Feel free to test the tool on the following websites as a part of demonstration:
https://msrkp.github.io/pp/2.html
https://ctf.nikitastupin.com/pp/known.html
Workflow
Identify if the website is vulnerable (https://www.kitploit.com/search/label/Vulnerable) to Prototype Pollution by heuristic scan Fingerprint the known gadgets (checks for specific variables in the global context) Display the final exploit & ready to perform XSS
Credits
Many thanks to @Tomnomnom for the inspiration: https://www.youtube.com/watch?v=Gv1nK6Wj8qM&t=1558s
The workflow of this program is hugely based on this article: https://infosecwriteups.com/javascript-prototype-pollution-practice-of-finding-and-exploitation-f97284333b2
The fingerprint (https://www.kitploit.com/search/label/Fingerprint) javascript file is based on this git: https://gist.github.com/nikitastupin/b3b64a9f8c0eb74ce37626860193eaec

Download Ppmap (https://github.com/kleiton0x00/ppmap)

___________________________
@hacking_Attack
@Hacking_Video

Ppmap - A Scanner/Exploitation Tool Written In GO, Which Leverages Prototype Pollution To XSS By Exploiting Known Gadgets

A simple scanner/exploitation tool written in GO which automatically exploits known and existing gadgets (checks for specific variables in the global context) to perform XSS via Prototype Pollution. NOTE: The program only exploits known gadgets, but does not cover code analysis or any advanced Prototype Pollution exploitation, which may include custom gadgets.Requirements Make sure to have chromedp installed: go get -u github.com/chromedp/chromedp Installation Automatically Download the already compiled binary here Give it the permission to execute chmod +x ppmap Manually (compile it yourself) Clone the project: git clone https://github.com/kleiton0x00/ppmap.git Change directory to ppmap folder: cd ~/ppmap Build the binary go build ppmap.go Usage Using the program is very simple, you can either: scan a directory/file (or even just the website): echo 'https://target.com/index.html' | ./ppmap or endpoint: echo 'http://target.com/something/?page=home' | ./ppmap For mass scanning: cat url.txt | ./ppmap where url.txt contains all url(s) in column. Demo Feel free to test the tool on the following websites as a part of demonstration: https://msrkp.github.io/pp/2.html https://ctf.nikitastupin.com/pp/known.html Workflow Identify if the website is vulnerable to Prototype Pollution by heuristic scan Fingerprint the known gadgets (checks for specific variables in the global context) Display the final exploit & ready to perform XSS Credits Many thanks to @Tomnomnom for the inspiration: https://www.youtube.com/watch?v=Gv1nK6Wj8qM&t=1558s The workflow of this program is hugely based on this article: https://infosecwriteups.com/javascript-prototype-pollution-practice-of-finding-and-exploitation-f97284333b2 The fingerprint javascript file is based on this git: https://gist.github.com/nikitastupin/b3b64a9f8c0eb74ce37626860193eaec Download Ppmap
Read more...

___________________________
@hacking_Attack
@Hacking_Video

adalanche: Active Directory ACL Visualizer
https://www.reddit.com/r/redteamsec/comments/orc571/adalanche_active_directory_acl_visualizer/

I thought I'd just share my tool "adalanche", which is a graph theory Active Directory ACL visualizer. It shares some of the functionality you get with other tools, but focuses only on things within the AD for now. It has no prerequisites - it's just a single binary and it's available for Windows, Linux and OS/X. On a domain joined Windows machine you just run it, and everything else should sort it self automatically. ​ https://preview.redd.it/5mry4gib8dd71.png?width=2056&format=png&auto=webp&s=5320cf1e26f46c7d63d81ac44c3020e40c3fa808 It works by dumping the relevant information into a highly compressed file, which it then loads into memory and presents to the user for analysis via the web browser. It uses regular LDAP queries, so you don't need to be an graphql wizard to use it. I have used it for several engagements with customers, and there has been "aha moments" for most admins when I've shown the results (I'm blue team, but this is just as relevant as BloodHound from a red team perspective). https://github.com/lkarlslund/adalanche There's more information in the readme file, and I suggest you either download the code and compile it yourself, or grab the lastest binaries from the "actions" tab (latest is https://github.com/lkarlslund/adalanche/actions/runs/1048619359#artifacts) Feedback is welcome :-) submitted by /u/lkarlslund (https://www.reddit.com/user/lkarlslund)
[link] (https://www.reddit.com/r/redteamsec/comments/orc571/adalanche_active_directory_acl_visualizer/) [comments] (https://www.reddit.com/r/redteamsec/comments/orc571/adalanche_active_directory_acl_visualizer/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is there a way to delete a subreddit if you are not the owner?

Sorry if this is the wrong place to ask but there is this one subreddit you have probably heard of lately (I'm still not gonna mention the name), anyway they are destroying lives at this point.

They have been sending death threats to innocent people for over a year now and some people are actually scared for their lives. They are by far the most evil and toxic place on Reddit and they need to be stopped. Most people on that sub are retarded idiots with no lives and I am so fucking sick of it at this point.

And please don't talk to me about freedom of speech because that is not it, death threats and constant insults are not freedom of speech.

submitted by /u/uncle__fester
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Network Tracking using Wireshark and Google Maps

https://external-preview.redd.it/ye4UqtaM6Gr1qiyuNmko3MUjkuB5HcHvdoNqbeaBH0E.jpg?width=320&crop=smart&auto=webp&s=8af92600d8101a9b06fbe32c747097a1ecdd2cf0 submitted by /u/EssayPuzzle
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Orbitaldump : A Simple Multi-Threaded Distributed SSH Brute-Forcing Tool Written In Python

Orbitaldump is a simple multi-threaded distributed SSH brute-forcing tool written in Python. When the script is executed without the --proxies switch, it acts just like any other multi-threaded SSH brute-forcing scripts. When the --proxies switch is added, the script pulls a list (usually thousands) of SOCKS4 proxies from ProxyScrape and launch all brute-force attacks over the SOCKS4 proxies so brute-force attempts […]

The post Orbitaldump : A Simple Multi-Threaded Distributed SSH Brute-Forcing Tool Written In Python appeared first on Kali Linux Tutorials.

Bypassing OTP Verification for Changing PIN in Registered Mobile Banking Account.
https://medium.com/@yoshimlutfi/bypassing-otp-verification-for-changing-pin-in-registered-mobile-banking-account-ed92dbcaa5c7?source=rss------bug_bounty-5

Assalamu’alaikum (Peace be upon you)Continue reading on Medium » (https://medium.com/@yoshimlutfi/bypassing-otp-verification-for-changing-pin-in-registered-mobile-banking-account-ed92dbcaa5c7?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

How I found a bug in Apple within just in 5min.
https://medium.com/@noneofyou/how-i-found-a-bug-in-apple-within-just-in-5min-d7357237d7a0?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Summary: I discovered a reflected cross site scripting bug in one of acquisition site of apple which is Filemaker.comContinue reading on Medium » (https://medium.com/@noneofyou/how-i-found-a-bug-in-apple-within-just-in-5min-d7357237d7a0?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Bypassing OTP Verification for Changing PIN in Registered Mobile Banking Account.

Assalamu’alaikum (Peace be upon you)Continue reading on Medium »
Read more...

How I found a bug in Apple within just in 5min.

Summary: I discovered a reflected cross site scripting bug in one of acquisition site of apple which is Filemaker.comContinue reading on Medium »
Read more...

Hacking on Medium
My First AI Hackathon

https://cdn-images-1.medium.com/max/1199/1*XrrIZxQen8fgUrJNnTApew.jpeg
Everything I learnt and how you can ace your first hackathon as well

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Wireshark 101 Walkthrough (Tryhackme)

https://cdn-images-1.medium.com/max/1920/1*rQQwNW3gzL_olcN0Rufi2Q.png
Q1 )What is the Opcode for Packet 6?

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video