Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials pFuzz : Helps Us To Bypass Web Application Firewall By Using Different Methods At The Same Time pFuzz is an advanced red teaming fuzzing tool which we developed for our research. It helps us to bypass web application firewall by using…
.txt -f -fe
Set multi-threads
python3 pfuzz.py -r request.txt -f -t 5
Output to the terminal
python3 pfuzz.py -r request.txt -f -o terminal
python3 pfuzz.py -r request.txt -f -od terminal
Output to a file
python3 pfuzz.py -r request.txt -f -o ~/Desktop/
python3 pfuzz.py -r request.txt -f -od ~/tmp/
Help
usage: pfuzz.py [-h] [–request REQUEST] [–proxy PROXY] [–log] [–ssl]
[–threads THREADS] [–output OUTPUT] [–delay TIME]
[–output-details OUTPUT] [–full-encode] [–encode]
[–fuzz] [–charfuzz] [–manipulate] [–version]
optional arguments:
–help/-h show this help message and exit
–proxy/-p PROXY proxy [IP:PORT]
–log/-l enable logging
–ssl/-s enable ssl
–threads/-t NUMBER thread(s) number [default=1]
–version/-v show program’s version number and exit
[Request Options]:
–request/-r REQUEST request file
–delay/-d TIME set a delay between requests [default=0.05]
–encode/-e encode space chars in uri/body
–full-encode/-fe encode all chars in uri/body
[Output Options]:
–output/-o OUTPUT output important info [terminal/folder name]
–output-details/-od OUTPUT
output all details [terminal/folder name]
[Modules]:
–fuzz/-f run fuzzing module
–charfuzz/-cf run char fuzzing module
–manipulate/-m run manipulating headers module
Usage: python3 pfuzz.py -r req.txt –log -s –fuzz -d 1 –encode -o terminal –threads 2
Usage: python3 pfuzz.py -r req.txt -f -l –proxy 127.0.0.1:8080 –output-details ~/output
Extras
How to Develop a New Module
* A python file that specifies the name of the module should be created inside modules/ folder.
* modules
* – charfuzzer.py
* – exparse.py
* – fuzzer.py
* – headeroperations.py
* – manupilatingheaders.py
*
You can use the parsed object like myreq = HTTPReq.getobj()
from reqparser import HTTPReq
myreq = HTTPReq.getobj()
It has many attributes derivated from HTTPReq class. You can them it in reqparser.py.
…
myreq.uri
myreq.body
myreq.http
myreq.referer
myreq.origin
myreq.host
myreq.cookie
…
If you want to get your payloads from the excel, you can use getpayloads methods coming from modules.exparse.
* getpayloads(fuzzsheetName, genericcolmnName, fuzzingpayloads)
from modules.exparse import getpayloads
getpayloads(fuzzsheetName, genericcolmnName, fuzzingpayloads)
We set statics-objects like fuzzsheetName in statics.py that is under static/ folder.
#Fuzzing Module in static/statics.py
fuzzsheetName = ‘Fuzzing’
genericcolmnName = ‘Payload’
fuzzingpayloads = []
Now, you can change/add/delete attributes whatever you want.
myreq.uri = tmpuri + payload
myreq.addheader(header, “127.0.0.1”)
myreq.content_type = “text/html”
To stop multi-threading, you should add #exitme# payload to the end of your payloads and set statics.exitCall = True to check whether queue is empty or not.
from modules.exparse import getpayloads
for payload in fuzzingpayloads:
if payload == ‘#exitme#’:
statics.exitCall = True
else:
[OPERATIONS]
When your object(request) is ready to be sent, you can use sendit() function to queue it.
from reqsender import sendit
sendit(myreq)
If you need to change core functions in pFuzz, you can start a pull request or open an issue. Some Important Functions to Develop New ModulesAimModule/ClassFunctionParameter(s)To send a requestreqsender.py sendit()objectTo use a request objectreqparser.py/HTTPReq getobj() –To add a custom headerreqparser.py/HTTPReq OBJECT.addheader() newHeadername,valueTo delete a headerreqparser.py/HTTPReq OBJECT.delheader() headerNameTo change a headerreqparser.py/HTTPReq OBJECT.changeheader()headerName,newHeaderNameTo get a payload from the fileexparse.py getpayloads() sheetName,columnNameTo write a log info/debug/warningwaflogger.py loginfo/logdebug/logwarn() logMessage Download
___________________________
@hacking_Attack
@Hacking_Video
Set multi-threads
python3 pfuzz.py -r request.txt -f -t 5
Output to the terminal
python3 pfuzz.py -r request.txt -f -o terminal
python3 pfuzz.py -r request.txt -f -od terminal
Output to a file
python3 pfuzz.py -r request.txt -f -o ~/Desktop/
python3 pfuzz.py -r request.txt -f -od ~/tmp/
Help
usage: pfuzz.py [-h] [–request REQUEST] [–proxy PROXY] [–log] [–ssl]
[–threads THREADS] [–output OUTPUT] [–delay TIME]
[–output-details OUTPUT] [–full-encode] [–encode]
[–fuzz] [–charfuzz] [–manipulate] [–version]
optional arguments:
–help/-h show this help message and exit
–proxy/-p PROXY proxy [IP:PORT]
–log/-l enable logging
–ssl/-s enable ssl
–threads/-t NUMBER thread(s) number [default=1]
–version/-v show program’s version number and exit
[Request Options]:
–request/-r REQUEST request file
–delay/-d TIME set a delay between requests [default=0.05]
–encode/-e encode space chars in uri/body
–full-encode/-fe encode all chars in uri/body
[Output Options]:
–output/-o OUTPUT output important info [terminal/folder name]
–output-details/-od OUTPUT
output all details [terminal/folder name]
[Modules]:
–fuzz/-f run fuzzing module
–charfuzz/-cf run char fuzzing module
–manipulate/-m run manipulating headers module
Usage: python3 pfuzz.py -r req.txt –log -s –fuzz -d 1 –encode -o terminal –threads 2
Usage: python3 pfuzz.py -r req.txt -f -l –proxy 127.0.0.1:8080 –output-details ~/output
Extras
How to Develop a New Module
* A python file that specifies the name of the module should be created inside modules/ folder.
* modules
* – charfuzzer.py
* – exparse.py
* – fuzzer.py
* – headeroperations.py
* – manupilatingheaders.py
*
You can use the parsed object like myreq = HTTPReq.getobj()
from reqparser import HTTPReq
myreq = HTTPReq.getobj()
It has many attributes derivated from HTTPReq class. You can them it in reqparser.py.
…
myreq.uri
myreq.body
myreq.http
myreq.referer
myreq.origin
myreq.host
myreq.cookie
…
If you want to get your payloads from the excel, you can use getpayloads methods coming from modules.exparse.
* getpayloads(fuzzsheetName, genericcolmnName, fuzzingpayloads)
from modules.exparse import getpayloads
getpayloads(fuzzsheetName, genericcolmnName, fuzzingpayloads)
We set statics-objects like fuzzsheetName in statics.py that is under static/ folder.
#Fuzzing Module in static/statics.py
fuzzsheetName = ‘Fuzzing’
genericcolmnName = ‘Payload’
fuzzingpayloads = []
Now, you can change/add/delete attributes whatever you want.
myreq.uri = tmpuri + payload
myreq.addheader(header, “127.0.0.1”)
myreq.content_type = “text/html”
To stop multi-threading, you should add #exitme# payload to the end of your payloads and set statics.exitCall = True to check whether queue is empty or not.
from modules.exparse import getpayloads
for payload in fuzzingpayloads:
if payload == ‘#exitme#’:
statics.exitCall = True
else:
[OPERATIONS]
When your object(request) is ready to be sent, you can use sendit() function to queue it.
from reqsender import sendit
sendit(myreq)
If you need to change core functions in pFuzz, you can start a pull request or open an issue. Some Important Functions to Develop New ModulesAimModule/ClassFunctionParameter(s)To send a requestreqsender.py sendit()objectTo use a request objectreqparser.py/HTTPReq getobj() –To add a custom headerreqparser.py/HTTPReq OBJECT.addheader() newHeadername,valueTo delete a headerreqparser.py/HTTPReq OBJECT.delheader() headerNameTo change a headerreqparser.py/HTTPReq OBJECT.changeheader()headerName,newHeaderNameTo get a payload from the fileexparse.py getpayloads() sheetName,columnNameTo write a log info/debug/warningwaflogger.py loginfo/logdebug/logwarn() logMessage Download
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Scrummage : The Ultimate OSINT And Threat Hunting Framework
Scrummage is an OSINT tool that centralises search functionality from powerful, yet simple OSINT sites. This project draws inspiration mainly from two other projects, including:
* The Scumblr project, which while is now deprecated, inspired this concept.
* The OSINT Framework project, which is a visualisation tool, depicting a range of sites that can be used to search for a variety of things.
While at first glance the web application may not look all that different when compared to Scumblr, the copious amounts of plugins this tool comes with is mainly what makes this project unique, where the provided Python/Flask web application is just a simple, lightweight, and scalable way of providing users with the ability to manage large pools of results. The other main benefit this projects brags is a much simpler installation process, which is kept up to date, compared to Scumblr which is now deprecated.
Any feedback is welcome.
An Overview Of The Web Application Some of the Many Available Scrummage Plugins
* Blockchain Search
* Domain Fuzzer
* Twitter Scraper
* Instagram Search
* Have I Been Pwned Search
* Ahmia Darkweb Search
* IP Stack Search
* Threat Crowd Search
* Yandex and Naver Search
* Vkontakte Search
* Vulners Search
* Built With Search
* YouTube Search
* Many more… Refer to the wiki page here for the full list. Dashboard
The dashboard is the home screen which the application directs a user to when they log in. It provides a high-level chart which shows the amount of each results based on their result type. It does this for each kind of finding. However, if a graph doesn’t load, this is most likely due to none of the results being in that category, I.e if there are no closed results, no graph will appear under “Overview of Closed Results”.
https://blogger.googleusercontent.com/img/a/AVvXsEjWrCN43lQoVrg2IKACt5lqAnW-AviTUfwADtu3OHXkv6HtyxPufjdFmuZwMKTcwhMSwj1hjYybrx0GlTejHo_DGQPZGbTQQOkGnTLblylA7w3avGqAGMCg8VH7LP6DS4ZiUqUGAdXdO0MduPeAjozn_xxMMWG8y-fDoy1HVlgf7KuzxXHjr8Ia-MnN=s1920
Events
The events page shows anything that changes within the web application, from logins, to failed login attempts, to any actions performed against a task. This assists with understanding what has recently been happening in the web app, and can assist in matters such as detecting brute-force login attempts or tracking down who altered a task.
Note: This page only loads the latest 1000 events, for optimisation of the web application.
https://blogger.googleusercontent.com/img/a/AVvXsEjjHvaWIeCMERHhOSRrMbevmg1jy5OY8d6WdGP2LMFgLeHCeSm8df1fvCmIFX1DTH9fmSqlg9QaSF38PXOwEBZy3iUsbV6AhSFX4gBS_NinSj1C7QS0-DX1shJPgmhkECYEPte4_qYyXd-pLt4czdkj0-tdvVDi5eX73vU0XPm0fpDrgPBTwe3--A9t=s1918
Results
The results page, simply shows results that have been created by a task. The results table shows the basic metadata of the result, but also provides a “Details” button which can be used to investigate the result further. As mentioned all results have some kind of output file, if a result is a link the file will be a copy of the HTML of the page. Furthermore screenshot functionality is provided to assist in keeping a photographic record of a result. Both the output and screenshot file will be deleted if the result is deleted.
Note: This page only loads the latest 1000 results, for optimisation of the web application.
https://blogger.googleusercontent.com/img/a/AVvXsEhCP1R3QbQEvBfDT33_uHl_VBAXf83vpoEpyLJ3uyLbhcEHxwROloF0zyQ-6MmcaFvM838AQYffqVSnlB1egDRAQEgwp6Bwg11lNQaXjcL41gsci70ic2B517f6bVvjxBgPc48kS2Ur9fd8qGjZliW6weWiGmKqW0kL9Jt1Je0hdDthvyUQnxfGapWD=s1919
For optimisation purposes, the results table only displays some of the general information regarding a result, to investigate a result further, the user should use the Details button. The details page allows the use[...]
___________________________
@hacking_Attack
@Hacking_Video
Scrummage : The Ultimate OSINT And Threat Hunting Framework
Scrummage is an OSINT tool that centralises search functionality from powerful, yet simple OSINT sites. This project draws inspiration mainly from two other projects, including:
* The Scumblr project, which while is now deprecated, inspired this concept.
* The OSINT Framework project, which is a visualisation tool, depicting a range of sites that can be used to search for a variety of things.
While at first glance the web application may not look all that different when compared to Scumblr, the copious amounts of plugins this tool comes with is mainly what makes this project unique, where the provided Python/Flask web application is just a simple, lightweight, and scalable way of providing users with the ability to manage large pools of results. The other main benefit this projects brags is a much simpler installation process, which is kept up to date, compared to Scumblr which is now deprecated.
Any feedback is welcome.
An Overview Of The Web Application Some of the Many Available Scrummage Plugins
* Blockchain Search
* Domain Fuzzer
* Twitter Scraper
* Instagram Search
* Have I Been Pwned Search
* Ahmia Darkweb Search
* IP Stack Search
* Threat Crowd Search
* Yandex and Naver Search
* Vkontakte Search
* Vulners Search
* Built With Search
* YouTube Search
* Many more… Refer to the wiki page here for the full list. Dashboard
The dashboard is the home screen which the application directs a user to when they log in. It provides a high-level chart which shows the amount of each results based on their result type. It does this for each kind of finding. However, if a graph doesn’t load, this is most likely due to none of the results being in that category, I.e if there are no closed results, no graph will appear under “Overview of Closed Results”.
https://blogger.googleusercontent.com/img/a/AVvXsEjWrCN43lQoVrg2IKACt5lqAnW-AviTUfwADtu3OHXkv6HtyxPufjdFmuZwMKTcwhMSwj1hjYybrx0GlTejHo_DGQPZGbTQQOkGnTLblylA7w3avGqAGMCg8VH7LP6DS4ZiUqUGAdXdO0MduPeAjozn_xxMMWG8y-fDoy1HVlgf7KuzxXHjr8Ia-MnN=s1920
Events
The events page shows anything that changes within the web application, from logins, to failed login attempts, to any actions performed against a task. This assists with understanding what has recently been happening in the web app, and can assist in matters such as detecting brute-force login attempts or tracking down who altered a task.
Note: This page only loads the latest 1000 events, for optimisation of the web application.
https://blogger.googleusercontent.com/img/a/AVvXsEjjHvaWIeCMERHhOSRrMbevmg1jy5OY8d6WdGP2LMFgLeHCeSm8df1fvCmIFX1DTH9fmSqlg9QaSF38PXOwEBZy3iUsbV6AhSFX4gBS_NinSj1C7QS0-DX1shJPgmhkECYEPte4_qYyXd-pLt4czdkj0-tdvVDi5eX73vU0XPm0fpDrgPBTwe3--A9t=s1918
Results
The results page, simply shows results that have been created by a task. The results table shows the basic metadata of the result, but also provides a “Details” button which can be used to investigate the result further. As mentioned all results have some kind of output file, if a result is a link the file will be a copy of the HTML of the page. Furthermore screenshot functionality is provided to assist in keeping a photographic record of a result. Both the output and screenshot file will be deleted if the result is deleted.
Note: This page only loads the latest 1000 results, for optimisation of the web application.
https://blogger.googleusercontent.com/img/a/AVvXsEhCP1R3QbQEvBfDT33_uHl_VBAXf83vpoEpyLJ3uyLbhcEHxwROloF0zyQ-6MmcaFvM838AQYffqVSnlB1egDRAQEgwp6Bwg11lNQaXjcL41gsci70ic2B517f6bVvjxBgPc48kS2Ur9fd8qGjZliW6weWiGmKqW0kL9Jt1Je0hdDthvyUQnxfGapWD=s1919
For optimisation purposes, the results table only displays some of the general information regarding a result, to investigate a result further, the user should use the Details button. The details page allows the use[...]
___________________________
@hacking_Attack
@Hacking_Video
Kali Linux Tutorials
Scrummage : The Ultimate OSINT And Threat Hunting Framework
Scrummage is an OSINT tool that centralises search functionality from powerful, yet simple OSINT sites. This project draws inspiration.
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials Scrummage : The Ultimate OSINT And Threat Hunting Framework Scrummage is an OSINT tool that centralises search functionality from powerful, yet simple OSINT sites. This project draws inspiration mainly from two other projects, including:…
r to view the soft copy of the result’s link and provides the ability for a user to generate a screenshot.
https://blogger.googleusercontent.com/img/a/AVvXsEiJX7MHfab2GPupYqEy54Ss-723EoeAaeHtGevH5Y6plZ8ROZ31Ck-4n5e0D6Nl1Uxi2RWy-eY6Rn235XyanXz1Og8SEY4fwSrr9YkdrLLhEBoP59p4C6TNgwaMKsvvLxdo6BvKMo80hoLiKTrLTzxtN-ebHByhCUY3gdWU4RP5T_zwmOhJoeUcTIKI=s1917
Tasks
The tasks page shows all created task, and provides the ability for the user to run each task. This page doesn’t have a limit on tasks; however, don’t go crazy creating tasks, you can always add a list to a task, rather than having the same task created multiple times for one search. So really you shouldn’t have any more than 50 tasks. Tasks have caching and logging for each which can be found in the “protected/output” directory under the tasks name, ex. Google Search is called “google”. If you need to remove the cache, you can edit/delete the appropriate cache file.
https://blogger.googleusercontent.com/img/a/AVvXsEic6E0jnKy5UmSkpbC1FN18dv9j8r5wrEwwbgIB7-1ytJq0YODHutgGhH4rKvzD7tFq9RXO5hwXVKPyA05bNIEGdBe6UlEZplM7aVwe7jE-vIfbIiTaoMEe_syAs5afsO5QZTDu313NiXC0IvOJUUBQPzebommFtkVlf51I2LW6tZSDg-GnkKJggCXA=s1919
All the plugins are open-source, free to individuals, just like the rest of the code. Furthermore, feel free to use the pre-existing libraries used in other plugins. If you are creating or editting a plugin, make sure to understand that when you run it for the first time, the web app may reload to reload the python cache. This is normal. Account Settings
This page changes according to the user’s privileges, if a user is an admin, they have the ability to change their password as well as other user’s passwords, they can block and unblock users, demote and promote users’ privileges, and of course create new users and delete existing users.
Additionally users with administrative privileges can check and edit input, output, and core configuration of the tool.
The account page looks as per below for administrative users:
https://blogger.googleusercontent.com/img/a/AVvXsEir8WarnL3-Ff-gjMusebyge3R-t81dM3UrCmNdGAsowCfF12Avb_Nk3OCFFaERHw9xTAWAvf4qlekIKO5LkJHgxOD1D-J3SvAD9C6XkNMQ-2TxRA5yl4H3GtSNPx5jCVZ-1XAeL5Ng8Hep8ny7Lh8I1liJrpL0PlITBevhUmbB98EK-gx_85XUC0mI=s1919
The account page looks as per below for non-administrative users:
https://blogger.googleusercontent.com/img/a/AVvXsEjAIFHLy4OmgV3RoroRz7QTqK_6lBDft-fRcaWdB9CLA61d_J8RCpwPoE09BNHir8NcaexPWcCCBHnrv7Nqc7R0e-puKnRfjJal6ZYfRr6x7zwTNNfaTNzrvZyvAD1jFeEvMnZATFM4FciogyjTXod4drbsV2V1INv1pReq2QTFryKoJdtLBkFVj9FJ=s1919
Identities
This concept was introduced in v3.6 of the Scrummage platform, this page is not to be confused with the Account Settings page. Account Settings is for managing users of the Scrummage platform itself, identities, is an entirely optional feature, where if rows are present, the information within can be used when executing tasks.
This is the main page, depicting a table with a faux identity created for documentation purposes:
https://blogger.googleusercontent.com/img/a/AVvXsEisEY1ITbg81iSiVeNfFEyopluvxY37Fe4fjPT7SHc2AVYzRJD8TGzeRop6jWRxcZunC0cJJhOvzYn1C2ya8WhhTAMi3t_YlsBKuqgDLe6LkxTAnBuzKVWm-jcolz5cwgRGOlRfD0o0wvgDqSJkxK7SpSnJ8bW9pYUV7eYq_Us0emkOoDvMKmfJu9Yq=s1919
Identities can be created one of three ways:
* Individual creation (Use the “Create Identity” function.)
https://blogger.googleusercontent.com/img/a/AVvXsEgaQPkZoS3QLI9QXu_HPCbKVIwR0HM2e88D3VbGw8xzpMfX7w5hfxs5I9_-1cWquKVHBLZKRHjTyjB5WaVUh-Xd04svCQp0BEdJX9KeudiMdwYF0GRiQ4vlqlRwp3wTUqsb-xnQC077u2VAPlxI5wKN9bd2FCEOlDgU68_il8DTvxP891yjnQlisjAG=s1918
* Bulk upload of identities (Use the “Bulk Upload” function.)
https://blogger.googleusercontent.com/img/a/AVvXsEin2OEXWakygMuTD-glns2n_vD9b_cJhzkCksIjNxJvKmx3btAppXOWaNX3F7jHFeTcnaKLdD_LXb1RBFs_lTcxB4Bn8ECC8CmuAqnar2lWXpISQ22IH_PSbkIyerHPPa7BzvB6HSMVw9ODdNx6Mq-W43bKRV_FHu0wu5n1Y_eUw9hooZkKgC3IZzQm=s1919
* If you have an IDM system in place, you are welcome to onboard st[...]
___________________________
@hacking_Attack
@Hacking_Video
https://blogger.googleusercontent.com/img/a/AVvXsEiJX7MHfab2GPupYqEy54Ss-723EoeAaeHtGevH5Y6plZ8ROZ31Ck-4n5e0D6Nl1Uxi2RWy-eY6Rn235XyanXz1Og8SEY4fwSrr9YkdrLLhEBoP59p4C6TNgwaMKsvvLxdo6BvKMo80hoLiKTrLTzxtN-ebHByhCUY3gdWU4RP5T_zwmOhJoeUcTIKI=s1917
Tasks
The tasks page shows all created task, and provides the ability for the user to run each task. This page doesn’t have a limit on tasks; however, don’t go crazy creating tasks, you can always add a list to a task, rather than having the same task created multiple times for one search. So really you shouldn’t have any more than 50 tasks. Tasks have caching and logging for each which can be found in the “protected/output” directory under the tasks name, ex. Google Search is called “google”. If you need to remove the cache, you can edit/delete the appropriate cache file.
https://blogger.googleusercontent.com/img/a/AVvXsEic6E0jnKy5UmSkpbC1FN18dv9j8r5wrEwwbgIB7-1ytJq0YODHutgGhH4rKvzD7tFq9RXO5hwXVKPyA05bNIEGdBe6UlEZplM7aVwe7jE-vIfbIiTaoMEe_syAs5afsO5QZTDu313NiXC0IvOJUUBQPzebommFtkVlf51I2LW6tZSDg-GnkKJggCXA=s1919
All the plugins are open-source, free to individuals, just like the rest of the code. Furthermore, feel free to use the pre-existing libraries used in other plugins. If you are creating or editting a plugin, make sure to understand that when you run it for the first time, the web app may reload to reload the python cache. This is normal. Account Settings
This page changes according to the user’s privileges, if a user is an admin, they have the ability to change their password as well as other user’s passwords, they can block and unblock users, demote and promote users’ privileges, and of course create new users and delete existing users.
Additionally users with administrative privileges can check and edit input, output, and core configuration of the tool.
The account page looks as per below for administrative users:
https://blogger.googleusercontent.com/img/a/AVvXsEir8WarnL3-Ff-gjMusebyge3R-t81dM3UrCmNdGAsowCfF12Avb_Nk3OCFFaERHw9xTAWAvf4qlekIKO5LkJHgxOD1D-J3SvAD9C6XkNMQ-2TxRA5yl4H3GtSNPx5jCVZ-1XAeL5Ng8Hep8ny7Lh8I1liJrpL0PlITBevhUmbB98EK-gx_85XUC0mI=s1919
The account page looks as per below for non-administrative users:
https://blogger.googleusercontent.com/img/a/AVvXsEjAIFHLy4OmgV3RoroRz7QTqK_6lBDft-fRcaWdB9CLA61d_J8RCpwPoE09BNHir8NcaexPWcCCBHnrv7Nqc7R0e-puKnRfjJal6ZYfRr6x7zwTNNfaTNzrvZyvAD1jFeEvMnZATFM4FciogyjTXod4drbsV2V1INv1pReq2QTFryKoJdtLBkFVj9FJ=s1919
Identities
This concept was introduced in v3.6 of the Scrummage platform, this page is not to be confused with the Account Settings page. Account Settings is for managing users of the Scrummage platform itself, identities, is an entirely optional feature, where if rows are present, the information within can be used when executing tasks.
This is the main page, depicting a table with a faux identity created for documentation purposes:
https://blogger.googleusercontent.com/img/a/AVvXsEisEY1ITbg81iSiVeNfFEyopluvxY37Fe4fjPT7SHc2AVYzRJD8TGzeRop6jWRxcZunC0cJJhOvzYn1C2ya8WhhTAMi3t_YlsBKuqgDLe6LkxTAnBuzKVWm-jcolz5cwgRGOlRfD0o0wvgDqSJkxK7SpSnJ8bW9pYUV7eYq_Us0emkOoDvMKmfJu9Yq=s1919
Identities can be created one of three ways:
* Individual creation (Use the “Create Identity” function.)
https://blogger.googleusercontent.com/img/a/AVvXsEgaQPkZoS3QLI9QXu_HPCbKVIwR0HM2e88D3VbGw8xzpMfX7w5hfxs5I9_-1cWquKVHBLZKRHjTyjB5WaVUh-Xd04svCQp0BEdJX9KeudiMdwYF0GRiQ4vlqlRwp3wTUqsb-xnQC077u2VAPlxI5wKN9bd2FCEOlDgU68_il8DTvxP891yjnQlisjAG=s1918
* Bulk upload of identities (Use the “Bulk Upload” function.)
https://blogger.googleusercontent.com/img/a/AVvXsEin2OEXWakygMuTD-glns2n_vD9b_cJhzkCksIjNxJvKmx3btAppXOWaNX3F7jHFeTcnaKLdD_LXb1RBFs_lTcxB4Bn8ECC8CmuAqnar2lWXpISQ22IH_PSbkIyerHPPa7BzvB6HSMVw9ODdNx6Mq-W43bKRV_FHu0wu5n1Y_eUw9hooZkKgC3IZzQm=s1919
* If you have an IDM system in place, you are welcome to onboard st[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
r to view the soft copy of the result’s link and provides the ability for a user to generate a screenshot. https://blogger.googleusercontent.com/img/a/AVvXsEiJX7MHfab2GPupYqEy54Ss-723EoeAaeHtGevH5Y6plZ8ROZ31Ck-4n5e0D6Nl1Uxi2RWy-eY6Rn235XyanXz1Og8SEY4fwSrr…
raight to the Scrummage database, under the
___________________________
@hacking_Attack
@Hacking_Video
org_identitiestable. This will help streamline and maintain your list of identities effectively. Download___________________________
@hacking_Attack
@Hacking_Video
hacking: security in practice
Ddos attack on website - how to stop it?
Hi, for the past few days my employers new website is being hacked. From what she explained to me I think it's a Ddos attack. My employer is a very good friend of mine, which is why I'd like to help.
The host is WordPress and their server is Amazon AWS.
I was told that the website goes down everyday, it is also connected to their app, therefore, both of them go down at the same time when the website is attacked.
I came to ask the professionals for help! If anyone has any information how this can be avoided or any advice for me to pass on please do share.
Thank you all in advance.
submitted by /u/cameheretopayless
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Ddos attack on website - how to stop it?
Hi, for the past few days my employers new website is being hacked. From what she explained to me I think it's a Ddos attack. My employer is a very good friend of mine, which is why I'd like to help.
The host is WordPress and their server is Amazon AWS.
I was told that the website goes down everyday, it is also connected to their app, therefore, both of them go down at the same time when the website is attacked.
I came to ask the professionals for help! If anyone has any information how this can be avoided or any advice for me to pass on please do share.
Thank you all in advance.
submitted by /u/cameheretopayless
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Ddos attack on website - how to stop it?
Hi, for the past few days my employers new website is being hacked. From what she explained to me I think it's a Ddos attack. My employer is a...
hacking: security in practice
Encrypted Chat
I really like my privacy and want to find an encrypted instant messenger to chat with friends on my linux machine. Using the terminal would be preferable but a GUI chat works too. Any solid recommendations?
submitted by /u/STATERA_DIGITAL
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Encrypted Chat
I really like my privacy and want to find an encrypted instant messenger to chat with friends on my linux machine. Using the terminal would be preferable but a GUI chat works too. Any solid recommendations?
submitted by /u/STATERA_DIGITAL
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Reddit
From the hacking community on Reddit
Explore this post and more from the hacking community
hacking: security in practice
Forgot Bitlocker password...
So, i found a USB drive i had encrypted a while ago using bitlocker. And for the life of me i can not find the recovery key! I thought i remembered the password but it says it's wrong every time I enter it. I have a few important work files in it. Is there a way to bypass bitlocker?
submitted by /u/TheN1ght0w1
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Forgot Bitlocker password...
So, i found a USB drive i had encrypted a while ago using bitlocker. And for the life of me i can not find the recovery key! I thought i remembered the password but it says it's wrong every time I enter it. I have a few important work files in it. Is there a way to bypass bitlocker?
submitted by /u/TheN1ght0w1
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Forgot Bitlocker password...
So, i found a USB drive i had encrypted a while ago using bitlocker. And for the life of me i can not find the recovery key! I thought i...
hacking: security in practice
How do offline games still manage to protect them sleves from value hacks without multipling values?
Hi i think the question is obvious. So a while ago i tried to hack a game with game gurdian (Its offline, doesn't rely on servers) but then came the shock, whenever i change anything it changes back instantly even if frozen then i decided to use BlueStacks with cheat engine, boom again same results Long story short i gave up -_-. So After A While I Came by another game wich did the same weird thing is the game between them and before them were changing good. So can anybody tell me why ,how or atleast how to prevent it.
Thanks.
Games i was talking about list: Botworld Angrybirds Transformers "I lost the third game sry"
submitted by /u/Bogienin
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
How do offline games still manage to protect them sleves from value hacks without multipling values?
Hi i think the question is obvious. So a while ago i tried to hack a game with game gurdian (Its offline, doesn't rely on servers) but then came the shock, whenever i change anything it changes back instantly even if frozen then i decided to use BlueStacks with cheat engine, boom again same results Long story short i gave up -_-. So After A While I Came by another game wich did the same weird thing is the game between them and before them were changing good. So can anybody tell me why ,how or atleast how to prevent it.
Thanks.
Games i was talking about list: Botworld Angrybirds Transformers "I lost the third game sry"
submitted by /u/Bogienin
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
How do offline games still manage to protect them sleves from...
Hi i think the question is obvious. So a while ago i tried to hack a game with game gurdian (Its offline, doesn't rely on servers) but then came...
hacking: security in practice
Is it possible to create a script to automate clicking on brave ads?
I want to create a script that automatically clicks on brave ads every time they appear, but I have no idea where to begin. Is this possible and if it is, could you give me some insight on how to do it?
submitted by /u/iamfeelings
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Is it possible to create a script to automate clicking on brave ads?
I want to create a script that automatically clicks on brave ads every time they appear, but I have no idea where to begin. Is this possible and if it is, could you give me some insight on how to do it?
submitted by /u/iamfeelings
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Is it possible to create a script to automate clicking on brave ads?
I want to create a script that automatically clicks on brave ads every time they appear, but I have no idea where to begin. Is this possible and...
hacking: security in practice
Buffer Overflows on android?
Wassup hackers.
Lately I've been learning about buffer overflows. I managed to take over my PC with my laptop via vulnserver. I think many people are aware of Vulnserver, But for the people who aren't. Vulnserver is a server that you can download and run on your own pc. It contains a couple of executables that you can crack. So I managed to get a buffer overflow in the TRUN application for example. But to do that I had to have the vulnserver with that application running ofcourse. But let's say I have a different application than Vulnserver running. How would I attack the application then? And would it be possible to run such attacks on android apps also?
Thanks in advance.
submitted by /u/Mario64Remasterdpls
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Buffer Overflows on android?
Wassup hackers.
Lately I've been learning about buffer overflows. I managed to take over my PC with my laptop via vulnserver. I think many people are aware of Vulnserver, But for the people who aren't. Vulnserver is a server that you can download and run on your own pc. It contains a couple of executables that you can crack. So I managed to get a buffer overflow in the TRUN application for example. But to do that I had to have the vulnserver with that application running ofcourse. But let's say I have a different application than Vulnserver running. How would I attack the application then? And would it be possible to run such attacks on android apps also?
Thanks in advance.
submitted by /u/Mario64Remasterdpls
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Buffer Overflows on android?
Wassup hackers. Lately I've been learning about buffer overflows. I managed to take over my PC with my laptop via vulnserver. I think many people...
How I hacked Nepal’s ecommerce site and bought huge packs of kitkat for free! :)
https://shubhdhungana.medium.com/how-i-hacked-nepals-ecommerce-site-and-bought-huge-packs-of-kitkat-for-free-b3625c5de97e?source=rss------bug_bounty-5
Before few months when I was tired of doing my college assignments, I started to drill up my skills in ethical hacking. I used to practise…Continue reading on Medium » (https://shubhdhungana.medium.com/how-i-hacked-nepals-ecommerce-site-and-bought-huge-packs-of-kitkat-for-free-b3625c5de97e?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
https://shubhdhungana.medium.com/how-i-hacked-nepals-ecommerce-site-and-bought-huge-packs-of-kitkat-for-free-b3625c5de97e?source=rss------bug_bounty-5
Before few months when I was tired of doing my college assignments, I started to drill up my skills in ethical hacking. I used to practise…Continue reading on Medium » (https://shubhdhungana.medium.com/how-i-hacked-nepals-ecommerce-site-and-bought-huge-packs-of-kitkat-for-free-b3625c5de97e?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
Medium
How I hacked Nepal’s ecommerce site and bought huge packs of kitkat for free! :)
Before few months when I was tired of doing my college assignments, I started to drill up my skills in ethical hacking. I used to practise…
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
How I hacked an Android app for a premium feature
https://cdn-images-1.medium.com/max/2600/0*o8EXiwl_UW4UkBaa
I rewrote the bytecode to unlock premium features and now I will show you how to prevent it from happening to your apps.
Continue reading on ProAndroidDev »
___________________________
@hacking_Attack
@Hacking_Video
How I hacked an Android app for a premium feature
https://cdn-images-1.medium.com/max/2600/0*o8EXiwl_UW4UkBaa
I rewrote the bytecode to unlock premium features and now I will show you how to prevent it from happening to your apps.
Continue reading on ProAndroidDev »
___________________________
@hacking_Attack
@Hacking_Video
Medium
How I hacked an Android app for a premium feature
I did rewrite the bytecode to unlock premium feature and now I will show you how to prevent it from happening
Resource Based Constrained Delegation
https://www.reddit.com/r/redteamsec/comments/qaokb6/resource_based_constrained_delegation/
submitted by /u/netbiosX (https://www.reddit.com/user/netbiosX)
[link] (https://pentestlab.blog/2021/10/18/resource-based-constrained-delegation/) [comments] (https://www.reddit.com/r/redteamsec/comments/qaokb6/resource_based_constrained_delegation/)
___________________________
@hacking_Attack
@Hacking_Video
https://www.reddit.com/r/redteamsec/comments/qaokb6/resource_based_constrained_delegation/
submitted by /u/netbiosX (https://www.reddit.com/user/netbiosX)
[link] (https://pentestlab.blog/2021/10/18/resource-based-constrained-delegation/) [comments] (https://www.reddit.com/r/redteamsec/comments/qaokb6/resource_based_constrained_delegation/)
___________________________
@hacking_Attack
@Hacking_Video
reddit
Resource Based Constrained Delegation
Posted in r/redteamsec by u/netbiosX • 2 points and 0 comments
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
Trojan-Spy.Win32.Ardamax.ocx Insecure Permissions
https://1.bp.blogspot.com/-qwhQ-DvjXeo/WWlvAVNcU1I/AAAAAAAAIKM/AQaWmoLkqQQ6jMUPY28Kv2eNsZnw7PnKQCLcBGAs/s1600/h122.png
Trojan-Spy.Win32.Ardamax.ocx malware suffers from an insecure permissions vulnerability.
MD5 |
Download
Source:packetstormsecurity.com
___________________________
@hacking_Attack
@Hacking_Video
Trojan-Spy.Win32.Ardamax.ocx Insecure Permissions
https://1.bp.blogspot.com/-qwhQ-DvjXeo/WWlvAVNcU1I/AAAAAAAAIKM/AQaWmoLkqQQ6jMUPY28Kv2eNsZnw7PnKQCLcBGAs/s1600/h122.png
Trojan-Spy.Win32.Ardamax.ocx malware suffers from an insecure permissions vulnerability.
MD5 |
1958fc9f88dc93972c6926deb4aa378bDownload
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/78a39875a0adb110cf3c7de3a0d1384c.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln
Threat: Trojan-Spy.Win32.Ardamax.ocx
Vulnerability: Insecure Permissions
Description: The malware creates an dir named "MUWOCI" or "28463" with insecure permissions under Windows\SysWOW64 granting full (F) permissions to the Everyone user group. Standard users can rename the executable dropped by the malware to disable it or replace it with their own executable. Then wait for a privileged user to logon to the infected machine to potentially escalate privileges.
Type: PE32
MD5: 78a39875a0adb110cf3c7de3a0d1384c
Vuln ID: MVID-2021-0362
Disclosure: 10/15/2021
Exploit/PoC:
C:\Windows\SysWOW64\MUWOCI>cacls HNI.001
C:\Windows\SysWOW64\MUWOCI\HNI.001 Everyone:(ID)F
C:\Windows\SysWOW64\MUWOCI>cd ..
C:\Windows\SysWOW64>cacls MUWOCI
C:\Windows\SysWOW64\MUWOCI Everyone:F
Everyone:(OI)(CI)(IO)F
C:\Windows\SysWOW64>dir MUWOCI
Volume in drive C has no label.
Directory of C:\Windows\SysWOW64\MUWOCI
10/05/2021 10:11 PM 62,464 HNI.001
1 File(s) 62,464 bytes
C:\Windows\SysWOW64>cacls 28463
C:\Windows\SysWOW64\28463 Everyone:F
Everyone:(OI)(CI)(IO)F
C:\Windows\SysWOW64>dir 28463
Volume in drive C has no label.
Directory of C:\Windows\SysWOW64\28463
10/05/2021 10:17 PM 402,944 AKV.exe
10/05/2021 10:17 PM 482 DQOC.001
10/05/2021 10:17 PM 7,680 DQOC.006
10/05/2021 10:17 PM 5,632 DQOC.007
10/05/2021 10:17 PM 483,840 DQOC.exe
5 File(s) 900,578 bytes
C:\Windows\SysWOW64>cacls 28463
C:\Windows\SysWOW64\28463 Everyone:F
Everyone:(OI)(CI)(IO)F
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).
Source:packetstormsecurity.com
___________________________
@hacking_Attack
@Hacking_Video
Kitploit
Trojan-Spy.Win32.Ardamax.ocx Insecure Permissions
Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
Support Board 3.3.4 Cross Site Scripting
https://1.bp.blogspot.com/-gLNlUWq63_8/WWlvGRw0eoI/AAAAAAAAILQ/4OYXBaTeiPkRlDYcEes6gWLLrvO9LjoiQCLcBGAs/s1600/h138.png
Support Board version 3.3.4 suffers from a persistent cross site scripting vulnerability.
MD5 |
Download
# Exploit Title: Support Board 3.3.4 - 'Message' Stored Cross-Site Scripting (XSS)
# Date: 16/10/2021
# Exploit Author: John Jefferson Li
Source:packetstormsecurity.com
___________________________
@hacking_Attack
@Hacking_Video
Support Board 3.3.4 Cross Site Scripting
https://1.bp.blogspot.com/-gLNlUWq63_8/WWlvGRw0eoI/AAAAAAAAILQ/4OYXBaTeiPkRlDYcEes6gWLLrvO9LjoiQCLcBGAs/s1600/h138.png
Support Board version 3.3.4 suffers from a persistent cross site scripting vulnerability.
MD5 |
e85bf621f79eb83adfb3108965fda106Download
# Exploit Title: Support Board 3.3.4 - 'Message' Stored Cross-Site Scripting (XSS)
# Date: 16/10/2021
# Exploit Author: John Jefferson Li
Source:packetstormsecurity.com
___________________________
@hacking_Attack
@Hacking_Video
Kitploit
Support Board 3.3.4 Cross Site Scripting
Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.
Exploit Collector
Company's Recruitment Management System 1.0 Cross Site Scripting
___________________________
@hacking_Attack
@Hacking_Video
Company's Recruitment Management System 1.0 Cross Site Scripting
___________________________
@hacking_Attack
@Hacking_Video
Kitploit
Company's Recruitment Management System 1.0 Cross Site Scripting
Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.