CTF Community | Hints

⭕️BishopFox/jsluice: jsluice is a Go package and command-line tool for extracting URLs, paths, secrets, and other interesting data from JavaScript source code. #Web @ctfplay

📣📢 Try new advance #pentesting challenges on @Vulnmachines 👩‍💻 ❌ No VPN required ✔️ Free Access ✔️ Access the lab using your favorite browser Challenge Name: Family Man 🕵️👩‍💻 Checkout: https://www.vulnmachines.com #infosec #cybersecurity #ctf

⭕️ Automated RE of Kernel Configurations Brandon Miller published an article about his Binary Ninja plugin that analyzes Linux kernel binaries to recover kernel configuration options. This tool is called bn-kconfig-recover. It can help when a kernel binary has CONFIG_IKCONFIG disabled. #kernel #linux #binary @ctfplay

https://epi052.gitlab.io/notes-to-self/blog/2022-01-17-fuzzing-101-with-libafl-part-5/ #Fuzzing @ctfplay

How I Get $1350 From IDOR Just Less 1 hours #Web @ctfplay

https://challenge-0321.intigriti.io/ #XSS #Web @ctfplay

Finding More IDORs – Tips And Tricks https://www.aon.com/cyber-solutions/aon_cyber_labs/finding-more-idors-tips-and-tricks/ #Web #IDOR #BugBounty @ctfplay

OWASP API : Broken Authentication https://medium.com/strike-sh/owasp-api-2-broken-authentication-5d6e8e3b595c #Web #Api @ctfplay

OWASP API : Broken Authentication https://medium.com/strike-sh/owasp-api-2-broken-authentication-5d6e8e3b595c #Web #Api @ctfplay

Account takeover through password reset #Web @ctfplay

In this writeup the author explained a two vulnerabilities that has found in a private program affecting their mobile apps which result for 3,300$ in bounty. A simple case study in real life bug bounty for how it has been used android studio to find bugs an android applications. #Android @ctfplay

CRYPTOHACK a fun platform for learning cryptography. The emphasis is on breaking bad implementations of "modern" crypto, such as AES, RSA, and Elliptic-curve. The format is a series of puzzles that teach small lessons and motivate further research. #Cryptography @ctfplay

iOS Security Analysis with MobSF https://www.netguru.com/codestories/ios-security-analysis-with-mobsf #Mobile #IOS @ctfplay

Activity Lifecycle #Android @ctfplay

Ghost : Android Debug Bridge To Remotely Access An Android Device. Ghost Framework is an Android post-exploitation framework that uses an Android Debug Bridge to remotely access an Android device. It Framework gives you the power and convenience of remote Android device administration. https://github.com/entynetproject/ghost #Android @ctfplay

Extended XSS Search Extended XSS Searcher is the is the extended version based on the initial idea already published as “xssfinder”. This private version allows an attacker to perform not only GET but also POST requests. Additionally its possible to proxy every request through Burp or another tunnel. https://github.com/Damian89/extended-xss-search#screenshot #web @ctfplay

CallObfuscator Obfuscate windows apis from static analysis tools and debuggers https://github.com/d35ha/CallObfuscator #WEB @ctfplay