Fuzzing Forum – Advanced Software Testing
.webp "Fuzzing Forum – Advanced Software Testing")
This project aims at hosting tutorials, examples, discussions, research proposals, and other resources related to fuzzing. External contributions are welcome, please see CONTRIBUTING Contributing File for more information. The "Fuzzing Forum" is a place where people can find tutorials, examples, discussions, and more, all about the fuzzing method. The project has resources for both beginners and experts on how to use fuzzing tools and...
Clairvoyance – Unmasking Hidden GraphQL Schemas
Clairvoyance is a game-changer for GraphQL API developers. This tool gets the GraphQL API schema from sites where introspection is turned off and displays it in a user-friendly JSON format. Learn how to install it, how to use it in more advanced ways, and how to get help from a dedicated team of contributors. You'll also find out how to...
Anti-Qakbot – Disabling The Malicious Threat
.webp "Anti-Qakbot – Disabling The Malicious Threat")
Kill a live running QAKbot on an infected machine. More on this : Operation Duckhunt : Field Testing the FBI’s Anti-Qakbot Payload (C) Raashid Bhat In the constantly changing world of online threats, Qakbot has become a powerful foe. This malware has caused problems on many systems because it stays around and does damage. But there is a bright side to every...
Server-Side Request Forgery (SSRF) – Exploitation And Defense Insights
.webp "Server-Side Request Forgery (SSRF) – Exploitation And Defense Insights")
In this section, we'll explain what server-side request forgery is, describe some common examples, and explain how to find and exploit various kinds of SSRF vulnerabilities. What is SSRF? Server-side request forgery (also known as SSRF) is a web security vulnerability that allows an attacker to induce the server-side application to make requests to an unintended location. In a typical SSRF attack,...
Coustom Bash – A Tool To Automate Penetration Testing Tasks
Custom bash scripts have emerged as powerful tools for automating a range of penetration testing tasks, from reconnaissance to payload creation. Tailored specifically for use with Kali Linux, these scripts streamline activities like scanning, enumeration, and the generation of malicious payloads using Metasploit. This article delves into the intricacies of setting up and leveraging such scripts, ensuring that security professionals...
CVE-2023-29360: Kernel DMA Exploit For Direct R/W Access To kernel Virtual Memory
When looking for vulnerabilities of interest, it’s always a good option to look for vulnerabilities used at pwn2own. Indeed, these vulnerabilities are exploited during the competition, meaning they have a practical impact. Thomas is recognized as one of the several highly skilled researchers in the French exploit scene, and is certainly knowledgeable The vulnerability, teased in the HITB's upcoming conference, is...
Burp Suite Sharpener – Advanced Features & Installation Guide
.webp "Burp Suite Sharpener – Advanced Features & Installation Guide")
A versatile tool designed to enhance both the UI and functionality of Burp Suite, streamlining your cybersecurity testing experience. Compatible exclusively with Burp Suite version 2023.10-22956 and above, this extension offers features such as theming, streamlined tab navigation, screenshot capabilities, and much more. Built upon the legacy of the original Burp Suite Sharpener project, this new iteration emphasizes user-centric enhancements...
Avred – Antivirus Red Teaming Unleashed
Antivirus REDucer for Antivirus REDteaming. Avred tries to provide as much context and information about each match as possible when identifying which portions of a file an antivirus has identified. Avred is a new tool that breaks down how antivirus programs work and shows exactly which parts of a file cause antivirus alerts. This tool not only finds these "hotspots,"...
AppleConnect – Streamlining Local Network With Bonjour
AppleConnect is a small Swift wrapper around a Network TCP stream on the local network (using Bonjour for discovery). Even though the transport is two-way, the API is built around a "service" that is offered by a single server and to which many clients can connect. Usage Setup for servers differs a little bit from that for clients. Once a connection...
Jormungandr – Unveiling The Kernel Power Of COFF Loading
Jormungandr is a kernel implementation of a COFF loader, allowing kernel developers to load and execute their COFFs in the kernel. The only supported type of COFF is an x64 kernel COFF (meaning a COFF that uses functions from either NTOSKRNL or SSDT). This project is not supported to run with VBS enabled because it is using pools with execute permissions but this project should...
