Continue reading on Medium » (https://medium.com/@not-matthias/reverse-engineering-discords-party-mode-d9c9dcaf0be4?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

How I Mass hunt for Admin Panel Access…
https://medium.com/@ratnadip1998/how-i-mass-hunt-for-admin-panel-access-8c2ad145054?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello All,🙂Continue reading on Medium » (https://medium.com/@ratnadip1998/how-i-mass-hunt-for-admin-panel-access-8c2ad145054?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What is Clickjacking?

https://cdn-images-1.medium.com/max/2600/1*ojUOoQkfcsxDs4rz9kaaRA.jpeg
The malicious technique of clickjacking (or user interface redress attack) involves tricking users into clicking on something other than…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What is a Data Spillage?

https://cdn-images-1.medium.com/max/2600/1*HeFz5z3SSpO-Pa7QVZVrSg.jpeg
There is a risk of data leakage when sensitive, confidential, or harmful information is moved into an environment where it is not…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How I Mass hunt for Admin Panel Access…

https://cdn-images-1.medium.com/max/1562/1*NA2e8jOkzbaFMUazaicHTA.png
Hello All,🙂

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
#WHOAMI

My name is Ibrahim and I am a Cyber Security Analyst in The Netherlands. A large part of my blog will be about Cyber Security and I will…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Exploiting CVE-2022-26923 by Abusing AD CS
https://www.reddit.com/r/redteamsec/comments/v35a1b/exploiting_cve202226923_by_abusing_ad_cs/

We are doing 2 THM Labs. In the first one we are abusing vulnerable certificate templates manually with Certify and Rubeus, then changing the domain Administrator's password. In the second lab, we are utilizing Certipy POC to takeover DC machine and dump hashes for all users. Available on YouTube: https://youtu.be/HBRCI5O35R8 Hope you enjoy the video and learn something new. The channel is new and all feedback is appreciated. submitted by /u/lsecqt (https://www.reddit.com/user/lsecqt)
[link] (https://www.reddit.com/r/redteamsec/comments/v35a1b/exploiting_cve202226923_by_abusing_ad_cs/) [comments] (https://www.reddit.com/r/redteamsec/comments/v35a1b/exploiting_cve202226923_by_abusing_ad_cs/)

___________________________
@hacking_Attack
@Hacking_Video

Complete Bug Bounty CheatSheet | Joas Antonio

XSS, SQLi, SSRF, CRLF, CSV-Injection, Command Injection, Directory Traversal, LFI, XXE, Open-Redirect, RCE, Crypto, Template Injection…Continue reading on Medium »
Read more...

Complete Bug Bounty CheatSheet | Joas Antonio
https://0xshakhawat.medium.com/complete-bug-bounty-cheatsheet-joas-antonio-ef7ea5411cca?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

XSS, SQLi, SSRF, CRLF, CSV-Injection, Command Injection, Directory Traversal, LFI, XXE, Open-Redirect, RCE, Crypto, Template Injection…Continue reading on Medium » (https://0xshakhawat.medium.com/complete-bug-bounty-cheatsheet-joas-antonio-ef7ea5411cca?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

MITM_Intercept - A Little Bit Less Hackish Way To Intercept And Modify non-HTTP Protocols Through Burp And Others
http://www.kitploit.com/2022/06/mitmintercept-little-bit-less-hackish.html

___________________________
@hacking_Attack
@Hacking_Video

A little bit less hackish way to intercept and modify non-HTTP protocols through Burp and others with SSL and TLS interception support. This tool is for researchers and applicative penetration testers that perform thick clients security assesments. An improved version of the fantastic mitm_relay (https://github.com/jrmdev/mitm_relay) project.
The Story As part of our work in the research department of CyberArk Labs, we needed a way to inspect SSL and TLS communication over TCP and have the option to modify the content of packets on the fly. There are many ways to do so (for example, the known Burp Suite (https://www.kitploit.com/search/label/Burp%20Suite) extension NoPE (https://portswigger.net/bappstore/12e84399d46a408dbe970f181391f781)), but none of them worked for us in some cases. In the end we stumbled upon mitm_relay (https://github.com/jrmdev/mitm_relay). mitm_relay is a quick and easy way to perform MITM of any TCP-based protocol through existing HTTP interception software like Burp Suite’s proxy. It is particularly useful for thick clients security assessments. But it didn’t completely work for us, so we needed to customize it. After a lot of customizations, every new change required a lot of work, and we ended up rewriting everything in a more modular way. We hope that others will find this script helpful, and we hope that adding functionality will be easy. How does it work For a start, listeners’ addresses and ports need to be configured. For each listener, there also needs to be a target configured (address and port). Every data received from the listener will be wrapped into a body of an HTTP POST request with the URL containing “CLIENT_REQUEST”. Every data received from the target will be wrapped into a body of an HTTP POST request with the URL containing “SERVER_RESPONSE”. Those requests are sent to a local HTTP interception server. There is the option to configure an HTTP proxy and use a tool like burp suite (https://portswigger.net/burp) as an HTTP interception tool and view the messages there. This way, it is easy to modify the messages by using Burp’s “Match and Replace”, extensions or even manually (Remember, the timeout mechanism of the intercepted protocol can be very short). Another way to modify the messages is by using a python script that the HTTP interception server will run when it receives messages. The body of the messages sent to the HTTP interception server will be printed to the shell. The messages will be printed after the changes if the modification (https://www.kitploit.com/search/label/Modification) script is given. After all the modifications, the interception server will also echo back as an HTTP response body. To decrypt the SSL/TLS communication, mitm_intercept need to be provided a certificate and a key that the client will accept when starting a handshake (https://www.kitploit.com/search/label/Handshake) with the listener. If the target server requires a specific certificate for a handshake, there is an option to give a certificate and a key. A small chart to show the typical traffic flow:

___________________________
@hacking_Attack
@Hacking_Video