Information Security
@sec_nerd_en
414 subscribers
157 photos
5 videos
9 files
2.28K links
Information Security News

we are @sec_nerd twin brother
Download Telegram
About
Blog
Apps
Platform
Join
Information Security
414 subscribers
Information Security
Information Security
https://medium.com/101-writeups/hacking-json-web-token-jwt-233fe6c862e6
https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2019/january/jwt-attack-walk-through/
123 views
Information Security
https://twitter.com/gerhart_x/status/1172975805447757826
Twitter
gerhart
Good job! Short exploit modification allows inject unsigned dll to protected (SignatureLevel+MitigationFlags) Hyper-V guest OS process (vmwp.exe) in Windows Server 2019, when Secure Boot option is enabled for host OS. https://t.co/gbqHu4eEiY
114 views
Information Security
https://medium.com/@vickieli/deserialization-bugs-in-the-wild-fe37149a7ee1
Medium
Deserialization Bugs in the Wild
A totally unscientific analysis of deserialization vulns found in the wild
97 views
Information Security
https://twitter.com/Steve_MSFT/status/1174394196184068097
Twitter
Steve Lee
Coming in #PowerShell7 Preview4, you can use `Invoke-DscResource` directly without LCM! Work in progress with some limitations! https://t.co/IpgGASst7g
102 views
Information Security
https://staaldraad.github.io/
95 views
Information Security
Scrapyd Unauthenticated Remote Code Execution

https://github.com/vulhub/vulhub/tree/master/scrapy/scrapyd-unacc
99 views
Information Security
https://twitter.com/RedDrip7/status/1174963799545090048
Twitter
RedDrip Team
#APT A decoy document, pretending to have content regarding conference held in #Kherson Oblast, seems created by #Gamaredon to target #Ukraine. Template injection has been used to avoid being detected. https://t.co/LxJnkx9VlF
100 views
Information Security
https://github.com/evilAdan0s/CVE-2019-16097/
GitHub
GitHub - evilAdan0s/CVE-2019-16097: CVE-2019-16097 PoC
CVE-2019-16097 PoC. Contribute to evilAdan0s/CVE-2019-16097 development by creating an account on GitHub.
90 views
Information Security
Bypass firewalls by abusing DNS history

https://github.com/vincentcox/bypass-firewalls-by-DNS-history
105 views
Information Security
https://github.com/PowerShellMafia/PowerSploit/tree/master/Recon
GitHub
PowerSploit/Recon at master · PowerShellMafia/PowerSploit
PowerSploit - A PowerShell Post-Exploitation Framework - PowerShellMafia/PowerSploit
106 views
Information Security
https://www.kalitut.com/2019/05/Wifiphisher-evil-twin-attack.html
KaliTut
KaliTut: Wifiphisher Evil Twin Attack
Wifiphisher uses social engineering to get a password for WiFi and websites. Those. You do not need a powerful hardware for a long time for brute-force password.
108 views
Information Security
https://medium.com/bugbountywriteup/bug-bounty-tips-tricks-js-javascript-files-bdde412ea49d
Medium
Bug Bounty — Tips / Tricks / JS (JavaScript Files)
It all started in month of August when I reached out to Gerben Javado regarding a question, yes it was a basic question but a quick chat…
138 views
Information Security
https://github.com/ytdl-org/youtube-dl/
GitHub
GitHub - ytdl-org/youtube-dl: Command-line program to download videos from YouTube.com and other video sites
Command-line program to download videos from YouTube.com and other video sites - ytdl-org/youtube-dl
160 views
Information Security
https://twitter.com/bohops/status/970792894012551171
174 views
Information Security
awesome tutorial for socket programming in C

http://www.cs.rpi.edu/~moorthy/Courses/os98/Pgms/socket.html
233 views
Information Security
https://medium.com/@z3roTrust/bypassing-windows-user-account-control-9051c6a85734?aduc=5sEDRWu1568976488023
3.72K views
Information Security
Windows Hacking/Red teaming resources
https://docs.google.com/document/d/1HYPX0MMn2Qc0TNYRRIaaYU2GIbuTMXHm-JBhRR2vNMU/mobilebasic
3.68K views
Information Security
https://medium.com/@reegun/unsanitized-file-validation-leads-to-malicious-payload-download-via-office-binaries-202d02db7191


#Microsoft Office binaries #winword #excel #powerpnt added to #lolbas || #lolbin

https://lolbas-project.github.io/lolbas/OtherMSBinaries/Winword/
https://lolbas-project.github.io/lolbas/OtherMSBinaries/Powerpnt/
https://lolbas-project.github.io/lolbas/OtherMSBinaries/Excel/
Medium
Unsanitized file validation leads to Malicious payload download via Office binaries.
As a part of finding vulnerable endpoints to improve defence, I used to reckon legitimate binaries on any chance of masking for payload…
216 views
Information Security
https://github.com/OWASP/Amass


OWASP Amass Tip

For ASNs:
amass intel -org OrgName

For domain names:
amass intel -active -asn n1,n2

For subdomains and infrastructure:
amass enum -src -ip -df domains.txt
GitHub
GitHub - owasp-amass/amass: In-depth attack surface mapping and asset discovery
In-depth attack surface mapping and asset discovery - owasp-amass/amass
145 views
Information Security
https://github.com/secrary/Andromeda


android reverse engineering
GitHub
GitHub - secrary/Andromeda: Andromeda - Interactive Reverse Engineering Tool for Android Applications
Andromeda - Interactive Reverse Engineering Tool for Android Applications - secrary/Andromeda
137 views