SharingSec

 Hello folks! A couple of weeks ago I found a security issue on Symantec Protection Engine which could lead to ICAP inspection bypass. Check it out here !

Hello folks, A couple of weeks ago I put together a Medium Story about the Hash Spraying Attack . Enjoy it!

Hello folks, I've put together a quick how to guide on how to perform user enumeration on Microsoft Office 365. Enjoy it here !

Hello folks, It is been a while since my last post. Recently the GitLab Red Team published a pretty comprehensive material about privilege escalation and post exploitation tactics on the Google Cloud Platform (GCP). I've made a fork of their enumeration tool and added a few enumerations to it. Aside of it, I've also created a second enumeration tool which is totally independent on the Google Cloud SDK being installed on the target machine, requiring only curl. Check it out here !

Hi there, Few months ago I modified a version of the Worawit Wang: GitHub zzz_exploit for MS17-010. The new version implements a few options such as username/password specification and an arbitrary command to be executed. It does not change anything related to the SMB exploitation This is a bundle with an executable and dependencies and DOES NOT require any python install. This is very suitable for scenarios where one has low privilege access to a vulnerable Windows but does not have any Python available nor Metasploit for proper exploitation. I hope you enjoy it. Here it goes: MS17-010 exploit .

Hi There, It is common to find websites/tools on the internet which performs speed test, loading third party images, load external JavaScript files etc. to be vulnerable to Server Side Request Forgery. I've found a couple of them, reported but some of them did not take it seriously. I've recently ran into KeyCDN tools website , a site owned and operated by KeyCDN , a CDN company and reported to be one of the best solution according to the TechRadar info . After looking at some functionalities presented on the web site I've found a few SSRF conditions. Here it goes: 1) Using the Trace Route utility to discovery some Internal IP Address When I used the Trace Route functionality there was an internal IP address 10.0.10.1 (which seems  no longer there) belonging to the Frankfurt POP. 2) Using the Ping utility to confirm the above finding (and maybe Brute Force some hosts?) I will discuss the FQDN you are seeing there soon! 3) Using the Performance Test  ...

Hi there, I've created a tool called Make-HtDigest which is able to generate username + password combination based on a word-list for HTTP Digest Authentication. This can be used to compare output with real password files such as mgmt-users.properties from WildFly and .digest_pw from Apache. I hope it is useful and you enjoy it.

Hello everybody, I wrote a python tool to detect Slow HTTP DoS attacks on pcap files: slowdos_detector . This is ideal for post-mortem analysis on captured traffic (pcap files). If you are curious about how to test it, you could leverage slowhttptest  to launch an HTTP DoS attack on your test server, capture the traffic and then use slowdos_detector to show offending HTTP transactions. Enjoy it and ping me if you have questions, issues or suggestions.

Hello All, I've written a Help Add On Script for the OWASP Zed Attack Proxy to sign requests to Amazon AWS. You can check it here . Enjoy it!

Hello all, It is being a while since my last post. March this year I had a talk at the Confraria0day conference about HTTP Security Headers. I made the slides available here . I hope it helps and let me know if you want to discuss it.

Recently on an independent research I've found the Goodreads API was vulnerable to a Reflected Cross-site scripting . The issue happens on their REST API on a callback function parameter. No sanitizing mechanism was found and the parameter is echoed back in the JSON payload, allowing a malicious user to potentially launch XSS attacks. I've submitted the issue to the Goodreads' security team and this was quickly fixed. Goodreads is an Amazon company with  55 millions of users. Their site is ranked 139 in the USA and 336 globally, according to Alexa . Proof Of Concept: Vulnerable API calls with XSS payload: https://www.goodreads.com/book/review_counts.json?callback=%3Chtml%3E%3Cbody%20onload=%22javascript:alert(%27XSS%27)%22%3E%3C/html%3E&isbns=0441172717 https://www.goodreads.com/book/isbn/0441172717?callback=%3Chtml%3E%3Cbody%20onload=%22javascript:alert(%27XSS%27)%22%3E%3C/html%3E&format=json Vulnerability Disclosu...

Who doesn’t like chocolate? I am a big fan of a Brazilian coffee/chocolate chain called Ychocolates (fictitious name). They produce good chocolates and serve good coffee as well. Recently they introduced a simple loyalty program: you buy products there and earn points for each purchase. After certain amount of points, you can redeem them and transform them into a delicious chocolate. It sounds simple and straightforward. To participate in this program the person needs to supply their name, an CPF (Brazilian identification number) and a phone number.  Every time a person goes into one of their stores and buy something, they should supply their CPF and get the  points. Once you inform your CPF the cashier (verbally) will tell you how many points you have earned so far. If you have the minimum amount of points for a reward, you can get a chocolate. I’ve noticed cashiers always inform the accumulated points to the customer. It seems to be part of a procedure. I personally us...

Hi, I´ve uploaded a very simple Python script to brute force JWT Token signature  here . Enjoy it.

Well, we are in 2013 and It’s amazing how many JBOSS administration interfaces (jmx-console, web-console, invokers etc) are still exposed on the internet, however we are not going to talk about it. A couple of days ago I was performing a penetration testing and I found an environment with JBOSS AS 6. The JMX-Console wasn’t password protected but one console in special attracted my attention: the Admin Console. It seems that this console, I do not know the reason, is kind of forgotten by the security community as an attack vector. The default access credential for this console is admin/admin and it is also built upon a vulnerable version of Seam framework CVE 2010-1871 . This console provides a powerful JBOSS administration allowing a user to check the server’s configuration, to deploy and to delete applications, to read datasources etc. I checked out for the default credential but they were changed. There were other ways to hack this JBOSS but I was quite interes...

In my last post I have talked about how to explore SQL injection flaws to perform port scanner when the database is Oracle. Now I am sharing with you a way to perform brute force attack to enumerate users from Microsoft AD (or other LDAP repository). Oracle provides a package called DBMS_LDAP since 9i version and this can help us with such task. It seems that even in Oracle 11g there is no special ACL assigned to such resource. What does it mean? It means we can use it in our SQL injection attacks with most of the Oracle users. Let's take a look at a practical example performed on a penetration testing: http://target/index_target.php?id=15||DBMS_LDAP.simple_bind_s((dbms_ldap.init('targetdomain.com',389)),'admin@targetdomain.com','password')-- In this case, the value of the vulnerable parameter id is concatenated with the result of DBMS_LDAP.simple_bind_s function. We can manipulate the target domain and its port as well user names and passwords. If the LD...

Have you ever used an SQL Injection flaw to perform a port scanner? It's known that common databases such as Oracle and SQLServer have special packages that can perform HTTP connections, build sockets, get host names and other information about networks. How about to use such resources to perform a port scanner exploiting a SQL injection flaw? It's useful to discover other assets in the network and to help us to map the environment. In our case, the DBMS was Oracle 10g. Usually we use the package URL_HTTP package to perform out of band SQL injection attack, however we are going to use it to perform a port scanner. Let's take a look at a practical example performed on a penetration testing: http://target/index_content. php?id=163447||utl_http. request('10.1.0.141:445')-- In this case, the value of the vulnerable parameter id is concatenated with the result of utl_http.request. We can manipulate the IP address as well the ports numbers. When the co...

Hello all. Let’s talk today about Man in the middle attack . No, this isn’t a post talking about what it is and how to perform a MITM attack. The proposal of this blog is to share experience with you, then most of the posts (at least until now) are about things that happened in real environments. Recently performing a penetration testing it was possible to get a web shell through a combination of vulnerabilities.   That’s good… a web shell right? But how about to going deep and explore more of the environment? Yes, if you thought about reverse web shell you are right, but, in this case, I couldn’t establish an outbound connection (this is a subject for another post). I did a lot of things in such environment and one of the things done was a MITM attack through a web shell. Let’s go to some important details. First of all, it was a Windows box. There are some tools you can perform a MITM attack on Windows box such as Cain & Abel , but remember, we had a web shell and...