Information Security

Henry Chen
@chybeta
CVE-2019-8451 Unauthorized SSRF via REST API /plugins/servlet/gadgets/makeRequest

use @ to bypass the whitelisting !

https://jira.atlassian.com/browse/JRASERVER-70001?filter=13085

127 views17:59

https://github.com/peewpw/Invoke-PSImage

130 views18:03

Information Security

https://twitter.com/GCHQ/status/1176138397636792320

Twitter

GCHQ

Ever wanted to encrypt messages with Enigma and decode them with the Bombe? Give our new features in #CyberChef a try! https://t.co/OxLcQQbePa

128 views18:28

Information Security

https://blog.ropnop.com/attacking-default-installs-of-helm-on-kubernetes/

ropnop blog

Attacking Default Installs of Helm on Kubernetes

Default installations of Helm on Kubernetes can make it trivial for attackers to escalate to cluster admin. In this post I’ll demonstrate how.

118 views18:26

Information Security

https://posts.specterops.io/shhmon-silencing-sysmon-via-driver-unload-682b5be57650

Medium

Shhmon — Silencing Sysmon via Driver Unload

Sysmon is an incredibly powerful tool to aide in data collection beyond Windows’ standard event logging capabilities. It presents a…

118 views18:26

Information Security

vb5.py

820 B

# vBulletin 5.x 0day pre-auth RCE exploit
#
# This should work on all versions from 5.0.0 till 5.5.4

180 views18:34

Information Security

Tesla
PowerPack

124 views18:37

Information Security

https://nullsweep.com/pivot-cheatsheet-for-pentesters/

Null Sweep

A Pivot Cheatsheet for Pentesters

Quick walkthrough of pivot techniques including ssh, meterpreter, ncat, and netcat.

369 views18:38

Information Security

https://medium.com/101-writeups/hacking-json-web-token-jwt-233fe6c862e6

https://github.com/pinnace/burp-jwt-fuzzhelper-extension

JWT FuzzHelper for Burp

GitHub

GitHub - pinnace/burp-jwt-fuzzhelper-extension: JWT Fuzzer for BurpSuite. Adds an Intruder hook for on-the-fly JWT fuzzing.

JWT Fuzzer for BurpSuite. Adds an Intruder hook for on-the-fly JWT fuzzing. - pinnace/burp-jwt-fuzzhelper-extension

113 views17:36

Information Security

bypass360mimikatz_x64:--

Method: change resources, add a digital signature
Unzip password: 6613kris

https://github.com/ianxtianxt/bypass360mimikatz_x64

GitHub

GitHub - ianxtianxt/bypass360mimikatz_x64

Contribute to ianxtianxt/bypass360mimikatz_x64 development by creating an account on GitHub.

125 views17:39

Information Security

vb5.py

https://viz.greynoise.io/query/?gnql=tags%3A%22vBulletin%205.x%20RCE%22

121 views17:41

Information Security

https://pentestmag.com/knocking-the-door-to-server-side-template-injection-part-1/

Pentestmag

Knocking the door to Server-side Template Injection. Part 1 - Pentestmag