Pentester

175 views05:15

https://www.blackhillsinfosec.com/using-cloudfront-to-relay-cobalt-strike-traffic/

Using CloudFront to Relay Cobalt Strike Traffic - Black Hills Information Security, Inc.

Brian Fehrman // Many of you have likely heard of Domain Fronting. Domain Fronting is a technique that can allow your C2 traffic to blend in with a target’s traffic […]

88 views18:52

Pentester

If CSP policy points to a dir and you use %2f to encode "/", it is still considered to be inside the dir. All browsers seem to agree on that.

This leads to a possible bypass, by using "%2f..%2f" if server decodes it, example: https://t.co/Dl9hkKtlQc

Jsbin

JS Bin

A live pastebin for HTML, CSS & JavaScript and a range of processors, including SCSS, CoffeeScript, Jade and more...

76 views18:16

Pentester

https://github.com/lgandx/Responder

GitHub

GitHub - lgandx/Responder: Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication…

Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authenticat...

75 views18:20

Pentester

96 views15:10

Pentester

Building_Telegram_Bots__Develop.pdf

8.7 MB

212 views15:11

Pentester

.NET malware threat: internals and reversing https://t.co/bUNRmUdvx1

76 views16:30

Pentester

https://www.attackdebris.com/?p=470

Attack Debris

Low Privilege Active Directory Enumeration from a non-Domain Joined Host

Scenario You have recovered Domain User credentials for a domain but have no privileged or interactive access to any targets i.e. no Domain Admin account or any account that is capable of establis…

82 views03:28

Pentester

https://lockboxx.blogspot.com/2019/08/macos-red-teaming-207-remote-apple.html?m=1

Blogspot

MacOS Red Teaming 207: Remote Apple Events (RAE)

A blog about information security, hacking, and protecting digital infrastructure. Penetration testing, malware analysis, and intrusion detection.

78 views04:04

Pentester

DNS investigation web tools (17 tools): https://t.co/o6eY7OGwKJ

GitHub

trimstray/the-book-of-secret-knowledge

A collection of inspiring lists, manuals, cheatsheets, blogs, hacks, one-liners, cli/web tools and more. - trimstray/the-book-of-secret-knowledge

76 views04:16

Pentester

Taking control of VMWare through the universal host controller interface
Part 1: https://www.zerodayinitiative.com/blog/2019/5/7/taking-control-of-vmware-through-the-universal-host-controller-interface-part-1
Part 2: https://www.zerodayinitiative.com/blog/2019/8/15/taking-control-of-vmware-through-the-universal-host-control-interface-part-2

#ITSecurity #pentest #hacking #hack #it

Zero Day Initiative

Zero Day Initiative — Taking Control of VMware Through the Universal Host Controller Interface: Part 1

Pwn2Own is a heck of an amazing contest. Not only because of all the media and vibe that goes with it, but because of the caliber of skills that we see demonstrated. It’s also quite fascinating to see new people burst onto the scene with mad skills. Additionally…

69 views06:49

Pentester

https://securityboulevard.com/2019/08/kubernetes-pentest-methodology-part-1/amp/?__twitter_impression=true

Security Boulevard

Kubernetes Pentest Methodology Part 1 - Security Boulevard

As the pace of life accelerates, we spend less time waiting or in downtime. Kubernetes offers something similar for our life with technology. It is a container orchestration platform that offers an easy, automated way...

72 views06:50

Pentester

64 views18:50

Pentester

https://www.malwaretech.com/2019/08/dejablue-analyzing-a-rdp-heap-overflow.html

Malwaretech

DejaBlue: Analyzing a RDP Heap Overflow

In August 2019 Microsoft announced it had patched a collection of RDP bugs, two of which were wormable. The wormable bugs, CVE-2019-1181 & CVE-2019-1182 affect every OS from Windows 7 to Windows 10. There is some confusion about which CVE is which, though…

69 views03:00

Pentester

https://github.com/toniblyx/my-arsenal-of-aws-security-tools

GitHub

GitHub - toniblyx/my-arsenal-of-aws-security-tools: List of open source tools for AWS security: defensive, offensive, auditing…

List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc. - toniblyx/my-arsenal-of-aws-security-tools

64 views03:04

Pentester

https://github.com/threat9/routersploit

GitHub

GitHub - threat9/routersploit: Exploitation Framework for Embedded Devices

Exploitation Framework for Embedded Devices. Contribute to threat9/routersploit development by creating an account on GitHub.

56 views03:12

Pentester

https://medium.com/@geminiimatt/creating-an-online-persona-deb4cd8c7f46

Medium

PRIVACY RECIPE: Creating an online persona

How To Create a Private Online Identity with An Anonymous Email Address and a Virtual Phone.

67 views03:25

Pentester

https://medium.com/@osamaavvan/json-csrf-to-formdata-attack-eb65272376a2

Medium

JSON CSRF To FormData Attack

So you guys must be aware of CSRF attack, if not then here is a short intro:

60 views19:54

Pentester

gophish: Open-source phishing toolkit designed for businesses and penetration testers. It provides the ability to quickly and easily setup and execute phishing engagements and security awareness training.

https://t.co/socwoZRCPq

GitHub

gophish/gophish

Open-Source Phishing Toolkit. Contribute to gophish/gophish development by creating an account on GitHub.

65 views04:05

Pentester

Hiding in plain sights with rogue/fake computer accounts:

1/2) https://t.co/qmoAW70RFz
2/2) https://t.co/E57cqSzKom

blog.menasec.net

Threat Hunting #6 - Hiding in plain sights with real or rogue computer accounts - Part 1/2

Every Windows computer that joins a domain has a computer account. Similar to user accounts, computer accounts provide a means for authentic...

70 views04:37

Pentester

Quick Tip: While you are trying to find more subdomains and you use the Google Dork: site:*.example.com, NEVER forget to check
site:*.*.example.com and
site:*.*.*.example.com

74 views04:40

About

Blog

Apps

Platform