SecList for CyberStudents
240 subscribers
593 photos
24 videos
211 files
903 links
Think outside the box
Download Telegram
Built-in AD Groups

#AD
https://otvet.mail.ru/question/240265785

Чтобы включить изоляцию ядра в Windows 11?
🔥3
Lenovo XSS via Unrestricted File Upload PoC

POC is here: —> https://t.iss.one/brutsecurity_poc/42

#BugBounty #XSS
New CERTIFICATE from Tryhackme SAL1 for Blue Teamers
Forwarded from APT
🔑 FindGPPPasswords

A cross-platforms tool to find and decrypt Group Policy Preferences passwords from the SYSVOL share using low-privileged domain accounts.

🚀 Features:
— Only requires a low privileges domain user account.
— Automatically gets the list of all domain controllers from the LDAP.
— Finds all the Group Policy Preferences Passwords present in SYSVOL share on each domain controller.
— Decrypts the passwords and prints them in cleartext.
— Outputs to a Excel file.

🔗 Source:
https://github.com/p0dalirius/FindGPPPasswords

#ad #windows #gpo #credentials
Please open Telegram to view this post
VIEW IN TELEGRAM
👍3
𝗚𝗮𝗺𝗲 𝗼𝗳 𝗔𝗰𝘁𝗶𝘃𝗲 𝗗𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆

GOAD is a pentest active directory LAB project. This lab aims to give pentesters a vulnerable AD environment ready to use to practice usual attack techniques.

https://github.com/Orange-Cyberdefense/GOAD
📖 Account Takeover на GitLab

Новый забавный дисклоз от гитлаба. Оказывается, в конце 2023 года им сдали баг на сброс пароля, в котором достаточно было поменять запрос на JSON и добавить вторую почту в массив.

Ссылка на отчет

#web #ato
👍3
Bug Bounty Tip

When you test a Django, Rails, or NodeJs web app try the following payloads in the "Accept:" header.
Forwarded from Cat Seclist
Security Training for Web Developers by HackSplaining

Completely free, comprehensive security training for web developers. Covers every major security vulnerability you are likely to face. Concrete, no-nonsense advice for the developer in a hurry.

❗️The lessons + OWASP classificatory
📌The book

#web #AppSec