“Legal, Regulations, Investigations, and Compliance CISSP Domain 8 Unraveled”

In the realm of cybersecurity, the Certified Information Systems Security Professional (CISSP) certification stands as a symbol of…Continue reading on Medium »
Read more...

eWPTX Prepare Resources

Main ResourcesContinue reading on Medium »
Read more...

eWPTX Prepare Resources
https://medium.com/@0UN390/ewptx-prepare-resources-a741220cf145?source=rss------bug_bounty-5

Main ResourcesContinue reading on Medium » (https://medium.com/@0UN390/ewptx-prepare-resources-a741220cf145?source=rss------bug_bounty-5)

#Day6 Bug Bounty Recon Part 2: ( Subdomains and S3 buckets )

Subdomain enumeration is a crucial step in bug bounty hunting that can help you identify potential vulnerabilities in web applications. By…Continue reading on CodingNinjaBlogs »
Read more...

#Day6 Bug Bounty Recon Part 2: ( Subdomains and S3 buckets )
https://medium.com/codingninjablogs/day6-bug-bounty-recon-part-2-subdomains-and-s3-buckets-1a01780e6908?source=rss------bug_bounty-5

Subdomain enumeration is a crucial step in bug bounty hunting that can help you identify potential vulnerabilities in web applications. By…Continue reading on CodingNinjaBlogs » (https://medium.com/codingninjablogs/day6-bug-bounty-recon-part-2-subdomains-and-s3-buckets-1a01780e6908?source=rss------bug_bounty-5)

AppSec Tales XXIII | XPathI
https://karol-mazurek95.medium.com/appsec-tales-xxiii-xpathi-ca6171826d2a?source=rss------bug_bounty-5

Application Security Testing for XPath Injections.Continue reading on Medium » (https://karol-mazurek95.medium.com/appsec-tales-xxiii-xpathi-ca6171826d2a?source=rss------bug_bounty-5)

AppSec Tales XXIII | XPathI

Application Security Testing for XPath Injections.Continue reading on Medium »
Read more...

Hacking Microsoft IIS : Uncovering Microsoft IIS Vulnerabilities

Enumeration TechniquesContinue reading on Medium »
Read more...

Bread - BIOS Reverse Engineering And Advanced Debugging
http://www.kitploit.com/2023/11/bread-bios-reverse-engineering-and.html

| |--------------->| |--------------->| |
| dbg | | bridge | | gdb |
|(real HW)|<---------------| (Linux) |<---------------| (Linux) |
+---------+ serial +----------+ TCP +---------+ Features By implementing the GDB stub, BREAD has many features out-of-the-box. The following commands are supported: Read memory (via x (https://sourceware.org/gdb/onlinedocs/gdb/Memory.html), dump (https://sourceware.org/gdb/onlinedocs/gdb/Dump_002fRestore-Files.html), find (https://sourceware.org/gdb/onlinedocs/gdb/Searching-Memory.html), and relateds) Write memory (via set (https://sourceware.org/gdb/onlinedocs/gdb/Assignment.html), restore (https://sourceware.org/gdb/onlinedocs/gdb/Dump_002fRestore-Files.html), and relateds) Read and write registers (https://sourceware.org/gdb/onlinedocs/gdb/Registers.html#Registers) Single-Step (si (https://sourceware.org/gdb/download/onlinedocs/gdb/Continuing-and-Stepping.html), stepi) and continue (c (https://sourceware.org/gdb/download/onlinedocs/gdb/Continuing-and-Stepping.html), continue) Breakpoints (b (https://sourceware.org/gdb/onlinedocs/gdb/Set-Breaks.html), break)1 (https://github.com/Theldus/bread#user-content-fn-bp_note-39e484c63d9d86e3a2c6e6aff6905f63) Hardware Watchpoints (watch (https://sourceware.org/gdb/download/onlinedocs/gdb/Set-Watchpoints.html) and its siblings)2 (https://github.com/Theldus/bread#user-content-fn-watchp_note-39e484c63d9d86e3a2c6e6aff6905f63) Limitations How many? Yes. Since the code being debugged is unaware that it is being debugged, it can interfere with the debugger in several ways, to name a few: Protected-mode jump: If the debugged code switches to protected-mode, the structures for interrupt handlers, etc. are altered and the debugger will no longer be invoked at that point in the code. However, it is possible that a jump back to real mode (restoring the full previous state) will allow the debugger to work again. IDT changes: If for any reason the debugged code changes the IDT or its base address, the debugger handlers will not be properly invoked. Stack: BREAD uses a stack and assumes it exists! It should not be inserted into locations where the stack has not yet been configured. For BIOS debugging, there are other limitations such as: it is not possible to debug the BIOS code from the very beggining (bootblock), as a minimum setup (such as RAM) is required for BREAD to function correctly. However, it is possible to perform a "warm-reboot" by setting CS:EIP to F000:FFF0. In this scenario, the BIOS initialization can be followed again, as BREAD is already properly loaded. Please note that the "code-path" of BIOS initialization during a warm-reboot may be different from a cold-reboot and the execution flow may not be exactly the same. Building Building only requires GNU Make, a C compiler (https://www.kitploit.com/search/label/Compiler) (such as GCC, Clang, or TCC), NASM, and a Linux machine. The debugger has two modes of operation: polling (default) and interrupt-based: Polling mode Polling mode is the simplest approach and should work well in a variety of environments. However, due the polling nature, there is a high CPU usage: Building $ git clone https://github.com/Theldus/BREAD.git
$ cd BREAD/
$ make Interrupt-based mode The interrupt-based mode optimizes CPU utilization by utilizing UART interrupts to receive new data, instead of constantly polling for it. This results in the CPU remaining in a 'halt' state until receiving commands from the debugger, and thus, preventing it from consuming 100% of the CPU's resources. However, as interrupts are not always enabled, this mode is not set as the default option: Building $ git clone https://github.com/Theldus/BREAD.git
$ cd BREAD/

... the following patch is sufficient: > CHANGE_HERE << +[ORG 0x8210] ; >> CHANGE_HERE << %include "constants.inc" @@ -140,8 +140,8 @@ _start: ; >> CHANGE_HERE << ; Overwritten BIOS instructions below (if any) - nop - nop + mov ax, 0x4F02 + int 0x10 nop nop' dir="auto">diff --git a/dbg.asm b/dbg.asm
index caedb70..88024d3 100644
--- a/dbg.asm
+++ b/dbg.asm
@@ -21,7 +21,7 @@
; SOFTWARE.

[BITS 16]
-[ORG 0x0000] ; >> CHANGE_HERE <<
+[ORG 0x8210] ; >> CHANGE_HERE <<

%include "constants.inc"

@@ -140,8 +140,8 @@ _start:

; >> CHANGE_HERE <<
; Overwritten BIOS instructions below (if any)
- nop
- nop
+ mov ax, 0x4F02
+ int 0x10
nop
nop It is important to note that if you have altered a few instructions within your ROM to invoke the debugger code, they must be restored prior to returning from the debugger. The reason for replacing these two instructions is that they are executed just prior to the BIOS displaying the logo on the screen, which is now the debugger, ensuring a few key points: The logo module (which is the debugger) has already been loaded into memory Video interrupts from the BIOS already work The code around it indicates that the stack already exists Finding a good location to call the debugger (where the BIOS has already initialized enough, but not too late) can be challenging, but it is possible. After this, dbg.bin is ready to be inserted into the correct position in the ROM. For DOS Debugging DOS programs with BREAD is a bit tricky, but possible: 1. Edit dbg.asm so that DOS understands it as a valid DOS program: Set the ORG to 0x100 Leave the useful code away from the beginning of the file (times) Set the program output (int 0x20) The following patch addresses this: > CHANGE_HERE << +[ORG 0x100] + +times 40*1024 db 0x90 ; keep some distance, + ; 40kB should be enough %include "constants.inc" @@ -140,7 +143,7 @@ _start: ; >> CHANGE_HERE << ; Overwritten BIOS instructions below (if any) - nop + int 0x20 ; DOS interrupt to exit process nop' dir="auto">diff --git a/dbg.asm b/dbg.asm
index caedb70..b042d35 100644
--- a/dbg.asm
+++ b/dbg.asm
@@ -21,7 +21,10 @@
; SOFTWARE.

[BITS 16]
-[ORG 0x0000] ; >> CHANGE_HERE <<
+[ORG 0x100]
+
+times 40*1024 db 0x90 ; keep some distance,
+ ; 40kB should be enough

%include "constants.inc"

@@ -140,7 +143,7 @@ _start:

; >> CHANGE_HERE <<
; Overwritten BIOS instructions below (if any)
- nop
+ int 0x20 ; DOS interrupt to exit process
nop 2. Create a minimal bootable DOS environment and run Create a bootable FreeDOS (or DOS) floppy image containing just the kernel and the terminal: KERNEL.SYS and COMMAND.COM. Also add to this floppy image the program to be debugged and the DBG.COM (dbg.bin). The following steps should be taken after creating the image: Boot it with bridge already opened (refer to the next section for instructions). Execute DBG.COM. Once execution stops, use GDB to add any desired breakpoints and watchpoints relative to the next process you want to debug. Then, allow the DBG.COM process to continue until it finishes. Run the process that you want to debug. The previously-configured breakpoints and watchpoints should trigger as expected. It is important to note that DOS does not erase the process image after it exits. As a result, the debugger can be configured like any other DOS program and the appropriate breakpoints can be set. The beginning of the debugger is filled with NOPs, so it is anticipated that the new process will not overwrite the debugger's memory, allowing it to continue functioning even after it appears to be "finished". This allows BREaD to debug other programs, including DOS itself. Bridge Bridge is the glue between the debugger and GDB and can be used in different ways, whether on real hardware or virtual machine. Its parameters are: Usage: ./bridge [options]
Options:

-s Enable serial through socket, instead of device
-d Replaces the default device path (/dev/ttyUSB0)
(does not work if -s is enabled)
-p Serial port (as socket), default: 2345
-g GDB port, default: 1234
-h This help

If no options are passed the default behavior is:
./bridge -d /dev/ttyUSB0 -g 1234

Minimal recommended usages:
./bridge -s (socket mode, serial on 2345 and GDB on 1234)
./bridge (device mode, serial on /dev/ttyUSB0 and GDB on 1234)
Real hardware To use it on real hardware, just invoke it without parameters. Optionally, you can change the device path with the -d parameter: Execution flow: Connect serial cable to PC Run bridge (./bridge or ./bridge -d /path/to/device) Turn on the PC to be debugged Wait for the message: Single-stepped, you can now connect GDB! and then launch GDB: gdb. Virtual machine For use in a virtual machine, the execution order changes slightly: Execution flow: Run bridge (./bridge or ./bridge -d /path/to/device) Open the VM3 (https://github.com/Theldus/bread#user-content-fn-vm_note-39e484c63d9d86e3a2c6e6aff6905f63) (such as: make bochs or make qemu) Wait for the message: Single-stepped, you can now connect GDB! and then launch GDB: gdb. In both cases, be sure to run GDB inside the BRIDGE root folder, as there are auxiliary files in this folder for GDB to work properly in 16-bit. Contributing BREAD is always open to the community and willing to accept contributions, whether with issues, documentation, testing, new features, bugfixes, typos, and etc. Welcome aboard. License and Authors BREAD is licensed under MIT License. Written by Davidson Francis and (hopefully) other contributors (https://github.com/Theldus/bread/graphs/contributors). Footnotes Breakpoints are implemented as hardware breakpoints and therefore have a limited number of available breakpoints. In the current implementation, only 1 active breakpoint at a time! ↩ (https://github.com/Theldus/bread#user-content-fnref-bp_note-39e484c63d9d86e3a2c6e6aff6905f63) Hardware watchpoints (like breakpoints) are also only supported one at a time. ↩ (https://github.com/Theldus/bread#user-content-fnref-watchp_note-39e484c63d9d86e3a2c6e6aff6905f63) Please note that debug registers do not work by default on VMs. For bochs, it needs to be compiled with the --enable-x86-debugger=yes flag. For Qemu, it needs to run with KVM enabled: --enable-kvm (make qemu already does this). ↩ (https://github.com/Theldus/bread#user-content-fnref-vm_note-39e484c63d9d86e3a2c6e6aff6905f63)

Download Bread (https://github.com/Theldus/bread)

Hacking Microsoft IIS : Enumerating IIS for V

IIS EnumerationContinue reading on Medium »
Read more...

23.5 Lab: User ID controlled by request parameter with password disclosure | 2023

This lab has user account page that contains the current user’s existing password, prefilled in a masked input. To solve the lab, retrieve…Continue reading on Medium »
Read more...