Information Security
@sec_nerd_en
416 subscribers
157 photos
5 videos
9 files
2.28K links
Information Security News

we are @sec_nerd twin brother
Download Telegram
About
Blog
Apps
Platform
Join
Information Security
416 subscribers
Information Security
Rate limit bypass:
Add header/s with request
X-Originating-IP: IP
X-Forwarded-For: IP
X-Remote-IP: IP
X-Remote-Addr: IP
X-Client-IP: IP
X-Host: IP
X-Forwared-Host: IP

If bypass successful, & after a while blocking request again. Increment the last octate
#infosec #bugbounty
143 views
Information Security
Bugbounty tips#3

Short IP addrs by dropping zeroes. To bypasses WAF filters for SSRF, open-redirect, whr any IP got blocked

Exmpls:
http://1.0.0.1 → http://1.1
http://192.168.0.1 → http://192.168.1

#infosec #SSRF #bugbountytip #bypass #WAF #bugbountytips #hackerone #hackers
121 views
Information Security
https://github.com/SynapticRewrite/RE101in20min

#RE
GitHub
GitHub - SynapticRewrite/RE101in20min: Slides for Reverse Engineering 101 in 20 minutes as presented at Pancakes Con
Slides for Reverse Engineering 101 in 20 minutes as presented at Pancakes Con - GitHub - SynapticRewrite/RE101in20min: Slides for Reverse Engineering 101 in 20 minutes as presented at Pancakes Con
105 views
Information Security
https://www.youtube.com/watch?v=_dmqf-T6x4c
YouTube
Meterpreter Remote Injection in Linux: Part 1 - Python
How to inject meterpreter stager straight into a process running on a remote Linux system without touching disk and using only ssh and python.

Blog post: https://blog.sektor7.net/#!res/2018/pure-in-memory-linux.md
Blog: https://blog.sektor7.net
On-line courses:…
112 views
Information Security
https://pwnchief.com/cars-writeup-fireshell-ctf-2020/amp/
pwnchief
Cars writeup - FireShell CTF 2020 - pwnchief
This was a simple and fun challenge which demonstrated a common vulnerability in web API's which are used by mobile applications.
126 views
Information Security
https://portswigger.net/research/javascript-without-parentheses-using-dommatrix
PortSwigger Research
JavaScript without parentheses using DOMMatrix
Every once a while, you'll find what looks like a healthy XSS vulnerability, only to bash your head against a limited charset that prevents exploitation. One common restriction is a website that doesn
132 views
Information Security
https://medium.com/@ivecodoe/detecting-ldapfragger-a-newly-released-cobalt-strike-beacon-using-ldap-for-c2-communication-c274a7f00961
Medium
Detecting LDAPFragger — A newly released Cobalt Strike Beacon using LDAP for C2 communication…
Goals:
120 views
Information Security
https://revers.engineering/applied-re-exceptions/
Reverse Engineering
Applied Reverse Engineering: Exceptions and Interrupts - Reverse Engineering
A detailed look at interrupts and exceptions on modern architectures. This article covers servicing and nuances of software interrupts and exceptions.
120 views
Information Security
https://neo-geo2.gitbook.io/adventures-on-security/frida-scripting-guide/frida-scripting-guide
neo-geo2.gitbook.io
Frida scripting guide for Java | Adventures on Security
A guide that will explain how to code scripts in Frida
106 views
Information Security
Payload xss en aplicación de javascript.

<object data='data:text/html;;;;;base64,PHNjcmlwdD5hbGVydGBZMDAwYDwvc2NyaXB0Pg=='></object>

#xss #payload #payloads #bugbountytips
142 views
Information Security
https://research.checkpoint.com/2018/50-adobe-cves-in-50-days/
Check Point Research
50 CVEs in 50 Days: Fuzzing Adobe Reader - Check Point Research
Research By: Yoav Alon, Netanel Ben-Simon Introduction The year 2017 was an inflection point in the vulnerability landscape. The number of new vulnerabilities reported that year was around 14,000, which is over twice the number from the year before (see table…
149 views
Information Security
http://deniable.org/windows/windows-callbacks
122 views
Information Security
https://amp.kitploit.com/2020/03/katana-python-tool-for-google-hacking.html?amp=1&m=1
KitPloit ☣
Katana - A Python Tool For Google Hacking
125 views
Information Security
https://pentestmag.com/practical-insider-threat-penetration-testing-cases-with-scapy-shell-code-and-protocol-evasion/
Pentestmag
Practical Insider Threat Penetration Testing Cases with Scapy (Shell Code and Protocol Evasion) - Pentestmag
Practical Insider Threat Penetration Testing Cases with Scapy (Shell Code and Protocol Evasion) by Dennis Chow As the penetration testing …
123 views
Information Security
https://research.checkpoint.com/2020/breaking-through-windows-defenses-analysing-mlnk-builder/
Check Point Research
Breaking through Windows' defenses: Analyzing mLNK Builder - Check Point Research
Introduction Launching an attack does not always require high technical aptitude on the part of a threat actor, especially when there are ready-made tools available for every stage of the infection chain. Delivery document builders and MaaS (Malware-as-a…
125 views
Information Security
https://medium.com/@prial261/xss-waf-character-limitation-bypass-like-a-boss-2c788647c229
Medium
XSS WAF & Character limitation bypass like a boss
Hello Fellow Hackers!
103 views
Information Security
https://silentbreaksecurity.com/weaponizing-self-xss/
NetSPI
Weaponizing self-xss
Maybe you’re a web app pentester who gets frustrated with finding self-xss on sites you test, or maybe you’re a website owner who keeps rejecting self-xss as a valid vulnerability. This post is intended to help both understand the risk involved in self-xss…
103 views
Information Security
https://pentestmag.com/thick-client-penetration-testing-exploiting-java-deserialization-vulnerability-remote-code-execution/
Pentestmag
Thick Client Penetration Testing – Exploiting JAVA Deserialization Vulnerability for Remote Code Execution - Pentestmag
Thick Client? What do you mean by that? Thick client is the kind of application which is installed on the …
92 views
Information Security
Find #CVEs

https://github.com/Medicean/VulApps
https://github.com/qazbnm456/awesome-cve-poc
https://github.com/tunz/js-vuln-db
https://github.com/cve-search/cve-search
https://github.com/nixawk/labs
https://github.com/Coalfire-Research/java-deserialization-exploits
https://github.com/Metnew/uxss-db
https://github.com/TH3xACE/SUDO_KILLER
https://github.com/Mr-xn/Penetration_Testing_POC
https://github.com/toolswatch/vFeed

#bugbounty,#bugbountytips
GitHub
GitHub - Medicean/VulApps: 快速搭建各种漏洞环境(Various vulnerability environment)
快速搭建各种漏洞环境(Various vulnerability environment). Contribute to Medicean/VulApps development by creating an account on GitHub.
97 views
Information Security
https://github.com/SofianeHamlaoui/Massy-Boutakus-Searcher
GitHub
SofianeHamlaoui/Massy-Boutakus-Searcher
MBS - Massy Boutakus Searcher : An FTP/HTTP Servers Files Seacher - SofianeHamlaoui/Massy-Boutakus-Searcher
90 views