LazyCSRF - A More Useful CSRF PoC Generator
http://www.kitploit.com/2021/10/lazycsrf-more-useful-csrf-poc-generator.html

___________________________
@hacking_Attack
@Hacking_Video

LazyCSRF is a more useful CSRF PoC generator (https://www.kitploit.com/search/label/Generator) that runs on Burp (https://www.kitploit.com/search/label/Burp) Suite.
Motivation
Burp Suite is an intercepting HTTP Proxy, and it is the defacto tool for performing web application security testing. The feature of Burp Suite (https://www.kitploit.com/search/label/Burp%20Suite) that I like the most is Generate CSRF PoC. However, this does not support JSON parameters. It also uses the , so it cannot send PUT/DELETE requests. In addition, multibyte characters that can be displayed in the burp itself are often garbled in the generated CSRF PoC. Those were the motivations for creating this extension.
Features
Generating CSRF PoC with Burp Suite Community Edition (of course, it also works in Professional Edition)Support JSON parameter (like GraphQL (https://www.kitploit.com/search/label/GraphQL) Request)Support PUT/DELETE (only work with CORS (https://www.kitploit.com/search/label/CORS) enabled with an unrestrictive policy)Support displaying multibyte characters (like Japanese)
Difference in display of multibyte characters
The following image shows the difference in the display of multibyte characters between Burp's CSRF PoC generator and LazyCSRF. LazyCSRF can generate CSRF PoC without garbling multibyte characters that are not garbled on Burp.

___________________________
@hacking_Attack
@Hacking_Video

Installation
Download the jar from GitHub Releases (https://github.com/tkmru/lazyCSRF/releases/). In Burp Suite, go to the Extensions tab in the Extender tab, and add a new extension. Select the extension type Java, and specify the location of the jar.
How to Build

intellij
If you use IntelliJ IDEA, you can build it by following Build -> Build Artifacts -> LazyCSRF:jar -> Build.
Command line
You can build it with maven.$ mvn install

Usage
You can generate a CSRF PoC by selecting Extensions->Generate JSON CSRF PoC with Ajax or Generate POST PoC with Form from the menu that opens by right-clicking on Burp Suite.

___________________________
@hacking_Attack
@Hacking_Video

LICENSE
MIT LicenseCopyright (C) 2021 tkmru

Download lazyCSRF (https://github.com/tkmru/lazyCSRF)

___________________________
@hacking_Attack
@Hacking_Video

LazyCSRF - A More Useful CSRF PoC Generator

LazyCSRF is a more useful CSRF PoC generator that runs on Burp Suite.MotivationBurp Suite is an intercepting HTTP Proxy, and it is the defacto tool for performing web application security testing. The feature of Burp Suite that I like the most is Generate CSRF PoC. However, this does not support JSON parameters. It also uses the , so it cannot send PUT/DELETE requests. In addition, multibyte characters that can be displayed in the burp itself are often garbled in the generated CSRF PoC. Those were the motivations for creating this extension.FeaturesGenerating CSRF PoC with Burp Suite Community Edition (of course, it also works in Professional Edition)Support JSON parameter (like GraphQL Request)Support PUT/DELETE (only work with CORS enabled with an unrestrictive policy)Support displaying multibyte characters (like Japanese)Difference in display of multibyte charactersThe following image shows the difference in the display of multibyte characters between Burp's CSRF PoC generator and LazyCSRF. LazyCSRF can generate CSRF PoC without garbling multibyte characters that are not garbled on Burp. InstallationDownload the jar from GitHub Releases. In Burp Suite, go to the Extensions tab in the Extender tab, and add a new extension. Select the extension type Java, and specify the location of the jar.How to BuildintellijIf you use IntelliJ IDEA, you can build it by following Build -> Build Artifacts -> LazyCSRF:jar -> Build.Command lineYou can build it with maven.$ mvn installUsageYou can generate a CSRF PoC by selecting Extensions->Generate JSON CSRF PoC with Ajax or Generate POST PoC with Form from the menu that opens by right-clicking on Burp Suite.LICENSEMIT LicenseCopyright (C) 2021 tkmruDownload lazyCSRF
Read more...

___________________________
@hacking_Attack
@Hacking_Video

India’s First CrowdSource Bug Bounty Platform

https://cyber3ra.com/Continue reading on Medium »
Read more...

KitPloit - PenTest Tools!
LazyCSRF - A More Useful CSRF PoC Generator

https://blogger.googleusercontent.com/img/a/AVvXsEhJWRJapZuz9HeJ2mIvfS7E6auhNUuzFRpWbabN__ib2MKlW0zj1abgGwfSaHp5LgbdBfzqiZ6xAhQaiLxvhWuSXIYzBFi1dBkOOFMhFcxKDw7L_GyhjRgfUeKipWNg8W5E9x0YlqOTth2E7qxlG-LSCwolYfUzkMfJFSLczVN3mNmPMXtfPzeA7vKf8Q=w640-h416 LazyCSRF is a more useful CSRF PoC generator that runs on Burp Suite. MotivationBurp Suite is an intercepting HTTP Proxy, and it is the defacto tool for performing web application security testing. The feature of Burp Suite that I like the most is Generate CSRF PoC. However, this does not support JSON parameters. It also uses the , so it cannot send PUT/DELETE requests. In addition, multibyte characters that can be displayed in the burp itself are often garbled in the generated CSRF PoC. Those were the motivations for creating this extension. Features* Generating CSRF PoC with Burp Suite Community Edition (of course, it also works in Professional Edition)
* Support JSON parameter (like GraphQL Request)
* Support PUT/DELETE (only work with CORS enabled with an unrestrictive policy)
* Support displaying multibyte characters (like Japanese) Difference in display of multibyte charactersThe following image shows the difference in the display of multibyte characters between Burp's CSRF PoC generator and LazyCSRF. LazyCSRF can generate CSRF PoC without garbling multibyte characters that are not garbled on Burp. https://blogger.googleusercontent.com/img/a/AVvXsEhJWRJapZuz9HeJ2mIvfS7E6auhNUuzFRpWbabN__ib2MKlW0zj1abgGwfSaHp5LgbdBfzqiZ6xAhQaiLxvhWuSXIYzBFi1dBkOOFMhFcxKDw7L_GyhjRgfUeKipWNg8W5E9x0YlqOTth2E7qxlG-LSCwolYfUzkMfJFSLczVN3mNmPMXtfPzeA7vKf8Q=w640-h416 InstallationDownload the jar from GitHub Releases. In Burp Suite, go to the Extensions tab in the Extender tab, and add a new extension. Select the extension type Java, and specify the location of the jar. How to BuildintellijIf you use IntelliJ IDEA, you can build it by following Build-> Build Artifacts-> LazyCSRF:jar-> Build. Command lineYou can build it with maven. $ mvn install UsageYou can generate a CSRF PoC by selecting Extensions->Generate JSON CSRF PoC with Ajax or Generate POST PoC with Formfrom the menu that opens by right-clicking on Burp Suite. https://blogger.googleusercontent.com/img/a/AVvXsEjyH7_kcySGpwGGfmNrVSwqVTjYBPB1QbplKZLi-AFr4uHfYMAakhjHR-4BAu2HJAiHdOu5QdlDiH0LHML0Z_l7jGNNbpU9PTrZK_yD2XUIma4vknRt4uS5k7RCz99m4kDwyfJUWAYfyBWhEdabfIR5mDBuKrpqOFAHZf7O3c8Oypz2oj889BqNjGg_KA=w640-h504 LICENSEMIT License

Copyright (C) 2021 tkmru Download lazyCSRF

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Name That Toon: Bone Dry

Feeling creative? Submit your caption and our panel of experts will reward the winner with a $25 Amazon gift card.

Dark Reading: Attacks/Breaches
Privacy Management for Microsoft 365 Now Generally Available

The tool is designed to automatically discover personal data in organizations' Microsoft 365 environments.
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Query.ai Closes $15M Series A for Security Investigations Tool

The funding will support product development for Query.AI's browser-based security investigations tool.

Dark Reading: Attacks/Breaches
Candy Corn Maker Hit With Ransomware

Ferrara Candy Co. said a ransomware attack earlier this month won't affect Halloween supplies of its sweets, which include Brachs, Keebler, Sweet Tarts, and other popular brands.
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Enterprise Cybersecurity Strategies Are Getting More Attention

Data in Dark Reading's 2021 Strategic Security Survey report suggest organizations are taking the security challenge seriously.

Dark Reading: Attacks/Breaches
2021 State of Ransomware Report Reveals 83% of Victims Paid to Get Data Restored

Research by ThycoticCentrify shows a majority of organizations experienced a ransomware attack, while 93% are allocating special budget to fight growing threats.
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
CrowdStrike Invests in Microsoft AD Competitor JumpCloud

Closes out $225 million Series F with additional $66 million raised from Atlassian Ventures, CrowdStrike Falcon Fund, NTT Docomo Ventures, and others.
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Keysight Technologies Acquires SCALABLE Network Technologies

Simulation and modeling solutions augment Keysight's 5G and cybersecurity portfolio.
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Cato Networks Valued at $2.5B, Raises Additional $200M to Accelerate SASE Adoption Among Large Enterprises

Cato more than doubles its valuation in one year with largest funding round to date. Total financing reaches $532 million.
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How effective is a custom wordlist for brute-force?

What's the percentage of people that uses pet name, company name, date of birth and etc as password? How effective can a customized wordlist be when brute-forcing passwords?

submitted by /u/Im_MrLonely
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video