Loader shellcode that executes an ELF in-memory using an anonymous file descriptor
https://www.reddit.com/r/redteamsec/comments/pmoseh/loader_shellcode_that_executes_an_elf_inmemory/
submitted by /u/0xDangerous_bit (https://www.reddit.com/user/0xDangerous_bit)
[link] (https://gist.github.com/zznop/0117c24164ee715e750150633c7c1782) [comments] (https://www.reddit.com/r/redteamsec/comments/pmoseh/loader_shellcode_that_executes_an_elf_inmemory/)
https://www.reddit.com/r/redteamsec/comments/pmoseh/loader_shellcode_that_executes_an_elf_inmemory/
submitted by /u/0xDangerous_bit (https://www.reddit.com/user/0xDangerous_bit)
[link] (https://gist.github.com/zznop/0117c24164ee715e750150633c7c1782) [comments] (https://www.reddit.com/r/redteamsec/comments/pmoseh/loader_shellcode_that_executes_an_elf_inmemory/)
How I Found 7 XSS Vulnerabilities in Filename Reflecting
https://alimanshester.medium.com/how-i-found-7-xss-vulnerabilities-in-filename-reflecting-6347279ee82a?source=rss------bug_bounty-5
https://alimanshester.medium.com/how-i-found-7-xss-vulnerabilities-in-filename-reflecting-6347279ee82a?source=rss------bug_bounty-5
in one of HackerOne public programsContinue reading on Medium » (https://alimanshester.medium.com/how-i-found-7-xss-vulnerabilities-in-filename-reflecting-6347279ee82a?source=rss------bug_bounty-5)
hacking: security in practice
Does Kali run on Docker well? What are the drawbacks?
I’ve read that Docker is less resource intensive and that there are Kali images for it, but some old sources mentioned it lacking full functionality.
I have a weak computer and don’t like waiting on VMware, so I’m considering this as an alternative.
submitted by /u/pass-the-word
[link] [comments]
Does Kali run on Docker well? What are the drawbacks?
I’ve read that Docker is less resource intensive and that there are Kali images for it, but some old sources mentioned it lacking full functionality.
I have a weak computer and don’t like waiting on VMware, so I’m considering this as an alternative.
submitted by /u/pass-the-word
[link] [comments]
reddit
Does Kali run on Docker well? What are the drawbacks?
I’ve read that Docker is less resource intensive and that there are Kali images for it, but some old sources mentioned it lacking full...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
source
photo
RickdiouslyEasy Walkthrough
As my first VlunHub lab practice, I had chosen this machine and got the root. Here is my walkthrough and experience. Please go through this and help me become better. I would really appreciate some constructive criticism.
https://medium.com/@sarangiprateek80/rickdiouslyeasy-walkthrough-36b3b905c500
submitted by /u/psarangi112
[link] [comments]
source
photo
RickdiouslyEasy Walkthrough
As my first VlunHub lab practice, I had chosen this machine and got the root. Here is my walkthrough and experience. Please go through this and help me become better. I would really appreciate some constructive criticism.
https://medium.com/@sarangiprateek80/rickdiouslyeasy-walkthrough-36b3b905c500
submitted by /u/psarangi112
[link] [comments]
How I Found 7 XSS Vulnerabilities in Filename Reflecting
in one of HackerOne public programsContinue reading on Medium »
Read more...
in one of HackerOne public programsContinue reading on Medium »
Read more...
Exposing Millions of IRCTC Passengers' ticket details.
https://renganathanofficial.medium.com/exposing-millions-of-irctc-passengers-ticket-details-53338280fb9e?source=rss------bug_bounty-5
https://renganathanofficial.medium.com/exposing-millions-of-irctc-passengers-ticket-details-53338280fb9e?source=rss------bug_bounty-5
Hi There,Continue reading on Medium » (https://renganathanofficial.medium.com/exposing-millions-of-irctc-passengers-ticket-details-53338280fb9e?source=rss------bug_bounty-5)
Deep Web
[HELP] payment still waiting ????
i used bitcoin to buy something and it’s still on waiting payment ?
submitted by /u/OTX4life
[link] [comments]
[HELP] payment still waiting ????
i used bitcoin to buy something and it’s still on waiting payment ?
submitted by /u/OTX4life
[link] [comments]
reddit
[HELP] payment still waiting ????
i used bitcoin to buy something and it’s still on waiting payment ?
Exposing Millions of IRCTC Passengers' ticket details.
Hi There,Continue reading on InfoSec Write-ups »
Read more...
Hi There,Continue reading on InfoSec Write-ups »
Read more...
ODBParser - OSINT Tool To Search, Parse And Dump Only The Open Elasticsearch And MongoDB Directories That Have The Data You Care About Exposing
http://www.kitploit.com/2021/09/odbparser-osint-tool-to-search-parse.html
___________________________
@hacking_Attack
@Hacking_Video
http://www.kitploit.com/2021/09/odbparser-osint-tool-to-search-parse.html
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
ODBParser - OSINT Tool To Search, Parse And Dump Only The Open Elasticsearch And MongoDB Directories That Have The Data You Care…
Customization
See the odbconfig.py file to specify your parameters, because really name of the game is exposing (https://www.kitploit.com/search/label/Exposing) the data YOU are interested in. I provided some examples in the config file. Play around with them! You can: specify what index or collection names you want to collect by specifying substrings in config file. For example, if have the term "client", script will pull index called "clients" or "client_data." I recommend you keep these lists blank as you never know what databases you care about will be called and instead specify the fields you care about. specify what fields you care about: if you only want to grab ES indices that have "email" in a field name, e.g."user_emails", you can do that. If you want to make sure the index has at least 2 fields you care about, you can do that too. Or if you just want to grab everything no matter what fields are in there, you can do that too. specify what indices you DON'T want e.g., system index names and others that are generally used for basic logging. Examples provided in config file. override config and grab everything on a server specify output (default is JSON, can choose CSV) set minimum and maximum size database script will dump by default and you can set flag to override (https://www.kitploit.com/search/label/OverRide) max docs on case by case basis.
Installation and Requirements
Clone or download to machine Get API keys for Shodan and/or BinaryEdge configure parameters in ODBconfig.py file install requirements (https://www.kitploit.com/search/label/Requirements) from file I suggest creating virtual environment for ODBParser so have no issues with incorrect module versions. Note: Tested ONLY on Python 3.7.3 and on Windows 10. PLEASE USE RESPONSIBLY
Next Steps and Known Issues
clean up code a bit more multithread various processes. expand to other db types add other open directory search engines (Zoomeye, etc.) unable to scroll past first page for certain ES instances due to way ES Pretty sure fixed this. Open issue if get scrollid errors
Usage
Examples: python ODBParser.py -cn US -p 8080 -t users --elastic --shodan --csv --limit 100
python ODBParser.py -ip 192.168.2:8080 --mongo --ignorelogs --nosizelimits
Damage to-date: 0 servers parsed | 0 databases dumped | 0 records pulled
_____________________________________________________________________________
optional arguments:
-h, --help show this help message and exit
Query Options:
--shodan, -sh Add this flag if using Shodan. Specify ES or MDB w/
flags.
--binary, -be Add this flag if using BinaryEdge. Specify ES or MDB
w/ flags.
--ip , -ip Query one server. Add port like so '192.165.2.1:8080'
or will use default ports for each db type. Add ES or
MDB flags to specify parser.
--file , -f Load line-separated IPs from file. Add port or will
assume default ports for each db type. Add ES or MDB
flags to specify parser.
--paste, -v Query line-separated IPs from clipboard. Add port or
will assume default ports for each db type, e.g. 9200
for ES. Add ES or MDB flags to specify parser.
Shodan/BinaryEdge Options:
--limit , -l Max number of results per query. Default is
500.
--port , -p Filter by port.
--country , -cn Filter by country (two-letter country code).
--terms , -t Enter any additional query terms you want here, e.g.
'users'
Dump Options:
--mongo, -mdb Use for IP, Shodan, BinaryEdge & Paste methods to
specify parser.
--elastic, -es Use for IP, Shodan, BinaryEdge & Paste me thods to
___________________________
@hacking_Attack
@Hacking_Video
See the odbconfig.py file to specify your parameters, because really name of the game is exposing (https://www.kitploit.com/search/label/Exposing) the data YOU are interested in. I provided some examples in the config file. Play around with them! You can: specify what index or collection names you want to collect by specifying substrings in config file. For example, if have the term "client", script will pull index called "clients" or "client_data." I recommend you keep these lists blank as you never know what databases you care about will be called and instead specify the fields you care about. specify what fields you care about: if you only want to grab ES indices that have "email" in a field name, e.g."user_emails", you can do that. If you want to make sure the index has at least 2 fields you care about, you can do that too. Or if you just want to grab everything no matter what fields are in there, you can do that too. specify what indices you DON'T want e.g., system index names and others that are generally used for basic logging. Examples provided in config file. override config and grab everything on a server specify output (default is JSON, can choose CSV) set minimum and maximum size database script will dump by default and you can set flag to override (https://www.kitploit.com/search/label/OverRide) max docs on case by case basis.
Installation and Requirements
Clone or download to machine Get API keys for Shodan and/or BinaryEdge configure parameters in ODBconfig.py file install requirements (https://www.kitploit.com/search/label/Requirements) from file I suggest creating virtual environment for ODBParser so have no issues with incorrect module versions. Note: Tested ONLY on Python 3.7.3 and on Windows 10. PLEASE USE RESPONSIBLY
Next Steps and Known Issues
clean up code a bit more multithread various processes. expand to other db types add other open directory search engines (Zoomeye, etc.) unable to scroll past first page for certain ES instances due to way ES Pretty sure fixed this. Open issue if get scrollid errors
Usage
Examples: python ODBParser.py -cn US -p 8080 -t users --elastic --shodan --csv --limit 100
python ODBParser.py -ip 192.168.2:8080 --mongo --ignorelogs --nosizelimits
Damage to-date: 0 servers parsed | 0 databases dumped | 0 records pulled
_____________________________________________________________________________
optional arguments:
-h, --help show this help message and exit
Query Options:
--shodan, -sh Add this flag if using Shodan. Specify ES or MDB w/
flags.
--binary, -be Add this flag if using BinaryEdge. Specify ES or MDB
w/ flags.
--ip , -ip Query one server. Add port like so '192.165.2.1:8080'
or will use default ports for each db type. Add ES or
MDB flags to specify parser.
--file , -f Load line-separated IPs from file. Add port or will
assume default ports for each db type. Add ES or MDB
flags to specify parser.
--paste, -v Query line-separated IPs from clipboard. Add port or
will assume default ports for each db type, e.g. 9200
for ES. Add ES or MDB flags to specify parser.
Shodan/BinaryEdge Options:
--limit , -l Max number of results per query. Default is
500.
--port , -p Filter by port.
--country , -cn Filter by country (two-letter country code).
--terms , -t Enter any additional query terms you want here, e.g.
'users'
Dump Options:
--mongo, -mdb Use for IP, Shodan, BinaryEdge & Paste methods to
specify parser.
--elastic, -es Use for IP, Shodan, BinaryEdge & Paste me thods to
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.
specify parser.
--properjson, -pj Add this flag if would like out put to be proper JSON
file. Default is one JSON string object per line.
--database , -db Specify database you want to grab. For MDB must be in
format format 'db:collection'. Use with IP arg & 'es'
or 'mdb' flag
--getall, -g Get all indices regardless of fields and
collection/index names (overrides selections in config
file).
--ignorelogs Connect to a server you've already checked out.
--nosizelimits, -n Dump index no matter how big it is. Default max doc
count is 800,000.
--csv Convert JSON dumps into CSV format on the fly. (Puts
JSON files in backup folder in case there is issue
with coversion)
CSV/Post-processing Options:
--convertToCSV , -c Convert JSON file or folder of JSON dumps to CSVs
after the fact. Enter full path or folder name in
current working directory
--dontflatten Use if run into memory issues converting JSON files to
CSV during post-processing.
--basic Use with --convertToCSV flag if your JSON dumps are
not true JSON files, but rather line separated JSON
objects that you got from other sources.
--dontclean, -dc Choose if want to keep useless data when convert to
CSV. See docs for more info.
Download ODBParser (https://github.com/citcheese/ODBParser)
___________________________
@hacking_Attack
@Hacking_Video
--properjson, -pj Add this flag if would like out put to be proper JSON
file. Default is one JSON string object per line.
--database , -db Specify database you want to grab. For MDB must be in
format format 'db:collection'. Use with IP arg & 'es'
or 'mdb' flag
--getall, -g Get all indices regardless of fields and
collection/index names (overrides selections in config
file).
--ignorelogs Connect to a server you've already checked out.
--nosizelimits, -n Dump index no matter how big it is. Default max doc
count is 800,000.
--csv Convert JSON dumps into CSV format on the fly. (Puts
JSON files in backup folder in case there is issue
with coversion)
CSV/Post-processing Options:
--convertToCSV , -c Convert JSON file or folder of JSON dumps to CSVs
after the fact. Enter full path or folder name in
current working directory
--dontflatten Use if run into memory issues converting JSON files to
CSV during post-processing.
--basic Use with --convertToCSV flag if your JSON dumps are
not true JSON files, but rather line separated JSON
objects that you got from other sources.
--dontclean, -dc Choose if want to keep useless data when convert to
CSV. See docs for more info.
Download ODBParser (https://github.com/citcheese/ODBParser)
___________________________
@hacking_Attack
@Hacking_Video
GitHub
GitHub - citcheese/ODBParser: OSINT tool to search, parse and dump only the open Elasticsearch and MongoDB directories that have…
OSINT tool to search, parse and dump only the open Elasticsearch and MongoDB directories that have the data you care about exposing - citcheese/ODBParser