diff --git a/.gitbook/assets/image (1) (1) (1) (1) (1) (1) (1) (1).png b/.gitbook/assets/image (1) (1) (1) (1) (1) (1) (1) (1).png new file mode 100644 index 000000000..e70bceed6 Binary files /dev/null and b/.gitbook/assets/image (1) (1) (1) (1) (1) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (1) (1) (1) (1) (1) (1) (1).png b/.gitbook/assets/image (1) (1) (1) (1) (1) (1) (1).png index e70bceed6..2173ed0a4 100644 Binary files a/.gitbook/assets/image (1) (1) (1) (1) (1) (1) (1).png and b/.gitbook/assets/image (1) (1) (1) (1) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (1) (1) (1) (1) (1) (1).png b/.gitbook/assets/image (1) (1) (1) (1) (1) (1).png index 2173ed0a4..53e9f7c1f 100644 Binary files a/.gitbook/assets/image (1) (1) (1) (1) (1) (1).png and b/.gitbook/assets/image (1) (1) (1) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (1) (1) (1) (1) (1).png b/.gitbook/assets/image (1) (1) (1) (1) (1).png index 53e9f7c1f..0ea1b8586 100644 Binary files a/.gitbook/assets/image (1) (1) (1) (1) (1).png and b/.gitbook/assets/image (1) (1) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (1) (1) (1) (1).png b/.gitbook/assets/image (1) (1) (1) (1).png index 0ea1b8586..b38f1e7c3 100644 Binary files a/.gitbook/assets/image (1) (1) (1) (1).png and b/.gitbook/assets/image (1) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (1) (1) (1).png b/.gitbook/assets/image (1) (1) (1).png index b38f1e7c3..0e554c193 100644 Binary files a/.gitbook/assets/image (1) (1) (1).png and b/.gitbook/assets/image (1) (1) (1).png differ diff --git a/.gitbook/assets/image (1) (1).png b/.gitbook/assets/image (1) (1).png index 0e554c193..a8cfa5b77 100644 Binary files a/.gitbook/assets/image (1) (1).png and b/.gitbook/assets/image (1) (1).png differ diff --git a/.gitbook/assets/image (1).png b/.gitbook/assets/image (1).png index a8cfa5b77..33c23d55b 100644 Binary files a/.gitbook/assets/image (1).png and b/.gitbook/assets/image (1).png differ diff --git a/.gitbook/assets/image (2) (1) (1) (1) (1) (1) (1) (1).png b/.gitbook/assets/image (2) (1) (1) (1) (1) (1) (1) (1).png new file mode 100644 index 000000000..eaa792ed6 Binary files /dev/null and b/.gitbook/assets/image (2) (1) (1) (1) (1) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (2) (1) (1) (1) (1) (1) (1).png b/.gitbook/assets/image (2) (1) (1) (1) (1) (1) (1).png index eaa792ed6..eb7611c98 100644 Binary files a/.gitbook/assets/image (2) (1) (1) (1) (1) (1) (1).png and b/.gitbook/assets/image (2) (1) (1) (1) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (2) (1) (1) (1) (1) (1).png b/.gitbook/assets/image (2) (1) (1) (1) (1) (1).png index eb7611c98..4ede9266b 100644 Binary files a/.gitbook/assets/image (2) (1) (1) (1) (1) (1).png and b/.gitbook/assets/image (2) (1) (1) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (2) (1) (1) (1) (1).png b/.gitbook/assets/image (2) (1) (1) (1) (1).png index 4ede9266b..d7789e602 100644 Binary files a/.gitbook/assets/image (2) (1) (1) (1) (1).png and b/.gitbook/assets/image (2) (1) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (2) (1) (1) (1).png b/.gitbook/assets/image (2) (1) (1) (1).png index d7789e602..ca4b6651b 100644 Binary files a/.gitbook/assets/image (2) (1) (1) (1).png and b/.gitbook/assets/image (2) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (2) (1) (1).png b/.gitbook/assets/image (2) (1) (1).png index ca4b6651b..0330f840b 100644 Binary files a/.gitbook/assets/image (2) (1) (1).png and b/.gitbook/assets/image (2) (1) (1).png differ diff --git a/.gitbook/assets/image (2) (1).png b/.gitbook/assets/image (2) (1).png index 0330f840b..8190e06a7 100644 Binary files a/.gitbook/assets/image (2) (1).png and b/.gitbook/assets/image (2) (1).png differ diff --git a/.gitbook/assets/image (2).png b/.gitbook/assets/image (2).png index 8190e06a7..0c49287b0 100644 Binary files a/.gitbook/assets/image (2).png and b/.gitbook/assets/image (2).png differ diff --git a/.gitbook/assets/image (3) (1) (1) (1) (1) (1) (1) (1).png b/.gitbook/assets/image (3) (1) (1) (1) (1) (1) (1) (1).png new file mode 100644 index 000000000..455fbb8b7 Binary files /dev/null and b/.gitbook/assets/image (3) (1) (1) (1) (1) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (3) (1) (1) (1) (1) (1) (1).png b/.gitbook/assets/image (3) (1) (1) (1) (1) (1) (1).png index 455fbb8b7..6874f9c86 100644 Binary files a/.gitbook/assets/image (3) (1) (1) (1) (1) (1) (1).png and b/.gitbook/assets/image (3) (1) (1) (1) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (3) (1) (1) (1) (1) (1).png b/.gitbook/assets/image (3) (1) (1) (1) (1) (1).png index 6874f9c86..38b71f3d4 100644 Binary files a/.gitbook/assets/image (3) (1) (1) (1) (1) (1).png and b/.gitbook/assets/image (3) (1) (1) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (3) (1) (1) (1) (1).png b/.gitbook/assets/image (3) (1) (1) (1) (1).png index 38b71f3d4..7dcdeb084 100644 Binary files a/.gitbook/assets/image (3) (1) (1) (1) (1).png and b/.gitbook/assets/image (3) (1) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (3) (1) (1) (1).png b/.gitbook/assets/image (3) (1) (1) (1).png index 7dcdeb084..865dc4ae4 100644 Binary files a/.gitbook/assets/image (3) (1) (1) (1).png and b/.gitbook/assets/image (3) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (3) (1) (1).png b/.gitbook/assets/image (3) (1) (1).png index 865dc4ae4..0d52048cb 100644 Binary files a/.gitbook/assets/image (3) (1) (1).png and b/.gitbook/assets/image (3) (1) (1).png differ diff --git a/.gitbook/assets/image (3) (1).png b/.gitbook/assets/image (3) (1).png index 0d52048cb..b98c9fbbc 100644 Binary files a/.gitbook/assets/image (3) (1).png and b/.gitbook/assets/image (3) (1).png differ diff --git a/.gitbook/assets/image (3).png b/.gitbook/assets/image (3).png index b98c9fbbc..78abb7891 100644 Binary files a/.gitbook/assets/image (3).png and b/.gitbook/assets/image (3).png differ diff --git a/.gitbook/assets/image (4) (1) (1) (1) (2) (1).png b/.gitbook/assets/image (4) (1) (1) (1) (2) (1).png new file mode 100644 index 000000000..6c4e73dca Binary files /dev/null and b/.gitbook/assets/image (4) (1) (1) (1) (2) (1).png differ diff --git a/.gitbook/assets/image (4) (1) (1) (1) (2).png b/.gitbook/assets/image (4) (1) (1) (1) (2).png index 6c4e73dca..743e51c38 100644 Binary files a/.gitbook/assets/image (4) (1) (1) (1) (2).png and b/.gitbook/assets/image (4) (1) (1) (1) (2).png differ diff --git a/.gitbook/assets/image (4) (1) (1) (1).png b/.gitbook/assets/image (4) (1) (1) (1).png index 743e51c38..ea50c990a 100644 Binary files a/.gitbook/assets/image (4) (1) (1) (1).png and b/.gitbook/assets/image (4) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (4) (1) (1).png b/.gitbook/assets/image (4) (1) (1).png index ea50c990a..bc4b76df1 100644 Binary files a/.gitbook/assets/image (4) (1) (1).png and b/.gitbook/assets/image (4) (1) (1).png differ diff --git a/.gitbook/assets/image (4) (1).png b/.gitbook/assets/image (4) (1).png index bc4b76df1..8cd1f020d 100644 Binary files a/.gitbook/assets/image (4) (1).png and b/.gitbook/assets/image (4) (1).png differ diff --git a/.gitbook/assets/image (4).png b/.gitbook/assets/image (4).png index 8cd1f020d..c4dc34691 100644 Binary files a/.gitbook/assets/image (4).png and b/.gitbook/assets/image (4).png differ diff --git a/.gitbook/assets/image (5) (1) (1) (3) (1).png b/.gitbook/assets/image (5) (1) (1) (3) (1).png new file mode 100644 index 000000000..4642e6584 Binary files /dev/null and b/.gitbook/assets/image (5) (1) (1) (3) (1).png differ diff --git a/.gitbook/assets/image (5) (1) (1) (3).png b/.gitbook/assets/image (5) (1) (1) (3).png index 4642e6584..4fbfba8c7 100644 Binary files a/.gitbook/assets/image (5) (1) (1) (3).png and b/.gitbook/assets/image (5) (1) (1) (3).png differ diff --git a/.gitbook/assets/image (5) (1) (1).png b/.gitbook/assets/image (5) (1) (1).png index 4fbfba8c7..77f2a8962 100644 Binary files a/.gitbook/assets/image (5) (1) (1).png and b/.gitbook/assets/image (5) (1) (1).png differ diff --git a/.gitbook/assets/image (5) (1).png b/.gitbook/assets/image (5) (1).png index 77f2a8962..d74f01753 100644 Binary files a/.gitbook/assets/image (5) (1).png and b/.gitbook/assets/image (5) (1).png differ diff --git a/.gitbook/assets/image (5).png b/.gitbook/assets/image (5).png index d74f01753..8f87ed9e5 100644 Binary files a/.gitbook/assets/image (5).png and b/.gitbook/assets/image (5).png differ diff --git a/.gitbook/assets/image (6) (1) (4).png b/.gitbook/assets/image (6) (1) (4).png new file mode 100644 index 000000000..a463e90ba Binary files /dev/null and b/.gitbook/assets/image (6) (1) (4).png differ diff --git a/.gitbook/assets/image (6) (1).png b/.gitbook/assets/image (6) (1).png index a463e90ba..3ae281225 100644 Binary files a/.gitbook/assets/image (6) (1).png and b/.gitbook/assets/image (6) (1).png differ diff --git a/.gitbook/assets/image (6).png b/.gitbook/assets/image (6).png index 3ae281225..8f87ed9e5 100644 Binary files a/.gitbook/assets/image (6).png and b/.gitbook/assets/image (6).png differ diff --git a/.gitbook/assets/image (7) (1) (2) (2).png b/.gitbook/assets/image (7) (1) (2) (2).png new file mode 100644 index 000000000..2cafa46e9 Binary files /dev/null and b/.gitbook/assets/image (7) (1) (2) (2).png differ diff --git a/.gitbook/assets/image (7) (1) (2).png b/.gitbook/assets/image (7) (1) (2).png index 2cafa46e9..d990711a1 100644 Binary files a/.gitbook/assets/image (7) (1) (2).png and b/.gitbook/assets/image (7) (1) (2).png differ diff --git a/.gitbook/assets/image (7) (1).png b/.gitbook/assets/image (7) (1).png index d990711a1..c78341920 100644 Binary files a/.gitbook/assets/image (7) (1).png and b/.gitbook/assets/image (7) (1).png differ diff --git a/.gitbook/assets/image (7).png b/.gitbook/assets/image (7).png index c78341920..a75850811 100644 Binary files a/.gitbook/assets/image (7).png and b/.gitbook/assets/image (7).png differ diff --git a/.gitbook/assets/image.png b/.gitbook/assets/image.png index a75850811..59ecb25fa 100644 Binary files a/.gitbook/assets/image.png and b/.gitbook/assets/image.png differ diff --git a/.gitbook/assets/stm (1).png b/.gitbook/assets/stm (1).png new file mode 100644 index 000000000..be6aab78a Binary files /dev/null and b/.gitbook/assets/stm (1).png differ diff --git a/.gitbook/assets/websec (1).svg b/.gitbook/assets/websec (1).svg new file mode 100644 index 000000000..22b6bb764 --- /dev/null +++ b/.gitbook/assets/websec (1).svg @@ -0,0 +1,12 @@ + + + + + + + + + + + + diff --git a/README.md b/README.md index ca2120e78..ba3866e24 100644 --- a/README.md +++ b/README.md @@ -16,13 +16,13 @@ To get started follow this page where you will find the **typical flow** that ** ## Platinum Sponsors -_Your company could be here_ +_Your company could be here._ ## Corporate Sponsors ### [STM Cyber](https://www.stmcyber.com) -![](<.gitbook/assets/image (642) (1) (1) (1).png>) +
[**STM Cyber**](https://www.stmcyber.com) is a great cybersecurity company whose slogan is **HACK THE UNHACKABLE**. They perform their own research and develop their own hacking tools to **offer several valuable cybersecurity services** like pentesting, Red teams and training. @@ -32,7 +32,7 @@ You can check their **blog** in [**https://blog.stmcyber.com**](https://blog.stm ### [RootedCON](https://www.rootedcon.com/) -
+
[**RootedCON**](https://www.rootedcon.com) is the most relevant cybersecurity event in **Spain** and one of the most important in **Europe**. With **the mission of promoting technical knowledge**, this congress is a boiling meeting point for technology and cybersecurity professionals in every discipline. @@ -40,7 +40,7 @@ You can check their **blog** in [**https://blog.stmcyber.com**](https://blog.stm ### [Intigriti](https://www.intigriti.com) -![](.gitbook/assets/i3.png) +
**Intigriti** is the **Europe's #1** ethical hacking and **bug bounty platform.** @@ -50,7 +50,7 @@ You can check their **blog** in [**https://blog.stmcyber.com**](https://blog.stm ### [Trickest](https://trickest.com/?utm\_campaign=hacktrics\&utm\_medium=banner\&utm\_source=hacktricks) -
+
\ Use [**Trickest**](https://trickest.com/?utm\_campaign=hacktrics\&utm\_medium=banner\&utm\_source=hacktricks) to easily build and **automate workflows** powered by the world's **most advanced** community tools. @@ -61,7 +61,7 @@ Get Access Today: ### [Intruder](https://www.intruder.io/?utm\_source=referral\&utm\_campaign=hacktricks) -
+
Stay a step ahead in the cybersecurity game. @@ -75,7 +75,7 @@ Intruder never rests. Round-the-clock protection monitors your systems 24/7. Wan ### [HACKENPROOF](https://bit.ly/3xrrDrL) -
+
**HackenProof is home to all crypto bug bounties.** @@ -92,11 +92,9 @@ Gain reputation points with each verified bug and conquer the top of the weekly {% embed url="https://hackenproof.com/register" %} -\--- - ### [WebSec](https://websec.nl/) -
+
[**WebSec**](https://websec.nl) is a professional cybersecurity company based in **Amsterdam** which helps **protecting** businesses **all over the world** against the latest cybersecurity threats by providing **offensive-security services** with a **modern** approach. @@ -116,13 +114,7 @@ In addition to the above WebSec is also a **committed supporter of HackTricks.** [**DragonJAR es una empresa líder en ciberseguridad ofensiva**](https://www.dragonjar.org/) **ubicada en Colombia**, DragonJAR ofrece [servicios integrales de seguridad informática ofensiva, como **pentesting**](https://www.dragonjar.org/servicios-de-seguridad-informatica) en diversas áreas y prácticamente **cualquier tecnología**, simulaciones de ataque **Red Team**, pruebas de seguridad **física**, **pruebas de estrés**, ingeniería social, revisión de seguridad en **código fuente** y capacitación en seguridad informática. Asimismo, organiza la **DragonJAR Security Conference**, [un congreso internacional de seguridad informática](https://www.dragonjarcon.org/) que se ha realizado durante más de una década, convirtiéndose en el escaparate para las últimas investigaciones de seguridad en español y de gran relevancia en la región. -### [SYN CUBES](https://www.syncubes.com/) -
- -**Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. - -{% embed url="https://www.syncubes.com/" %} ## License diff --git a/backdoors/salseo.md b/backdoors/salseo.md index 6cf240ba6..b0c226fee 100644 --- a/backdoors/salseo.md +++ b/backdoors/salseo.md @@ -99,13 +99,13 @@ Open the SalseoLoader project using Visual Studio. ### Add before the main function: \[DllExport] -![](<../.gitbook/assets/image (2) (1) (1) (1) (1) (1) (1).png>) +![](<../.gitbook/assets/image (2) (1) (1) (1) (1) (1) (1) (1).png>) ### Install DllExport for this project #### **Tools** --> **NuGet Package Manager** --> **Manage NuGet Packages for Solution...** -![](<../.gitbook/assets/image (3) (1) (1) (1) (1) (1) (1).png>) +![](<../.gitbook/assets/image (3) (1) (1) (1) (1) (1) (1) (1).png>) #### **Search for DllExport package (using Browse tab), and press Install (and accept the popup)** diff --git a/forensics/basic-forensic-methodology/specific-software-file-type-tricks/.pyc.md b/forensics/basic-forensic-methodology/specific-software-file-type-tricks/.pyc.md index 0e56efe11..79ce0dce7 100644 --- a/forensics/basic-forensic-methodology/specific-software-file-type-tricks/.pyc.md +++ b/forensics/basic-forensic-methodology/specific-software-file-type-tricks/.pyc.md @@ -12,7 +12,7 @@ - + If you are interested in **hacking career** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). @@ -231,7 +231,7 @@ C:\Users\test\Desktop\test>pyinstaller --onefile hello.py * [https://blog.f-secure.com/how-to-decompile-any-python-binary/](https://blog.f-secure.com/how-to-decompile-any-python-binary/) - + If you are interested in **hacking career** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). diff --git a/macos-hardening/macos-red-teaming/README.md b/macos-hardening/macos-red-teaming/README.md index 368e60c38..893375f03 100644 --- a/macos-hardening/macos-red-teaming/README.md +++ b/macos-hardening/macos-red-teaming/README.md @@ -49,11 +49,11 @@ You could use the script [**JamfSniper.py**](https://github.com/WithSecureLabs/J Moreover, after finding proper credentials you could be able to brute-force other usernames with the next form: -![](<../../.gitbook/assets/image (7).png>) +![](<../../.gitbook/assets/image (7) (1).png>) #### JAMF device Authentication -
+
The **`jamf`** binary contained the secret to open the keychain which at the time of the discovery was **shared** among everybody and it was: **`jk23ucnq91jfu9aj`**.\ Moreover, jamf **persist** as a **LaunchDaemon** in **`/Library/LaunchAgents/com.jamf.management.agent.plist`** diff --git a/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-ipc-inter-process-communication/macos-pid-reuse.md b/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-ipc-inter-process-communication/macos-pid-reuse.md index 6c17c2893..2a9175348 100644 --- a/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-ipc-inter-process-communication/macos-pid-reuse.md +++ b/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-ipc-inter-process-communication/macos-pid-reuse.md @@ -23,7 +23,7 @@ This function will make the **allowed binary own the PID** but the **malicious X If you find the function **`shouldAcceptNewConnection`** or a function called by it **calling** **`processIdentifier`** and not calling **`auditToken`**. It highly probable means that it's v**erifying the process PID** and not the audit token.\ Like for example in this image (taken from the reference): -
+
Check this example exploit (again, taken from the reference) to see the 2 parts of the exploit: diff --git a/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-extensions.md b/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-extensions.md index 36d4da0d8..53c8234bd 100644 --- a/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-extensions.md +++ b/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-kernel-extensions.md @@ -22,7 +22,7 @@ Obviamente, esto es tan poderoso que es complicado cargar una extensión de kern * Al entrar en **modo de recuperación**, las extensiones de kernel deben estar **permitidas para ser cargadas**: -
+
* La extensión de kernel debe estar **firmada con un certificado de firma de código de kernel**, que solo puede ser otorgado por **Apple**. Quien revisará en detalle la **empresa** y las **razones** por las que se necesita. * La extensión de kernel también debe estar **notarizada**, Apple podrá verificarla en busca de malware. diff --git a/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/universal-binaries-and-mach-o-format.md b/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/universal-binaries-and-mach-o-format.md index 3c667436b..2498da2bf 100644 --- a/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/universal-binaries-and-mach-o-format.md +++ b/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/universal-binaries-and-mach-o-format.md @@ -76,7 +76,7 @@ fat_magic FAT_MAGIC or using the [Mach-O View](https://sourceforge.net/projects/machoview/) tool: -
+
As you may be thinking usually a universal binary compiled for 2 architectures **doubles the size** of one compiled for just 1 arch. @@ -203,7 +203,7 @@ Example of **section header**: If you **add** the **section offset** (0x37DC) + the **offset** where the **arch starts**, in this case `0x18000` --> `0x37DC + 0x18000 = 0x1B7DC` -
+
It's also possible to get **headers information** from the **command line** with: diff --git a/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-.net-applications-injection.md b/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-.net-applications-injection.md index 411d50d95..300fb82ee 100644 --- a/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-.net-applications-injection.md +++ b/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-.net-applications-injection.md @@ -21,7 +21,7 @@ It creates a 2 of names pipes per .Net process in [dbgtransportsession.cpp#L127] So, if you go to the users **`$TMPDIR`** you will be able to find **debugging fifos** you could use to debug .Net applications: -
+
The function [**DbgTransportSession::TransportWorker**](https://github.com/dotnet/runtime/blob/0633ecfb79a3b2f1e4c098d1dd0166bc1ae41739/src/coreclr/debug/shared/dbgtransportsession.cpp#L1259) will handle the communication from a debugger. diff --git a/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses.md b/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses.md index 7c623dec4..d6df2e920 100644 --- a/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses.md +++ b/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses.md @@ -149,7 +149,7 @@ $> ls ~/Documents Notes had access to TCC protected locations but when a note is created this is **created in a non-protected location**. So, you could ask notes to copy a protected file in a noe (so in a non-protected location) and then access the file: -
+
### CVE-2021-XXXX - Translocation diff --git a/mobile-pentesting/android-app-pentesting/avd-android-virtual-device.md b/mobile-pentesting/android-app-pentesting/avd-android-virtual-device.md index c054247fa..2b1192561 100644 --- a/mobile-pentesting/android-app-pentesting/avd-android-virtual-device.md +++ b/mobile-pentesting/android-app-pentesting/avd-android-virtual-device.md @@ -270,19 +270,19 @@ Explained in [**this video**](https://www.youtube.com/watch?v=qQicUW0svB8) you n 1. **Install a CA certificate**: Just **drag\&drop** the DER Burp certificate **changing the extension** to `.crt` in the mobile so it's stored in the Downloads folder and go to `Install a certificate` -> `CA certificate` -
+
* Check that the certificate was correctly stored going to `Trusted credentials` -> `USER` -
+
2. **Make it System trusted**: Download the Magisc module [MagiskTrustUserCerts](https://github.com/NVISOsecurity/MagiskTrustUserCerts) (a .zip file), **drag\&drop it** in the phone, go to the **Magics app** in the phone to the **`Modules`** section, click on **`Install from storage`**, select the `.zip` module and once installed **reboot** the phone: -
+
* After rebooting, go to `Trusted credentials` -> `SYSTEM` and check the Postswigger cert is there -
+
## Nice AVD Options diff --git a/mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-1.md b/mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-1.md index 8169b3bff..e9b66dae0 100644 --- a/mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-1.md +++ b/mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-1.md @@ -12,7 +12,7 @@ -
+
If you are interested in **hacking career** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). @@ -149,7 +149,7 @@ You can see that in [the next tutorial](frida-tutorial-2.md). -
+
If you are interested in **hacking career** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). diff --git a/mobile-pentesting/xamarin-apps.md b/mobile-pentesting/xamarin-apps.md index eed64f27d..c9128a9a7 100644 --- a/mobile-pentesting/xamarin-apps.md +++ b/mobile-pentesting/xamarin-apps.md @@ -18,7 +18,7 @@ Xamarin is an open-source platform that gives developers access to a comprehensi ### Xamarin Android Architecture -
+
Xamarin offers .NET bindings to Android.\* and Java.\* namespaces. Xamarin. @@ -36,7 +36,7 @@ It runs along with the Objective-C Runtime. The runtime environments run on top The below-given diagram depicts this architecture: -
+
### What is .Net Runtime and Mono Framework? @@ -72,7 +72,7 @@ If you encounter a Full AOT compiled application, and if the IL Assembly files a Just **unzip the apk/ipa** file and copy all the files present under the assemblies directory: -
+
In case of Android **APKs these dll files are compressed** and cannot be directly used for decompilation. Luckily there are tools out there that we can use to **uncompress these dll files** like [XamAsmUnZ](https://github.com/cihansol/XamAsmUnZ) and [xamarin-decompress](https://github.com/NickstaDB/xamarin-decompress). @@ -84,7 +84,7 @@ In the case of the iOS, **dll files inside the IPA files can be directly loaded* **Most of the application code can be found when we decompile the dll files.** Also note that Xamarin Framework based apps contain 90% of common code in the builds of all platforms like iOS and Android etc. -
+
From the above screenshot of listing the dll files that were present in the apk, we can confirm that it is a Xamarin app. It contains app-specific dll files along with the library files that are required for the app to run, such as `Xamarin.Essentails.dll` or `Mono.Security.dll` . diff --git a/network-services-pentesting/15672-pentesting-rabbitmq-management.md b/network-services-pentesting/15672-pentesting-rabbitmq-management.md index dde860cb7..060937612 100644 --- a/network-services-pentesting/15672-pentesting-rabbitmq-management.md +++ b/network-services-pentesting/15672-pentesting-rabbitmq-management.md @@ -12,7 +12,7 @@ - + If you are interested in **hacking career** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). @@ -60,7 +60,7 @@ Content-Length: 267 * `port:15672 http` - + If you are interested in **hacking career** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). diff --git a/network-services-pentesting/pentesting-postgresql.md b/network-services-pentesting/pentesting-postgresql.md index 10983df09..c79c6f8cc 100644 --- a/network-services-pentesting/pentesting-postgresql.md +++ b/network-services-pentesting/pentesting-postgresql.md @@ -489,7 +489,7 @@ In[ this **writeup**](https://www.wiz.io/blog/the-cloud-has-an-isolation-problem When you try to **make another user owner of a table** you should get an **error** preventing it, but apparently GCP gave that **option to the not-superuser postgres user** in GCP: -
+
Joining this idea with the fact that when the **INSERT/UPDATE/**[**ANALYZE**](https://www.postgresql.org/docs/13/sql-analyze.html) commands are executed on a **table with an index function**, the **function** is **called** as part of the command with the **table** **owner’s permissions**. It's possible to create an index with a function and give owner permissions to a **super user** over that table, and then run ANALYZE over the table with the malicious function that will be able to execute commands because it's using the privileges of the owner. diff --git a/network-services-pentesting/pentesting-ssh.md b/network-services-pentesting/pentesting-ssh.md index e08871a3d..270687a16 100644 --- a/network-services-pentesting/pentesting-ssh.md +++ b/network-services-pentesting/pentesting-ssh.md @@ -12,7 +12,7 @@ - + If you are interested in **hacking career** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). @@ -313,7 +313,7 @@ id_rsa * You can find interesting guides on how to harden SSH in [https://www.ssh-audit.com/hardening\_guides.html](https://www.ssh-audit.com/hardening\_guides.html) * [https://community.turgensec.com/ssh-hacking-guide](https://community.turgensec.com/ssh-hacking-guide) - + If you are interested in **hacking career** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). diff --git a/network-services-pentesting/pentesting-web/jboss.md b/network-services-pentesting/pentesting-web/jboss.md index b9f4beb6a..3eb2cac17 100644 --- a/network-services-pentesting/pentesting-web/jboss.md +++ b/network-services-pentesting/pentesting-web/jboss.md @@ -12,7 +12,7 @@ - + If you are interested in **hacking career** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). @@ -40,7 +40,7 @@ You can expose **management servlets** via the following paths within JBoss (dep inurl:status EJInvokerServlet ``` - + If you are interested in **hacking career** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). diff --git a/network-services-pentesting/pentesting-web/moodle.md b/network-services-pentesting/pentesting-web/moodle.md index 91a76fbe3..cf9493bf1 100644 --- a/network-services-pentesting/pentesting-web/moodle.md +++ b/network-services-pentesting/pentesting-web/moodle.md @@ -12,7 +12,7 @@ - + If you are interested in **hacking career** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). @@ -120,7 +120,7 @@ find / -name "config.php" 2>/dev/null | grep "moodle/config.php" /usr/local/bin/mysql -u --password= -e "use moodle; select email,username,password from mdl_user; exit" ``` - + If you are interested in **hacking career** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). diff --git a/pentesting-web/crlf-0d-0a.md b/pentesting-web/crlf-0d-0a.md index 5943673e0..22a6e664b 100644 --- a/pentesting-web/crlf-0d-0a.md +++ b/pentesting-web/crlf-0d-0a.md @@ -12,7 +12,7 @@ - + If you are interested in **hacking career** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). @@ -194,7 +194,7 @@ If a plarform is taking **data from an HTTP request and using it without sanitiz For example, in the original discovered vuln, cache keys were used to return the IP and port a user shuold connect to, and attackers were able to **inject memcache comands** that would **poison** the **cache to send the vistims details** (usrnames and passwords included) to the attacker servers: -
+
Moreover, researchers also discovered that they could desync the memcache responses to send the attackers ip and ports to users whose email the attacker didn't know: @@ -249,7 +249,7 @@ The best prevention technique is to not use users input directly inside response * [**https://www.acunetix.com/websitesecurity/crlf-injection/**](https://www.acunetix.com/websitesecurity/crlf-injection/) * [**https://portswigger.net/research/making-http-header-injection-critical-via-response-queue-poisoning**](https://portswigger.net/research/making-http-header-injection-critical-via-response-queue-poisoning) - + If you are interested in **hacking career** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). diff --git a/pentesting-web/deserialization/exploiting-__viewstate-parameter.md b/pentesting-web/deserialization/exploiting-__viewstate-parameter.md index d72a67ac8..90e6ca499 100644 --- a/pentesting-web/deserialization/exploiting-__viewstate-parameter.md +++ b/pentesting-web/deserialization/exploiting-__viewstate-parameter.md @@ -12,7 +12,7 @@ - + If you are interested in **hacking career** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). @@ -237,7 +237,7 @@ out of band request with the current username * [**https://soroush.secproject.com/blog/2019/04/exploiting-deserialisation-in-asp-net-via-viewstate/**](https://soroush.secproject.com/blog/2019/04/exploiting-deserialisation-in-asp-net-via-viewstate/) * [**https://blog.blacklanternsecurity.com/p/introducing-badsecrets**](https://blog.blacklanternsecurity.com/p/introducing-badsecrets) - + If you are interested in **hacking career** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). diff --git a/pentesting-web/file-inclusion/phar-deserialization.md b/pentesting-web/file-inclusion/phar-deserialization.md index 0e28c4cc2..cde92f322 100644 --- a/pentesting-web/file-inclusion/phar-deserialization.md +++ b/pentesting-web/file-inclusion/phar-deserialization.md @@ -12,7 +12,7 @@ - + If you are interested in **hacking career** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). @@ -89,7 +89,7 @@ php vuln.php {% embed url="https://blog.ripstech.com/2018/new-php-exploitation-technique/" %} - + If you are interested in **hacking career** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). diff --git a/pentesting-web/race-condition.md b/pentesting-web/race-condition.md index 162248fdb..07b98af19 100644 --- a/pentesting-web/race-condition.md +++ b/pentesting-web/race-condition.md @@ -24,7 +24,7 @@ Get Access Today: The main problem of abusing RC's is that you need the requests to be processed in parallel with a very short time difference(usually >1ms). In the following section, different solutions are proposed for making this possible. -
+
### Single-packet attack (HTTP/2) / Last-byte sync (HTTP/1.1) @@ -52,7 +52,7 @@ Note that It **doesn't work for static files** on certain servers but as static Using this technique, you can make 20-30 requests arrive at the server simultaneously - regardless of network jitter: -
+
**Adapting to the target architecture** @@ -72,13 +72,13 @@ If connection warming doesn't make any difference, there are various solutions t Using Turbo Intruder, you can introduce a short client-side delay. However, as this involves splitting your actual attack requests across multiple TCP packets, you won't be able to use the single-packet attack technique. As a result, on high-jitter targets, the attack is unlikely to work reliably regardless of what delay you set. -
+
Instead, you may be able to solve this problem by abusing a common security feature. Web servers often **delay the processing of requests if too many are sent too quickly**. By sending a large number of dummy requests to intentionally trigger the rate or resource limit, you may be able to cause a suitable server-side delay. This makes the single-packet attack viable even when delayed execution is required. -
+
{% hint style="warning" %} For more information about this technique check the original report in [https://portswigger.net/research/smashing-the-state-machine](https://portswigger.net/research/smashing-the-state-machine) @@ -88,7 +88,7 @@ For more information about this technique check the original report in [https:// * **Tubo Intruder - HTTP2 single-packet attack (1 endpoint)**: You can send the request to **Turbo intruder** (`Extensions` -> `Turbo Intruder` -> `Send to Turbo Intruder`), you can change in the request the value you want to brute force for **`%s`** like in `csrf=Bn9VQB8OyefIs3ShR2fPESR0FzzulI1d&username=carlos&password=%s` and then select the **`examples/race-single-packer-attack.py`** from the drop down: -
+
If you are going to **send different values**, you could modify the code with this one that uses a wordlist from the clipboard: @@ -141,7 +141,7 @@ Content-Length: 0 * For **delaying** the process **between** processing **one request and another** in a 2 substates steps, you could **add extra requests between** both requests. * For a **multi-endpoint** RC you could start sending the **request** that **goes to the hidden state** and then **50 requests** just after it that **exploits the hidden state**. -
+
### Raw BF @@ -238,7 +238,7 @@ Operations that edit existing data (such as changing an account's primary email Most endpoints operate on a specific record, which is looked up using a 'key', such as a username, password reset token, or filename. For a successful attack, we need two operations that use the same key. For example, picture two plausible password reset implementations: -
+
2. **Probe for clues** diff --git a/pentesting-web/xss-cross-site-scripting/dom-invader.md b/pentesting-web/xss-cross-site-scripting/dom-invader.md index c352a5e92..2cf1e60e4 100644 --- a/pentesting-web/xss-cross-site-scripting/dom-invader.md +++ b/pentesting-web/xss-cross-site-scripting/dom-invader.md @@ -31,7 +31,7 @@ In the Burp's builtin browser go to the **Burp extension** and enable it: Noe refresh the page and in the **Dev Tools** you will find the **DOM Invader tab:** -
+
### Inject a Canary @@ -69,7 +69,7 @@ You can click each message to view more detailed information about it, including DOM Invader can also search for **Prototype Pollution vulnerabilities**. First, you need to enable it: -
+
Then, it will **search for sources** that enable you to add arbitrary properties to the **`Object.prototype`**. diff --git a/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.md b/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.md index ae6953ea7..3d82556e3 100644 --- a/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.md +++ b/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.md @@ -579,7 +579,7 @@ If we try to authenticate with the certificate and `-ldap-shell`, we will notice One of the available commands for the LDAP shell is `set_rbcd` which will set Resource-Based Constrained Delegation (RBCD) on the target. So we could perform a RBCD attack to compromise the domain controller. -
+
Alternatively, we can also compromise any user account where there is no `userPrincipalName` set or where the `userPrincipalName` doesn’t match the `sAMAccountName` of that account. From my own testing, the default domain administrator `Administrator@corp.local` doesn’t have a `userPrincipalName` set by default, and this account should by default have more privileges in LDAP than domain controllers. diff --git a/windows-hardening/active-directory-methodology/silver-ticket.md b/windows-hardening/active-directory-methodology/silver-ticket.md index b5f2ee898..a04ebac47 100644 --- a/windows-hardening/active-directory-methodology/silver-ticket.md +++ b/windows-hardening/active-directory-methodology/silver-ticket.md @@ -12,7 +12,7 @@ - + If you are interested in **hacking career** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). @@ -168,7 +168,7 @@ mimikatz(commandline) # lsadump::dcsync /dc:pcdc.domain.local /domain:domain.loc [dcsync.md](dcsync.md) {% endcontent-ref %} - + If you are interested in **hacking career** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). diff --git a/windows-hardening/windows-local-privilege-escalation/dll-hijacking.md b/windows-hardening/windows-local-privilege-escalation/dll-hijacking.md index 4e0c387c9..fdf2f3efd 100644 --- a/windows-hardening/windows-local-privilege-escalation/dll-hijacking.md +++ b/windows-hardening/windows-local-privilege-escalation/dll-hijacking.md @@ -12,7 +12,7 @@ - + If you are interested in **hacking career** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). @@ -243,7 +243,7 @@ BOOL APIENTRY DllMain (HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReser } ``` - + If you are interested in **hacking career** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). diff --git a/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md b/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md index 1ae253a5d..40ac152af 100644 --- a/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md +++ b/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md @@ -12,7 +12,7 @@ - + If you are interested in **hacking career** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). @@ -351,7 +351,7 @@ Find more Autoruns like registries in [https://www.microsoftpressstore.com/artic * [https://attack.mitre.org/techniques/T1547/001/](https://attack.mitre.org/techniques/T1547/001/) * [https://www.microsoftpressstore.com/articles/article.aspx?p=2762082\&seqNum=2](https://www.microsoftpressstore.com/articles/article.aspx?p=2762082\&seqNum=2) - + If you are interested in **hacking career** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_).