Collaborate Disseminate
I’ve done a couple of boxes with bloodhound and found that I can’t just run bloodhound-python on every account I can find, even with username & password. What makes an account open to bloodhound-python? Is there a way to check if blood… Continue reading When can bloodhound-python be run on an account?
Given a binary and looking to abuse LD_PRELOAD (privilege escalation or persistence), what’s a good way to list what functions can be hijacked when running the binary? Are there functions that should (almost) always be good hijacking candi… Continue reading How to see what functions can be hijacked when abusing LD_PRELOAD?
I have compromised box A and another target server. I don’t have SSH on A and want to do port forwarding with escalating to root. I can’t install or run services without root, and only have nc and some common networking tools. I’m looking … Continue reading Dynamic port forwarding without sudo or SSH
Let’s say HonestInc is super generous and provides the source code of its web application HonestApp on github. However, I’m extremely distrustful of them, and have doubts that their actual server is running the same source code as what is … Continue reading Is it possible to verify the source code of a web service? [duplicate]
My target requires the Authorization header with credentials to get into. I have the credentials but the module I’m using (multi/http/mediawiki_thumb) doesn’t seem to have an option for Authorization.
I’ve tried setting RHOSTS to user:pass… Continue reading Problem using `multi/http/mediawiki_thumb`, possibly due to the `Authorization` header
I’ve heard/read about a number of scams around the internet, and most of the time, the scammer tells the victim to transfer money using Western Union. I might be biased due to my sources, but Western Union is almost always the bank used fo… Continue reading Why is Western Union so popular among scammers?
I’m testing a target with osTicket 1.7 for CVE-2017-15580. Instead of getting a shell, I’m trying to get the target to make an HTTP request to a temporary end-point.
My temporary end-point is https://test.free.beeceptor.com and the command… Continue reading CVE-2017-15580: Getting code execution with upload
I’m testing a target with osTicket 1.7 for CVE-2017-15580. Instead of getting a shell, I’m trying to get the target to make an HTTP request to a temporary end-point.
My temporary end-point is https://test.free.beeceptor.com and the command… Continue reading CVE-2017-15580: Getting code execution with upload
I want to test RFI but I don’t have a web server I can host test files on, and I’d rather not host from my own machine (e.g. python3 -m http.server) if possible. I’d like to test RFI with many things, but mainly scripts like PHP code to do… Continue reading What’s a good way to host files for testing remote file inclusion?
I want to test RFI but I don’t have a web server I can host test files on, and I’d rather not host from my own machine (e.g. python3 -m http.server) if possible. I’d like to test RFI with many things, but mainly scripts like PHP code to do… Continue reading What’s a good way to host files for testing remote file inclusion?