APT

AD Security Assessment Active Directory Security Assessment script pulls important security facts from Active Directory and generates nicely viewable reports in HTML format by highlighting the spots that require attention. The script manipulates user data using facts collected with benchmark values. https://github.com/gkm-automation/AD-Security-Assessment #ad #security #assessment #ps1

WMEye A small project I wrote that uses WMI foo to remotely upload shellcode into a WMI Class and execute it by invoking MSBuild. It uses LogFileEventConsumer Class to write the MSBuild Payload. https://github.com/pwn1sher/WMEye #wmi #redteam #tools

PowerRemoteDesktop Have you ever dreamed about having a Remote Desktop Application entirely coded in PowerShell (Even the GUI) ? Well it is now possible with this very first beta release https://github.com/DarkCoderSc/PowerRemoteDesktop #rdp #powershell #tools

Bypass Rate Limits in Web Applications and API's. — What is Rate Limit Rate limiting is a process to limiting the number of request an user can make to a web server in an span of time. This can be achieved by implementing IP based, Session Based rate limits on web server. —Where to Look for Rate Limit Bugs Place like : — Login/Signup pages — Register Pages — 2FA codes — Confirmation Codes ...and any other request which if bruteforce will allow attacker to achieve anything malicious should be check for "No Rate Limit" issue. [Bypass 1] - Using Null Chars %00, %0d%0a, %09, %0C, %20, %0 Example: — Bruteforce with snapsec@gmail.com — After some time you will be blocked — Now Bruteforce with snapsec@gmail.com%00 and check if you are able continue bruteforce it [Bypass 2] - Adding Spaces A webserver may strip off extra spaces added to email/username at the backend, Which may allow you to bruteforce the same email by appending an extra space every time you are blocked. [Bypass 3] - Host Header Injection Try Modifying Host header of the request after being blocked by the server Change Host: www,newsite,com Change Host: localhost Change Host: 127.0.0.1 [Bypass 4] - Changing Cookies Try changing Session cookie after being blocked by the server. This can be achieved by figuring out which request is responsible to set session cookies to the user and then use that request to update session cookie everytime you are blocked. [Bypass 5] - X-forwarded-For — dig target,com — Change The X-Forwarded-For: IP Address This may confuse WAF/server/loadbalancer, as if requests are being forwarded to another host but will be forwarded to same target host hence will allow you to bypass the rate limit. [Bypass 6] - Confuse server with correct attempts If the server is blocking you after 20 attempts, Try bruteforcing with 19 attempts and use your credentials to login to your account on 20th attempt and then repeat the process. [Bypass 7] - Updating target Paths Appending random param=value may sometimes bypass rate limit on the endpoint Eg: — Bruteforce /api/v1/users/<id> — Got blocked after 200 attempts — Now Bruteforce /api/v1/users/<id>?xyz=123 — Change the param=value after each 200 attempts [Bypass 8] - IP based Rate limits IP based rate limits can be easily bypassed by changing the Ip address of your machine. The alternative would be using IP Rotate Burp Extension. #web #api #rate #limit #bypass

Bypassing HttpOnly 1. Why phpinfo 2. Stealing ci_session with info.php file 3. PoC Research: https://aleksikistauri.medium.com/bypassing-httponly-with-phpinfo-file-4e5a8b17129b #web #httponly #phpinfo #xss

API Guesser A simple website to guess API Key / OAuth Token When you do pentest / Github recon and find API key / OAuth token but you don't know what API key it is, you can use my website that I built from javascript https://api-guesser.netlify.app Source: https://github.com/daffainfo/apiguesser-web #api #token #osint #bugbounty

Redash Exploiting (CVE-2021-41192) Redash is a package for data visualization and sharing. If an admin sets up Redash versions 10.0.0 and prior without explicitly specifying the REDASH_COOKIE_SECRET or REDASH_SECRET_KEY environment variables, a default value is used for both that is the same across all installations. In such cases, the instance is vulnerable to attackers being able to forge sessions using the known default value. https://ian.sh/redash #redash #cve #research

Our team wishes you and yours a Merry Christmas and a Happy New Year! ❤️

New article "Fuzzing for XSS via nested parsers condition" by our researcher @Psych0tr1a. This techniques allowed us to find a bunch of vulnerabilities in popular web products that no one had noticed before! https://swarm.ptsecurity.com/fuzzing-for-xss-via-nested-parsers-condition/

Apache APISIX Dashboard — Unauthorized RCE (CVE-2021-45232) Attackers can access certain interfaces without logging in to Apache APISIX Dashboard, thus making unauthorized changes or obtaining relevant configuration information such as Apache APISIX Route, Upstream, Service, etc., and cause problems such as SSRF, malicious traffic proxies built by attackers, and arbitrary code execution. Shodan Dorks:

title:"Apache APISIX Dashboard"

PoC:

curl http://IP:9000/apisix/admin/migrate/export

https://apisix.apache.org/blog/2021/12/28/dashboard-cve-2021-45232/ #apache #apisix #cve #poc

VPN Overall Reconnaissance, Testing, Enumeration and Exploitation Toolkit (Vortex) A very simple Python framework, inspired by SprayingToolkit, that tries to automate most of the process required to detect, enumerate and attack common O365 and VPN endpoints (like Cisco, Citrix, Fortinet, Pulse, etc...). Features: — User Search and Collection — Password Leaks — Main Domain Identification — Subdomain Search — VPN Endpoint Detection — Password Spraying/Guessing attacks — Search profiles on Social Networks https://github.com/klezVirus/vortex #osint #vpn #enumeration #spraying #tools

Decoding PDF Injection This article talks about PDF injection from scratch to the execution of XSS and SSRF via PDF injection. https://medium.com/@urshilaravindran/pdf-injection-in-simple-words-8c399f92593c #pdf #xss #ssrf #injection

ADExplorerSnapshot ADExplorerSnapshot is an AD Explorer snapshot ingestor for BloodHound. AD Explorer allows you to connect to a DC and browse LDAP data. It can also create snapshots of the server you are currently attached to. This tool allows you to convert those snapshots to BloodHound-compatible JSON files. https://github.com/c3c/ADExplorerSnapshot.py #adexplorer #ldap #json #bloodhound

Apache APISIX Dashboard — Unauthorized RCE (CVE-2021-45232) Attackers can access certain interfaces without logging in to Apache APISIX Dashboard, thus making unauthorized changes or obtaining relevant configuration information such as Apache APISIX Route, Upstream, Service, etc., and cause problems such as SSRF, malicious traffic proxies built by attackers, and arbitrary code execution. Shodan Dorks:

title:"Apache APISIX Dashboard"

PoC:

curl http://IP:9000/apisix/admin/migrate/export

https://apisix.apache.org/blog/2021/12/28/dashboard-cve-2021-45232/ #apache #apisix #cve #poc

ldap2json — Offline Analysis Tool The ldap2json script allows you to extract the whole LDAP content of a Windows domain into a JSON file. Features: — Authenticate with password — Authenticate with LM:NT hashes — Authenticate with kerberos ticket — Save ldap content in json format https://github.com/p0dalirius/ldap2json #ldap #json #tools #redteam

GoWard GoWard proxies HTTP C2 traffic to specified Red Team servers based on the HTTP header of the traffic. https://github.com/chdav/GoWard #c2 #proxy #redteam

PHP LFI with Nginx Assistance This post presents a new method to exploit local file inclusion (LFI) vulnerabilities in utmost generality, assuming only that PHP is running in combination with Nginx under a common standard configuration. https://bierbaumer.net/security/php-lfi-with-nginx-assistance/ #lfi #nginx #php

ADCS: Playing with ESC4 ADCS cert template modification and ACL enumeration https://www.fortalicesolutions.com/posts/adcs-playing-with-esc4 https://github.com/fortalice/modifyCertTemplate #adcs #certificates #esc4 #acl

Executing Code Using Microsoft Teams Updater https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/executing-code-using-microsoft-teams-updater/ #teams #redteam #research

Сaldera — Automated Adversary Emulation Platform Сaldera is a cyber security platform designed to easily automate adversary emulation, assist manual red-teams, and automate incident response. https://github.com/mitre/caldera #blueteam #redteam #automated