test\nAnd put KKK in all fields. All fields will be replaced with this payload.\n\nIt will find trivial XSS and SQLi.","datePublished":"2021-07-05T01:01:06Z","dateModified":"2021-07-05T01:01:06Z","author":{"@type":"Organization","name":"APT","url":"https://telemetr.io/fa/channels/1390210355-apt_notes","image":"https://img.telemetr.io/c/1w5bdF/5386640763535865221?ty=x"},"publisher":{"@type":"Organization","name":"APT","url":"https://telemetr.io/fa/channels/1390210355-apt_notes","image":"https://img.telemetr.io/c/1w5bdF/5386640763535865221?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":92},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":1}]}},{"@type":"ListItem","position":13,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/fa/channels/1390210355-apt_notes/posts/115","url":"https://telemetr.io/fa/channels/1390210355-apt_notes/posts/115","mainEntityOfPage":"https://telemetr.io/fa/channels/1390210355-apt_notes/posts/115","headline":"2/n This is an example trick to change the false returned body to true. And this is a very common use case. T…","articleBody":"2/n\nThis is an example trick to change the false returned body to true.\nAnd this is a very common use case. \n\nThe major trick for today: Injecting payloads into forms instead of typing out the entire payload.","datePublished":"2021-07-05T01:01:06Z","dateModified":"2021-07-05T01:01:06Z","author":{"@type":"Organization","name":"APT","url":"https://telemetr.io/fa/channels/1390210355-apt_notes","image":"https://img.telemetr.io/c/1w5bdF/5386640763535865221?ty=x"},"publisher":{"@type":"Organization","name":"APT","url":"https://telemetr.io/fa/channels/1390210355-apt_notes","image":"https://img.telemetr.io/c/1w5bdF/5386640763535865221?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":83}]}},{"@type":"ListItem","position":14,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/fa/channels/1390210355-apt_notes/posts/114","url":"https://telemetr.io/fa/channels/1390210355-apt_notes/posts/114","mainEntityOfPage":"https://telemetr.io/fa/channels/1390210355-apt_notes/posts/114","headline":"1/n False2True trick, when access to a resource for the user is unauthorized. By changing server response bod…","articleBody":"1/n False2True trick, when access to a resource for the user is unauthorized.\nBy changing server response body from F to T in burp response body match and replace, there are great chances it can un-hide client-side controls.\n\n1. Add Match and replace.\n2. Add shown replacement.","datePublished":"2021-07-05T01:01:06Z","dateModified":"2021-07-05T01:01:06Z","author":{"@type":"Organization","name":"APT","url":"https://telemetr.io/fa/channels/1390210355-apt_notes","image":"https://img.telemetr.io/c/1w5bdF/5386640763535865221?ty=x"},"publisher":{"@type":"Organization","name":"APT","url":"https://telemetr.io/fa/channels/1390210355-apt_notes","image":"https://img.telemetr.io/c/1w5bdF/5386640763535865221?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":87}]}},{"@type":"ListItem","position":15,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/fa/channels/1390210355-apt_notes/posts/113","url":"https://telemetr.io/fa/channels/1390210355-apt_notes/posts/113","mainEntityOfPage":"https://telemetr.io/fa/channels/1390210355-apt_notes/posts/113","headline":"#BurpHacksForBounties - Day 2/30 Effective usage of Match and Replace feature of Burp Suite False2True Trick…","articleBody":"#BurpHacksForBounties - Day 2/30\n\nEffective usage of Match and Replace feature of Burp Suite \n\nFalse2True Trick & Injecting all fields with polyglot payloads 😉😉\n\nHow to thread 🧵👇\n\n#infosec #security #appsec #burp #bugbounty #bugbountytips","datePublished":"2021-07-05T01:00:08Z","dateModified":"2021-07-05T01:00:08Z","author":{"@type":"Organization","name":"APT","url":"https://telemetr.io/fa/channels/1390210355-apt_notes","image":"https://img.telemetr.io/c/1w5bdF/5386640763535865221?ty=x"},"publisher":{"@type":"Organization","name":"APT","url":"https://telemetr.io/fa/channels/1390210355-apt_notes","image":"https://img.telemetr.io/c/1w5bdF/5386640763535865221?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":84}]}},{"@type":"ListItem","position":16,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/fa/channels/1390210355-apt_notes/posts/112","url":"https://telemetr.io/fa/channels/1390210355-apt_notes/posts/112","mainEntityOfPage":"https://telemetr.io/fa/channels/1390210355-apt_notes/posts/112","headline":"Snaffler Snaffler - Gets a list of Windows computers from Active Directory, then spreads out its snaffly appe…","articleBody":"Snaffler \n\nSnaffler - Gets a list of Windows computers from Active Directory, then spreads out its snaffly appendages to them all to figure out which ones have file shares, and whether you can read them\n\nhttps://github.com/SnaffCon/Snaffler\n\n\n#pentest","datePublished":"2021-07-04T16:37:27Z","dateModified":"2021-07-04T16:37:27Z","author":{"@type":"Organization","name":"APT","url":"https://telemetr.io/fa/channels/1390210355-apt_notes","image":"https://img.telemetr.io/c/1w5bdF/5386640763535865221?ty=x"},"publisher":{"@type":"Organization","name":"APT","url":"https://telemetr.io/fa/channels/1390210355-apt_notes","image":"https://img.telemetr.io/c/1w5bdF/5386640763535865221?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":85}]}},{"@type":"ListItem","position":17,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/fa/channels/1390210355-apt_notes/posts/111","url":"https://telemetr.io/fa/channels/1390210355-apt_notes/posts/111","mainEntityOfPage":"https://telemetr.io/fa/channels/1390210355-apt_notes/posts/111","headline":"n/n You can do almost anything with Python inside Burp. Eg. - Handle custom login - Tailored testing - Filter…","articleBody":"n/n\nYou can do almost anything with Python inside Burp.\nEg.\n- Handle custom login\n- Tailored testing\n- Filter out requests on \"interesting\" responses\n- Scale your testing\n- Add rate limiting, pipeline, etc\n\nThis approach can overcome intruder multithreading deficiencies in CE.","datePublished":"2021-07-04T01:01:06Z","dateModified":"2021-07-04T01:01:06Z","author":{"@type":"Organization","name":"APT","url":"https://telemetr.io/fa/channels/1390210355-apt_notes","image":"https://img.telemetr.io/c/1w5bdF/5386640763535865221?ty=x"},"publisher":{"@type":"Organization","name":"APT","url":"https://telemetr.io/fa/channels/1390210355-apt_notes","image":"https://img.telemetr.io/c/1w5bdF/5386640763535865221?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":93},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":1}]}},{"@type":"ListItem","position":18,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/fa/channels/1390210355-apt_notes/posts/110","url":"https://telemetr.io/fa/channels/1390210355-apt_notes/posts/110","mainEntityOfPage":"https://telemetr.io/fa/channels/1390210355-apt_notes/posts/110","headline":"3/n Details in comments. Code: https://gist.github.com/r0hi7/47e3d47efaa1ee3df63a6e936dade787 Increase concur…","articleBody":"3/n\nDetails in comments.\nCode: https://gist.github.com/r0hi7/47e3d47efaa1ee3df63a6e936dade787\n\nIncrease concurrency or can add pipeline. \nThen click attack.","datePublished":"2021-07-04T01:01:06Z","dateModified":"2021-07-04T01:01:06Z","author":{"@type":"Organization","name":"APT","url":"https://telemetr.io/fa/channels/1390210355-apt_notes","image":"https://img.telemetr.io/c/1w5bdF/5386640763535865221?ty=x"},"publisher":{"@type":"Organization","name":"APT","url":"https://telemetr.io/fa/channels/1390210355-apt_notes","image":"https://img.telemetr.io/c/1w5bdF/5386640763535865221?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":96},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":1}]}},{"@type":"ListItem","position":19,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/fa/channels/1390210355-apt_notes/posts/109","url":"https://telemetr.io/fa/channels/1390210355-apt_notes/posts/109","mainEntityOfPage":"https://telemetr.io/fa/channels/1390210355-apt_notes/posts/109","headline":"2/n Once you send req to the plugin, a python editor will open. This will show a couple of existing python sc…","articleBody":"2/n\nOnce you send req to the plugin, a python editor will open. This will show a couple of existing python scripts to take reference from and to use.","datePublished":"2021-07-04T01:01:06Z","dateModified":"2021-07-04T01:01:06Z","author":{"@type":"Organization","name":"APT","url":"https://telemetr.io/fa/channels/1390210355-apt_notes","image":"https://img.telemetr.io/c/1w5bdF/5386640763535865221?ty=x"},"publisher":{"@type":"Organization","name":"APT","url":"https://telemetr.io/fa/channels/1390210355-apt_notes","image":"https://img.telemetr.io/c/1w5bdF/5386640763535865221?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":95},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":1}]}},{"@type":"ListItem","position":20,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/fa/channels/1390210355-apt_notes/posts/108","url":"https://telemetr.io/fa/channels/1390210355-apt_notes/posts/108","mainEntityOfPage":"https://telemetr.io/fa/channels/1390210355-apt_notes/posts/108","headline":"1/n Using: CE so that everyone can explore. Intruder in CE is limited in multithreading, Turbo-Intruder can o…","articleBody":"1/n \nUsing: CE so that everyone can explore.\nIntruder in CE is limited in multithreading, Turbo-Intruder can overcome that.\n- Install through Extender\n- Send req to the plugin.","datePublished":"2021-07-04T01:01:06Z","dateModified":"2021-07-04T01:01:06Z","author":{"@type":"Organization","name":"APT","url":"https://telemetr.io/fa/channels/1390210355-apt_notes","image":"https://img.telemetr.io/c/1w5bdF/5386640763535865221?ty=x"},"publisher":{"@type":"Organization","name":"APT","url":"https://telemetr.io/fa/channels/1390210355-apt_notes","image":"https://img.telemetr.io/c/1w5bdF/5386640763535865221?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":93},{"@type":"InteractionCounter","interactionType":"https://schema.org/ShareAction","userInteractionCount":1}]}}]}

APT

17 267

owerHub - post exploitation tool based on a web application https://reconshell.com/powerhub-post-exploitation-tool-based-on-a-web-application/ #PowerHub #PowerSploit #PowerView #Kerberos #LPE #PowerShell

87

analytics

APT

17 267

charlotte – fully undetected shellcode launcher #shellcode #msfvenom #XOR #ShellcodeLauncher #CobaltStrike #Payload https://reconshell.com/charlotte-fully-undetected-shellcode-launcher/

97

analytics

APT

17 267

red shadow - Lightspin AWS Vulnerability Scanner https://reconshell.com/red-shadow-lightspin-aws-vulnerability-scanner/ #PrivilegeEscalation #exploit #Exploitation #AWS #Vulnerability #Scanner

961

analytics

APT

17 267

Link to stokfredrik blog on Burp Suite: https://portswigger.net/blog/burp-suite-tips-from-power-user-and-hackfluencer-stok A must-read for beginners.

91

analytics

APT

17 267

+1

2/n Before & After.

80

analytics

APT

17 267

1/n Unzipping setting is disabled by default in Burp Proxy, enable it like this.

73

analytics

APT

17 267

🍺🤡 #BurpHacksForBounties - Day 4/30 Don't ignore junk-looking information in Burp Suite. Keep this setting on, and play with zipped data in Burp Suite. 🤫🤫 You can change zipped data in req Learned from @stokfredrik #infosec #appsec #security #burp #bugbountytips #bugbountytip

76

analytics

APT

17 267

3/n Can be used to discover the request sent by script from the browser and learn it to craft your valid payload request to that endpoint. More references: https://portswigger.net/burp/documentation/desktop/functions/search

83

analytics

APT

17 267

+1

2/n A new window will open up which will show the references and location of those references as well. Location can be a repeater, scanner, etc. The reference can be in Request, Response, Headers. Will be highlighted like the one shown in the image.

78

analytics

APT

17 267

1/n Pick request from anywhere, right click -> Engagement Tools -> Find References

78

analytics

APT

17 267

♥️ #BurpHacksForBounties - Day 3/30 ♥️ 🔍🔎 Find References: The most underrated and underused feature of Burp Suite Pro Only & Can find references for URIs across the entire Burp. A short thread : 🧵👇 #infosec #appsec #security #burp #bugbountytip #bugbountytips

81

analytics

APT

17 267

3/n The above match and replace rule will replace all KKK in the request body to SQLi and XSS polyglot. Say I use this : '"><script src="somesrc"></script><h1>test And put KKK in all fields. All fields will be replaced with this payload. It will find trivial XSS and SQLi.

921

analytics

APT

17 267

2/n This is an example trick to change the false returned body to true. And this is a very common use case. The major trick for today: Injecting payloads into forms instead of typing out the entire payload.

83

analytics

APT

17 267

+2

1/n False2True trick, when access to a resource for the user is unauthorized. By changing server response body from F to T in burp response body match and replace, there are great chances it can un-hide client-side controls. 1. Add Match and replace. 2. Add shown replacement.

87

analytics

APT

17 267

#BurpHacksForBounties - Day 2/30 Effective usage of Match and Replace feature of Burp Suite False2True Trick & Injecting all fields with polyglot payloads 😉😉 How to thread 🧵👇 #infosec #security #appsec #burp #bugbounty #bugbountytips

84

analytics

APT

17 267

Snaffler Snaffler - Gets a list of Windows computers from Active Directory, then spreads out its snaffly appendages to them all to figure out which ones have file shares, and whether you can read them https://github.com/SnaffCon/Snaffler #pentest

85

analytics

APT

17 267

n/n You can do almost anything with Python inside Burp. Eg. - Handle custom login - Tailored testing - Filter out requests on "interesting" responses - Scale your testing - Add rate limiting, pipeline, etc This approach can overcome intruder multithreading deficiencies in CE.

931

analytics

APT

17 267

3/n Details in comments. Code: https://gist.github.com/r0hi7/47e3d47efaa1ee3df63a6e936dade787 Increase concurrency or can add pipeline. Then click attack.

961

analytics

APT

17 267

2/n Once you send req to the plugin, a python editor will open. This will show a couple of existing python scripts to take reference from and to use.

951

analytics

APT

17 267

1/n Using: CE so that everyone can explore. Intruder in CE is limited in multithreading, Turbo-Intruder can overcome that. - Install through Extender - Send req to the plugin.

931

analytics

نمایش بیشتر