ific to scripting flare-qdb can be found in the Methods Reference.

A full reference of flare-qdb's builtins (available both from the CLI and as instance methods) is available in the Builtins Reference or by typing flareqdb --help-builtinsafter installing flare-qdb.

De-DOSfuscator documentation can be found in the De-DOSfuscator Guide.

Troubleshooting information can be found in the Troubleshooting Guide.

Acknowledgements and thoughts about future functionality that may be useful can be found in the Notes. Download Flare-Qdb

Неочевидное об XSS и HTML-энкодинге

Многие знают о том, что перед тем, как получить значение атрибута тега, браузер декодирует HTML-сущности внутри. Скажем, если попытаться…Continue reading on Medium »
Read more...

Flare-Qdb - Command-line And Python Debugger For Instrumenting And Modifying Native Software Behavior On Windows And Linux
http://www.kitploit.com/2022/02/flare-qdb-command-line-and-python.html

flare-qdb is a command-line and scriptable Python-based tool for evaluating and manipulating native program state. It uses Vivisect (https://github.com/vivisect/vivisect) to set a breakpoint on each queried instruction and executes Python code when hit. flare-qdb frees the analyst to take a nonlinear approach to dynamic analysis that accommodates the questions that arise in the course of normal debugging and static analysis. flare-qdb answers these questions without requiring the analyst to manually set up an interactive debugger session and navigate the program counter to that code location.
Here are some examples of spot questions flare-qdb can answer: Does eax always equal this value at this point? What was eax equal to before this branch? What values will this string assume throughout this loop? At the first iteration of the inner loop, what base address is used? Is the program even going to hit this logic? Which code executes first? Does the number of loop iterations depend on the value of argv[1]? Can I alter the command-line arguments to avoid this condition? flare-qdb can also be used to facilitate automated, repeatable manipulation (https://www.kitploit.com/search/label/Manipulation) of program execution. Here are some examples of useful applications: Executing a string decoder with different arguments to quickly extract all the strings used by a malware sample. Overriding the arguments to Sleep() to permit rapid iterative testing of a custom command and control (C2) server. Telling a privilege escalation (https://www.kitploit.com/search/label/Privilege%20Escalation) tool that its integrity level is 0x1000 (MANDATORY_LOW_RID) in order to induce it to execute its exploit code. Repeatably automating the unpacking of a packer that jumps into one or more non-deterministic heap locations. flare-qdb accepts multiple queries that take the form of a program counter or Vivisect expression paired with some Python text to evaluate in the flare-qdb scripting environment. Vivisect expressions can be used to specify simple constant program counter values like "0x401000", symbolic expressions like "kernel32.Sleep", and more. Vivisect expressions can also incorporate register and memory state to articulate sophisticated conditions, such as "not eax or (( edx > 3) and (poi(ebp-8) < 5))". The command line (https://www.kitploit.com/search/label/Command%20Line) argument format for this is: -at
flare-qdb also supports conditional evaluation (https://www.kitploit.com/search/label/Evaluation) based on the truth value of a Vivisect expression: -at-if
flare-qdb provides several builtins for convenient debugging, which are available both from the command line and as methods of its Qdb class. flare-qdb has been tested primarily on Windows, but works on Linux. Unfortunately, the Darwin port of Vivisect's vtrace.Trace class is incomplete, so flare-qdb does not support OSX. Example Scripts flare-qdb comes with De-DOSfuscator, which is a tool for decoding obfuscated batch files by running them. Details can be found in the De-DOSfuscator Guide (https://github.com/mandiant/flare-qdb/blob/master/doc/dedosfuscator.md) or by reading the blog Cmd and Conquer: De-DOSfuscation with flare-qdb (https://www.fireeye.com/blog/threat-research/2018/11/cmd-and-conquer-de-dosfuscation-with-flare-qdb.html). Detailed Information Information about installing flare-qdb is available in the Installation Guide (https://github.com/mandiant/flare-qdb/blob/master/doc/installation.md). Information about using flare-qdb on the command line is available in the Command Line Usage Guide (https://github.com/mandiant/flare-qdb/blob/master/doc/usage.md). Information about scripting with flare-qdb is available in the Scripting Guide (https://github.com/mandiant/flare-qdb/blob/master/doc/scripting.md). Qdb class methods specific to scripting flare-qdb can be found in the Methods Reference

(https://github.com/mandiant/flare-qdb/blob/master/doc/qdb_methods.txt). A full reference of flare-qdb's builtins (available both from the CLI and as instance methods) is available in the Builtins Reference (https://github.com/mandiant/flare-qdb/blob/master/doc/qdb_builtins.txt) or by typing flareqdb --help-builtins after installing flare-qdb. De-DOSfuscator documentation can be found in the De-DOSfuscator Guide (https://github.com/mandiant/flare-qdb/blob/master/doc/dedosfuscator.md). Troubleshooting information can be found in the Troubleshooting Guide (https://github.com/mandiant/flare-qdb/blob/master/doc/troubleshooting.md). Acknowledgements and thoughts about future functionality that may be useful can be found in the Notes (https://github.com/mandiant/flare-qdb/blob/master/doc/notes.md).

Download Flare-Qdb (https://github.com/mandiant/flare-qdb)

Неочевидное об XSS и HTML-энкодинге
https://medium.com/@skavans_/%D0%BD%D0%B5%D0%BE%D1%87%D0%B5%D0%B2%D0%B8%D0%B4%D0%BD%D0%BE%D0%B5-%D0%BE%D0%B1-xss-%D0%B8-html-%D1%8D%D0%BD%D0%BA%D0%BE%D0%B4%D0%B8%D0%BD%D0%B3%D0%B5-46fa75212496?source=rss------bug_bounty-5

Многие знают о том, что перед тем, как получить значение атрибута тега, браузер декодирует HTML-сущности внутри. Скажем, если попытаться…Continue reading on Medium » (https://medium.com/@skavans_/%D0%BD%D0%B5%D0%BE%D1%87%D0%B5%D0%B2%D0%B8%D0%B4%D0%BD%D0%BE%D0%B5-%D0%BE%D0%B1-xss-%D0%B8-html-%D1%8D%D0%BD%D0%BA%D0%BE%D0%B4%D0%B8%D0%BD%D0%B3%D0%B5-46fa75212496?source=rss------bug_bounty-5)

​​How Did I Start Doing Bug Bounty?
https://medium.com/@skavans_/how-did-i-start-doing-bug-bounty-c4374b2d98af?source=rss------bug_bounty-5

Since school, I have been reading Hacker (the Russian offensive security magazine) when I had the opportunity to buy it (then it was still…Continue reading on Medium » (https://medium.com/@skavans_/how-did-i-start-doing-bug-bounty-c4374b2d98af?source=rss------bug_bounty-5)

Bug Bounty: Low Hanging Fruit
https://medium.com/@skavans_/bug-bounty-low-hanging-fruit-4ba92ec46f02?source=rss------bug_bounty-5

Low-hanging fruit are bugs that are very easy to find. I would divide them into 2 more types.Continue reading on Medium » (https://medium.com/@skavans_/bug-bounty-low-hanging-fruit-4ba92ec46f02?source=rss------bug_bounty-5)

Jax.Money testing: rewards up to $20,000 and more!
https://medium.com/jax-network/jax-money-testing-rewards-up-to-20-000-and-more-6266a3d26eca?source=rss------bug_bounty-5

by Ramyata Rao, Digital Marketing Manager at Jax.NetworkContinue reading on Jax.Network Blog » (https://medium.com/jax-network/jax-money-testing-rewards-up-to-20-000-and-more-6266a3d26eca?source=rss------bug_bounty-5)

PORTSWIGGER WEB SECURITY - FILE UPLOAD LAB ÇÖZÜMLERİ
https://ariarif.medium.com/portswigger-web-security-file-upload-lab-%C3%A7%C3%B6z%C3%BCmleri%CC%87-be48de3d0657?source=rss------bug_bounty-5

File Upload (Dosya Yükleme), kullanıcının bir web sunucusuna dosya yüklemesine denir. Web sayfaları kullanıcıdan dosya yüklemesi için…Continue reading on Medium » (https://ariarif.medium.com/portswigger-web-security-file-upload-lab-%C3%A7%C3%B6z%C3%BCmleri%CC%87-be48de3d0657?source=rss------bug_bounty-5)