It’s been over a year and a half since I’ve started my bug bounty journey as a hacker. With years of experience triaging reports and…

List DTDs and generate XXE payloads using those local DTDs. - GoSecure/dtd-finder

Check out the latest releases of Empire v3.2 and Starkiller v1.2 beta. We added 2 new modules: SharpChromium and BloodHound3. As well as some general improvements. Most importantly, the addition of Dark Mode! Empire: https://t.co/CYD971pjYj Starkiller: h…

PoC 2019-2215 exploit for S8/S8 active with DAC + SELinux + Knox/RKP bypass - chompie1337/s8_2019_2215_poc

you can find PuTTY cleartext credentials in the Windows Registry under HKCU/Software/SimonTatham/Putty/Sessions #postexploitation #hacking #PenTest

Chrome-extension implant that turns victim Chrome browsers into fully-functional HTTP proxies, allowing you to browse sites as your victims. - mandatoryprogrammer/CursedChrome

JWT tokens are generally used as part of the authentication mechanism to authenticate a particular user into the application. JWT tokens…

After 2 days of struggling, Bypassed a strong XSS filter on one of the private program. [ No '>' was allowed , no Html tags, Character length 35 ] XSS Payload used :- <svg onload="alert(1)" <="" svg="" @XssPayloads #BugBountyTips #BugBounty

Over the past year, the security community - specifically Red Team Operators and Blue Team Defenders - have seen a massive rise in both public and private utilization of System Calls in windows malware for post-exploitation activities, as well as for the…

Our analysts had to think fast when they recently encountered an incident involving compromised AWS access keys. Find out how they identified the attack and then kicked the bad guy out.

Hey all, I’m back in the pocket after doing the deep dive into hack the box. I really enjoyed the bulk of the challenges and learned some new great tricks and techniques. One box I highly rec…

Bypassing CloudFlare's WAF to exploit an OGNL injection vulnerability in a red team engagement while avoiding detection.

NTLM is still actively exploited. Follow each step in this Vigilance MDR analysis of a real-world attack and learn how to prevent it on your network.

Continuing from our previous blog Basics of AWS S3 Bucket Penetration Testing and once you have configured the AWS CLI setup we will move to exploit the AWS S3 bucket vulnerabilities. AWS S3 Common Vulnerabilities: Unauthenticated Bucket Access: S3 bucket…

A few months ago I came across a curious design pattern on Google Scholar. Multiple screens of the web application were fetched and rendered using a combination of location.hash parameters and XHR to retrieve the supposed templating snippets from a relative…

Rsync is a tool for intelligently syncing local and remote directories. In this article we will explore the basic usage of this utility to copy files from di…

Netsweeper provides real-time content monitoring and reporting for early intervention. One of our researchers had recently managed to perform remote code execution on Netsweeper’s content monitoring platform which may pose a risk to firms and industries utilizing…