🔖php-jpeg-injector - Injects php payloads into jpeg images. Related to this repo: 📱 GitHub

This script injects PHP code into a specified jpeg image. The web application will execute the payload if it interprets the image. Make sure your input jpeg is uncompressed!

❓Use Case⤵️
You have a web application that runs a jpeg image through PHP's GD graphics library.

👀 Discover additional commands and options on GitHub page 👇

📱Github: Link
#BugBounty #BugBountyTools #pentest

FFIEC IT Examination Handbook

AQShdagi banklar uchun, axborot texnologiyalari xavfsizligi auditini o‘tkazish bo‘yicha qo‘llanma.

#Audit #BlueTeam

#OSINT #Guide

Analyzing logs with Suricata

#HTB #BlueTeam #Suricata

#XSS #BugBounty

#OSINT #CT

afrog - A Security Tool for Bug Bounty, Pentest and Red Teaming.

afrog is a high-performance vulnerability scanner that is fast and stable. It supports user-defined PoC and comes with several built-in types, such as CVE, CNVD, default passwords, information disclosure, fingerprint identification, unauthorized access, arbitrary file reading, and command execution. With afrog, network security professionals can quickly validate and remediate vulnerabilities, which helps to enhance their security defense capabilities.

Installation

go install -v github.com/zan8in/afrog/v3/cmd/afrog@latest

Github: Link

#BugBounty #Tools

https://owasp.org/www-chapter-pune/meetups/2023/Jan/File-upload-Vulnerability-Praveen-Sutar.pptx.pdf

#Pentesing #BugBounty #FileUpload

Burp + Elastic Logging (RU only lang)

https://blog.hackinone.click/burp_and_elk

OSINT Tools Uzbekistan

- Open Data portals
- Legal Entities
- Cadastral Maps
- Vehicles
- Phones
- Public procurements

https://github.com/paulpogoda/OSINT-Tools-Uzbekistan

Contributor https://t.iss.one/pavelbannikov

#osint #geoint

urldna.io – A Free OSINT Tool for URL Analysis

urldna.io offers detailed information about any URL, including:

Screenshots
SSL certificates
IP addresses
Title/body text
Cookies
Technologies
HTTP requests
Headers
Console messages
Meta tags

#OSINT

https://github.com/streaak/keyhacks?tab=readme-ov-file

#Pentest #API_KEY

https://github.com/arainho/awesome-api-security

#Pentest #API_KEY

System Monitor (Sysmon) – Windows tizim xizmati va qurilma drayveri bo‘lib, tizim qayta yuklanishlari davomida ishlashni davom ettiradi va Windows event logga tizim faoliyatini kuzatib, qayd qiladi. Sysmon jarayon yaratilishi, tarmoq ulanishlari, fayl yaratilish vaqtidagi o‘zgarishlar va boshqa ko‘p narsalar haqida batafsil ma’lumot beradi.

Sysmon’ning asosiy tarkibiy qismlari quyidagilardan iborat:

- Tizim faoliyatini kuzatish uchun Windows xizmati.
- Tizim faoliyati ma’lumotlarini yig‘ishda yordam beruvchi qurilma drayveri.
- Kuzatilgan faoliyat ma’lumotlarini ko‘rsatish uchun event log.

Sysmon’ning noyob imkoniyati shundaki, u odatda Security Event loglarda paydo bo‘lmaydigan ma’lumotlarni qayd qilish imkonini beradi, bu esa uni tizimni chuqur kuzatish va kiberxavfsizlik bo‘yicha sud ekspertizasi (Forensic) tahlili uchun kuchli vositaga aylantiradi.

Sysmon turli xil tizim faoliyatlarini event ID'lar orqali tasniflaydi, har bir ID ma’lum bir event turiga mos keladi. Masalan, Event ID 1 "Process Creation" (jarayon yaratilishi) eventlariga, Event ID 3 esa "Network Connection" (tarmoq ulanishi) eventlariga tegishli. Sysmon event ID'larining to‘liq ro‘yxatini quyidagi link orqali topishingiz mumkin.

https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon

Sysmon configuration file: https://github.com/SwiftOnSecurity/sysmon-config

Sysmon For Linux: https://github.com/microsoft/SysmonForLinux


#BlueTeam #Log_Analyse #Sysmon