А тут ультимативный гайд по бурпу, бесплатно
"The Ultimate Guide to Learning Burp Suite for FREE"

Включено в смежных статьях(тож по бурпику):
The Beginner’s Guide to API Hacking
7 Essential Burp Extensions for Hacking APIs
Automate your API hacking with Autorize
A Step-by-Step Guide to Writing Extensions for API Hacking
Improve your API Security Testing with Burp BCheck Scripts

https://danaepp.com/the-ultimate-guide-to-learning-burp-suite-for-free

#Beacon

Индус ковыряет zomato.com ручками на протяжении часа и таки нашел что-то типа idor. Не самый интересный ролик, но всю рутину как и что происходит описывает +-

https://www.youtube.com/live/oWrqe-mhjJ8?si=l0E1QT3D3dl-ebeH

#Becon

Автоматизация ручного пентеста,
https://youtu.be/DlTWet7JcKk?si=x6rhW6Bc7oQ3_Sdl

Прикольный спич про баг-баунти, девсекопс и underrated skills во всем этом, а также собственно как автоматизировать ручную работу

#Beacon

🚀 We're excited to unveil a new tool developed by our researcher @kiber_io: APKd. Now, you can effortlessly download APKs from AppGallery, APKPure, and RuStore directly from the terminal!

Check it out here: https://github.com/kiber-io/apkd

Pass-the-Challenge: Defeating Windows Defender Credential Guard

https://research.ifcr.dk/pass-the-challenge-defeating-windows-defender-credential-guard-31a892eee22

Why do we care?
Attackers often attempt to dump credentials from the LSASS process memory on a compromised machine in order to move laterally within the network, using tools like Mimikatz that can extract various credentials, including plaintext passwords, NTLM hashes, and Kerberos tickets.

Credential Guard appears to protect against these types of attacks by isolating NTLM hashes (and Kerberos tickets) in the LSASS process memory, thus protect against the initial compromise of a user’s NTLM hash.

Now, if we compromise a system that has Credential Guard enabled and attempt to extract credentials from the LSASS process memory using Mimikatz, what do we observe?...
(Дальше скрин в посте, хорошая статья)

#Beacon

"I’m Not A Pentester (And You Might Not Want To Be One Either)"

https://assume-breach.medium.com/im-not-a-pentester-and-you-might-not-want-to-be-one-either-8b5701808dfc?source=user_profile---------4----------------------------

https://assume-breach.medium.com/im-not-a-pentester-and-you-might-not-want-to-be-one-either-part-2-the-response-ab838cca3519?source=user_profile---------3----------------------------

Погружение в реальный мир ИБ
#Beacon

A LNK Between Browsers: Hunting Methodologies and Extension Abusing Actors

https://cloud.google.com/blog/topics/threat-intelligence/lnk-between-browsers

#Beacon

Red Team Fails - “Oops my bad I ruined the operation”, a story on how to fail a red team assessment.

https://swisskyrepo.github.io/Drink-Love-Share-Rump/

#Beacon

This book is truly intended to be an all-in-one guide for security professionals who work with Windows-
based infrastructure, especially AD. Penetration testers and red team operators will find practical
attack scenarios that they may encounter during real-life assessments. Security and IT engineers, as
well as blue teamers and incident responders, will benefit from detection and remediation guidelines.
To get the most out of this book, you should have basic knowledge of Windows services and AD

#Beacon

Full time bug hunting (Grzegorz Niedziela)

https://youtu.be/HwbEmHJGpcM?si=7jK1RyY2nQSxTvJU

#Beacon

Прикольный и интересный гайдик по основа редтима (да, это база)

Active Directory (Attack & Defense )
understand the specific tactics, techniques, and procedures (TTP) attackers are leveraging to compromise the active directory, this document is being updated regularly grabbed from different sources

https://0xsp.com/offensive/active-directory-attack-defense/#Discovery

Вкусно

вот-с в mp4 :)

Telegram has been hacked

#Beacon

https://youtu.be/6JY3uaLSflk