Learn Regex in 4 tweets :)
cat matches cat
ca+t matches caaaaaaaaaaaat but not ct
ca*t matches caaaaaaaaaaaat and also ct
ca{2,4} matches caat, caaat and caaaat
c(at)+ matches catatatatatat
c(at|orn) matches cat and corn
c[ea] matches cat and cet
c[ea]+ matches caaaat and ceeet
🚨 ALERT 🚨
Python's ctx library and a fork of PHP's phpass have been compromised. 3 million users combined.
The malicious code sends all the environment variables to a heroku app, likely to mine AWS credentials.
Incident: Account hacked despite having 2FA
Expectation: <some fancy technique>
Reality: Website had no 2FA on "Password Reset" mechanism and the attacker got straight in.
Sometimes bugs are too simple, hiding in plain sight.
Simple tip to find juicy assets that most hackers miss 🔥
1. Resolve all subdomains to IP addresses. Save IPs to list1.txt
2. Find the organization name target.com uses in SSL certificates
3. Go to shodan.io and search ssl:"Target Company"
Check if a server is running any vulnerable services
wget https://raw.githubusercontent(.)com/vulnersCom/nmap-vulners/master/vulners.nse -O /usr/share/nmap/scripts/vulners.nse && nmap --script-updatedb
All done, now you can do a scan with
nmap -sV --script vulners <target>
The hacker after executing 'whoami' on my PC to check his privileges
(I have replaced whoami with a command that prints the IP address and location of everyone connected to me and then says, "you tell me")
SSRF Break Points [1/2]
- Anything that accepts a URL
- File upload option? Change type="file" to type="url" and submit a URL.
- Image upload? Submit a svg containing "image" element with the payload in xlink:href attribute. Try ImageMagick exploits.
Want to find XSS in a list of 100000 URLs?
This will give you all the URLs that have parameters commonly vulnerable to XSS.
cat urls.txt | uro | parth --pipe xss
