Bypassing Cloudflare for achieving SQL InjectionContinue reading on Medium » (https://cyberguy0xd1.medium.com/how-i-was-able-to-bypass-cloudflare-waf-for-sqli-payload-b9e7a4260026?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Review of the eJPT certification b

https://cdn-images-1.medium.com/max/600/0*8zhGsrwVCVBLNY2h.png
Author: Lalith Kumar

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TGB re-launch scheduled for 1st December

https://cdn-images-1.medium.com/max/860/1*UJCOB_TjJBeJTx6E_QcfXg.png
After 4 days of the first launch, TGB had to suspend trading due to a security breach in the first contract on 16/11. The team then…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Nyx: 1: Vulnhub Walkthrough

https://cdn-images-1.medium.com/max/751/0*5Cr5i72YUo-2w02-.png
Makineyi indirebilirsiniz.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Vulnerabilidad de lectura de archivos no autorizada sin parches que afecta al sistema operativo…

https://cdn-images-1.medium.com/max/1336/0*iDGSSYGWgKn7G_O0
PUBLICADO EN 30 NOVIEMBRE, 2021POR DPAB

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Just a friendly reminder that VM’s are not 100% safe. Kinda shocked that i still hear people describing VM’s like they are isolated.

submitted by /u/12AngrySnowflakes
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Permit Empty Password for SSHD

What would be a real consequence for allowing permitemptypassword to yes at sshd config file ? I know no password means no protection but curious why it would be required and could be exploited in real world.

submitted by /u/Harry_pentest
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

ZipExec - A Unique Technique To Execute Binaries From A Password Protected Zip
http://www.kitploit.com/2021/11/zipexec-unique-technique-to-execute.html

___________________________
@hacking_Attack
@Hacking_Video

ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file. This zip file is then base64 encoded into a string that is rebuilt on disk. This encoded string is then loaded into a JScript file that when executed, would rebuild the password-protected zip file on disk and execute it. This is done programmatically by using COM objects to access (https://www.kitploit.com/search/label/Access) the GUI-based functions in Windows (https://www.kitploit.com/search/label/Windows) via the generated JScript loader, executing the loader inside the password-protected zip without having to unzip it first. By password protecting the zip file, it protects the binary from EDRs and disk-based or anti-malware scanning (https://www.kitploit.com/search/label/Scanning) mechanisms.
Installation The first step as always is to clone the repo. Before you compile ZipExec you'll need to install the dependencies. To install them, run following commands: go get github.com/yeka/zip
Then build it go build ZipExec.go
or go get github.com/Tylous/ZipExec Help > \> <\ ___/\ \___ /_______ \|__| __/_______ /__/\_ \\___ >\___ > \/ |__| \/ \/ \/ \/ (@Tyl0us) Usage of ./ZipExec: -I string Path to the file containing binary to zip. -O string Name of output file (e.g. loader.js) -sandbox Enables sandbox evasion (https://www.kitploit.com/search/label/Evasion) using IsDomainedJoined. ">./ZipExec -h

__________.__ ___________
\____ /|__|_____\_ _____/__ ___ ____ ____
/ / | \____ \| __)_\ \/ // __ \_/ ___\
/ /_ | | |_> > \> <\ ___/\ \___
/_______ \|__| __/_______ /__/\_ \\___ >\___ >
\/ |__| \/ \/ \/ \/
(@Tyl0us)

Usage of ./ZipExec:
-I string
Path to the file containing binary to zip.
-O string
Name of output file (e.g. loader.js)
-sandbox
Enables sandbox evasion using IsDomainedJoined.


Download ZipExec (https://github.com/Tylous/ZipExec)

___________________________
@hacking_Attack
@Hacking_Video

Hydra nedir?Nasıl kullanılır?
https://mirabbasagalarov.medium.com/hydra-nedir-nas%C4%B1l-kullan%C4%B1l%C4%B1r-f251ddb57951?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hydra Nedir?Continue reading on Medium » (https://mirabbasagalarov.medium.com/hydra-nedir-nas%C4%B1l-kullan%C4%B1l%C4%B1r-f251ddb57951?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

ZipExec - A Unique Technique To Execute Binaries From A Password Protected Zip

ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file. This zip file is then base64 encoded into a string that is rebuilt on disk. This encoded string is then loaded into a JScript file that when executed, would rebuild the password-protected zip file on disk and execute it. This is done programmatically by using COM objects to access the GUI-based functions in Windows via the generated JScript loader, executing the loader inside the password-protected zip without having to unzip it first. By password protecting the zip file, it protects the binary from EDRs and disk-based or anti-malware scanning mechanisms. Installation The first step as always is to clone the repo. Before you compile ZipExec you'll need to install the dependencies. To install them, run following commands: go get github.com/yeka/zip Then build it go build ZipExec.go or go get github.com/Tylous/ZipExec Help sandbox evasion using IsDomainedJoined. ">./ZipExec -h. \ /||_ / / / | _ \| )\\ \/ // _ \_/ _\ / /_ | | |_> > \> <\ _/\ \_ /_ \|_| _/_ /_/\_ \\_ >\_ > \/ |_| \/ \/ \/ \/ (@Tyl0us)Usage of ./ZipExec: -I string Path to the file containing binary to zip. -O string Name of output file (e.g. loader.js) -sandbox Enables sandbox evasion using IsDomainedJoined. Download ZipExec
Read more...

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
ZipExec - A Unique Technique To Execute Binaries From A Password Protected Zip

http://1.bp.blogspot.com/-KNZqYc058e8/YZ3QB79eJDI/AAAAAAAA3_0/qYprCfc_n0QiAs9zCtdOMGGQ0SQdKSGeACK4BGAYYCw/w640-h360/ZipExec_1-745577.gif

ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file. This zip file is then base64 encoded into a string that is rebuilt on disk. This encoded string is then loaded into a JScript file that when executed, would rebuild the password-protected zip file on disk and execute it. This is done programmatically by using COM objects to access the GUI-based functions in Windows via the generated JScript loader, executing the loader inside the password-protected zip without having to unzip it first. By password protecting the zip file, it protects the binary from EDRs and disk-based or anti-malware scanning mechanisms.
Installation

The first step as always is to clone the repo. Before you compile ZipExec you'll need to install the dependencies. To install them, run following commands:

go get github.com/yeka/zip


Then build it

go build ZipExec.go


or

go get github.com/Tylous/ZipExec

Help

sandbox evasion using IsDomainedJoined. ">./ZipExec -h

__________.__ ___________
\____ /|__|_____\_ _____/__ ___ ____ ____
/ / | \____ \| __)_\ \/ // __ \_/ ___\
/ /_ | | |_> > \> <\
/_______ \|__| __/_______ /__/\_ \\___ >\___ >
\/ |__| \/ \/ \/ \/
(@Tyl0us)

Usage of ./ZipExec:
-I string
Path to the file containing binary to zip.
-O string
Name of output file (e.g. loader.js)
-sandbox
Enables sandbox evasion using IsDomainedJoined.

Download ZipExec

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
What’s the Difference Between SASE and SD-WAN?

While SD-WAN is a key part of a hybrid workplace and multicloud operation, it should be treated as a stepping stone to SASE, not an alternative.