AppSec… XML External Entity (XXE) Example 14 Oct 2019 According to OWASP, an XML External Entity attack is a type of attack against an application that parses XML input. This attack occurs when XML input containing a reference to…
#Metasploit… BlueKeep – Exploit Windows (RDP Vulnerability) Remotely 10 Oct 201910 Oct 2019 Remote desktop protocol (RDP) is a secure network communications protocol designed for remote management, as well as for remote access to virtual desktops, applications and an RDP terminal server. RDP…
Attacks… Reverse Engineering Router Firmware 3 Oct 201911 Oct 2019 Reverse engineering, also called back engineering, is the process by which a man-made object is deconstructed to reveal its designs, architecture, or to extract knowledge from the object; similar to…
Attacks… Create a Backdoor Shell in Python 28 Sep 201910 Oct 2019 So we've delved into Python before, but this post should be a bit more interesting. What we will do today is write a backdoor in Python and if you manage…
#Metasploit… Exploiting Routers With Routersploit 26 Sep 20195 Oct 2019 If you have Wi-Fi at home, then you have a router, this is how you get your internet access. Today we will be looking a piece of software that allows…
Attacks… Find Vulnerable Devices On The Internet With Shodan 9 Sep 201923 Sep 2019 Welcome back to LSB and thanks for reading. Today we will be looking at how to search for vulnerable devices around the world using Shodan. Shodan is an index of…
#career… Hacking Android With Metasploit 4 Sep 20197 Sep 2019 Good morning/evening/night my fellow hackers, today's lesson is on Metasploit and how we can hack Android with a Metasploit payload. So let's get started!! As always, this post is for…
#career… Set up some Honeypots and a Threat Map 2 Sep 201917 Sep 2019 Welcome back my fellow ethical hackers. Remember, the contents in this post is for educational purposes and should only be used for ethical reasons, so with that caveat, let's get…
AppSec… Write a Ping Sweeper in 4 Lines of Bash 21 Aug 201930 Aug 2019 What we will do today is write a script that will ping a certain IP range and tell us which IP's respond to our ICMP requests. In other words we…
AppSec… POC – EternalBlue and Doublepulsar in Kali 4 Jun 201914 Jun 2019 This article is educational, using proof of concept in uncontrolled environments or without prior authorization may be illegal On April 14, 2017, the ShadowBrokers team leaked a new hacking toolkit…
AppSec… Set Up Your First Penetration Testing Lab Easily With Vagrant 30 May 201922 Sep 2019 Today we will be looking at a neat little command line tool called Vagrant. This tool allows us to deploy virtual machines seamlessly and we are going to show you…
AppSec… Build a Multi-Protocol Tunneling Tool in Java 29 May 201910 Oct 2019 Welcome back to LSB, hackers and developers alike. Today we show how we built a multi-protocol tunneling tool that allows you create encrypted tunnels to a remote server which then…
AppSec… Enabling Monitor Mode & Packet Injection on the Raspberry Pi 20 May 201920 May 2019 By Kodyhttps://null-byte.wonderhowto.com/how-to/enable-monitor-mode-packet-injection-raspberry-pi-0189378/The Raspberry Pi Zero W and Pi 3 Model B+ include integrated Wi-Fi, Bluetooth Low Energy, and more than enough power to run Kali Linux. They sound like perfect…
#career… OWASP A2: Broken Authentication and Session Management Cause and Prevention 12 May 201912 May 2019 Threat Agents Attack Vectors Security Weakness Technical Impacts Business Impacts Application Specific Exploitability AVERAGE Prevalence WIDESPREAD Detectability AVERAGE Impact SEVERE Application / Business Specific Consider anonymous external attackers, as well…
AppSec… New Exploits for Insecure SAP Systems 6 May 201918 May 2019 Summary The Cybersecurity and Infrastructure Security Agency (CISA) is issuing this activity alert in response to recently disclosed exploits that target insecure configurations of SAP components. REGISTER TODAY FOR YOUR…
#career… Malware Analysis With Valkyrie 22 Apr 201914 Oct 2019 Valkyrie is a malware analysis tool that's free for you for a year to try out. You can visit https://valkyrie.comodo.com to sign up. Once you sign up you will presented…
AppSec… Emotet The Banking Trojan 11 Apr 2019 Emotet is a kind of malware originally designed as a banking Trojan aimed at stealing financial data, but it’s evolved to become a major threat to users everywhere. Let’s talk…
#career… Create An SQL Backdoor 7 Apr 20197 Apr 2019 SQL Malware affects a variety of database-driven applications, including but not limited to web applications, services, and desktop applications. This breed of malware is made possible by the SQL functionality for triggers and stored sub-procedures. Notice: SQL malware persists beyond deletion of rows…
Attacks… Security Researchers say Half Of Industrial Control System Networks Have Faced Cyber Attacks 4 Apr 20197 Apr 2019 But in many cases they are not deliberately targeted and only fall victim because of poor security. By Danny Palmer | March 27, 2019 Industrial control systems in manufacturing,…
#Metasploit… NetBIOS Auxiliary Modules 26 Mar 201927 Mar 2019 Full article: https://www.offensive-security.com/metasploit-unleashed/scanner-netbios-auxiliary-modules/ nbname The nbname auxiliary module scans a range of hosts and determines their hostnames via NetBIOS. msf > use auxiliary/scanner/netbios/nbname msf auxiliary(nbname) > show options Module options (auxiliary/scanner/netbios/nbname): Name…
AppSec… SMB Exploited 14 Mar 20197 Apr 2019 Server Message Block (SMB) is the transport protocol used by Windows machines for a wide variety of purposes such as file sharing, printer sharing, and access to remote Windows services.…
AppSec… Ghidra – First impressions of the NSA Reverse Engineering Tool 13 Mar 201910 Oct 2019 Ghidra is a reverse engineering tool, written in Java, that was recently open-sourced by the National Security Agency (NSA). You can find the Github page here and the download link…
AppSec… Exploiting XXE Vulnerabilities in IIS/.NET 5 Mar 20195 Mar 2019 By Chris Davis XXE (XML External Entity) attacks happen when an XML parser improperly processes input from a user that contains an external entity declaration in the doctype of an…
AppSec… CSRF Code Examples and Defense 3 Mar 20193 Mar 2019 CSRF is an attack that tricks the victim into submitting a malicious request. It inherits the identity and privileges of the victim to perform an undesired function on the victim's…
#career… Exploiting Poor SMB Configuration 1 Mar 20191 Mar 2019 What’s an SMB? SMB, which stands for Server Message Block, is a protocol for sharing files, printers, serial ports and communications abstractions such as named pipes and mail slots between…
AppSec… VFEmail Suffers ‘Catastrophic’ Hack 13 Feb 2019 Email company VFEmail suffered what they call a "catastrophic" hack that destroyed their primary and backup data for the U.S. The firm’s founder says he now fears some 18 years’…
AppSec… Create a Backdoor with Cryptcat 23 Dec 2018 In this tutorial, I'll introduce you to netcat's popular cousin, cryptcat (she's actually much cuter and more exotic than the plain netcat). Cryptcat enables us to communicate between two systems and encrypts…
#career… Pivoting the Network 18 Dec 201815 Mar 2019 What is Pivoting? Pivoting is the unique technique of using an instance (also referred to as a ‘plant’ or ‘foothold’) to be able to move around inside a network. Basically…
#career… Pwned 10 Dec 201823 Jan 2019 Let[s] talk a little about this box. In this HTB machine we will see only one port is open and that will be the http one , we will fireup the dirbuster…
Attacks… 500 Million Marriott Guest Records Stolen 30 Nov 20188 Dec 2018 The world's biggest hotel chain Marriott International today disclosed that unknown hackers compromised guest reservation database its subsidiary Starwood hotels and walked away with personal details of about 500 million…
AppSec… SQL Injection Attacks 20 Nov 2018 A customer asked that we check out his intranet site, which was used by the company's employees and customers. This was part of a larger security review, and though we'd…
#Metasploit… Payload in PDF 12 Nov 2018 Infected PDFs have always been a privileged way to infect users because this document format is very common and used by almost everyone. Moreover, it exists many ways to exploit Acrobat Reader…
#career… Now Is The Time, Linux is the Direction 11 Nov 201824 Jan 2019 Your future matters to us @ LSB, so get into Linux and see the new world it will open for you. Created by QuBits 2018-11-11
AppSec… OWASP Security Shepherd- Session Management Challenge One – Solution – LSB 12 Oct 201812 Oct 2018 We have another solution in the OWASP Security Shepherd challenges and we enjoyed completing this one. You can find out about Session Management from OWASP here. So let's get on…
AppSec… Penetration Testing – Complete Guide 10 Oct 201810 Dec 2018 What is Penetration Testing? It’s the process to identify security vulnerabilities in an application by evaluating the system or network with various malicious techniques. The weak points of a system…
Attacks… The Evil Twin Attack 8 Oct 2018 By Matthew Cranford I searched through many guides, and none of them really gave good description of how to do this. There’s a lot of software out there (such as…
AppSec… OWASP Security Shepherd – Failure To Restrict Access Solution – LSB 27 Sep 201827 May 2019 Am I Vulnerable To 'Failure to Restrict URL Access'? The best way to find out if an application has failed to properly restrict URL access is to verify every page. Consider for…
AppSec… OWASP Security Shepherd – Insecure Cryptographic Storage Challenge 1 Solution – LSB 21 Sep 2018 Thanks for visiting and today we have another OWASP Security Shepherd Solution for you. This time it's the Insecure Cryptographic Storage Challenge. Cryptography is usually the safest way to communicate…
AppSec… OWASP Security Shepherd – SQL Injection Solution – LSB 15 Sep 201819 Sep 2019 A SQL injection attack consists of insertion or "injection" of a SQL query via the input data from the client to the application. A successful SQL injection exploit can read sensitive data…
