APT

charlotte – fully undetected shellcode launcher

#shellcode #msfvenom #XOR #ShellcodeLauncher #CobaltStrike #Payload

https://reconshell.com/charlotte-fully-undetected-shellcode-launcher/

red shadow - Lightspin AWS Vulnerability Scanner

https://reconshell.com/red-shadow-lightspin-aws-vulnerability-scanner/

#PrivilegeEscalation #exploit #Exploitation #AWS
#Vulnerability #Scanner

Link to stokfredrik blog on Burp Suite:

https://portswigger.net/blog/burp-suite-tips-from-power-user-and-hackfluencer-stok

A must-read for beginners.

2/n Before & After.

1/n
Unzipping setting is disabled by default in Burp Proxy, enable it like this.

🍺🤡 #BurpHacksForBounties - Day 4/30

Don't ignore junk-looking information in Burp Suite.
Keep this setting on, and play with zipped data in Burp Suite.

🤫🤫 You can change zipped data in req

Learned from @stokfredrik

#infosec #appsec #security #burp #bugbountytips #bugbountytip

3/n
Can be used to discover the request sent by script from the browser and learn it to craft your valid payload request to that endpoint.

More references:

https://portswigger.net/burp/documentation/desktop/functions/search

2/n
A new window will open up which will show the references and location of those references as well.
Location can be a repeater, scanner, etc.

The reference can be in Request, Response, Headers. Will be highlighted like the one shown in the image.

1/n
Pick request from anywhere, right click -> Engagement Tools -> Find References

♥️ #BurpHacksForBounties - Day 3/30 ♥️

🔍🔎
Find References: The most underrated and underused feature of Burp Suite

Pro Only & Can find references for URIs across the entire Burp.

A short thread : 🧵👇

#infosec #appsec #security #burp #bugbountytip #bugbountytips

3/n
The above match and replace rule will replace all KKK in the request body to SQLi and XSS polyglot.

Say I use this :
'"><script src="somesrc"></script><h1>test
And put KKK in all fields. All fields will be replaced with this payload.

It will find trivial XSS and SQLi.

2/n
This is an example trick to change the false returned body to true.
And this is a very common use case.

The major trick for today: Injecting payloads into forms instead of typing out the entire payload.

1/n False2True trick, when access to a resource for the user is unauthorized.
By changing server response body from F to T in burp response body match and replace, there are great chances it can un-hide client-side controls.

1. Add Match and replace.
2. Add shown replacement.

#BurpHacksForBounties - Day 2/30

Effective usage of Match and Replace feature of Burp Suite

False2True Trick & Injecting all fields with polyglot payloads 😉😉

How to thread 🧵👇

#infosec #security #appsec #burp #bugbounty #bugbountytips

Snaffler

Snaffler - Gets a list of Windows computers from Active Directory, then spreads out its snaffly appendages to them all to figure out which ones have file shares, and whether you can read them

https://github.com/SnaffCon/Snaffler


#pentest

n/n
You can do almost anything with Python inside Burp.
Eg.
- Handle custom login
- Tailored testing
- Filter out requests on "interesting" responses
- Scale your testing
- Add rate limiting, pipeline, etc

This approach can overcome intruder multithreading deficiencies in CE.