Hacking Articles Tips Tricks Videos Tutorials

Web App Pen Testing - Learning SQL Injection
https://www.reddit.com/r/Pentesting/comments/nmawn4/web_app_pen_testing_learning_sql_injection/

Hello Everyone, I'm on my journey to become a web app pen tester and I have started with the Portswigger Web Security Academy which I'm finding incredibly useful so far. I have started on the SQL injection topic and I've just started looking at blind SQL injection and its the first time where I have relied heavily on hints/solutions to assist me in completing the labs. What I'm struggling with is the many extra variables you may potentially have to include in order to be successful. So my question is how would you know whether to use URL encoding vs concatenation vs a comment trailer or even a combination of these? Is it simply trial and error or is there a set pattern you should always try when discovering a potential injectable field? Some examples below. Lab example with double concatenation encased in quotes TrackingId=xyz'||(SELECT ' ')||' Lab example with concatenation and comment trailer TrackingId=x'||pg_sleep(10)-- Lab example with some URL encoding and + TrackingId=x'%3BSELECT+CASE+WHEN+(1=1)+THEN+pg_sleep(10)+ELSE+pg_sleep(0)+END-- At the moment these labs feel impossible without these hints/walkthroughs so any advice would be greatly appreciated. Thanks in advance :)  submitted by /u/lewis20188 (https://www.reddit.com/user/lewis20188)
[link] (https://www.reddit.com/r/Pentesting/comments/nmawn4/web_app_pen_testing_learning_sql_injection/) [comments] (https://www.reddit.com/r/Pentesting/comments/nmawn4/web_app_pen_testing_learning_sql_injection/)

7 views19:09

Bug Bounty Methodology V3.0: Hunt like a rat
https://thexssrat.medium.com/bug-bounty-methodology-v3-0-hunt-like-a-rat-9e030fc54363?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Medium

Bug Bounty Methodology V3.0: Hunt like a rat

Over time i ran into some issues when i was following other people’s methodologies. I was testing like my mentors and my hero’s but it…

6 viewsedited 19:36

Hacking Articles Tips Tricks Videos Tutorials

7 views19:36

Hacking Articles Tips Tricks Videos Tutorials

Over time i ran into some issues when i was following other people’s methodologies. I was testing like my mentors and my hero’s but it…Continue reading on Medium » (https://thexssrat.medium.com/bug-bounty-methodology-v3-0-hunt-like-a-rat-9e030fc54363?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Medium

Bug Bounty Methodology V3.0: Hunt like a rat

Over time i ran into some issues when i was following other people’s methodologies. I was testing like my mentors and my hero’s but it…

9 viewsedited 19:36

Hacking Articles Tips Tricks Videos Tutorials

10 views20:00

Hacking Articles Tips Tricks Videos Tutorials

Photo

hacking: security in practice
Demo for Mr. Beast's Self Updating Thumbnail Hack

https://external-preview.redd.it/Zj-byydGu0QD2Ijxe2jVSU2FwRFAiw86iAvg_rjm0io.jpg?width=320&crop=smart&auto=webp&s=04019f1fe1a7655152291c2626f9471e9d65d402 submitted by /u/EmergencyCloud2080
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

r/hacking - Demo for Mr. Beast's Self Updating Thumbnail Hack

0 votes and 0 comments so far on Reddit

9 viewsedited 20:00

Hacking Articles Tips Tricks Videos Tutorials

Enterprise Scale Threat Hunting: C2 Beacon Detection with Unsupervised ML and KQL — Part 2
https://www.reddit.com/r/redteamsec/comments/nmhys3/enterprise_scale_threat_hunting_c2_beacon/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://mergene.medium.com/enterprise-scale-threat-hunting-network-beacon-detection-with-unsupervised-ml-and-kql-part-2-bff46cfc1e7e) [comments] (https://www.reddit.com/r/redteamsec/comments/nmhys3/enterprise_scale_threat_hunting_c2_beacon/)

___________________________
@hacking_Attack
@Hacking_Video

Enterprise Scale Threat Hunting: C2 Beacon Detection with...

Posted in r/redteamsec by u/dmchell • 1 point and 0 comments

10 viewsedited 21:30

Hacking Articles Tips Tricks Videos Tutorials

BHIS | Getting Started in Pentesting The Cloud: Azure | Beau Bullock (1-Hour)
https://www.reddit.com/r/redteamsec/comments/nmhze0/bhis_getting_started_in_pentesting_the_cloud/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://youtu.be/fCbVMWvncuw) [comments] (https://www.reddit.com/r/redteamsec/comments/nmhze0/bhis_getting_started_in_pentesting_the_cloud/)

___________________________
@hacking_Attack
@Hacking_Video

BHIS | Getting Started in Pentesting The Cloud: Azure | Beau...

Posted in r/redteamsec by u/dmchell • 1 point and 0 comments

10 viewsedited 21:31

Hacking Articles Tips Tricks Videos Tutorials

10 views21:47

Hacking Articles Tips Tricks Videos Tutorials

10 views21:47

Hacking Articles Tips Tricks Videos Tutorials

Photo

Black Hat Ethical Hacking
Pulse Secure VPNs Get Quick Fix for Critical RCE

https://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Pulse Secure VPNs Get Quick Fix for Critical RCEPost Views: 160
Reading Time: 1 Minute
Pulse Secure has issued a workaround for a critical remote-code execution (RCE) vulnerability in its Pulse Connect Secure (PCS) VPNs that may allow an unauthenticated, remote attacker to execute code as a user with root privileges.
Pulse Secure’s parent company, Ivanti, issued an out-of-band advisory on May 14. The company explained that this high-severity bug – identified as CVE-2021-22908 and rated CVSS 8.5 – affects Pulse Connect Secure versions 9.0Rx and 9.1Rx.

“Buffer Overflow in Windows File Resource Profiles in 9.X allows a remote authenticated user with privileges to browse SMB shares to execute arbitrary code as the root user,” according to the advisory. “As of version 9.1R3, this permission is not enabled by default.”

The CERT Coordination Center issued a report about the vulnerability, explaining that the problem stems from a buffer overflow vulnerability in the PCS gateway. CERT/CC explained that the gateway’s ability to connect to Windows file shares through a number of CGI endpoints could be leveraged to carry out an attack.

“When specifying a long server name for some SMB operations, the smbcltapplication may crash due to either a stack buffer overflow or a heap buffer overflow, depending on how long of a server name is specified,” CERT/CC noted. PCS 9.1R11.4 systems are vulnerable: CERT/CC said that it’s managed to trigger the vulnerability by targeting the CGI script /dana/fb/smb/wnf.cgi, although “Other CGI endpoints may also trigger the vulnerable code.”
See Also: 100M Android Users Hit By Rampant Cloud Leaks There’s currently no practical solution to this problem, at least not that CERT/CC is aware of, according to Will Dormann, who both discovered the vulnerability and wrote up the CERT/CC report. He offered two workarounds: Fix No. 1: Apply XML WorkaroundPulse Secure has published a quick fix: a Workaround-2105.xml file with a mitigation to protect against the vulnerability. “Importing this XML workaround will activate the protections immediately,” according to Dormann’s report, and “does not require any downtime for the VPN system.

The workaround blocks requests that match these URI patterns: ^/+dana/+fb/+smb^/+dana-cached/+fb/+smbDormann advised users to note that Workaround-2105.xmlwill automatically deactivate the mitigations applied by an earlier workaround, Workaround-2104.xml. That makes it “imperative that a PCS system is running 9.1R11.4 before applying the Workaround-2105.xmlmitigation,” he said, to ensure that the vulnerabilities outlined in SA44784 aren’t reintroduced as the result of applying the workaround.

The workaround will block the ability to use Windows File Share Browser.
See Also: Offensive Security Tool: Snallygaster Fix No. 2: Set a Windows File Access PolicyDormann said that a PCS system that started as 9.1R2 or earlier will retain the default Initial File Browsing Policy of Allow for \\*SMB connections, which will expose this vulnerability. He advised users to check out the administrative page for the PCS, at Users -> Resource Policies -> Windows File Access Policiesto view current SMB policy.

A PCS policy that explicitly allows \\*or otherwise “may allow users to initiate connections to arbitrary SMB server names,” Dormann advised, telling users to “configure the PCS to Deny connections to such resources to minimize [...]

___________________________
@hacking_Attack
@Hacking_Video

10 viewsedited 21:47

About

Blog

Apps

Platform