs.xdavidhu.me/bugs/0017
2. UAC Bypass On Windows Defender For Endpoint With HighBorn
https://assume-breach.medium.com/home-grown-red-team-uac-bypass-on-windows-defender-for-endpoint-with-highborn-e9ea16546029
1. Header spoofing via a hidden parameter in Facebook Batch GraphQL APIs
https://feed.bugs.xdavidhu.me/bugs/0017
2. UAC Bypass On Windows Defender For Endpoint With HighBorn
https://assume-breach.medium.com/home-grown-red-team-uac-bypass-on-windows-defender-for-endpoint-with-highborn-e9ea16546029
feed.bugs.xdavidhu.me
Header spoofing via a hidden parameter in Facebook Batch GraphQL APIs
xdavidhu's bug bounty disclosures.
👍1
Defending_nginx (1).pdf
8.9 MB
#hardening
"Defending against automatization using NGINX", 2022.
]-> Nginx Bad Bot and User-Agent Blocker, Spam Referrer Blocker, Anti DDOS, Bad IP Blocker, Wordpress Theme Detector Blocker:
https://github.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker
"Defending against automatization using NGINX", 2022.
]-> Nginx Bad Bot and User-Agent Blocker, Spam Referrer Blocker, Anti DDOS, Bad IP Blocker, Wordpress Theme Detector Blocker:
https://github.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker
#OpSec
JustEvadeBro, a cheat sheet which will aid you through AMSI/AV evasion & bypasses
https://github.com/sinfulz/JustEvadeBro
JustEvadeBro, a cheat sheet which will aid you through AMSI/AV evasion & bypasses
https://github.com/sinfulz/JustEvadeBro
GitHub
GitHub - sinfulz/JustEvadeBro: JustEvadeBro, a cheat sheet which will aid you through AMSI/AV evasion & bypasses.
JustEvadeBro, a cheat sheet which will aid you through AMSI/AV evasion & bypasses. - sinfulz/JustEvadeBro
Nessie.pdf
747.9 KB
#Research
"Nessie: Automatically Testing JavaScript APIs with Asynchronous Callbacks", 2022.
]-> https://zenodo.org/record/5874851#.Y4Gx7aSOFSA
"Nessie: Automatically Testing JavaScript APIs with Asynchronous Callbacks", 2022.
]-> https://zenodo.org/record/5874851#.Y4Gx7aSOFSA
#exploit
1. CVE-2022-32898:
ANE_ProgramCreate() multiple kernel memory corruption
https://0x36.github.io/CVE-2022-32898
2. CVE-2022-43781:
Command injection vulnerability using environment variables in Bitbucket Server/Data Center
https://petrusviet.medium.com/cve-2022-43781-32bc29de8960
3. CVE-2022-38374:
XSS in Fortinet FortiADC 7.0.0 - 7.0.2, 6.2.0 - 6.2.4
https://github.com/azhurtanov/CVE-2022-38374
1. CVE-2022-32898:
ANE_ProgramCreate() multiple kernel memory corruption
https://0x36.github.io/CVE-2022-32898
2. CVE-2022-43781:
Command injection vulnerability using environment variables in Bitbucket Server/Data Center
https://petrusviet.medium.com/cve-2022-43781-32bc29de8960
3. CVE-2022-38374:
XSS in Fortinet FortiADC 7.0.0 - 7.0.2, 6.2.0 - 6.2.4
https://github.com/azhurtanov/CVE-2022-38374
Nimjector.pdf
4.9 MB
#Offensive_security
"Understanding and Re-creating Process Injection Techniques through Nimjector", 2022.
]-> https://github.com/cybernomad1/NimJection
"Understanding and Re-creating Process Injection Techniques through Nimjector", 2022.
]-> https://github.com/cybernomad1/NimJection
💥Nighthawk: An Up-and-Coming Pentest Tool Likely to Gain Threat Actor Notice
Nighthawk is a mature and advanced commercial C2 framework for lawful red team operations that is specifically built for detection evasion, and it does this well. While Proofpoint researchers are not aware of adoption of Nighthawk in the wild by attributed threat actors, it would be incorrect and dangerous to assume that this tool will never be appropriated by threat actors with a variety of intexfnts and purposes.
🔥🔥🔥PoC of the removed registered LdrDllNotification for your enjoyment.
🔥🔥🔥PoC for utilizing RtlQueueWorkItem to load libraries
Nighthawk is a mature and advanced commercial C2 framework for lawful red team operations that is specifically built for detection evasion, and it does this well. While Proofpoint researchers are not aware of adoption of Nighthawk in the wild by attributed threat actors, it would be incorrect and dangerous to assume that this tool will never be appropriated by threat actors with a variety of intexfnts and purposes.
🔥🔥🔥PoC of the removed registered LdrDllNotification for your enjoyment.
🔥🔥🔥PoC for utilizing RtlQueueWorkItem to load libraries
🔥Vulnerabilities in BMC Firmware Affect OT/IoT Device Security(part1)
By abusing these vulnerabilities, an unauthenticated attacker may achieve RCE with root privileges on the BMC, completely compromising it and gaining control of the managed host. During our research, we uncovered other vulnerabilities whose patching is still in progress and thus cannot be disclosed as of yet; those will be covered in a follow-up blog post.
Our discussion starts with an introduction to BMCs and an illustration of the vulnerabilities discovered. We will then provide an example of how an attacker can abuse these issues to ultimately compromise the device, and conclude with remediations that asset owners can implement.
By abusing these vulnerabilities, an unauthenticated attacker may achieve RCE with root privileges on the BMC, completely compromising it and gaining control of the managed host. During our research, we uncovered other vulnerabilities whose patching is still in progress and thus cannot be disclosed as of yet; those will be covered in a follow-up blog post.
Our discussion starts with an introduction to BMCs and an illustration of the vulnerabilities discovered. We will then provide an example of how an attacker can abuse these issues to ultimately compromise the device, and conclude with remediations that asset owners can implement.
💥NETGEAR R7800 AFPD PreAuth + PoC exploit
A heap-buffer overflow in afpdʼs dsi_writeinit is leveraged to overwrite the proto_close function pointer in the DSI struct, and execute arbitrary code on the NETGEAR R7800 Smart Router, in the default configuration, on the LAN side, pre-auth.
A heap-buffer overflow in afpdʼs dsi_writeinit is leveraged to overwrite the proto_close function pointer in the DSI struct, and execute arbitrary code on the NETGEAR R7800 Smart Router, in the default configuration, on the LAN side, pre-auth.
Forwarded from ㅤㅤㅤ
Containers: Rootful, Rootless, Privileged and Super Privileged.
https://infosecadalid.com/2021/08/30/containers-rootful-rootless-privileged-and-super-privileged/
https://infosecadalid.com/2021/08/30/containers-rootful-rootless-privileged-and-super-privileged/
Forwarded from ㅤㅤㅤ
Boa Web Server 0.94.13_0.94.14 Authentication Bypass.file
2.2 KB
Forwarded from ㅤㅤㅤ
Simmeth_System_GmbH_Supplier_Manager_LFI_SQL_Injection_Bypass.report
13.6 KB
Forwarded from ㅤㅤㅤ
Cisco Secure Email Gateway Malware Detection Evasion.report
7.1 KB