APT

TIGMINT - OSINT GUI software framework https://github.com/TIGMINT/TIGMINT #social #media #Intelligence #OSINT #TwitterAnalyser

#RCE #Chrome https://tiszka.com/blog/CVE_2021_21225.html https://tiszka.com/blog/CVE_2021_21225_exploit.html https://gist.github.com/cd789/bbc6a6fea4c22c10d7f3a57472f4a235

https://github.com/dmaasland/proxyshell-poc/blob/main/proxyshell_rce.py #ProxyShell #RCE

The Red Team Vade Mecum https://kwcsec.gitbook.io/the-red-team-handbook/ #redteam #cheatsheet

Search JS using Gau gau -subs DOMAIN |grep -iE '\.js'|grep -iEv '(\.jsp|\.json)' >> js.txt #bugbounty #bugbountytips

Search Subdomains using Jldc curl -s "jldc.me/anubis/subdomains/example.com" | grep -Po '(?<=")[\w*.-]*(?=")' #bugbounty #bugbountytips

PowerShell cmdlets for ProxyShell Here is a list of PowerShell cmdlets you can use with ProxyShell. Don't focus exclusively on "New-ManagementRoleAssignment" or "New-MailExportRequest". https://gist.github.com/dmaasland/38bb8fbd05c764bab1baa441b4416317 #proxyshell #cmdlets

https://github.com/dmaasland/proxyshell-poc #poc #proxyshell

https://github.com/khast3x/Redcloud #redteam #infra #docker

https://y4y.space/2021/08/12/my-steps-of-reproducing-proxyshell/ #proxyshell

Resolve domains into IP address: while read l; do ip=$(dig +short $l | grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b"|head -1);echo "[+] '$l' => $ip";echo $ip >> ips.txt;done < domains.txt #cybersecuritytips #bugbounty

https://threatpost.com/microsoft-unpatched-printnightmare-zero-day/168613/ #news #nightmare

DEF CON 29 Main Stage Presentations: 1-Babak Javadi, Nick Draffen, Eric Bettse, Anze Jensterle - The PACS man Comes For Us All https://www.youtube.com/watch?v=NARJrwX_KFY 2-Reza Soosahabi, Chuck McAuley - SPARROW: A Novel Covert Communication Scheme https://www.youtube.com/watch?v=oaLIo9HwW-g 3-Tomer Bar, Eran Segal - 2021 Our Journey Back To The Future Of Windows Vulnerabilities https://www.youtube.com/watch?v=VxNi5pVDZU0 4-Sick Codes - The Agricultural Data Arms Race Exploiting a Tractor Load of Vulns https://www.youtube.com/watch?v=zpouLO-GXLo 5-Shir Tamari, Ami Luttwak - New class of DNS Vulns Affecting DNS-as-Service Platforms https://www.youtube.com/watch?v=72uzIZPyVjI 6-Sheila A Berta - The Unbelievable Insecurity of the Big Data Stack https://www.youtube.com/watch?v=vl9hk4fQdos 7-Roy Davis - No Key No PIN No Combo No Problem Pwning ATMs For Fun and Profit https://www.youtube.com/watch?v=9cG-JL0LHYw 8-Rotem Bar - Abusing SAST tools When scanners do more than just scanning https://www.youtube.com/watch?v=Jl-CU6G4Ofc 9-Richard Thieme AKA neuralcowboy - UFOs: Misinformation, Disinfo, and the Basic Truth https://www.youtube.com/watch?v=mExktWB0qz4 10-Richard Henderson - Old MacDonald Had a Barcode, E I E I CAR https://www.youtube.com/watch?v=cIcbAMO6sxo 11-Rex Guo, Junyuan Zeng - Phantom Attack: Evading System Call Monitoring https://www.youtube.com/watch?v=yaAdM8pWKG8 12-Paz Hameiri - TEMPEST Radio Station https://www.youtube.com/watch?v=m9WkEwshNKc 13-Patrick Wardle - Bundles of Joy: Breaking MacOS via Subverted Applications Bundles https://www.youtube.com/watch?v=raSTgFqYaoc 14-PatH - Warping Reality: Creating and Countering the Next Generation of Linux Rootkits https://www.youtube.com/watch?v=g6SKWT7sROQ 15-Orange Tsai - ProxyLogon Just Tip of the Iceberg, New Attack Surface on Exchange Server-@onhex_ir https://www.youtube.com/watch?v=5mqid-7zp8k 16-Matthew Bryant - Hacking G Suite: The Power of Dark Apps Script Magic https://www.youtube.com/watch?v=6AsVUS79gLw 17-Mars Cheng, Selmon Yang - Taking Apart and Taking Over ICS & SCADA Ecosystems https://www.youtube.com/watch?v=L0w_aE4jRFw 18-Laura Abbott, Rick Altherr -Breaking TrustZone M: Privilege Escalation on LPC55S69 https://www.youtube.com/watch?v=eKKgaGbcq4o 19-Justin Perdok - Hi Im DOMAIN Steve, Please Let Me Access VLAN2 https://www.youtube.com/watch?v=lDCoyxIhTN8 20-Jenko Hwong - New Phishing Attacks Exploiting OAuth Authentication Flows https://www.youtube.com/watch?v=9slRYvpKHp4 21-Jeff Dileo - Instrument and Find Out: Parasitic Tracers for High Level Languages https://www.youtube.com/watch?v=Iy1BNywebpY 22-James Kettle - HTTP2: The Sequel is Always Worse https://www.youtube.com/watch?v=rHxVVeM9R-M 23-Jacob Baines - Bring Your Own Print Driver Vulnerability https://www.youtube.com/watch?v=vdesswZYz-8 24-Ian Coldwater, Chad Rikansrud - Real Life Story of the 1st Mainframe Container Breakout https://www.youtube.com/watch?v=7DXF7YDBf-g 25-hyp3ri0n aka Alejandro Caceres Jason Hopper - PunkSPIDER and IOStation: Making a Mess-@onhex_ir https://www.youtube.com/watch?v=DlS_sl4hTWg 26-Hao Xing, Zekai Wu - How I use a JSON 0day to Steal Your Money on the Blockchain https://www.youtube.com/watch?v=pUexrXOGCkE 27-David Dworken - Worming through IDEs https://www.youtube.com/watch?v=pzqu_qaoNuY 28-Cory Doctorow - Privacy Without Monopoly https://www.youtube.com/watch?v=deRRR5B1hwI 29-Christopher Wade - Breaking Secure Bootloaders https://www.youtube.com/watch?v=z4gIxdFfJDg 30-Chad Seaman - UPnProxyPot: Fake the Funk, Become a Blackhat Proxy, MITM their TLS... https://www.youtube.com/watch?v=mHCGNUsrTf0 31-Brian Hong - Sleight of ARM: Demystifying Intel Houdini https://www.youtube.com/watch?v=9oQ5XjA1aq0 32-Bill Graydon - Defeating Physical Intrusion Detection Alarm Wires https://www.youtube.com/watch?v=Liz9R_QxSgk 33-Ben Kurtz - Offensive Golang Bonanza: Writing Golang Malware https://www.youtube.com/watch?v=3RQb05ITSyk

Scope Based Recon https://www.xmind.net/m/hKKexj/ #AppSec #hacking #bugbountytips #websecurity #xmind

Cookie Based Auth Vulnerabilities https://www.xmind.net/m/2FwJ7D/ #AppSec #hacking #bugbountytips #websecurity #xmind

Forget Password Vulns https://www.xmind.net/m/nZwbdk/ #AppSec #hacking #bugbountytips #websecurity #xmind

AppSec Ezine https://pathonproject.com/zb/?da0fdd7f7fd0d09c#bod4fYcp6Zbxi3iRKuTDAGQgWNFHbJ/JwPjWjd/Veaw= #AppSec #Security

Search JS using Gau gau -subs DOMAIN |grep -iE '\.js'|grep -iEv '(\.jsp|\.json)' >> js.txt #bugbounty #bugbountytips