XM Goat (https://www.kitploit.com/search/label/Goat) is composed of XM Cyber (https://www.kitploit.com/search/label/Cyber) terraform (https://www.kitploit.com/search/label/Terraform) templates that help you learn about common Azure (https://www.kitploit.com/search/label/Azure) security issues. Each template is a vulnerable (https://www.kitploit.com/search/label/Vulnerable) environment, with some significant misconfigurations. Your job is to attack and compromise the environments. Here's what to do for each environment: Run installation and then get started. With the initial user and service principal credentials, attack the environment based on the scenario flow (for example, XMGoat/scenarios/scenario_1/scenario1_flow.png). If you need help with your attack, refer to the solution (for example, XMGoat/scenarios/scenario_1/solution.md). When you're done learning the attack, clean up.
Requirements Azure tenant Terafform version 1.0.9 or above Azure CLI Azure User with Owner permissions on Subscription and Global Admin privileges in AAD Installation Run these commands: $ az login
$ git clone https://github.com/XMCyber/XMGoat.git
$ cd XMGoat
$ cd scenarios
$ cd scenario_<\SCENARIO>
Where <\SCENARIO> is the scenario number you want to complete $ terraform init
$ terraform plan -out <\FILENAME>
$ terraform apply <\FILENAME>
Where <\FILENAME> is the name of the output file Get started To get the initial user and service principal credentials, run the following query: $ terraform output --json
For Service Principals, use application_id.value and application_secret.value. For Users, use username.value and password.value. Cleaning up After completing the scenario, run the following command in order to clean all the resources created in your tenant $ az login
$ cd XMGoat
$ cd scenarios
$ cd scenario_<\SCENARIO>
Where <\SCENARIO> is the scenario number you want to complete $ terraform destroy


Download XMGoat (https://github.com/XMCyber/XMGoat)

How I found a .env file and can access the whole server of mysql
https://medium.com/@jeetpal2007/how-i-found-a-env-file-and-can-access-the-whole-server-of-mysql-a21af69cbd12?source=rss------bug_bounty-5

HelloContinue reading on Medium » (https://medium.com/@jeetpal2007/how-i-found-a-env-file-and-can-access-the-whole-server-of-mysql-a21af69cbd12?source=rss------bug_bounty-5)

How I found a .env file and can access the whole server of mysql

HelloContinue reading on Medium »
Read more...

Lifetime ETW Patch & Amsi (Using PS1Profiles)
https://www.reddit.com/r/redteamsec/comments/1dlvvg1/lifetime_etw_patch_amsi_using_ps1profiles/

submitted by /u/Temporary_Hope_7198 (https://www.reddit.com/user/Temporary_Hope_7198)
[link] (https://github.com/EvilBytecode/Lifetime-Amsi-EtwPatch) [comments] (https://www.reddit.com/r/redteamsec/comments/1dlvvg1/lifetime_etw_patch_amsi_using_ps1profiles/)

13.28 Lab: Reflected XSS into a template literal with angle brackets, single, double quotes…
https://cyberw1ng.medium.com/13-28-lab-reflected-xss-into-a-template-literal-with-angle-brackets-single-double-quotes-45602869f45f?source=rss------bug_bounty-5

This lab contains a reflected cross-site scripting vulnerability in the search blog functionality. The reflection occurs inside a template…Continue reading on Medium » (https://cyberw1ng.medium.com/13-28-lab-reflected-xss-into-a-template-literal-with-angle-brackets-single-double-quotes-45602869f45f?source=rss------bug_bounty-5)

13.28 Lab: Reflected XSS into a template literal with angle brackets, single, double quotes…

This lab contains a reflected cross-site scripting vulnerability in the search blog functionality. The reflection occurs inside a template…Continue reading on Medium »
Read more...

CVE-2024–28999 SolarWinds Race Condition

Vulnerability Details:Continue reading on Medium »
Read more...

CVE-2024–28999 SolarWinds Race Condition
https://medium.com/@0xSphinx/cve-2024-28999-solarwinds-race-condition-62e175339b46?source=rss------bug_bounty-5

Vulnerability Details:Continue reading on Medium » (https://medium.com/@0xSphinx/cve-2024-28999-solarwinds-race-condition-62e175339b46?source=rss------bug_bounty-5)

Found Bugs, Got paid, Stayed poor: Making a Living with Bug Bounties
https://slava-moskvin.medium.com/found-bugs-got-paid-stayed-poor-making-a-living-with-bug-bounties-04ba1fbbab73?source=rss------bug_bounty-5

Early 2021. After feeling unsatisfied with my job for quite some time and battling burnout, I decided to take a sabbatical. “To hell with…Continue reading on Medium » (https://slava-moskvin.medium.com/found-bugs-got-paid-stayed-poor-making-a-living-with-bug-bounties-04ba1fbbab73?source=rss------bug_bounty-5)

Found Bugs, Got paid, Stayed poor: Making a Living with Bug Bounties

Early 2021. After feeling unsatisfied with my job for quite some time and battling burnout, I decided to take a sabbatical. “To hell with…Continue reading on Medium »
Read more...

Javascript cookie exfiltration problem
https://www.reddit.com/r/Pentesting/comments/1dlvc1l/javascript_cookie_exfiltration_problem/

<!-- SC_OFF -->Hello everyone, hope you're fine. I was doing a hacking challenge online on root-me which meant to exploit a calculator using eval. I wanted to display the cookie. Knowing that my input would be given as argument to the function eval() I entered the following : 1+1+alert `${document.cookie}` which was interpreted as eval(1+1+alert `${document.cookie}`) Is there something special associated with `${}`, i used this format because the following characters were banned in the input : "(" , ")" , "<" , ">" and I don't know why instead of displaying the cookie it displayed me "," in the alert box. I solved the challenge, i want to know why it displayed a comma instead of the cookie. <!-- SC_ON --> submitted by /u/aes256bits (https://www.reddit.com/user/aes256bits)
[link] (https://www.reddit.com/r/Pentesting/comments/1dlvc1l/javascript_cookie_exfiltration_problem/) [comments] (https://www.reddit.com/r/Pentesting/comments/1dlvc1l/javascript_cookie_exfiltration_problem/)

How i got easy multiple RXSS

السلام عليكمContinue reading on Medium »
Read more...

How i got easy multiple RXSS
https://medium.com/@0xmekky/how-i-got-easy-multiple-rxss-dd3a6bc521dd?source=rss------bug_bounty-5