APT

Why I do this: I save sessions, and burp will store those credentials and sessions. I personally don't want credentials to be stored in files.
Another important point is we are not testing SSO, rather we are testing App behind SSO.

Steps :

1. Temporary project/session.
2. Login to the application, like normal.
3. Identify which requests to which domains contain credentials.
4. Start the main project in Burp.
5. Add those Domains to SSL passthrough. Proxy > Options > TLS Pass-Through

#BurpHacksForBounties - Hack 11/30

We mostly use PortSwigger 's Burp Suite pro for corporate pentesting, & we should not capture and store corporate credentials.

Steps that I use and why is it important: 👇

#infosec #appsec #burp #Burpsuite

🔥 Credential Dumping 🔥

Clipboard: https://www.hackingarticles.in/credential-dumping-clipboard/

Local Security Authority: https://www.hackingarticles.in/credential-dumping-local-security-authority-lsalsass-exe/

NTDS.dit https://www.hackingarticles.in/credential-dumping-ntds-dit/

DCSync Attack: https://www.hackingarticles.in/credential-dumping-dcsync-attack/

Windows Autologon Password: https://www.hackingarticles.in/credential-dumping-windows-autologon-password/

Domain Cache Credential: https://www.hackingarticles.in/credential-dumping-domain-cache-credential/

Fake Services: https://www.hackingarticles.in/credential-dumping-fake-services/

Phishing Windows Credentials: https://www.hackingarticles.in/credential-dumping-phishing-windows-credentials/

#infosec #redteaming #cybersecurity #pentest

CVE-2021-22555: Turning \x00\x00 into 10000$

This is a 15 years old heap out-of-bounds write vulnerability in Linux Netfilter that is powerful enough to bypass all modern security mitigations and achieve kernel code execution

# Technical details — https://github.com/google/security-research/blob/master/pocs/linux/cve-2021-22555/writeup.md

# PoC — https://github.com/google/security-research/tree/master/pocs/linux/cve-2021-22555


#CVE #BoF #Vulns

Awesome DevSecOps

https://github.com/devsecops/awesome-devsecops

#devsecops #awesome

https://twitter.com/gentilkiwi/status/1415520478693888004?s=21

#meme

Kerlab

Kerberos laboratory to better understand and then detecting attack on kerberos

https://github.com/citronneur/kerlab

#kerberos #pentest #lab

GTRS - Google Translator Reverse Shell

https://github.com/mthbernardes/GTRS

#pentest #redteam

Sometimes I see 304 in response in Burp and I have to dig in the Burp history to check the first occurrence of the response and analyze. With those headers removed, you may not find such responses.

Enable the following rules in Proxy -> Options -> Match and Replace.
- If-Modified-Since
- If-None-Match

These are inbuilt rules in Burp Suite

#BurpHacksForBounties - Day 10/30

Do you face issues with Cached responses too with Burp Suite?
Then this is what you should do. Just disable it 😂😂

#infosec #security #appsec #bugbountytips #bugbounty

Huntkit - Docker Image For Pentesting, Bug Bounty, CTF and Red Teaming

https://github.com/mcnamee/huntkit

#Metasploit #masscan #Exploitation #BugBounty #RedTeaming #CTF

Labs for Web application Pentesting Practice

SQLi: https://github.com/Audi-1/sqli-labs

Oauth 2.0: https://github.com/koenbuyens/Vulnerable-OAuth-2.0-Applications

GraphQL: https://github.com/david3107/graphql-security-labs

JWT Authentication: https://github.com/Sjord/jwtdemo

SAML Authentication: https://github.com/yogisec/VulnerableSAMLApp

XSS: https://portswigger.net/web-security/cross-site-scripting

#bugbounty

Zero-day / CVE-2021-35211

SolarWinds 2.0: Serv-U Remote Memory Escape Vulnerability. The said vulnerability was reported to SolarWinds by Microsoft security team and is under active exploitation.

This security vulnerability only affects Serv-U Managed File Transfer and Serv-U Secure FTP and does not affect any other SolarWinds or N-able (formerly SolarWinds MSP) products.

https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211

Proxying Edge for Burp Suite without interfering with your system proxy settings.

#bugbountytips

When you are playing with a parameter in the repeater tab and its value gets reflected in the response, you can enable this toggle when you have to scroll to see what has changed...a true time-saver!

How to? See the image below.

🚨🚨🤓 #BurpHacksForBounties - Day 9/30

Following parameter in Burp Suite repeater's response.

A time-saver tip that I read from @sw33tLie reply in the thread by @codingo_

👇🔽⬇️
#security #appsec #burp #bugbountytips #bugbountytip

Create Macros for burp as discussed in previous tweet.
#BurpHacksForBounties - Day 7

Once created, add it as session and set the scope. For demo, I am adding all URLs as Scope.

Now all the requests mentioned in Tools scope will be Macro processed.

Use Tracer to debug macro