Information Security
@sec_nerd_en
408 subscribers
157 photos
5 videos
9 files
2.28K links
Information Security News

we are @sec_nerd twin brother
Download Telegram
About
Blog
Apps
Platform
Join
Information Security
408 subscribers
Information Security
https://github.com/taviso/avscript
GitHub
GitHub - taviso/avscript: Avast JavaScript Interactive Shell
Avast JavaScript Interactive Shell . Contribute to taviso/avscript development by creating an account on GitHub.
102 views
Information Security
https://github.com/xdavidhu/awesome-google-vrp-writeups
GitHub
GitHub - xdavidhu/awesome-google-vrp-writeups: 🐛 A list of writeups from the Google VRP Bug Bounty program
🐛 A list of writeups from the Google VRP Bug Bounty program - xdavidhu/awesome-google-vrp-writeups
106 views
Information Security
#bugbountytip #bugbounty Directory listing bypass payloads : Any file name or folder name ..%3B/
/%20../
/.ssh/authorized_keys
/.ssh/known_hosts
/%2e%2e/google.com
..%3B/////////////////////////////////
108 views
Information Security
Some Automated Scanner

https://github.com/1N3/BruteX
https://github.com/1N3/BlackWidow
https://github.com/sa7mon/S3Scanner
https://github.com/MichaelStott/CRLF-Injection-Scanner
https://github.com/jaeles-project/jaeles
https://github.com/random-robbie/kube-scan
https://github.com/hash3liZer/Subrake
https://github.com/j3ssie/Osmedeus
https://github.com/sullo/nikto

#bugbounty,#bugbountytips
GitHub
GitHub - 1N3/BruteX: Automatically brute force all services running on a target.
Automatically brute force all services running on a target. - 1N3/BruteX
108 views
Information Security
https://www.miguelxpn.com/security/2020/03/08/Server-side-XSS.html
Miguel Xavier Penha Neto
Server side XSS
XSS stands for Cross Site Scripting, it’s basically when input is not properly sanitized somewhere and a malicious actor can inject unintended javascript somewhere. That javascript will be executed by some unsuspecting user’s browser and then bad stuff can…
108 views
Information Security
https://twitter.com/wugeej/status/1237197554015600640?s=20
Twitter
Jin Wook Kim
[CVE-2020-10111] Citrix Gateway 11.1 / 12.0 / 12.1 Cache Bypass [Proof Of Concept] $ curl --include --url https://$NSGATEWAYHOST/logon/incremental.php --data "value=22" https://t.co/qSZ5pgUhpe
103 views
Information Security
https://nets.ec/Unsafe_string_replacement
108 views
Information Security
https://medium.com/@br4nsh/a-meterpreter-and-windows-proxy-case-4af2b866f4a1
Medium
A Meterpreter and Windows proxy case
Introduction
101 views
Information Security
Linux For Pentester:tmux Privilege Escalation.pdf:
https://github.com/blaCCkHatHacEEkr/PENTESTING-BIBLE/blob/master/8-part-100-article/62_article/new/Linux%20For%20Pentester:%20tmux%20Privilege%20Escalation.pdf
Linux for Pentester:Perl Privilege Escalation.pdf
https://github.com/blaCCkHatHacEEkr/PENTESTING-BIBLE/blob/master/2/Linux%20for%20Pentester:%20Perl%20Privilege%20Escalation.pdf
Linux for Pentester:ed Privilege Escalation.pdf
https://github.com/blaCCkHatHacEEkr/PENTESTING-BIBLE/blob/master/8-part-100-article/62_article/new/Linux%20for%20Pentester:%20ed%20Privilege%20Escalation.pdf
#Pentesting #RedTeam #hacking #PenTest
GitHub
blaCCkHatHacEEkr/PENTESTING-BIBLE
This repository was created and developed by Ammar Amer @cry__pto Only. Updates to this repository will continue to arrive until the number of links reaches 10000 links & 10000 pdf files .L...
108 views
Information Security
https://blahcat.github.io/2020/03/09/unexpected-logic-bug-win32k/
blahcat.github.io
Blah Cats
Tales of a binary encoded life...
91 views
Information Security
https://github.com/hlldz/pickl3
GitHub
GitHub - hlldz/pickl3: Windows active user credential phishing tool
Windows active user credential phishing tool. Contribute to hlldz/pickl3 development by creating an account on GitHub.
100 views
Information Security
Return a list of endpoints from a swagger.json.
Pass them to your fuzzer(s), +profit?

curl -s hxxps://petstore.swagger.io/v2/swagger.json | jq '.paths | keys[]'

#bugbounty #bugbountytips #redteam #security #oneliner #bash
106 views
Information Security
Lots to dive into this week's CryptOsint.

U.S. Treasury tries its hand at graphic design, Paul Singer & Jack Dorsey make up, AND Russian oligarchs are investing in Telegram's ICO.


https://mailchi.mp/782847570f22/us-treasury-shows-how-chinese-nationals-launder-money-for-dprk
110 views
Information Security
https://www.youtube.com/watch?v=nNBktKw9Is4
YouTube
Hardware Wallet Hack: Ledger Nano S - f00dbabe
It was found that the Ledger Nano S bootloader can be tricked into flashing and executing untrusted firmware.

Research Site: https://wallet.fail/
Twitter: https://twitter.com/walletfail
Thomas Roth: https://twitter.com/stacksmashing
original wallet.fail…
107 views
Information Security
https://bo0om.ru/icloud-phishers
100 views
Information Security
https://medium.com/@br4nsh/a-meterpreter-and-windows-proxy-case-4af2b866f4a1
Medium
A Meterpreter and Windows proxy case
Introduction
96 views
Information Security
No Privilege Escalating through standard methods ?

whoami /priv

If you got one of these == win 😏


SeBackupPrivilege, SeDebugPrivilege, SeTakeOwnershipPrivilege, SeTcbPrivilege, SeCreateToken Privilege, SeLoadDriver Privilege, SeImpersonate

#infosec #pentest #redteam
105 views
Information Security
https://www.cybereason.com/blog/excel4.0-macros-now-with-twice-the-bits
Cybereason
Excel4.0 Macros - Now with Twice The Bits!
In this research, we outline how to enable the execution of 64-bit shellcode via Excel 4.0 macros and previous research on 32-bit shellcode.
98 views
Information Security
https://www.youtube.com/watch?v=O7CuFlM4V54
YouTube
How a packet moves through network
How a packet moves through network
107 views
Information Security
https://github.com/saferwall/saferwall
GitHub
GitHub - saferwall/saferwall: :cloud: Collaborative Malware Analysis Platform at Scale
:cloud: Collaborative Malware Analysis Platform at Scale - GitHub - saferwall/saferwall: :cloud: Collaborative Malware Analysis Platform at Scale
109 views