TGViewer
Channel Public Channel
APT

APT

@apt_notes

This channel discusses:

— Offensive Security
— RedTeam
— Malware Research
— OSINT
— etc

Disclaimer:
t.me/APT_Notes/6

Chat Link:
t.me/APT_Notes_PublicChat
Open in Telegram
Subscribers
16.8K
Photos
565
Videos
28
Links
909

Showing posts older than #662 · Back to latest

Older Posts 19 shown
Post #661 648
DNS Abuse & Misconfiguration


The History of DNS Vulnerabilities and the Cloud
https://unit42.paloaltonetworks.com/dns-vulnerabilities/

Dangling Domains: Security Threats, Detection and Prevalence
https://unit42.paloaltonetworks.com/dangling-domains/

Fishing the AWS IP Pool for Dangling Domains
https://bishopfox.com/blog/fishing-the-aws-ip-pool-for-dangling-domains

Respect My Authority – Hijacking Broken Nameservers to Compromise Your Target
https://thehackerblog.com/respect-my-authority-hijacking-broken-nameservers-to-compromise-your-target/

The Orphaned Internet – Taking Over 120K Domains via a DNS Vulnerability in AWS, Google Cloud, Rackspace and Digital Ocean
https://thehackerblog.com/the-orphaned-internet-taking-over-120k-domains-via-a-dns-vulnerability-in-aws-google-cloud-rackspace-and-digital-ocean/

The .io Error – Taking Control of All .io Domains With a Targeted Registration
https://thehackerblog.com/the-io-error-taking-control-of-all-io-domains-with-a-targeted-registration/

The International Incident – Gaining Control of a .int Domain Name With DNS Trickery
https://thehackerblog.com/the-international-incident-gaining-control-of-a-int-domain-name-with-dns-trickery/

Hostile Subdomain Takeover using Heroku/Github/Desk + more
https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/

Dangling DNS: Amazon EC2 IPs
https://blog.melbadry9.xyz/dangling-dns/aws/ddns-ec2-current-state

Eliminating Dangling Elastic IP Takeovers with Ghostbuster
https://blog.assetnote.io/2022/02/13/dangling-eips/

Internet-Wide Analysis of Subdomain Takeovers
https://redhuntlabs.com/blog/project-resonance-wave-1.html

Subdomain Takeover
https://0xpatrik.com/subdomain-takeover-basics/
https://0xpatrik.com/subdomain-takeover-candidates/
https://0xpatrik.com/takeover-proofs/
https://0xpatrik.com/subdomain-takeover-ns/
https://0xpatrik.com/subdomain-takeover/

#dns #abuse #aws #elastic #subdomain #takeover
  • 👍 1
  • 🔥 1
Post #660 610
Certipy 2.0: BloodHound, New Escalations, Shadow Credentials, Golden Certificates, and more!

Blog:
https://research.ifcr.dk/certipy-2-0-bloodhound-new-escalations-shadow-credentials-golden-certificates-and-more-34d1c26f0dc6

Tool:
https://github.com/ly4k/Certipy

#ad #adcs #abuse #tools
Medium Certipy 2.0: BloodHound, New Escalations, Shadow Credentials, Golden Certificates, and more! As the title states, the latest release of Certipy contains many new features, techniques and improvements. This blog post dives into the…
Post #658 634
LOLBIN — wlrmdr

Action on click:
wlrmdr.exe -s 60000 -f 1 -t "Important" -m "Click this dude!" -a 10 -u cmd

You can use "-a 11" to skip the click requirement and spawn your process immediately:
wlrmdr -s 0 -f 0 -t 0 -m 0 -a 11 -u cmd

#windows #wlrmdr #lolbin #lolbas
Post #653 528
S3Scanner

Scan for open S3 buckets and dump the contents

Features:
— Multi-threaded scanning
— Supports tons of S3-compatible APIs
— Scans all bucket permissions to find misconfigurations
— Dump bucket contents to a local folder
— Docker support

https://github.com/sa7mon/S3Scanner

#aws #s3 #bucket #scanner
Post #650 684
CredMaster

Launch a password spray / brute force attach via Amazon AWS passthrough proxies, shifting the requesting IP address for every authentication attempt. This dynamically creates FireProx APIs for more evasive password sprays.

The following plugins are currently supported:
— OWA
— EWS
— O365
— O365Enum
— MSOL
— Okta
— FortinetVPN
— HTTPBrute
— ADFS
— AzureSSO

https://github.com/knavesec/CredMaster

#owa #o365 #adfs #password #spraying
  • 🔥 4
Post #649 576
Password Spraying and MFA Bypasses

https://www.sprocketsecurity.com/blog/how-to-bypass-mfa-all-day

#ntlm #password #spraying #o365 #exchange #mfa
Sprocket Security Password spraying and MFA bypasses in the modern security landscape Any offensive security operator will tell you that guessing employee credentials is key to compromising your customer’s network – and therefore highlighting vulnerabilities – during a cyber-security engagement. The thing is, it’s easier said than done as…
Post #648 1.23K
Windows Security Log Quick Reference Cheat Sheet

#windows #security #log #blueteam
Post #643 645
EDRChecker

Checks running processes, process metadata, Dlls loaded into your current process and the each DLLs metadata, common install directories, installed services and each service binaries metadata, installed drivers and each drivers metadata, all for the presence of known defensive products such as AV's, EDR's and logging tools.

C#
https://github.com/PwnDexter/SharpEDRChecker

PowerShell
https://github.com/PwnDexter/Invoke-EDRChecker

#edr #checker #csharp #powershell #tools
Older posts →
Threads Profile ViewerView any public Threads profile without an account.Open ThreadLook →Writing with AI? Make it sound human.Metric37 rewrites AI drafts so they read naturally. Free AI detector, 1,500 words free.Try Metric37 →