CVE-2022-1292

OpenSSL - OS Command Injection

https://github.com/li8u99/CVE-2022-1292

XSS Game by Google | Bug Bounty - XSS | Live Broadcast Hacking
https://youtube.com/watch?v=YHNRYa1gOzk

#HacKingPro - Hack Like A Pro
Menu / To Do
[p] - Planning and Scoping
Asking for Target IP:
Asking for Target Name:
Asking for Target Phone:
Asking for Target Nik Name:
Asking for Target Email:
00 - Anonymity
00 - Firewall Rules
01 - Clear Logs
02 - Clear History
03 - Change MAC Address
04 - Change IP Address
05 - Change Routing
01 - Information Gathering
01 - Systems Information
02 - Networks Information
03 - Social Information
04 - SubDomain Information
02 - Vulnerability Assessment
03 - Web Application HacKing
04 - Database Assessment
05 - Password HacKing
06 - Wireless HacKing
07 - Reverse Engineering
08 - Exploit Frameworks & DataBases
09 - Sniffing - Spoofing
10 - Gaining & Maintaining Access
11 - Digital Forensic
12 - Analysis & Reporting
13 - Social Engineering
14 - Privilege Enumeration & Escalation
15 - Malware Analysis Labs/Tools
16 - Covering Tracks
https://github.com/Anlominus/HacKingPro

Palestinian Gemzo ISP Full DB 200K Records
→ Contains full info about gemzo customers/administrators ISP

There are dozens of tools for automating Google Dorking and collecting search results.

Many of them are based on the python module "googlesearch".

It is extremely simple.

But it can be applied to a multitude of investigative purposes.

You can learn it in two minutes and use it to create the perfect search automation script for your purposes.

1. Installation:

pip install googlesearch-python

2. Simple search:

from googlesearch import search
search("Osint")

3. Search with output URL of the results to the console:

for url in search('Osint'):
print(url)

4. Search in Russian:

search('Osint', lang="ru")

5. Search with a fixed number of results:

search('Osint', num_results=3)


The picture above shows an example of search automation with results output to a text file.


Official project repository: https://github.com/MarioVilas/googlesearch

Hacking the Cloud

Encyclopedia of the attacks/tactics/techniques that offensive security professionals can use on cloud exploitation (#AWS, #Azure, #GoogleCloud, #Terraform,)

https://hackingthe.cloud

Contributor twitter.com/Frichette_n

​​hackerone-reports

Tops of HackerOne reports. All reports' raw info stored in data.csv. Scripts to update this file are written in Python 3 and require chromedriver and Chromium executables at PATH. Every script contains some info about how it works. The run order of scripts:

▫️ fetcher.py
▫️ uniquer.py
▫️ filler.py
▫️ rater.py

https://github.com/reddelexc/hackerone-reports

Educational Heap Exploitation

This repo is for learning various heap exploitation techniques. We use Ubuntu's Libc releases as the gold-standard. Each technique is verified to work on corresponding Ubuntu releases.

You can run apt source libc6 to download the source code of the Libc your are using on Debian-based operating system. You can also click ▶️ to debug the technique in your browser using gdb.

https://github.com/shellphish/how2heap

​CVE-2022-24086-MASS-RCE

CVE-2022-24086 and CVE-2022-24087 are an rce in adobe commerce and magento

https://github.com/TomArni680/CVE-2022-24086-MASS-RCE

#cve #RCE