diff --git a/.gitbook/assets/image (1) (1) (1) (1) (1).png b/.gitbook/assets/image (1) (1) (1) (1) (1).png deleted file mode 100644 index e70bceed6..000000000 Binary files a/.gitbook/assets/image (1) (1) (1) (1) (1).png and /dev/null differ diff --git a/.gitbook/assets/image (1) (1) (1) (1).png b/.gitbook/assets/image (1) (1) (1) (1).png index 847a8c4e7..e70bceed6 100644 Binary files a/.gitbook/assets/image (1) (1) (1) (1).png and b/.gitbook/assets/image (1) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (1) (1) (1).png b/.gitbook/assets/image (1) (1) (1).png index 964c9c53a..847a8c4e7 100644 Binary files a/.gitbook/assets/image (1) (1) (1).png and b/.gitbook/assets/image (1) (1) (1).png differ diff --git a/.gitbook/assets/image (1) (1).png b/.gitbook/assets/image (1) (1).png index 1defaaff1..964c9c53a 100644 Binary files a/.gitbook/assets/image (1) (1).png and b/.gitbook/assets/image (1) (1).png differ diff --git a/.gitbook/assets/image (1) (2) (2) (1).png b/.gitbook/assets/image (1) (2) (2) (1).png new file mode 100644 index 000000000..03b2fa6b3 Binary files /dev/null and b/.gitbook/assets/image (1) (2) (2) (1).png differ diff --git a/.gitbook/assets/image (1) (2) (2).png b/.gitbook/assets/image (1) (2) (2).png index 03b2fa6b3..357f8f6e1 100644 Binary files a/.gitbook/assets/image (1) (2) (2).png and b/.gitbook/assets/image (1) (2) (2).png differ diff --git a/.gitbook/assets/image (1) (2).png b/.gitbook/assets/image (1) (2).png index 357f8f6e1..1defaaff1 100644 Binary files a/.gitbook/assets/image (1) (2).png and b/.gitbook/assets/image (1) (2).png differ diff --git a/.gitbook/assets/image (1).png b/.gitbook/assets/image (1).png index 5fa1723d3..4f71bc136 100644 Binary files a/.gitbook/assets/image (1).png and b/.gitbook/assets/image (1).png differ diff --git a/.gitbook/assets/image (10) (1) (1).png b/.gitbook/assets/image (10) (1) (1).png new file mode 100644 index 000000000..d3370cd6f Binary files /dev/null and b/.gitbook/assets/image (10) (1) (1).png differ diff --git a/.gitbook/assets/image (10) (1).png b/.gitbook/assets/image (10) (1).png index d3370cd6f..89ad985c9 100644 Binary files a/.gitbook/assets/image (10) (1).png and b/.gitbook/assets/image (10) (1).png differ diff --git a/.gitbook/assets/image (10).png b/.gitbook/assets/image (10).png index 89ad985c9..e9a108f4c 100644 Binary files a/.gitbook/assets/image (10).png and b/.gitbook/assets/image (10).png differ diff --git a/.gitbook/assets/image (11) (3).png b/.gitbook/assets/image (11) (3).png new file mode 100644 index 000000000..8aeeb8354 Binary files /dev/null and b/.gitbook/assets/image (11) (3).png differ diff --git a/.gitbook/assets/image (11).png b/.gitbook/assets/image (11).png index 8aeeb8354..96e65bf64 100644 Binary files a/.gitbook/assets/image (11).png and b/.gitbook/assets/image (11).png differ diff --git a/.gitbook/assets/image (12) (1) (1).png b/.gitbook/assets/image (12) (1) (1).png new file mode 100644 index 000000000..c29de7533 Binary files /dev/null and b/.gitbook/assets/image (12) (1) (1).png differ diff --git a/.gitbook/assets/image (12) (1).png b/.gitbook/assets/image (12) (1).png index c29de7533..44fe5cb65 100644 Binary files a/.gitbook/assets/image (12) (1).png and b/.gitbook/assets/image (12) (1).png differ diff --git a/.gitbook/assets/image (12).png b/.gitbook/assets/image (12).png index 44fe5cb65..97878931c 100644 Binary files a/.gitbook/assets/image (12).png and b/.gitbook/assets/image (12).png differ diff --git a/.gitbook/assets/image (2) (1) (1) (1).png b/.gitbook/assets/image (2) (1) (1) (1).png deleted file mode 100644 index eaa792ed6..000000000 Binary files a/.gitbook/assets/image (2) (1) (1) (1).png and /dev/null differ diff --git a/.gitbook/assets/image (2) (1) (1).png b/.gitbook/assets/image (2) (1) (1).png index 0f8a86733..eaa792ed6 100644 Binary files a/.gitbook/assets/image (2) (1) (1).png and b/.gitbook/assets/image (2) (1) (1).png differ diff --git a/.gitbook/assets/image (2) (1) (2).png b/.gitbook/assets/image (2) (1) (2).png new file mode 100644 index 000000000..0f8a86733 Binary files /dev/null and b/.gitbook/assets/image (2) (1) (2).png differ diff --git a/.gitbook/assets/image (2).png b/.gitbook/assets/image (2).png index b9f5c2e68..7ed9c3141 100644 Binary files a/.gitbook/assets/image (2).png and b/.gitbook/assets/image (2).png differ diff --git a/.gitbook/assets/image (3) (1) (1) (1) (1).png b/.gitbook/assets/image (3) (1) (1) (1) (1).png deleted file mode 100644 index 455fbb8b7..000000000 Binary files a/.gitbook/assets/image (3) (1) (1) (1) (1).png and /dev/null differ diff --git a/.gitbook/assets/image (3) (1) (1) (1).png b/.gitbook/assets/image (3) (1) (1) (1).png index 371b81139..455fbb8b7 100644 Binary files a/.gitbook/assets/image (3) (1) (1) (1).png and b/.gitbook/assets/image (3) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (3) (1) (1) (2).png b/.gitbook/assets/image (3) (1) (1) (2).png new file mode 100644 index 000000000..371b81139 Binary files /dev/null and b/.gitbook/assets/image (3) (1) (1) (2).png differ diff --git a/.gitbook/assets/image (3).png b/.gitbook/assets/image (3).png index 7ed9c3141..a724cd3ae 100644 Binary files a/.gitbook/assets/image (3).png and b/.gitbook/assets/image (3).png differ diff --git a/.gitbook/assets/image (33) (1).png b/.gitbook/assets/image (33) (1).png deleted file mode 100644 index 7681c85e2..000000000 Binary files a/.gitbook/assets/image (33) (1).png and /dev/null differ diff --git a/.gitbook/assets/image (33).png b/.gitbook/assets/image (33).png index a724cd3ae..7681c85e2 100644 Binary files a/.gitbook/assets/image (33).png and b/.gitbook/assets/image (33).png differ diff --git a/.gitbook/assets/image (34) (1).png b/.gitbook/assets/image (34) (1).png deleted file mode 100644 index 9a275baae..000000000 Binary files a/.gitbook/assets/image (34) (1).png and /dev/null differ diff --git a/.gitbook/assets/image (34).png b/.gitbook/assets/image (34).png index e0eebcc35..9a275baae 100644 Binary files a/.gitbook/assets/image (34).png and b/.gitbook/assets/image (34).png differ diff --git a/.gitbook/assets/image (35) (1).png b/.gitbook/assets/image (35) (1).png deleted file mode 100644 index 84735e384..000000000 Binary files a/.gitbook/assets/image (35) (1).png and /dev/null differ diff --git a/.gitbook/assets/image (35).png b/.gitbook/assets/image (35).png index e9a108f4c..84735e384 100644 Binary files a/.gitbook/assets/image (35).png and b/.gitbook/assets/image (35).png differ diff --git a/.gitbook/assets/image (36) (1).png b/.gitbook/assets/image (36) (1).png deleted file mode 100644 index ceb0a0f91..000000000 Binary files a/.gitbook/assets/image (36) (1).png and /dev/null differ diff --git a/.gitbook/assets/image (36).png b/.gitbook/assets/image (36).png index 96e65bf64..ceb0a0f91 100644 Binary files a/.gitbook/assets/image (36).png and b/.gitbook/assets/image (36).png differ diff --git a/.gitbook/assets/image (37) (1).png b/.gitbook/assets/image (37) (1).png deleted file mode 100644 index 540b55ef0..000000000 Binary files a/.gitbook/assets/image (37) (1).png and /dev/null differ diff --git a/.gitbook/assets/image (37).png b/.gitbook/assets/image (37).png index a947aaf42..540b55ef0 100644 Binary files a/.gitbook/assets/image (37).png and b/.gitbook/assets/image (37).png differ diff --git a/.gitbook/assets/image (38) (1).png b/.gitbook/assets/image (38) (1).png deleted file mode 100644 index bcf09b809..000000000 Binary files a/.gitbook/assets/image (38) (1).png and /dev/null differ diff --git a/.gitbook/assets/image (38).png b/.gitbook/assets/image (38).png index 97878931c..bcf09b809 100644 Binary files a/.gitbook/assets/image (38).png and b/.gitbook/assets/image (38).png differ diff --git a/.gitbook/assets/image (39) (1).png b/.gitbook/assets/image (39) (1).png deleted file mode 100644 index 32dd042db..000000000 Binary files a/.gitbook/assets/image (39) (1).png and /dev/null differ diff --git a/.gitbook/assets/image (39).png b/.gitbook/assets/image (39).png index 4f71bc136..32dd042db 100644 Binary files a/.gitbook/assets/image (39).png and b/.gitbook/assets/image (39).png differ diff --git a/.gitbook/assets/image (4) (1) (1) (1).png b/.gitbook/assets/image (4) (1) (1) (1).png deleted file mode 100644 index 2fde683ec..000000000 Binary files a/.gitbook/assets/image (4) (1) (1) (1).png and /dev/null differ diff --git a/.gitbook/assets/image (4) (1) (1).png b/.gitbook/assets/image (4) (1) (1).png index 769cb6b20..2fde683ec 100644 Binary files a/.gitbook/assets/image (4) (1) (1).png and b/.gitbook/assets/image (4) (1) (1).png differ diff --git a/.gitbook/assets/image (4) (1) (3).png b/.gitbook/assets/image (4) (1) (3).png new file mode 100644 index 000000000..769cb6b20 Binary files /dev/null and b/.gitbook/assets/image (4) (1) (3).png differ diff --git a/.gitbook/assets/image (4).png b/.gitbook/assets/image (4).png index 7ed352b60..4ce8d98dd 100644 Binary files a/.gitbook/assets/image (4).png and b/.gitbook/assets/image (4).png differ diff --git a/.gitbook/assets/image (40) (1).png b/.gitbook/assets/image (40) (1).png deleted file mode 100644 index 53dd523e3..000000000 Binary files a/.gitbook/assets/image (40) (1).png and /dev/null differ diff --git a/.gitbook/assets/image (40).png b/.gitbook/assets/image (40).png index 87ef92dff..53dd523e3 100644 Binary files a/.gitbook/assets/image (40).png and b/.gitbook/assets/image (40).png differ diff --git a/.gitbook/assets/image (5) (1) (1) (1).png b/.gitbook/assets/image (5) (1) (1) (1).png new file mode 100644 index 000000000..b2c2c3d26 Binary files /dev/null and b/.gitbook/assets/image (5) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (5) (1) (1).png b/.gitbook/assets/image (5) (1) (1).png index b2c2c3d26..5dc69a4e7 100644 Binary files a/.gitbook/assets/image (5) (1) (1).png and b/.gitbook/assets/image (5) (1) (1).png differ diff --git a/.gitbook/assets/image (5) (1).png b/.gitbook/assets/image (5) (1).png index 5dc69a4e7..798a43e99 100644 Binary files a/.gitbook/assets/image (5) (1).png and b/.gitbook/assets/image (5) (1).png differ diff --git a/.gitbook/assets/image (5).png b/.gitbook/assets/image (5).png index 798a43e99..e0eebcc35 100644 Binary files a/.gitbook/assets/image (5).png and b/.gitbook/assets/image (5).png differ diff --git a/.gitbook/assets/image (6) (3).png b/.gitbook/assets/image (6) (3).png new file mode 100644 index 000000000..83716d209 Binary files /dev/null and b/.gitbook/assets/image (6) (3).png differ diff --git a/.gitbook/assets/image (6).png b/.gitbook/assets/image (6).png index 83716d209..b9f5c2e68 100644 Binary files a/.gitbook/assets/image (6).png and b/.gitbook/assets/image (6).png differ diff --git a/.gitbook/assets/image (7) (2).png b/.gitbook/assets/image (7) (2).png new file mode 100644 index 000000000..d56929629 Binary files /dev/null and b/.gitbook/assets/image (7) (2).png differ diff --git a/.gitbook/assets/image (7).png b/.gitbook/assets/image (7).png index d56929629..87ef92dff 100644 Binary files a/.gitbook/assets/image (7).png and b/.gitbook/assets/image (7).png differ diff --git a/.gitbook/assets/image (8) (3).png b/.gitbook/assets/image (8) (3).png new file mode 100644 index 000000000..0cadfb948 Binary files /dev/null and b/.gitbook/assets/image (8) (3).png differ diff --git a/.gitbook/assets/image (8).png b/.gitbook/assets/image (8).png index 0cadfb948..7ed352b60 100644 Binary files a/.gitbook/assets/image (8).png and b/.gitbook/assets/image (8).png differ diff --git a/.gitbook/assets/image (9) (3).png b/.gitbook/assets/image (9) (3).png new file mode 100644 index 000000000..84884c474 Binary files /dev/null and b/.gitbook/assets/image (9) (3).png differ diff --git a/.gitbook/assets/image (9).png b/.gitbook/assets/image (9).png index 84884c474..5fa1723d3 100644 Binary files a/.gitbook/assets/image (9).png and b/.gitbook/assets/image (9).png differ diff --git a/.gitbook/assets/image.png b/.gitbook/assets/image.png index 4ce8d98dd..a947aaf42 100644 Binary files a/.gitbook/assets/image.png and b/.gitbook/assets/image.png differ diff --git a/README.md b/README.md index edd8222e4..744742ef3 100644 --- a/README.md +++ b/README.md @@ -44,7 +44,7 @@ You can check their **blog** in [**https://blog.stmcyber.com**](https://blog.stm ### [SYN CUBES](https://www.syncubes.com/) -
+
**Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. diff --git a/backdoors/salseo.md b/backdoors/salseo.md index 694527c3a..6b0006022 100644 --- a/backdoors/salseo.md +++ b/backdoors/salseo.md @@ -99,17 +99,17 @@ Open the SalseoLoader project using Visual Studio. ### Add before the main function: \[DllExport] -![](<../.gitbook/assets/image (2) (1) (1) (1).png>) +![](<../.gitbook/assets/image (2) (1) (1).png>) ### Install DllExport for this project #### **Tools** --> **NuGet Package Manager** --> **Manage NuGet Packages for Solution...** -![](<../.gitbook/assets/image (3) (1) (1) (1) (1).png>) +![](<../.gitbook/assets/image (3) (1) (1) (1).png>) #### **Search for DllExport package (using Browse tab), and press Install (and accept the popup)** -![](<../.gitbook/assets/image (4) (1) (1) (1).png>) +![](<../.gitbook/assets/image (4) (1) (1).png>) In your project folder have appeared the files: **DllExport.bat** and **DllExport\_Configure.bat** @@ -117,7 +117,7 @@ In your project folder have appeared the files: **DllExport.bat** and **DllExpor Press **Uninstall** (yeah, its weird but trust me, it is necessary) -![](<../.gitbook/assets/image (5) (1).png>) +![](<../.gitbook/assets/image (5) (1) (1).png>) ### **Exit Visual Studio and execute DllExport\_configure** @@ -139,7 +139,7 @@ Select **x64** (if you are going to use it inside a x64 box, that was my case), Select **Output Type = Class Library** (Project --> SalseoLoader Properties --> Application --> Output type = Class Library) -![](<../.gitbook/assets/image (10) (1).png>) +![](<../.gitbook/assets/image (10) (1) (1).png>) Select **x64** **platform** (Project --> SalseoLoader Properties --> Build --> Platform target = x64) diff --git a/cryptography/certificates.md b/cryptography/certificates.md index d643969b7..7af8f3d85 100644 --- a/cryptography/certificates.md +++ b/cryptography/certificates.md @@ -12,7 +12,7 @@ - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. @@ -195,7 +195,7 @@ openssl pkcs7 -print_certs -in certificatename.p7b -out certificatename.cer openssl pkcs12 -export -in certificatename.cer -inkey privateKey.key -out certificatename.pfx -certfile cacert.cer ``` - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. diff --git a/exploiting/windows-exploiting-basic-guide-oscp-lvl.md b/exploiting/windows-exploiting-basic-guide-oscp-lvl.md index fb24d0eb4..1844fae16 100644 --- a/exploiting/windows-exploiting-basic-guide-oscp-lvl.md +++ b/exploiting/windows-exploiting-basic-guide-oscp-lvl.md @@ -160,11 +160,11 @@ For example: In this case you can see that **you shouldn't use the char 0x0A** (nothing is saved in memory since the char 0x09). -![](<../.gitbook/assets/image (33) (1).png>) +![](<../.gitbook/assets/image (33).png>) In this case you can see that **the char 0x0D is avoided**: -![](<../.gitbook/assets/image (34) (1).png>) +![](<../.gitbook/assets/image (34).png>) ## Find a JMP ESP as a return address @@ -182,7 +182,7 @@ You will **list the memory maps**. Search for some DLl that has: * **NXCompat: False** * **OS Dll: True** -![](<../.gitbook/assets/image (35) (1).png>) +![](<../.gitbook/assets/image (35).png>) Now, inside this memory you should find some JMP ESP bytes, to do that execute: @@ -193,7 +193,7 @@ Now, inside this memory you should find some JMP ESP bytes, to do that execute: **Then, if some address is found, choose one that don't contain any badchar:** -![](<../.gitbook/assets/image (36) (1).png>) +![](<../.gitbook/assets/image (36).png>) **In this case, for example: \_0x5f4a358f**\_ diff --git a/forensics/basic-forensic-methodology/specific-software-file-type-tricks/.pyc.md b/forensics/basic-forensic-methodology/specific-software-file-type-tricks/.pyc.md index 591ff3c1a..c8ea337d2 100644 --- a/forensics/basic-forensic-methodology/specific-software-file-type-tricks/.pyc.md +++ b/forensics/basic-forensic-methodology/specific-software-file-type-tricks/.pyc.md @@ -12,7 +12,7 @@ - + If you are interested in **hacking carer** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). @@ -231,7 +231,7 @@ C:\Users\test\Desktop\test>pyinstaller --onefile hello.py * [https://blog.f-secure.com/how-to-decompile-any-python-binary/](https://blog.f-secure.com/how-to-decompile-any-python-binary/) - + If you are interested in **hacking carer** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). diff --git a/forensics/basic-forensic-methodology/specific-software-file-type-tricks/browser-artifacts.md b/forensics/basic-forensic-methodology/specific-software-file-type-tricks/browser-artifacts.md index 15f383a79..30c7a6078 100644 --- a/forensics/basic-forensic-methodology/specific-software-file-type-tricks/browser-artifacts.md +++ b/forensics/basic-forensic-methodology/specific-software-file-type-tricks/browser-artifacts.md @@ -12,7 +12,7 @@ - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. @@ -266,7 +266,7 @@ Opera **stores browser history and download data in the exact same format as Goo * **Browser’s built-in anti-phishing:** `grep --color 'fraud_protection_enabled' ~/Library/Application Support/com.operasoftware.Opera/Preferences` * **fraud\_protection\_enabled** should be **true** - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. diff --git a/forensics/basic-forensic-methodology/specific-software-file-type-tricks/local-cloud-storage.md b/forensics/basic-forensic-methodology/specific-software-file-type-tricks/local-cloud-storage.md index 2982fc3d6..0ac347a76 100644 --- a/forensics/basic-forensic-methodology/specific-software-file-type-tricks/local-cloud-storage.md +++ b/forensics/basic-forensic-methodology/specific-software-file-type-tricks/local-cloud-storage.md @@ -12,7 +12,7 @@ - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. @@ -111,7 +111,7 @@ Other tables inside this database contain more interesting information: * **deleted\_fields**: Dropbox deleted files * **date\_added** - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. diff --git a/forensics/basic-forensic-methodology/specific-software-file-type-tricks/office-file-analysis.md b/forensics/basic-forensic-methodology/specific-software-file-type-tricks/office-file-analysis.md index 31164bdf5..03c3d46ea 100644 --- a/forensics/basic-forensic-methodology/specific-software-file-type-tricks/office-file-analysis.md +++ b/forensics/basic-forensic-methodology/specific-software-file-type-tricks/office-file-analysis.md @@ -12,7 +12,7 @@ - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. diff --git a/forensics/basic-forensic-methodology/specific-software-file-type-tricks/pdf-file-analysis.md b/forensics/basic-forensic-methodology/specific-software-file-type-tricks/pdf-file-analysis.md index 60f946006..7c8d5dd89 100644 --- a/forensics/basic-forensic-methodology/specific-software-file-type-tricks/pdf-file-analysis.md +++ b/forensics/basic-forensic-methodology/specific-software-file-type-tricks/pdf-file-analysis.md @@ -12,7 +12,7 @@ - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. diff --git a/generic-methodologies-and-resources/pentesting-network/eigrp-attacks.md b/generic-methodologies-and-resources/pentesting-network/eigrp-attacks.md index 2bf75f6c8..64e79bed2 100644 --- a/generic-methodologies-and-resources/pentesting-network/eigrp-attacks.md +++ b/generic-methodologies-and-resources/pentesting-network/eigrp-attacks.md @@ -84,7 +84,7 @@ After that, the neighborhood between the legitimate EIGRP routers is established EIGRP Neighborship with GW1 (10.10.100.100): -
+
EIGRP Neighborship with GW2 (10.10.100.200): @@ -141,7 +141,7 @@ Arguments of the script: **Our host seems to be in trouble :)** -
+
As you can see, the host loses connectivity to host **172.16.100.140/32** due to route injection. @@ -149,7 +149,7 @@ As you can see, the host loses connectivity to host **172.16.100.140/32** due to To establish EIGRP neighbors, **routers use special K-values.** They must be the same among all EIGRP neighbors. If at least one K-value does not match, the EIGRP domain will crash and the neighborhood will be broken. We will use [**relationshipnightmare.py**](https://github.com/in9uz/EIGRPWN/blob/main/relationshipnightmare.py) **** to perform this attack**.** -
+
Script arguments: @@ -163,7 +163,7 @@ Script arguments: ~$ sudo python3 relationshipnightmare.py --interface eth0 --as 1 --src 10.10.100.100 ``` -

Dump of traffic during a neighborhood disruption

+

Dump of traffic during a neighborhood disruption

GW1 router endlessly disconnects and reconnects EIGRP

diff --git a/linux-hardening/freeipa-pentesting.md b/linux-hardening/freeipa-pentesting.md index 8630b3263..c7fd9f42c 100644 --- a/linux-hardening/freeipa-pentesting.md +++ b/linux-hardening/freeipa-pentesting.md @@ -66,7 +66,7 @@ When tickets are set to be **stored** as a **file** on **disk**, the standard fo klist /tmp/krb5cc_0 ``` -
+
For an attacker re-using a CCACHE Ticket is very easy. To **re-use** a valid CCACHE Ticket, **export** **KRB5CCNAME** to the **path** of the valid ticket file. The system should recognize the environment variable and will attempt to use that credential material when interacting with the domain. @@ -75,7 +75,7 @@ export KRB5CCNAME=/tmp/krb5cc_0 klist ``` -
+
#### **Unix Keyring** @@ -89,11 +89,11 @@ CCACHE Tickets **** can also be **stored** in **** the Linux **keyring**. The ke Depending on how the administrator scoped the ticket stored inside of the Unix keyring, parsing it out may be difficult. However, the **default** **scope** for CCACHE Tickets in the Unix keyring is **`KEYRING:persistent:uidnumber`**. Fortunately if you are in the **context** of the **user**, `klist` can **parse** this information for us. -
+
As an attacker, **re-using a CCACHE** Ticket stored in the Unix **keyring** is fairly **difficult** depending on how the ticket is scoped. Fortunately [@Zer1t0](https://github.com/Zer1t0) from [@Tarlogic](https://twitter.com/Tarlogic) has built a tool that can extract Kerberos tickets from the Unix keyring. The tool is called **Tickey** and can be found [**here**](https://github.com/TarlogicSecurity/tickey). -
+
### Keytab @@ -107,7 +107,7 @@ Keytab files can be used to **obtain a valid ticket granting ticket** (TGT) for Parsing a Keytab file is very easy, and can be accomplished a few ways. The easiest way to **parse** a **keytab** file is with **klist**. The second way utilizes a great python utility that [Cody Thomas](https://medium.com/u/645ffcef8682?source=post\_page-----77e73d837d6a--------------------------------) has created. His **** [**KeytabParser**](https://github.com/its-a-feature/KeytabParser) **** project will parse out the principal and its relevant encrypted keys. -
+
Attackers can **re-use credentials stored in keytab files by generating a CCACHE Ticket** through the kinit binary. @@ -119,7 +119,7 @@ klist -k /rtc/krb5.keytab kinit -kt /etc/krb5.keytab host/bastion.westeros.local@WESTEROS.LOCAL ``` -
+
### Cheatsheet @@ -203,7 +203,7 @@ ipa sudorule-show --all Each **role** contains a set of **privileges**, and those respective privileges contain a **set** of **permissions**. Roles can be **applied to Users**, User **Groups**, **Hosts**, Host Groups, and Services. To illustrate this concept let’s discuss the default “User Administrator” role in FreeIPA. -
+
As the screenshot above shows the “User Administrator” role contains the following privileges: @@ -213,7 +213,7 @@ As the screenshot above shows the “User Administrator” role contains the fol We can drill down further and enumerate the **permissions** delegated to each **privilege**: -
+
As we can see the “**User Administrator**” role contains quite **a lot of permissions** inside of the environment. Understanding the general concept and structure of **roles**, **privileges**, and **permissions** can be critical to identifying attack paths throughout an environment. @@ -245,19 +245,19 @@ If you can **create a new user with the name `root`**, you can impersonate him a The "**User Administrators**" privilege, is very powerful (as its name indicates it): -
+
With this privilege comes a lot of different power to affect users inside the environment. Using this privilege we can **make a new user inside the FreeIPA domain named **_**root**._ -
+
Once the user is created in the domain we can **obtain a ticket for the account with **_**kinit**_. -
+
Now we can attempt to **SSH** using our newly created root domain account. -
+
As shown this **drops the user into the local root account**! So simply by creating a domain user for a local user we were able to authenticate using the _root@WESTEROS.LOCAL_ account and obtain the **user context of the local root account**_._ diff --git a/linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation/README.md b/linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation/README.md index 4440f4fdf..8f1341f9b 100644 --- a/linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation/README.md +++ b/linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation/README.md @@ -12,7 +12,7 @@ - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. @@ -508,7 +508,7 @@ If you only have `hostIPC=true`, you most likely can't do much. If any process o The second technique explained in the post [https://labs.f-secure.com/blog/abusing-the-access-to-mount-namespaces-through-procpidroot/](https://labs.f-secure.com/blog/abusing-the-access-to-mount-namespaces-through-procpidroot/) indicates how you can abuse bind mounts with user namespaces, to affect files inside the host (in that specific case, delete files). - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. @@ -557,7 +557,7 @@ If you are in **userspace** (**no kernel exploit** involved) the way to find new * [https://0xn3va.gitbook.io/cheat-sheets/container/escaping/exposed-docker-socket](https://0xn3va.gitbook.io/cheat-sheets/container/escaping/exposed-docker-socket) * [https://bishopfox.com/blog/kubernetes-pod-privilege-escalation#Pod4](https://bishopfox.com/blog/kubernetes-pod-privilege-escalation#Pod4) - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. diff --git a/linux-hardening/useful-linux-commands/bypass-bash-restrictions.md b/linux-hardening/useful-linux-commands/bypass-bash-restrictions.md index 3a8129618..cd1712014 100644 --- a/linux-hardening/useful-linux-commands/bypass-bash-restrictions.md +++ b/linux-hardening/useful-linux-commands/bypass-bash-restrictions.md @@ -12,7 +12,7 @@ - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. @@ -345,7 +345,7 @@ If you are inside a filesystem with the **read-only and noexec protections** the * [https://medium.com/secjuice/web-application-firewall-waf-evasion-techniques-2-125995f3e7b0](https://medium.com/secjuice/web-application-firewall-waf-evasion-techniques-2-125995f3e7b0) * [https://www.secjuice.com/web-application-firewall-waf-evasion/](https://www.secjuice.com/web-application-firewall-waf-evasion/) - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. diff --git a/mobile-pentesting/android-app-pentesting/android-burp-suite-settings.md b/mobile-pentesting/android-app-pentesting/android-burp-suite-settings.md index 8877d2038..abe115825 100644 --- a/mobile-pentesting/android-app-pentesting/android-burp-suite-settings.md +++ b/mobile-pentesting/android-app-pentesting/android-burp-suite-settings.md @@ -12,7 +12,7 @@ - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. @@ -86,7 +86,7 @@ After installing Certificate SSL endpoints also working fine tested using → [h After installing the certificate this way Firefox for Android won't use it (based on my tests), so use a different browser. {% endhint %} - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. diff --git a/mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-1.md b/mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-1.md index ce38b690c..ebb256429 100644 --- a/mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-1.md +++ b/mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-1.md @@ -12,7 +12,7 @@ - + If you are interested in **hacking carer** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). @@ -147,7 +147,7 @@ In this tutorial you have hooked methods using the name of the mathod and _.impl You can see that in [the next tutorial](frida-tutorial-2.md). - + If you are interested in **hacking carer** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). diff --git a/mobile-pentesting/ios-pentesting-checklist.md b/mobile-pentesting/ios-pentesting-checklist.md index 8488e5677..707b9eb23 100644 --- a/mobile-pentesting/ios-pentesting-checklist.md +++ b/mobile-pentesting/ios-pentesting-checklist.md @@ -1,6 +1,6 @@ # iOS Pentesting Checklist - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. @@ -118,7 +118,7 @@ - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. diff --git a/mobile-pentesting/ios-pentesting/README.md b/mobile-pentesting/ios-pentesting/README.md index c710b169c..99df65dd5 100644 --- a/mobile-pentesting/ios-pentesting/README.md +++ b/mobile-pentesting/ios-pentesting/README.md @@ -1,6 +1,6 @@ # iOS Pentesting - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. @@ -382,7 +382,7 @@ struct CGSize { However, the best options to disassemble the binary are: [**Hopper**](https://www.hopperapp.com/download.html?) and [**IDA**](https://www.hex-rays.com/products/ida/support/download\_freeware/). - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. @@ -742,7 +742,7 @@ Jun 7 13:42:14 iPhone touch[9708] : MS:Notice: Injecting: (null) [touch ... ``` - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. @@ -1166,7 +1166,7 @@ You can find the **libraries used by an application** by running **`otool`** aga * [https://github.com/authenticationfailure/WheresMyBrowser.iOS](https://github.com/authenticationfailure/WheresMyBrowser.iOS) * [https://github.com/nabla-c0d3/ssl-kill-switch2](https://github.com/nabla-c0d3/ssl-kill-switch2) - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. diff --git a/mobile-pentesting/ios-pentesting/burp-configuration-for-ios.md b/mobile-pentesting/ios-pentesting/burp-configuration-for-ios.md index 341928017..3a8a50484 100644 --- a/mobile-pentesting/ios-pentesting/burp-configuration-for-ios.md +++ b/mobile-pentesting/ios-pentesting/burp-configuration-for-ios.md @@ -12,7 +12,7 @@ - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. @@ -118,7 +118,7 @@ Steps to configure Burp as proxy: * Click on _**Ok**_ and the in _**Apply**_ - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. diff --git a/network-services-pentesting/1099-pentesting-java-rmi.md b/network-services-pentesting/1099-pentesting-java-rmi.md index 0e8ff4223..c731f1aa6 100644 --- a/network-services-pentesting/1099-pentesting-java-rmi.md +++ b/network-services-pentesting/1099-pentesting-java-rmi.md @@ -12,7 +12,7 @@ - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. @@ -323,7 +323,7 @@ Entry_1: Command: rmg enum {IP} {PORT} ``` - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. diff --git a/network-services-pentesting/15672-pentesting-rabbitmq-management.md b/network-services-pentesting/15672-pentesting-rabbitmq-management.md index 49fcdfc84..5227323a9 100644 --- a/network-services-pentesting/15672-pentesting-rabbitmq-management.md +++ b/network-services-pentesting/15672-pentesting-rabbitmq-management.md @@ -12,7 +12,7 @@ - + If you are interested in **hacking carer** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). @@ -60,7 +60,7 @@ Content-Length: 267 * `port:15672 http` - + If you are interested in **hacking carer** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). diff --git a/network-services-pentesting/49-pentesting-tacacs+.md b/network-services-pentesting/49-pentesting-tacacs+.md index a4b16b4ac..0e3667552 100644 --- a/network-services-pentesting/49-pentesting-tacacs+.md +++ b/network-services-pentesting/49-pentesting-tacacs+.md @@ -43,11 +43,11 @@ sudo loki_gtk.py You also need to specify the path to the dictionary in order to bruteforce the encrypted key. Be sure to uncheck the **Use Bruteforce** option, otherwise Loki will bruteforce the password without using the dictionary. -
+
Now we have to wait for an administrator to log into the device through the TACACS server. It is assumed that the network administrator has already logged in, and we, **standing in the middle via ARP spoofing**, intercept the traffic. And in doing so, the legitimate hosts don’t realize that someone else has interfered with their connection. -
+
Now click the **CRACK** button and wait for **Loki** to break the password. @@ -65,7 +65,7 @@ We see which banner was used. We find the username of the user `admin` -
+
As a result, **we have the `admin:secret1234` credentials,** which can be used to access the hardware itself. **I think I’ll check their validity.** diff --git a/network-services-pentesting/pentesting-ssh.md b/network-services-pentesting/pentesting-ssh.md index a92e202db..792bb9c85 100644 --- a/network-services-pentesting/pentesting-ssh.md +++ b/network-services-pentesting/pentesting-ssh.md @@ -12,7 +12,7 @@ - + If you are interested in **hacking carer** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). @@ -307,7 +307,7 @@ id_rsa * You can find interesting guides on how to harden SSH in [https://www.ssh-audit.com/hardening\_guides.html](https://www.ssh-audit.com/hardening\_guides.html) * [https://community.turgensec.com/ssh-hacking-guide](https://community.turgensec.com/ssh-hacking-guide) - + If you are interested in **hacking carer** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). diff --git a/network-services-pentesting/pentesting-web/flask.md b/network-services-pentesting/pentesting-web/flask.md index 0c2d9a095..3cf3472d5 100644 --- a/network-services-pentesting/pentesting-web/flask.md +++ b/network-services-pentesting/pentesting-web/flask.md @@ -12,7 +12,7 @@ - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. @@ -86,7 +86,7 @@ Command line tool to brute-force websites using cookies crafted with flask-unsig [**This example**](../../pentesting-web/sql-injection/sqlmap/#eval) uses sqlmap `eval` option to **automatically sign sqlmap payloads** for flask using a known secret. - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. diff --git a/network-services-pentesting/pentesting-web/jboss.md b/network-services-pentesting/pentesting-web/jboss.md index ff9ef9510..392250288 100644 --- a/network-services-pentesting/pentesting-web/jboss.md +++ b/network-services-pentesting/pentesting-web/jboss.md @@ -12,7 +12,7 @@ - + If you are interested in **hacking carer** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). @@ -40,7 +40,7 @@ You can expose **management servlets** via the following paths within JBoss (dep inurl:status EJInvokerServlet ``` - + If you are interested in **hacking carer** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). diff --git a/network-services-pentesting/pentesting-web/moodle.md b/network-services-pentesting/pentesting-web/moodle.md index 391970807..9b9d55a70 100644 --- a/network-services-pentesting/pentesting-web/moodle.md +++ b/network-services-pentesting/pentesting-web/moodle.md @@ -12,7 +12,7 @@ - + If you are interested in **hacking carer** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). @@ -120,7 +120,7 @@ find / -name "config.php" 2>/dev/null | grep "moodle/config.php" /usr/local/bin/mysql -u --password= -e "use moodle; select email,username,password from mdl_user; exit" ``` - + If you are interested in **hacking carer** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). diff --git a/network-services-pentesting/pentesting-web/php-tricks-esp/README.md b/network-services-pentesting/pentesting-web/php-tricks-esp/README.md index 635decc44..777af9cea 100644 --- a/network-services-pentesting/pentesting-web/php-tricks-esp/README.md +++ b/network-services-pentesting/pentesting-web/php-tricks-esp/README.md @@ -40,7 +40,7 @@ If `==` is used in PHP, then there are unexpected cases where the comparison doe PHP comparison tables: [https://www.php.net/manual/en/types.comparisons.php](https://www.php.net/manual/en/types.comparisons.php) -![](<../../../.gitbook/assets/image (40) (1).png>) +![](<../../../.gitbook/assets/image (40).png>) {% file src="../../../.gitbook/assets/EN-PHP-loose-comparison-Type-Juggling-OWASP (1).pdf" %} diff --git a/network-services-pentesting/pentesting-web/web-api-pentesting.md b/network-services-pentesting/pentesting-web/web-api-pentesting.md index a7898e9b7..482d33f12 100644 --- a/network-services-pentesting/pentesting-web/web-api-pentesting.md +++ b/network-services-pentesting/pentesting-web/web-api-pentesting.md @@ -12,7 +12,7 @@ - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. @@ -133,7 +133,7 @@ AutoRepeater Burp Extension: Add a replacement rule * `Match: v2 (higher version)` * `Replace: v1 (lower version)` - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. @@ -223,7 +223,7 @@ kr brute https://domain.com/api/ -w /tmp/lang-english.txt -x 20 -d=0 * [**API-fuzzer**](https://github.com/Fuzzapi/API-fuzzer): API\_Fuzzer gem accepts a API request as input and returns vulnerabilities possible in the API. * [**race-the-web**](https://github.com/TheHackerDev/race-the-web): Tests for race conditions in web applications by sending out a user-specified number of requests to a target URL (or URLs) _simultaneously_, and then compares the responses from the server for uniqueness. - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. diff --git a/network-services-pentesting/pentesting-web/wordpress.md b/network-services-pentesting/pentesting-web/wordpress.md index eaf861321..6a0f6c158 100644 --- a/network-services-pentesting/pentesting-web/wordpress.md +++ b/network-services-pentesting/pentesting-web/wordpress.md @@ -12,7 +12,7 @@ - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. @@ -99,7 +99,7 @@ curl -s -X GET https://wordpress.org/support/article/pages/ | grep -E 'wp-conten curl -s -X GET https://wordpress.org/support/article/pages/ | grep http | grep -E '?ver=' | sed -E 's,href=|src=,THIIIIS,g' | awk -F "THIIIIS" '{print $2}' | cut -d "'" -f2 ``` - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. @@ -210,7 +210,7 @@ Using the correct credentials you can upload a file. In the response the path wi Also there is a **faster way** to brute-force credentials using **`system.multicall`** as you can try several credentials on the same request: -
+
**Bypass 2FA** @@ -281,7 +281,7 @@ wpscan --rua -e ap,at,tt,cb,dbe,u,m --url http://www.domain.com [--plugins-detec #You can try to bruteforce the admin user using wpscan with "-U admin" ``` - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. @@ -423,7 +423,7 @@ Also, **only install trustable WordPress plugins and themes**. * **Limit login attempts** to prevent Brute Force attacks * Rename **`wp-admin.php`** file and only allow access internally or from certain IP addresses. - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. diff --git a/pentesting-web/cache-deception.md b/pentesting-web/cache-deception.md index e34589f7b..40b0c5e10 100644 --- a/pentesting-web/cache-deception.md +++ b/pentesting-web/cache-deception.md @@ -12,7 +12,7 @@ - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. @@ -123,7 +123,7 @@ The [Web Cache Vulnerability Scanner](https://github.com/Hackmanit/Web-Cache-Vul Example usage: `wcvs -u example.com` - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. @@ -227,7 +227,7 @@ Learn here about how to perform[ Cache Deceptions attacks abusing HTTP Request S * [https://youst.in/posts/cache-poisoning-at-scale/](https://youst.in/posts/cache-poisoning-at-scale/) * [https://bxmbn.medium.com/how-i-test-for-web-cache-vulnerabilities-tips-and-tricks-9b138da08ff9](https://bxmbn.medium.com/how-i-test-for-web-cache-vulnerabilities-tips-and-tricks-9b138da08ff9) - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. diff --git a/pentesting-web/clickjacking.md b/pentesting-web/clickjacking.md index ea819ca12..b17bbd312 100644 --- a/pentesting-web/clickjacking.md +++ b/pentesting-web/clickjacking.md @@ -12,7 +12,7 @@ - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. @@ -175,7 +175,7 @@ See the following documentation for further details and more complex examples: * [**https://portswigger.net/web-security/clickjacking**](https://portswigger.net/web-security/clickjacking) * [**https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking\_Defense\_Cheat\_Sheet.html**](https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking\_Defense\_Cheat\_Sheet.html) - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. diff --git a/pentesting-web/crlf-0d-0a.md b/pentesting-web/crlf-0d-0a.md index 851452089..f7c09b604 100644 --- a/pentesting-web/crlf-0d-0a.md +++ b/pentesting-web/crlf-0d-0a.md @@ -12,7 +12,7 @@ - + If you are interested in **hacking carer** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). @@ -231,7 +231,7 @@ The best prevention technique is to not use users input directly inside response - + If you are interested in **hacking carer** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). diff --git a/pentesting-web/deserialization/exploiting-__viewstate-parameter.md b/pentesting-web/deserialization/exploiting-__viewstate-parameter.md index 2cec3b95f..8feb706c9 100644 --- a/pentesting-web/deserialization/exploiting-__viewstate-parameter.md +++ b/pentesting-web/deserialization/exploiting-__viewstate-parameter.md @@ -12,7 +12,7 @@ - + If you are interested in **hacking carer** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). @@ -195,7 +195,7 @@ out of band request with the current username * [**https://medium.com/@swapneildash/deep-dive-into-net-viewstate-deserialization-and-its-exploitation-54bf5b788817**](https://medium.com/@swapneildash/deep-dive-into-net-viewstate-deserialization-and-its-exploitation-54bf5b788817)\\ * [**https://soroush.secproject.com/blog/2019/04/exploiting-deserialisation-in-asp-net-via-viewstate/**](https://soroush.secproject.com/blog/2019/04/exploiting-deserialisation-in-asp-net-via-viewstate/) - + If you are interested in **hacking carer** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). diff --git a/pentesting-web/domain-subdomain-takeover.md b/pentesting-web/domain-subdomain-takeover.md index 2e826c64b..6ac2e47f7 100644 --- a/pentesting-web/domain-subdomain-takeover.md +++ b/pentesting-web/domain-subdomain-takeover.md @@ -12,7 +12,7 @@ - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. @@ -67,7 +67,7 @@ All of them vulnerable to subdomain takeover. All of them were big brands. Talki Nevertheless, recent phishing campaigns host content on domains with long domain names that include name of the brand (see [Apple example](https://www.phishtank.com/target\_search.php?target\_id=183\&valid=y\&active=All\&Search=Search)). Having valid SSL certificate (more on that below), keyword in domain name and website which mimics the website of targeted brand, people tend to fall into these attacks. Think about chances with a legitimate subdomain of this brand. - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. @@ -159,7 +159,7 @@ Until next time! [Patrik](https://twitter.com/0xpatrik) - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. diff --git a/pentesting-web/file-inclusion/phar-deserialization.md b/pentesting-web/file-inclusion/phar-deserialization.md index 6b6f90a60..a1370801b 100644 --- a/pentesting-web/file-inclusion/phar-deserialization.md +++ b/pentesting-web/file-inclusion/phar-deserialization.md @@ -12,7 +12,7 @@ - + If you are interested in **hacking carer** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). @@ -89,7 +89,7 @@ php vuln.php {% embed url="https://blog.ripstech.com/2018/new-php-exploitation-technique/" %} - + If you are interested in **hacking carer** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). diff --git a/pentesting-web/http-request-smuggling/browser-http-request-smuggling.md b/pentesting-web/http-request-smuggling/browser-http-request-smuggling.md index 2ed24391f..c972da8ad 100644 --- a/pentesting-web/http-request-smuggling/browser-http-request-smuggling.md +++ b/pentesting-web/http-request-smuggling/browser-http-request-smuggling.md @@ -45,7 +45,7 @@ Secondly, the request must be **triggerable in a web-browser cross-domain**. Bro The way to test this missconfig is to **send 2 requests and smuggle one** in the **middle**. If the **smuggled** connection **affected** the response of the **second** **request**, it means that it's **vulnerable**: -![](<../../.gitbook/assets/image (1) (2) (2).png>) +![](<../../.gitbook/assets/image (1) (2) (2) (1).png>) {% hint style="warning" %} Note that you **cannot** test this vuln by just sending a **Content-Length bigger** than the one sent and **looking for a timeout** because some servers **respond** even if they **didn't receive the whole body**. diff --git a/stego/stego-tricks.md b/stego/stego-tricks.md index 09ac550d7..b0e764fab 100644 --- a/stego/stego-tricks.md +++ b/stego/stego-tricks.md @@ -12,7 +12,7 @@ - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. @@ -84,7 +84,7 @@ cmp original.jpg stego.jpg -b -l If you find that a **text line** is **bigger** than it should be, then some **hidden information** could be included inside the **spaces** using invisible characters.󐁈󐁥󐁬󐁬󐁯󐀠󐁴󐁨\ To **extract** the **data**, you can use: [https://www.irongeek.com/i.php?page=security/unicode-steganography-homoglyph-encoder](https://www.irongeek.com/i.php?page=security/unicode-steganography-homoglyph-encoder) - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. @@ -218,7 +218,7 @@ To read a QR code: [https://online-barcode-reader.inliteresearch.com/](https://o * [**https://0xrick.github.io/lists/stego/**](https://0xrick.github.io/lists/stego/) * [**https://github.com/DominicBreuker/stego-toolkit**](https://github.com/DominicBreuker/stego-toolkit) - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. diff --git a/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.md b/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.md index 112531421..47d627b96 100644 --- a/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.md +++ b/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.md @@ -489,11 +489,11 @@ Notice that the `userPrincipalName` in the certificate is `Administrator` and th Then, we change back the `userPrincipalName` of `Jane` to be something else, like her original `userPrincipalName` `Jane@corp.local`. -
+
Now, if we try to authenticate with the certificate, we will receive the NT hash of the `Administrator@corp.local` user. You will need to add `-domain ` to your command line since there is no domain specified in the certificate. -
+
## Weak Certificate Mappings - ESC10 diff --git a/windows-hardening/active-directory-methodology/external-forest-domain-one-way-outbound.md b/windows-hardening/active-directory-methodology/external-forest-domain-one-way-outbound.md index d28783712..a7f429e13 100644 --- a/windows-hardening/active-directory-methodology/external-forest-domain-one-way-outbound.md +++ b/windows-hardening/active-directory-methodology/external-forest-domain-one-way-outbound.md @@ -83,13 +83,13 @@ In the previous flow it was used the trust hash instead of the **clear text pass The cleartext password can be obtained by converting the \[ CLEAR ] output from mimikatz from hexadecimal and removing null bytes ‘\x00’: -![](<../../.gitbook/assets/image (2) (1) (1).png>) +![](<../../.gitbook/assets/image (2) (1) (2).png>) Sometimes when creating a trust relationship, a password must be typed in by the user for the trust. In this demonstration, the key is the original trust password and therefore human readable. As the key cycles (30 days), the cleartext will not be human-readable but technically still usable. The cleartext password can be used to perform regular authentication as the trust account, an alternative to requesting a TGT using the Kerberos secret key of the trust account. Here, querying root.local from ext.local for members of Domain Admins: -![](<../../.gitbook/assets/image (1) (1) (1) (1).png>) +![](<../../.gitbook/assets/image (1) (1) (1).png>) ## References diff --git a/windows-hardening/active-directory-methodology/kerberos-double-hop-problem.md b/windows-hardening/active-directory-methodology/kerberos-double-hop-problem.md index f4d0ce90e..acbaf72a3 100644 --- a/windows-hardening/active-directory-methodology/kerberos-double-hop-problem.md +++ b/windows-hardening/active-directory-methodology/kerberos-double-hop-problem.md @@ -140,7 +140,7 @@ Uncompress the zip to where you’d like. Then, run the install script - `Instal Lastly, just add a firewall rule to **open port 22**. Verify the SSH services are installed, and start them. Both of these services will need to be running for SSH to work. -
+
If you receive a `Connection reset` error, update permissions to allow **Everyone: Read & Execute** on the root OpenSSH directory. diff --git a/windows-hardening/active-directory-methodology/pass-the-ticket.md b/windows-hardening/active-directory-methodology/pass-the-ticket.md index 1721d52ae..8faef286a 100644 --- a/windows-hardening/active-directory-methodology/pass-the-ticket.md +++ b/windows-hardening/active-directory-methodology/pass-the-ticket.md @@ -12,7 +12,7 @@ - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. @@ -63,7 +63,7 @@ klist #List tickets in cache to cehck that mimikatz has loaded the ticket * [https://www.tarlogic.com/blog/how-to-attack-kerberos/](https://www.tarlogic.com/blog/how-to-attack-kerberos/) - + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. diff --git a/windows-hardening/active-directory-methodology/silver-ticket.md b/windows-hardening/active-directory-methodology/silver-ticket.md index d008c4874..b849da4ac 100644 --- a/windows-hardening/active-directory-methodology/silver-ticket.md +++ b/windows-hardening/active-directory-methodology/silver-ticket.md @@ -12,7 +12,7 @@ - + If you are interested in **hacking carer** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). @@ -168,7 +168,7 @@ mimikatz(commandline) # lsadump::dcsync /dc:pcdc.domain.local /domain:domain.loc [dcsync.md](dcsync.md) {% endcontent-ref %} - + If you are interested in **hacking carer** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). diff --git a/windows-hardening/lateral-movement/dcom-exec.md b/windows-hardening/lateral-movement/dcom-exec.md index da2fd0a73..70d8462f6 100644 --- a/windows-hardening/lateral-movement/dcom-exec.md +++ b/windows-hardening/lateral-movement/dcom-exec.md @@ -39,7 +39,7 @@ The **MMC20.Application** object lacked explicit “[LaunchPermissions](https:// You can read more on that thread [here](https://twitter.com/tiraniddo/status/817532039771525120).\ Viewing which other objects that have no explicit LaunchPermission set can be achieved using [@tiraniddo](https://twitter.com/tiraniddo)’s [OleView .NET](https://github.com/tyranid/oleviewdotnet), which has excellent Python filters (among other things). In this instance, we can filter down to all objects that have no explicit Launch Permission. When doing so, two objects stood out to me: `ShellBrowserWindow` and `ShellWindows`: -![](<../../.gitbook/assets/image (3) (1) (1) (1).png>) +![](<../../.gitbook/assets/image (3) (1) (1) (2).png>) Another way to identify potential target objects is to look for the value `LaunchPermission` missing from keys in `HKCR:\AppID\{guid}`. An object with Launch Permissions set will look like below, with data representing the ACL for the object in Binary format: diff --git a/windows-hardening/windows-local-privilege-escalation/dll-hijacking.md b/windows-hardening/windows-local-privilege-escalation/dll-hijacking.md index 41a48ee8e..5e609bf2b 100644 --- a/windows-hardening/windows-local-privilege-escalation/dll-hijacking.md +++ b/windows-hardening/windows-local-privilege-escalation/dll-hijacking.md @@ -12,7 +12,7 @@ - + If you are interested in **hacking carer** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). @@ -217,7 +217,7 @@ BOOL APIENTRY DllMain (HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReser } ``` - + If you are interested in **hacking carer** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). diff --git a/windows-hardening/windows-local-privilege-escalation/juicypotato.md b/windows-hardening/windows-local-privilege-escalation/juicypotato.md index 1bc5f7773..17bb2397f 100644 --- a/windows-hardening/windows-local-privilege-escalation/juicypotato.md +++ b/windows-hardening/windows-local-privilege-escalation/juicypotato.md @@ -115,7 +115,7 @@ c:\Users\Public> ### Launch a new CMD (if you have RDP access) -![](<../../.gitbook/assets/image (37) (1).png>) +![](<../../.gitbook/assets/image (37).png>) ## CLSID Problems diff --git a/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md b/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md index a7771ad76..1cc0ef5b9 100644 --- a/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md +++ b/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md @@ -12,7 +12,7 @@ - + If you are interested in **hacking carer** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_). @@ -351,7 +351,7 @@ Find more Autoruns like registries in [https://www.microsoftpressstore.com/artic * [https://attack.mitre.org/techniques/T1547/001/](https://attack.mitre.org/techniques/T1547/001/) * [https://www.microsoftpressstore.com/articles/article.aspx?p=2762082\&seqNum=2](https://www.microsoftpressstore.com/articles/article.aspx?p=2762082\&seqNum=2) - + If you are interested in **hacking carer** and hack the unhackable - **we are hiring!** (_fluent polish written and spoken required_).