12.5K subscribers
550 photos
27 videos
24 files
889 links
This channel discusses:

— Offensive Security
— RedTeam
— Malware Research
— OSINT
— etc

Disclaimer:
t.iss.one/APT_Notes/6

Chat Link:
t.iss.one/APT_Notes_PublicChat
Download Telegram
Snaffler

Snaffler - Gets a list of Windows computers from Active Directory, then spreads out its snaffly appendages to them all to figure out which ones have file shares, and whether you can read them

https://github.com/SnaffCon/Snaffler


#pentest
#BurpHacksForBounties - Day 2/30

Effective usage of Match and Replace feature of Burp Suite

False2True Trick & Injecting all fields with polyglot payloads 😉😉

How to thread 🧵👇

#infosec #security #appsec #burp #bugbounty #bugbountytips
1/n False2True trick, when access to a resource for the user is unauthorized.
By changing server response body from F to T in burp response body match and replace, there are great chances it can un-hide client-side controls.

1. Add Match and replace.
2. Add shown replacement.
2/n
This is an example trick to change the false returned body to true.
And this is a very common use case.

The major trick for today: Injecting payloads into forms instead of typing out the entire payload.
3/n
The above match and replace rule will replace all KKK in the request body to SQLi and XSS polyglot.

Say I use this :
'"><script src="somesrc"></script><h1>test

And put KKK in all fields. All fields will be replaced with this payload.

It will find trivial XSS and SQLi.
♥️ #BurpHacksForBounties - Day 3/30 ♥️

🔍🔎
Find References: The most underrated and underused feature of Burp Suite

Pro Only & Can find references for URIs across the entire Burp.

A short thread : 🧵👇

#infosec #appsec #security #burp #bugbountytip #bugbountytips
1/n
Pick request from anywhere, right click -> Engagement Tools -> Find References
2/n
A new window will open up which will show the references and location of those references as well.
Location can be a repeater, scanner, etc.

The reference can be in Request, Response, Headers. Will be highlighted like the one shown in the image.
3/n
Can be used to discover the request sent by script from the browser and learn it to craft your valid payload request to that endpoint.

More references:

https://portswigger.net/burp/documentation/desktop/functions/search
🍺🤡 #BurpHacksForBounties - Day 4/30

Don't ignore junk-looking information in Burp Suite.
Keep this setting on, and play with zipped data in Burp Suite.

🤫🤫 You can change zipped data in req

Learned from @stokfredrik

#infosec #appsec #security #burp #bugbountytips #bugbountytip
1/n
Unzipping setting is disabled by default in Burp Proxy, enable it like this.
2/n Before & After.