Information Security
@sec_nerd_en
416 subscribers
157 photos
5 videos
9 files
2.28K links
Information Security News

we are @sec_nerd twin brother
Download Telegram
About
Blog
Apps
Platform
Join
Information Security
416 subscribers
Information Security
https://ijustwannared.team/2018/07/13/customized-psexec-via-reflective-dll/
ijustwannaredteam
Customized PSExec via Reflective DLL
Hey all, I’m back in the pocket after doing the deep dive into hack the box. I really enjoyed the bulk of the challenges and learned some new great tricks and techniques. One box I highly rec…
141 views
Information Security
https://aon.com/cyber-solutions/aon_cyber_labs/red-team-case-study-bypassing-cloudflare-waf-for-successful-ognl-injection
Aon
Red Team Case Study: Bypassing CloudFlare WAF for Successful OGNL Injection
Bypassing CloudFlare's WAF to exploit an OGNL injection vulnerability in a red team engagement while avoiding detection.
169 views
Information Security
https://www.sentinelone.com/blog/deep-dive-exploring-an-ntlm-brute-force-attack-with-bloodhound/
SentinelOne
Deep Dive: Exploring an NTLM Brute Force Attack with Bloodhound
NTLM is still actively exploited. Follow each step in this Vigilance MDR analysis of a real-world attack and learn how to prevent it on your network.
132 views
Information Security
https://blog.securelayer7.net/hands-on-aws-s3-bucket-vulnerabilities/amp/#click=https://t.co/XoJcSHQLmG
Penetration Testing and CyberSecurity Solution - SecureLayer7
Hands-on AWS S3 Bucket Vulnerabilities
Continuing from our previous blog Basics of AWS S3 Bucket Penetration Testing and once you have configured the AWS CLI setup we will move to exploit the AWS S3 bucket vulnerabilities. AWS S3 Common Vulnerabilities: Unauthenticated Bucket Access: S3 bucket…
134 views
Information Security
https://blog.doyensec.com/2020/04/30/polymorphic-images-for-xss.html
Doyensec
Researching Polymorphic Images for XSS on Google Scholar
A few months ago I came across a curious design pattern on Google Scholar. Multiple screens of the web application were fetched and rendered using a combination of location.hash parameters and XHR to retrieve the supposed templating snippets from a relative…
125 views
Information Security
https://book.hacktricks.xyz/linux-unix/useful-linux-commands/bypass-bash-restrictions
book.hacktricks.xyz
Bypass Bash Restrictions
142 views
Information Security
https://www.digitalocean.com/community/tutorials/how-to-use-rsync-to-sync-local-and-remote-directories-on-a-vps
Digitalocean
How To Use Rsync to Sync Local and Remote Directories | DigitalOcean
Rsync is a tool for intelligently syncing local and remote directories. In this article we will explore the basic usage of this utility to copy files from di…
134 views
Information Security
https://ssd-disclosure.com/ssd-advisory-netsweeper-preauth-rce/
SSD Secure Disclosure
SSD Advisory - Netsweeper PreAuth RCE - SSD Secure Disclosure
Netsweeper provides real-time content monitoring and reporting for early intervention. One of our researchers had recently managed to perform remote code execution on Netsweeper’s content monitoring platform which may pose a risk to firms and industries utilizing…
140 views
Information Security
https://medium.com/@rooterkaustubh/the-story-of-blind-ssrf-leads-to-internal-host-discovery-ee65b9b91e23
Medium
The Story of Blind SSRF leads to internal Host discovery.
Background
162 views
Information Security
https://wunderwuzzi23.github.io/blog/passthecookie.html
140 views
Information Security
https://medium.com/@impratikdabhi/reflected-xss-on-microsoft-com-via-angular-template-injection-2e26d80a7fd8
Medium
Reflected XSS on Microsoft.com via Angular Js template injection
I got lots of message for Microsoft POC on Instagram and whatsapp also So i think write a blog for it.
136 views
Information Security
https://itm4n.github.io/printspoofer-abusing-impersonate-privileges/
itm4n’s blog
PrintSpoofer - Abusing Impersonation Privileges on Windows 10 and Server 2019
Over the last few years, tools such as RottenPotato, RottenPotatoNG or Juicy Potato have made the exploitation of impersonation privileges on Windows very popular among the offensive security community. Though, recent changes to the operating system have…
149 views
Information Security
https://github.com/buftas/Active-Directory-Exploitation-Cheat-Sheet
GitHub
GitHub - S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet: A cheat sheet that contains common enumeration and attack methods…
A cheat sheet that contains common enumeration and attack methods for Windows Active Directory. - S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
139 views
Information Security
[XSS] #BugBountyTips

Found a weird XSS filter bypass using this payload:

<style/><img src="z'z</style><script/z>alert(1)</script>">

#BugBounty @XssPayloads
141 views
Information Security
https://github.com/ivan-sincek/powershell-reverse-tcp
GitHub
GitHub - ivan-sincek/powershell-reverse-tcp: PowerShell scripts for communicating with a remote host.
PowerShell scripts for communicating with a remote host. - ivan-sincek/powershell-reverse-tcp
147 views
Information Security
https://hausec.com/2019/03/05/penetration-testing-active-directory-part-i/

https://hausec.com/2019/03/12/penetration-testing-active-directory-part-ii/
hausec
Penetration Testing Active Directory, Part I
I’ve had several customers come to me before a pentest and say they think they’re in a good shape because their vulnerability scan shows no critical vulnerabilities and that they’…
181 views
Information Security
https://github.com/splitline/PHPFuck
GitHub
GitHub - splitline/PHPFuck: PHPFuck: ([+.^]) / Using only 7 different characters to write and execute php.
PHPFuck: ([+.^]) / Using only 7 different characters to write and execute php. - GitHub - splitline/PHPFuck: PHPFuck: ([+.^]) / Using only 7 different characters to write and execute php.
162 views
Information Security
https://blog.silentsignal.eu/2020/05/04/decrypting-and-analyzing-https-traffic-without-mitm/
131 views
Information Security
https://ijustwannared.team/2020/05/05/com-hijacking-for-lateral-movement/
ijustwannaredteam
COM Hijacking for Lateral Movement
Hey all, This post is about leveraging COM hijacking for lateral movement. I’m going to stay away from deep-diving COM internals as hijacking is not a new topic and has been explored by peopl…
128 views
Information Security
https://github.com/Flangvik/NetLoader
GitHub
GitHub - Flangvik/NetLoader: Loads any C# binary in mem, patching AMSI + ETW.
Loads any C# binary in mem, patching AMSI + ETW. . Contribute to Flangvik/NetLoader development by creating an account on GitHub.
134 views