Russian roulette XSS

StoryContinue reading on Medium »
Read more...

Wodat - Windows Oracle Database Attack Toolkit
http://www.kitploit.com/2022/11/wodat-windows-oracle-database-attack.html

___________________________
@hacking_Attack
@Hacking_Video

Simple port of the popular Oracle Database Attack Tool (ODAT) (https://github.com/quentinhardy/odat) to C# .Net Framework. Credit to https://github.com/quentinhardy/odat as lots of the functionality are ported from his code. Perform password based attacks e.g. username as password, username list against given password, password list against given username, username:pass combolist. Test if a credential/connection string is working against target Brute force attacks to discover valid SID/ServiceNames Perform discovery of valid TNS listeners against provided target file or CIDR range More to come, I hope!

___________________________
@hacking_Attack
@Hacking_Video

Disclaimer I take not responsibility for your use of the software. Development is done in my personal capacity and carry no affiliation to my work. Usage The general command line (https://www.kitploit.com/search/label/Command%20Line) arguments required are as follow: wodat.exe COMMAND ARGGUMENTS
COMMAND (ALL,BRUTECRED,BRUTESID,BRUTESRV,TEST,DISC)
-server:XXX.XXX.XXX.XXX -port:1520
-sid:AS OR -srv:AS
-user:Peter -pass:Password

To test if a specific credential set works. wodat.exe TEST -server:XXX.XXX.XXX.XXX -port:1521 -sid:XE -user:peter -pass:pan

See the outline on modules for further usage. The tool will always first check if the TNS listener that is targeted works. Modules BRUTESID Module performs wordlist SID guessing attack if not successful will ask for brute force (https://www.kitploit.com/search/label/Brute%20Force) attack. wodat.exe BRUTESID -server:XXX.XXX.XXX.XXX -port:1521

___________________________
@hacking_Attack
@Hacking_Video

BRUTESRV Module performs wordlist ServiceName guessing attack if not successful will ask for brute force attack. wodat.exe BRUTESRV -server:XXX.XXX.XXX.XXX -port:1521
BRUTECRED Module performs wordlist password based attack. The following options exist: A - username:password combolist with no credentials (https://www.kitploit.com/search/label/Credentials) given during arguments
B - username list with password given in arguments
C - password list with username given in arguments
D - username as password with username list provided
To perform a basic attack with a given file that has username:password combos. wodat.exe BRUTECRED -server:XXX.XXX.XXX.XXX -port:1521 -sid:XE

___________________________
@hacking_Attack
@Hacking_Video

TEST Module tests if the given connection string can connect successfully. wodat.exe TEST -server:XXX.XXX.XXX.XXX -port:1521 -sid:XE -user:peter -pass:pan

___________________________
@hacking_Attack
@Hacking_Video

DISC Module will perform discovery against provided CIDR range or file with instances. Note, only instances with valid TNS listeners will be returned. Testing a network range will be much faster as it’s processed in parallel. wodat.exe DISC

Instances to test must be formatted as per the below example targets.txt: 192.168.10.1
192.168.10.5,1521

___________________________
@hacking_Attack
@Hacking_Video

Russian roulette XSS
https://splint3rsec.medium.com/russian-roulette-xss-bbba6afd2570?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

StoryContinue reading on Medium » (https://splint3rsec.medium.com/russian-roulette-xss-bbba6afd2570?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Cracking a code with known characters

Say that I have a 6-digit code where I know the first and last characters. (Ex. A****@)

How would I go about cracking this code in a website input field?

submitted by /u/TastingLemons493
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
HTTP Request smuggling

https://cdn-images-1.medium.com/max/600/1*Eu-YHNZ8SaIGZRn9sVK3ug.png
It is a technique of interfering with a website processing a sequence of HTTP requests.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Kaspersky: Der nächste Angriff à la WannaCry steht bevor

https://cdn-images-1.medium.com/max/602/0*XYj5h_9CIkaAiU3W.jpg
Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe 25 Days of Christmas Writeup

25 Days of Christmas Walkthrough

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video