Azuro has launched a bug bounty on web3’s leading bug bounty platform Immunefi, with hackers being rewarded a maximum bounty of $21,500…Continue reading on Medium » (https://azuroprotocol.medium.com/azuro-launches-a-30-000-bug-bounty-on-immunefi-918142d0e9f9?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
Azuro Launches a $30,000+ Bug Bounty on Immunefi
Azuro has launched a bug bounty on web3’s leading bug bounty platform Immunefi, with hackers being rewarded a maximum bounty of $21,500 for…
Xml External Entity Web Application Vulnerability : Mechanisms Part
https://medium.com/@arshiadev/xml-external-entity-web-application-vulnerability-mechanisms-part-1ac069c4aeb3?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://medium.com/@arshiadev/xml-external-entity-web-application-vulnerability-mechanisms-part-1ac069c4aeb3?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
Xml External Entity Web Application Vulnerability : Mechanisms Part
XML external entity attacks (XXEs) are fascinating vulnerabilities that target the XML parsers of an application. XXEs can be very…
XML external entity attacks (XXEs) are fascinating vulnerabilities that target the XML parsers of an application. XXEs can be very…Continue reading on Medium » (https://medium.com/@arshiadev/xml-external-entity-web-application-vulnerability-mechanisms-part-1ac069c4aeb3?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
Xml External Entity Web Application Vulnerability : Mechanisms Part
XML external entity attacks (XXEs) are fascinating vulnerabilities that target the XML parsers of an application. XXEs can be very…
Hacking Articles Tips Tricks Videos Tutorials
Photo
KitPloit - PenTest Tools!
SSOh-No - User Enumeration And Password Spraying Tool For Testing Azure AD
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhPAGUnwLISOeAKG_H8ovlfsgHxS43aSvzxSyqxHElUFm8mgR25ygy2-NDVWZlCSPgddzOWfQFasHcnnwXRCZEKN7MoltMW_uj-OBN2EyRHX16jbZVG5ZTUEcHaUhVhh2LUbYEoB4UL2sVGARawYgvHoQJJ1FW3UGcRF_-LZ9EuUnlmqLLD2iQKa1LN/w640-h502/SSOh-No.png
This tool is designed to enumerate users, password spray and perform brute force attacks against any organisation that utilises Azure AD or O365.
Generally, this endpoint provides extremely verbose errors which can be leveraged to enumerate users and validate their passwords via brute force/spraying attacks, while also failing to log any failed authentication attempts.
This tool is a weaponised version of a PoC demonstrated in the arstechnica research article which discusses the techniques utilised to exploit the endpoint.
This endpoint is known to Microsoft however, in typical fashion it has been branded a feature, not a bug.
This endpoint does enforce "smart locking" which can be bypassed by rotating IP.
Why Is This Unique?
The SSO Autologon endpoint does not contain logging of any sort bar potentially updating the users "Last Logon" time.
The following have been tested and contain no logs:
* AzureAD
* Sentinel
* Defender for Identity (Formerly Advanced Thread Protection)
* Defender for Cloud Apps
Usage
$ ./SSOh-No -h usage: SSOh-No [-h|--help] [-e|--email "
Upcoming Features
* Proxy Implementation to bypass smart lock
* Password brute force from password lists (single user- No plans for password list brute force against a userlist)
Download SSOh-No
___________________________
@hacking_Attack
@Hacking_Video
SSOh-No - User Enumeration And Password Spraying Tool For Testing Azure AD
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhPAGUnwLISOeAKG_H8ovlfsgHxS43aSvzxSyqxHElUFm8mgR25ygy2-NDVWZlCSPgddzOWfQFasHcnnwXRCZEKN7MoltMW_uj-OBN2EyRHX16jbZVG5ZTUEcHaUhVhh2LUbYEoB4UL2sVGARawYgvHoQJJ1FW3UGcRF_-LZ9EuUnlmqLLD2iQKa1LN/w640-h502/SSOh-No.png
This tool is designed to enumerate users, password spray and perform brute force attacks against any organisation that utilises Azure AD or O365.
Generally, this endpoint provides extremely verbose errors which can be leveraged to enumerate users and validate their passwords via brute force/spraying attacks, while also failing to log any failed authentication attempts.
This tool is a weaponised version of a PoC demonstrated in the arstechnica research article which discusses the techniques utilised to exploit the endpoint.
This endpoint is known to Microsoft however, in typical fashion it has been branded a feature, not a bug.
This endpoint does enforce "smart locking" which can be bypassed by rotating IP.
Why Is This Unique?
The SSO Autologon endpoint does not contain logging of any sort bar potentially updating the users "Last Logon" time.
The following have been tested and contain no logs:
* AzureAD
* Sentinel
* Defender for Identity (Formerly Advanced Thread Protection)
* Defender for Cloud Apps
Usage
$ ./SSOh-No -h usage: SSOh-No [-h|--help] [-e|--email "
Upcoming Features
* Proxy Implementation to bypass smart lock
* Password brute force from password lists (single user- No plans for password list brute force against a userlist)
Download SSOh-No
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
SSOh-No - User Enumeration And Password Spraying Tool For Testing Azure AD
Xml External Entity Web Application Vulnerability : Mechanisms Part
XML external entity attacks (XXEs) are fascinating vulnerabilities that target the XML parsers of an application. XXEs can be very…Continue reading on Medium »
Read more...
XML external entity attacks (XXEs) are fascinating vulnerabilities that target the XML parsers of an application. XXEs can be very…Continue reading on Medium »
Read more...
Passive/Active Information Gathering: Subdomain Enumeration
This post is design to share some of the information I’ve learned while working through the Information Gathering- Web Edition module in…Continue reading on Medium »
Read more...
This post is design to share some of the information I’ve learned while working through the Information Gathering- Web Edition module in…Continue reading on Medium »
Read more...
How To Handle The Aftermath Of A Cyber Attack
Once a breach or an attack happens, the company should try to resolve the issue in 30 days or less. During that time, the team should…Continue reading on Medium »
Read more...
Once a breach or an attack happens, the company should try to resolve the issue in 30 days or less. During that time, the team should…Continue reading on Medium »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Invoca Capture the Flag (CTF) 2022
https://cdn-images-1.medium.com/max/658/1*6hb_mYdB6bFofxB0qmcW8g.png
A perspective from a first-time CTF host, novice penetration tester, and Security professional
Continue reading on Medium »
Invoca Capture the Flag (CTF) 2022
https://cdn-images-1.medium.com/max/658/1*6hb_mYdB6bFofxB0qmcW8g.png
A perspective from a first-time CTF host, novice penetration tester, and Security professional
Continue reading on Medium »