Information Security
@sec_nerd_en
415 subscribers
157 photos
5 videos
9 files
2.28K links
Information Security News

we are @sec_nerd twin brother
Download Telegram
About
Blog
Apps
Platform
Join
Information Security
415 subscribers
Information Security
https://blog.doyensec.com/2020/04/30/polymorphic-images-for-xss.html
Doyensec
Researching Polymorphic Images for XSS on Google Scholar
A few months ago I came across a curious design pattern on Google Scholar. Multiple screens of the web application were fetched and rendered using a combination of location.hash parameters and XHR to retrieve the supposed templating snippets from a relative…
125 views
Information Security
https://book.hacktricks.xyz/linux-unix/useful-linux-commands/bypass-bash-restrictions
book.hacktricks.xyz
Bypass Bash Restrictions
142 views
Information Security
https://www.digitalocean.com/community/tutorials/how-to-use-rsync-to-sync-local-and-remote-directories-on-a-vps
Digitalocean
How To Use Rsync to Sync Local and Remote Directories | DigitalOcean
Rsync is a tool for intelligently syncing local and remote directories. In this article we will explore the basic usage of this utility to copy files from di…
134 views
Information Security
https://ssd-disclosure.com/ssd-advisory-netsweeper-preauth-rce/
SSD Secure Disclosure
SSD Advisory - Netsweeper PreAuth RCE - SSD Secure Disclosure
Netsweeper provides real-time content monitoring and reporting for early intervention. One of our researchers had recently managed to perform remote code execution on Netsweeper’s content monitoring platform which may pose a risk to firms and industries utilizing…
140 views
Information Security
https://medium.com/@rooterkaustubh/the-story-of-blind-ssrf-leads-to-internal-host-discovery-ee65b9b91e23
Medium
The Story of Blind SSRF leads to internal Host discovery.
Background
162 views
Information Security
https://wunderwuzzi23.github.io/blog/passthecookie.html
140 views
Information Security
https://medium.com/@impratikdabhi/reflected-xss-on-microsoft-com-via-angular-template-injection-2e26d80a7fd8
Medium
Reflected XSS on Microsoft.com via Angular Js template injection
I got lots of message for Microsoft POC on Instagram and whatsapp also So i think write a blog for it.
136 views
Information Security
https://itm4n.github.io/printspoofer-abusing-impersonate-privileges/
itm4n’s blog
PrintSpoofer - Abusing Impersonation Privileges on Windows 10 and Server 2019
Over the last few years, tools such as RottenPotato, RottenPotatoNG or Juicy Potato have made the exploitation of impersonation privileges on Windows very popular among the offensive security community. Though, recent changes to the operating system have…
149 views
Information Security
https://github.com/buftas/Active-Directory-Exploitation-Cheat-Sheet
GitHub
GitHub - S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet: A cheat sheet that contains common enumeration and attack methods…
A cheat sheet that contains common enumeration and attack methods for Windows Active Directory. - S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
139 views
Information Security
[XSS] #BugBountyTips

Found a weird XSS filter bypass using this payload:

<style/><img src="z'z</style><script/z>alert(1)</script>">

#BugBounty @XssPayloads
141 views
Information Security
https://github.com/ivan-sincek/powershell-reverse-tcp
GitHub
GitHub - ivan-sincek/powershell-reverse-tcp: PowerShell scripts for communicating with a remote host.
PowerShell scripts for communicating with a remote host. - ivan-sincek/powershell-reverse-tcp
147 views
Information Security
https://hausec.com/2019/03/05/penetration-testing-active-directory-part-i/

https://hausec.com/2019/03/12/penetration-testing-active-directory-part-ii/
hausec
Penetration Testing Active Directory, Part I
I’ve had several customers come to me before a pentest and say they think they’re in a good shape because their vulnerability scan shows no critical vulnerabilities and that they’…
181 views
Information Security
https://github.com/splitline/PHPFuck
GitHub
GitHub - splitline/PHPFuck: PHPFuck: ([+.^]) / Using only 7 different characters to write and execute php.
PHPFuck: ([+.^]) / Using only 7 different characters to write and execute php. - GitHub - splitline/PHPFuck: PHPFuck: ([+.^]) / Using only 7 different characters to write and execute php.
162 views
Information Security
https://blog.silentsignal.eu/2020/05/04/decrypting-and-analyzing-https-traffic-without-mitm/
131 views
Information Security
https://ijustwannared.team/2020/05/05/com-hijacking-for-lateral-movement/
ijustwannaredteam
COM Hijacking for Lateral Movement
Hey all, This post is about leveraging COM hijacking for lateral movement. I’m going to stay away from deep-diving COM internals as hijacking is not a new topic and has been explored by peopl…
128 views
Information Security
https://github.com/Flangvik/NetLoader
GitHub
GitHub - Flangvik/NetLoader: Loads any C# binary in mem, patching AMSI + ETW.
Loads any C# binary in mem, patching AMSI + ETW. . Contribute to Flangvik/NetLoader development by creating an account on GitHub.
134 views
Information Security
https://medium.com/@mattharr0ey/privilege-escalation-uac-bypass-in-changepk-c40b92818d1b
Medium
Privilege escalation (UAC bypass) in ChangePK
Introduction It’s been a long time since I decided to to be away from Twitter for a while for self-improvements reasons and finding…
127 views
Information Security
https://github.com/dozernz/cve-2020-11651
GitHub
GitHub - dozernz/cve-2020-11651
Contribute to dozernz/cve-2020-11651 development by creating an account on GitHub.
122 views
Information Security
https://github.com/euphrat1ca/CVE-2020-0618
GitHub
GitHub - euphrat1ca/CVE-2020-0618: SQL Server Reporting Services(CVE-2020-0618)中的RCE
SQL Server Reporting Services(CVE-2020-0618)中的RCE. Contribute to euphrat1ca/CVE-2020-0618 development by creating an account on GitHub.
129 views
Information Security
#Pentest #bugbounty

https://github.com/k8gege/K8tools
https://github.com/mbechler/marshalsec
https://github.com/lanjelot/patator
https://github.com/coreb1t/awesome-pentest-cheat-sheets
https://github.com/evilcos/xssor2
https://github.com/cujanovic/SSRF-Testing
https://github.com/LandGrey/pydictor
https://github.com/m0rtem/CloudFail
https://github.com/1N3/Findsploit
https://github.com/rewardone/OSCPRepo


#bugbountytips
GitHub
GitHub - k8gege/K8tools: K8工具合集(内网渗透/提权工具/远程溢出/漏洞利用/扫描工具/密码破解/免杀工具/Exploit/APT/0day/Shellcode/Payload/priviledge/BypassUAC/Ove…
K8工具合集(内网渗透/提权工具/远程溢出/漏洞利用/扫描工具/密码破解/免杀工具/Exploit/APT/0day/Shellcode/Payload/priviledge/BypassUAC/OverFlow/WebShell/PenTest) Web GetShell Exploit(Struts2/Zimbra/Weblogic/Tomcat/Apache/Jboss/DotNetN...
150 views