Follow the evidence.

URL https://twitter.com/orpheus9001

Indicator published by the cited source.

research3_Section3

The Ultimate Guide to Crashing Your Friend's Wedding - The Knot, Business Logic Flaw

Credits John Github: https://github.com/johnjhacking Robert Willis: Twitter: https://twitter.com/rej_ex Identification The Wedding websites that can be created with The Knot have many components built in. Among some of the functions included the ability to send out RSVP invites to friends or family. The websites that utilize RSVP can easily be identified: inurl:"theknot.com" intext:"rsvp-link" Whe

URL https://twitter.com/tensor_bodega

Indicator published by the cited source.

URL https://twitter.com/kaoudis

Indicator published by the cited source.

URL https://twitter.com/Kirtaner

Indicator published by the cited source.

Indian Government Breached, Massive Amount of Critical Vulnerabilities

Indian Government Breach, Massive Amount of Critical Vulnerabilities Executive Summary Sakura Samurai knew that the Indian Government operated an RVDP (Responsible Vulnerability Disclosure Program). Jackson Henry put a list together of initial assets in scope for Sakura Samurai to legally test. Robert Willis reported that he had found sensitive data and was able to breach police assets. Jackson He

CVE-2020-28360: npm private-ip SSRF Bypass (IP Phone Home)

Credits Sick.Codes Github: (https://github.com/sickcodes) Twitter: (https://twitter.com/sickcodes) John Github: (https://github.com/johnjhacking) Nick Sahler Github: (https://github.com/nicksahler) Twitter: (https://twitter.com/tensor_bodega) With Collaboration from: Harold Hunt LinkedIn: (https://www.linkedin.com/in/huntharo) Identification Over the course of several months, John dealt with remed

CVE-2020-27388: YOURLS 1.5 - 1.7.10, Multiple Stored Cross Site Scripting (XSS) Vulnerabilities in Admin Panel

Potential Abuse on a hooked Function There is a potential for abuse with any plugins that implement the hook function ‘shunt_is_valid_user’. In the code below we simply demonstrate that authentication can be completely bypassed by returning TRUE in the hooked function. This would be an ideal place for a stealthy backdoor or any other malicious code. It should be noted that this itself is not a vul

URL https://twitter.com/JacksonHHax

Indicator published by the cited source.

Linux Privilege Escalation: Quick and Dirty

Linux Privilege Escalation: Quick and Dirty Automated Tooling Usually, my approach is to use an automated tool in conjunction with some manual enumeration. However, you can completely accomplish the Privilege Escalation process from an automated tool paired with the right exploitation methodology. 1. Linpeas.sh (my go-to, fully automated) https://github.com/carlospolop/privilege-escalation-awesome

research5_Section1

research6_section1

Stealing Data with Zix - Bypassing Data Loss Prevention Policies

Background If you haven’t done so yet, read my first Zix exploitation article: Spear Phishing with Zix: An Undisclosed Red Team Method for the Hungry APT, which established baselines to abuse the native organizational trust that Zix provides to perform spear phishing on the affected company. Shortly after the spear phishing writeup, I discovered that Zix is also an excellent data exfiltration tool

The Ultimate OSCP Preparation Guide [DEPRECATED]

The Ultimate OSCP Preparation Guide [DEPRECATED] Update Notes This guide is now deprecated due to exam revisions made by Offensive Security on January 11, 2022. I published this guide on August 17th, of 2020. Offensive Security no longer requires the buffer overflow, and to pass this exam, you’ll have to understand Active Directory hacking. Since I’m not going to retake the OSCP to update this res

Stealing Data with Zix - Bypassing Data Loss Prevention Policies

Background If you haven’t done so yet, read my first Zix exploitation article: Spear Phishing with Zix: An Undisclosed Red Team Method for the Hungry APT, which established baselines to abuse the native organizational trust that Zix provides to perform spear phishing on the affected company. Shortly after the spear phishing writeup, I discovered that Zix is also an excellent data exfiltration tool

CVE-2021-40875: Improper Access Control in Gurock TestRail versions ≤ 7.2.0.3014 results in sensitive file exposure

Credits John Github: https://github.com/johnjhacking SickCodes Twitter: https://twitter.com/sickcodes Identification During research, I stumbled upon a TestRail application. While using Burp Suite to look at various requests and responses of the application, I noticed a files.md5 path: It seemed fairly normal at first, until I saw how massive the list was: I attempted to try some of the paths, and

CEH Master, An Honest Review

Certified Ethical Hacker | Master The CEH Master offered by EC-Council, claims to be a real-world, hands-on approach to everyday life as an ethical hacker: In the above photo, what stood out the most to me was, “We test your abilities with real-world challenges in a real-world environment, and a time limit, just as you would find in your job.” The CEH Master is a combination of the CEH Exam and th

URL https://twitter.com/erwan_lr

Indicator published by the cited source.

UNEP Breached, 100K+ Employee Records Accessed

United Nations Environment Programme Breached, 100K+ Employee Records Accessed Executive Summary We noticed that The United Nations had a Vulnerability Disclosure Program and a Hall of Fame, therefore Sakura Samurai 桜の侍 our security research group, set out to look for vulnerabilities to report to the United Nations. During the research process Jackson Henry @JacksonHHax , Nick Sahler, John @johnjh

CVE-2023-24068 && CVE-2023-24069: Abusing Signal Desktop Client for fun and for Espionage

Identification While using signal, it was observed that the preview of an image was still visible even after having deleted the image because the image had been “replied” to. After looking through multiple files, the culprit directory was identified. C:\Users\foo\AppData\Roaming\Signal\attachments.noindex\*\ To replicate, an image was sent in a group chat The image was stored as a regular file in

Account Takeover on the Jack Daniel's Tennessee Squire Association Platform

Summary Many people do not know about the Jack Daniel’s Tennessee Squires. The Squire Association is an Elite Club for “friends of Jack Daniel’s”. Anyone that has ever dreamed of being a Tennessee Squire knows how difficult - if not impossible it is to obtain membership without paying thousands of dollars (or knowing someone who can nominate you). Tonight, I give you an inside look of the Squire A

URL https://twitter.com/da1mshlomd

Indicator published by the cited source.

URL https://twitter.com/molly0xFFF

Indicator published by the cited source.