Hacking on Medium
Hacking my way into a US school and becoming an international student.
https://cdn-images-1.medium.com/max/600/1*bUbEH_wjiOS1hDG0v-zLbw.png
Hello beautiful people, this story is quite interesting as it triggered the importance of having necessary security configurations…
Continue reading on Medium »
Hacking my way into a US school and becoming an international student.
https://cdn-images-1.medium.com/max/600/1*bUbEH_wjiOS1hDG0v-zLbw.png
Hello beautiful people, this story is quite interesting as it triggered the importance of having necessary security configurations…
Continue reading on Medium »
Medium
Hacking my way into a US school and becoming an international student.
Hello beautiful people, this story is quite interesting as it triggered the importance of having necessary security configurations…
Hacking on Medium
Save a Hacker Foundation Under Attack
It would appear that there is a group known as group-ib that is placing targets on me spanning from Luxembourg to Singapore. They are…
Continue reading on Medium »
Save a Hacker Foundation Under Attack
It would appear that there is a group known as group-ib that is placing targets on me spanning from Luxembourg to Singapore. They are…
Continue reading on Medium »
Medium
Save a Hacker Foundation Under Attack
It would appear that there is a group known as group-ib that is placing targets on me spanning from Luxembourg to Singapore. They are…
How I got $$$$ Bounty within 5 mins
Hi folks, Usually I don't do writeups nither share anything related to bug bounty.Continue reading on Medium »
Read more...
Hi folks, Usually I don't do writeups nither share anything related to bug bounty.Continue reading on Medium »
Read more...
How I got $$$$ Bounty within 5 mins
https://p4n7h3rx.medium.com/how-i-got-bounty-within-5-mins-f1448f6db9b5?source=rss------bug_bounty-5
https://p4n7h3rx.medium.com/how-i-got-bounty-within-5-mins-f1448f6db9b5?source=rss------bug_bounty-5
Hi folks, Usually I don't do writeups nither share anything related to bug bounty.Continue reading on Medium » (https://p4n7h3rx.medium.com/how-i-got-bounty-within-5-mins-f1448f6db9b5?source=rss------bug_bounty-5)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
REST-Attacker : A Proof-Of-Concept For The Feasibility Of Testing
REST-Attacker is an automated penetration testing framework for APIs following the REST architecture style. The tool’s focus is on streamlining the analysis of generic REST API implementations by completely automating the testing process – including test generation, access control handling, and report generation – with minimal configuration effort. Additionally, REST-Attacker is designed to be flexible and extensible with support for both large-scale testing and fine-grained analysis.
REST-Attacker is maintained by the Chair of Network & Data Security of the Ruhr University of Bochum.
Features
REST-Attacker currently provides these features:
* Automated generation of tests
* Utilize an OpenAPI description to automatically generate test runs
* 32 integrated security tests based on OWASP and other scientific contributions
* Built-in creation of security reports
* Streamlined API communication
* Custom request interface for the REST security use case (based on the Python3 requests module)
* Communicate with any generic REST API
* Handling of access control
* Background authentication/authorization with API
* Support for the most popular access control mechanisms: OAuth2, HTTP Basic Auth, API keys and more
* Easy to use & extend
* Usable as standalone (CLI) tool or as a module
* Adapt test runs to specific APIs with extensive configuration options
* Create custom test cases or access control schemes with the tool’s interfaces
Install
Get the tool by downloading or cloning the repository:
git clone https://github.com/RUB-NDS/REST-Attacker.git
You need Python >3.10 for running the tool.
You also need to install the following packages with pip:
python3 -m pip install -r requirements.txt
Quickstart
Here you can find a quick rundown of the most common and useful commands. You can find more information on each command and other about available configuration options in our usage guides.
Get the list of supported test cases:
python3 -m rest_attacker –list
Basic test run (with load-time test case generation):
python3 -m rest_attacker <cfg-dir-or-openapi-file–generate
Full test run (with load-time and runtime test case generation + rate limit handling):
python3 -m rest_attacker <cfg-dir-or-openapi-file–generate –propose –handle-limits
Test run with only selected test cases (only generates test cases for test cases
python3 -m rest_attacker <cfg-dir-or-openapi-file–generate –test-cases scopes.TestTokenRequestScopeOmit resources.FindSecurityParameters
Rerun a test run from a report:
python3 -m rest_attacker <cfg-dir-or-openapi-file–run /path/to/report.json
Documentation
Usage guides and configuration format documentation can be found in the documentation subfolders.
Troubleshooting
For fixes/mitigations for known problems with the tool, see the troubleshooting docs or the Issues section.
Click Here To Download
REST-Attacker : A Proof-Of-Concept For The Feasibility Of Testing
REST-Attacker is an automated penetration testing framework for APIs following the REST architecture style. The tool’s focus is on streamlining the analysis of generic REST API implementations by completely automating the testing process – including test generation, access control handling, and report generation – with minimal configuration effort. Additionally, REST-Attacker is designed to be flexible and extensible with support for both large-scale testing and fine-grained analysis.
REST-Attacker is maintained by the Chair of Network & Data Security of the Ruhr University of Bochum.
Features
REST-Attacker currently provides these features:
* Automated generation of tests
* Utilize an OpenAPI description to automatically generate test runs
* 32 integrated security tests based on OWASP and other scientific contributions
* Built-in creation of security reports
* Streamlined API communication
* Custom request interface for the REST security use case (based on the Python3 requests module)
* Communicate with any generic REST API
* Handling of access control
* Background authentication/authorization with API
* Support for the most popular access control mechanisms: OAuth2, HTTP Basic Auth, API keys and more
* Easy to use & extend
* Usable as standalone (CLI) tool or as a module
* Adapt test runs to specific APIs with extensive configuration options
* Create custom test cases or access control schemes with the tool’s interfaces
Install
Get the tool by downloading or cloning the repository:
git clone https://github.com/RUB-NDS/REST-Attacker.git
You need Python >3.10 for running the tool.
You also need to install the following packages with pip:
python3 -m pip install -r requirements.txt
Quickstart
Here you can find a quick rundown of the most common and useful commands. You can find more information on each command and other about available configuration options in our usage guides.
Get the list of supported test cases:
python3 -m rest_attacker –list
Basic test run (with load-time test case generation):
python3 -m rest_attacker <cfg-dir-or-openapi-file–generate
Full test run (with load-time and runtime test case generation + rate limit handling):
python3 -m rest_attacker <cfg-dir-or-openapi-file–generate –propose –handle-limits
Test run with only selected test cases (only generates test cases for test cases
scopes.TestTokenRequestScopeOmitand resources.FindSecurityParameters):python3 -m rest_attacker <cfg-dir-or-openapi-file–generate –test-cases scopes.TestTokenRequestScopeOmit resources.FindSecurityParameters
Rerun a test run from a report:
python3 -m rest_attacker <cfg-dir-or-openapi-file–run /path/to/report.json
Documentation
Usage guides and configuration format documentation can be found in the documentation subfolders.
Troubleshooting
For fixes/mitigations for known problems with the tool, see the troubleshooting docs or the Issues section.
Click Here To Download
Hacking Articles Tips Tricks Videos Tutorials
Photo
KitPloit - PenTest Tools!
C99Shell-PHP7 - PHP 7 And Safe-Build Update Of The Popular C99 Variant Of PHP Shell
https://blogger.googleusercontent.com/img/a/AVvXsEgM5673_l5p8LZW2RUBTXeebgWq2EfrsUTcjRhmyNEFb_kxGsz-rAhJiqmdm8mjzOR-Aq6NjMnA3yIJ-OhAlWM3FCqddR1N-askE6n_7zsMHmzCFVh81KK9S5_2HkygBgd6JaxOZj5baTErmWoZVQ2Um_ippXSdl29SgLEqSZLC-I5wFalymGetxe3oAA=w640-h388
C99Shell-PHP7
PHP 7 and safe-build Update of the popular C99 variant of PHP Shell.
c99shell.php v.2.0 (PHP 7) (25.02.2019) Updated by: PinoyWH1Z for PHP 7
About C99Shell
An excellent example of a web shell is the c99 variant, which is a PHP shell (most of them calls it malware) often uploaded to a vulnerable web application to give hackers an interface. The c99 shell lets the attacker take control of the processes of the Internet server, allowing him or her give commands on the server as the account under which the threat is operating. It lets the hacker upload, browse the file system, edit and view files, in addition, to deleting, moving them and changing permissions. Finding a c99 shell is an excellent way to identify a compromise on a system. The c99 shell is about 1500 lines long if packed and 4900+ if properly displayed, and some of its traits include showing security measures the web server may use, a file viewer that has permissions, a place w here the attacker can operate custom PHP code (PHP malware c99 shell).
There are different variants of the c99 shell that are being used today. This github release is an example of a relatively recent one. It has many signatures that can be utilized to write protective countermeasures.
About this release:
I've been using php shells as part of my Ethical Hacking activities. And I have noticed that most of the php shells that are downloadable online are encrypted with malicious codes and without you knowing, others also insert trackers so they can see where you placed your php shell at.
I've came up with an idea such as "what if I get the stable version of c99shell and reverse the encrypted codes, remove the malicious codes and release it to public for good." And yeah, I decided to do it, but I noticed that most of the servers now have upgraded their apache service to PHP 7, sadly, the codes that I have is for PHP 5.3 and below.
The good thing is.. only few lines of syntax are needed to be altered, so I did it.
Here you go mates, a clean and safe-build version of the most stable c99shell that I can see.
If ever you see more bugs, please create an issue or just fork it, update it and do a pull request so I can check it and update the codes for stabilization.
PS:
This is a widely used php shell by hackers, so don't freak out if your anti-virus/anti-malware detects this php file as malicious or treated as backdoor. Since you can see the codes in my re-released project, you can read all throughout the codes and inspect or even debug as much as you like.
Disclaimer:
I will NOT be held responsible for any unethical use of this hacking tool.
Official Release:
c99shell_v2.0.zip (
Download C99Shell-PHP7
C99Shell-PHP7 - PHP 7 And Safe-Build Update Of The Popular C99 Variant Of PHP Shell
https://blogger.googleusercontent.com/img/a/AVvXsEgM5673_l5p8LZW2RUBTXeebgWq2EfrsUTcjRhmyNEFb_kxGsz-rAhJiqmdm8mjzOR-Aq6NjMnA3yIJ-OhAlWM3FCqddR1N-askE6n_7zsMHmzCFVh81KK9S5_2HkygBgd6JaxOZj5baTErmWoZVQ2Um_ippXSdl29SgLEqSZLC-I5wFalymGetxe3oAA=w640-h388
C99Shell-PHP7
PHP 7 and safe-build Update of the popular C99 variant of PHP Shell.
c99shell.php v.2.0 (PHP 7) (25.02.2019) Updated by: PinoyWH1Z for PHP 7
About C99Shell
An excellent example of a web shell is the c99 variant, which is a PHP shell (most of them calls it malware) often uploaded to a vulnerable web application to give hackers an interface. The c99 shell lets the attacker take control of the processes of the Internet server, allowing him or her give commands on the server as the account under which the threat is operating. It lets the hacker upload, browse the file system, edit and view files, in addition, to deleting, moving them and changing permissions. Finding a c99 shell is an excellent way to identify a compromise on a system. The c99 shell is about 1500 lines long if packed and 4900+ if properly displayed, and some of its traits include showing security measures the web server may use, a file viewer that has permissions, a place w here the attacker can operate custom PHP code (PHP malware c99 shell).
There are different variants of the c99 shell that are being used today. This github release is an example of a relatively recent one. It has many signatures that can be utilized to write protective countermeasures.
About this release:
I've been using php shells as part of my Ethical Hacking activities. And I have noticed that most of the php shells that are downloadable online are encrypted with malicious codes and without you knowing, others also insert trackers so they can see where you placed your php shell at.
I've came up with an idea such as "what if I get the stable version of c99shell and reverse the encrypted codes, remove the malicious codes and release it to public for good." And yeah, I decided to do it, but I noticed that most of the servers now have upgraded their apache service to PHP 7, sadly, the codes that I have is for PHP 5.3 and below.
The good thing is.. only few lines of syntax are needed to be altered, so I did it.
Here you go mates, a clean and safe-build version of the most stable c99shell that I can see.
If ever you see more bugs, please create an issue or just fork it, update it and do a pull request so I can check it and update the codes for stabilization.
PS:
This is a widely used php shell by hackers, so don't freak out if your anti-virus/anti-malware detects this php file as malicious or treated as backdoor. Since you can see the codes in my re-released project, you can read all throughout the codes and inspect or even debug as much as you like.
Disclaimer:
I will NOT be held responsible for any unethical use of this hacking tool.
Official Release:
c99shell_v2.0.zip (
Zip Password: PinoyWH1Z)Download C99Shell-PHP7
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
How would one download a web-based program to run it offline?
If this is illegal please take it down, but is there a way, or a merit in attempting to pursue, downloading a web-based program to run it while offline? I'll be in a remote location and use a resource known as SKYCIV but it's online based.
Thanks for the advice.
submitted by /u/tiredofland
[link] [comments]
How would one download a web-based program to run it offline?
If this is illegal please take it down, but is there a way, or a merit in attempting to pursue, downloading a web-based program to run it while offline? I'll be in a remote location and use a resource known as SKYCIV but it's online based.
Thanks for the advice.
submitted by /u/tiredofland
[link] [comments]
Fuzz Open Source, Get Paid by Google
The OSS-Fuzz project by Google increased their rewards. How you earn: integrate OSS-Fuzz into a critical open source project and find bugs…Continue reading on Medium »
Read more...
The OSS-Fuzz project by Google increased their rewards. How you earn: integrate OSS-Fuzz into a critical open source project and find bugs…Continue reading on Medium »
Read more...
How to Get Into Bug Bounties?(
A common question nowadays is “How to get started in Bug Bounties?”. So, in this article, I’ll go over a beginner’s bug bounty guide.Continue reading on Medium »
Read more...
A common question nowadays is “How to get started in Bug Bounties?”. So, in this article, I’ll go over a beginner’s bug bounty guide.Continue reading on Medium »
Read more...