As we are growing slowly (thanks for that!) I wonder what would YOU like to see more often?
Anonymous Poll
43%
Content about web security / bug bounty
29%
Binary exploitation / low level stuff
29%
Writeups for HackTheBox/TryHackMe machines
29%
Other (let me know in the comments)
An easy level of #nebula for today's post. Exploiting a basic OS command injection via Lua binary.
#exploitdev
https://telegra.ph/Nebula---12-11-24
#exploitdev
https://telegra.ph/Nebula---12-11-24
Telegraph
Nebula - 12
> Source code local socket = require("socket") local server = assert(socket.bind("127.0.0.1", 50001)) function hash(password) prog = io.popen("echo "..password.." | sha1sum", "r") data = prog:read("*all") prog:close() data = string.sub(data, 1, 40) return…
A basic example of the SQL injection in another blogpost about #web exploitation.
https://telegra.ph/SQL-injection-vulnerability-in-WHERE-clause-allowing-retrieval-of-hidden-data-11-25
https://telegra.ph/SQL-injection-vulnerability-in-WHERE-clause-allowing-retrieval-of-hidden-data-11-25
Telegraph
SQL injection vulnerability in WHERE clause allowing retrieval of hidden data
> Objective This lab contains an SQL injection vulnerability in the product category filter. When the user selects a category, the application carries out an SQL query like the following: SELECT * FROM products WHERE category = 'Gifts' AND released = 1 To…
Hacking For Ramen
So PortSwigger (folks who made Burp Suite and Web Academy) finally decided to make their own #cert. It costs $99, but if you will purchase it before Dec 15th they reimburse the whole amount. That could kill the eWPT 🤔 https://portswigger.net/web-security/certification
By the way! It's just 8 Euros due to Black Friday right now.
Hello hackers,
It is CyberMonday, so today and only today you can get all my writeups for FREE!
Hurry up, tomorrow the price will return to the original $0!
It is CyberMonday, so today and only today you can get all my writeups for FREE!
Hurry up, tomorrow the price will return to the original $0!
Continuing to drill into the #Web Security Academy. Another blog post about SQL injections:
https://telegra.ph/SQL-injection-vulnerability-allowing-login-bypass-11-29
https://telegra.ph/SQL-injection-vulnerability-allowing-login-bypass-11-29
Telegraph
SQL injection vulnerability allowing login bypass
> Objective This lab contains an SQL injection vulnerability in the login function. To solve the lab, perform an SQL injection attack that logs in to the application as the administrator user. > Solving the challenge In this challenge, we will work with the…
This year's Humble Hacking Bundle is here! It's getting better in better every year, I like that.
Check it out, some dang good #books about hacking
https://www.humblebundle.com/books/hacking-by-no-starch-press-books
Check it out, some dang good #books about hacking
https://www.humblebundle.com/books/hacking-by-no-starch-press-books
Humble Bundle
Humble Book Bundle: Hacking by No Starch Press
Pay what you want to think like a hacker with this ebook bundle from No Starch Press.
December is here! What does it mean? Christmas and the new year are coming!
I had an idea to do some sort of hacking advent calendar, maybe a bit similar to THM's Advent of Cyber. Maybe not.
The Idea is to do some challenges every day from December 1st right until Christmas. Or maybe share some goodies with you!
It is going to be fun, that's for sure!
I had an idea to do some sort of hacking advent calendar, maybe a bit similar to THM's Advent of Cyber. Maybe not.
The Idea is to do some challenges every day from December 1st right until Christmas. Or maybe share some goodies with you!
It is going to be fun, that's for sure!
For the second day of the #adventofhacking I'd like to bring up the basic example of the Reflected XSS vulnerability from #Web Security Academy.
https://telegra.ph/Reflected-XSS-into-HTML-context-with-nothing-encoded-12-02
https://telegra.ph/Reflected-XSS-into-HTML-context-with-nothing-encoded-12-02
Telegraph
Reflected XSS into HTML context with nothing encoded
> Objective This lab contains a simple reflected cross-site scripting vulnerability in the search functionality. To solve the lab, perform a cross-site scripting attack that calls the alert function. > Solving the challenge We've got a web page with the search…
For the 3rd day of the #adventofhacking I'd like to talk about basic example of the Stored XSS, as scratched the surface of explaining the XSS vulnerability in general.
#web
https://telegra.ph/Stored-XSS-into-HTML-context-with-nothing-encoded-12-02
#web
https://telegra.ph/Stored-XSS-into-HTML-context-with-nothing-encoded-12-02
Telegraph
Stored XSS into HTML context with nothing encoded
> Objective This lab contains a stored cross-site scripting vulnerability in the comment functionality. To solve this lab, submit a comment that calls the alert function when the blog post is viewed. > Solving the challenge For this challenge, we will work…
An example of DOM XSS from #Web Security Academy on today's plate.
Happy #adventofhacking everyone!
https://telegra.ph/DOM-XSS-in-documentwrite-sink-using-source-locationsearch-12-02
Happy #adventofhacking everyone!
https://telegra.ph/DOM-XSS-in-documentwrite-sink-using-source-locationsearch-12-02
Telegraph
DOM XSS in document.write sink using source location.search
> Objective This lab contains a DOM-based cross-site scripting vulnerability in the search query tracking functionality. It uses the JavaScript document.write function, which writes data out to the page. The document.write function is called with data fr…
A good day for some #binaryexploitation challenge, isn't it? Well, any day is a good one during the #adventofhacking!
In this level of #nebula we will debug a simple program with GDB to reveal the access token.
https://telegra.ph/Nebula---13-12-06
In this level of #nebula we will debug a simple program with GDB to reveal the access token.
https://telegra.ph/Nebula---13-12-06
Telegraph
Nebula - 13
> Objective
PortSwigger released the new category of challenges in their #Web Security Academy - file upload.
Let's hook in in today's #adventofhacking article:
https://telegra.ph/Remote-code-execution-via-web-shell-upload-12-08
Let's hook in in today's #adventofhacking article:
https://telegra.ph/Remote-code-execution-via-web-shell-upload-12-08
Telegraph
Remote code execution via web shell upload
> Objective
That's it! That's the end of #adventofhacking series.
I hope you liked it, and maybe learned a thing or two.
Happy Holidays, local nodes! I wish you all the best!
See you all in new year!
I hope you liked it, and maybe learned a thing or two.
Happy Holidays, local nodes! I wish you all the best!
See you all in new year!
Hello hackers,
I didn’t mean to do another post on holidays, but the end of the year is a perfect occasion to evaluate and celebrate even such a small win.
I’m a strong believer that people don’t care about other people goals and resolutions for the new year, but I can assure you there will be more cool and original content here in the future. So with this 101st post I’d like to thank all of you for being a part of that small community! It wouldn’t be possible without you, who could learn something from those posts. I hope you find this channel helpful. If you do, you can share some of the books (that are there for now), or a write-up to someone who could be interested in such stuff, so I will be more motivated to bake some more content.
I wish you all the best in the upcoming new year, and happy holidays!
I didn’t mean to do another post on holidays, but the end of the year is a perfect occasion to evaluate and celebrate even such a small win.
I’m a strong believer that people don’t care about other people goals and resolutions for the new year, but I can assure you there will be more cool and original content here in the future. So with this 101st post I’d like to thank all of you for being a part of that small community! It wouldn’t be possible without you, who could learn something from those posts. I hope you find this channel helpful. If you do, you can share some of the books (that are there for now), or a write-up to someone who could be interested in such stuff, so I will be more motivated to bake some more content.
I wish you all the best in the upcoming new year, and happy holidays!
My next post will be about fuzzing anyway, as I’m preparing metering for a talk on a local meetup. Those are good resources to begin with:
Forwarded from IOSSec (cha1ned)
101 fuzzing. Thank you, bublik community! List will be updated.
[Academic articles]
link: https://github.com/0xricksanchez/paper_collection
[Conversations]
link: https://youtu.be/zDXyH8HxTwg
link: https://youtu.be/YV3jewkUJ54
[tutorials & workshops]
(@HackingForRamen contribution)
link: https://fuzzing.in/
link: https://github.com/antonio-morales/Fuzzing101
link: https://github.com/google/fuzzing
[afl internals]
link: https://afl-1.readthedocs.io/en/latest/
#fuzzing
[Academic articles]
link: https://github.com/0xricksanchez/paper_collection
[Conversations]
link: https://youtu.be/zDXyH8HxTwg
link: https://youtu.be/YV3jewkUJ54
[tutorials & workshops]
(@HackingForRamen contribution)
link: https://fuzzing.in/
link: https://github.com/antonio-morales/Fuzzing101
link: https://github.com/google/fuzzing
[afl internals]
link: https://afl-1.readthedocs.io/en/latest/
#fuzzing