When not letting go, and fighting for your rights, payback.. — The Death Eaters If you are a Harry Potter fan, just like my girlfriend is, you already know who these people are. Some of you might know them by their most common name — triagers. Triager is the assessment of a security event to determine if there is a security incident, its priority…

Many websites have private S3 buckets holding secrets inside. We want them. — What Is An Amazon S3 Bucket? Is a public static cloud file storage resource available in Amazon Web Services’ (AWS) Simple Storage Service (S3), an object storage offering. S3 buckets, are similar to file folders, store objects, which consist of data and its descriptive metadata. Amazon S3 uses the same scalable storage infrastructure that Amazon.com uses…

How to use a USB to Unlock your Box — How often have you found yourself in the frustrating scenario of attempting to log into your computer, only to realize you’ve forgotten the password? It’s a common occurrence, particularly for those of us who utilize Virtual Machines for Penetration Testing or day-to-day tasks. Managing multiple Windows machines becomes a necessity…

How Red Team members take control over User’s RDP sessions — The Remote Desktop Protocol (RDP) has become an indispensable tool for system administrators, enabling them to manage Windows environments from a remote location. However, with its widespread use, RDP has also caught the attention of malicious actors seeking to exploit its vulnerabilities for nefarious purposes. …

Getting The Master Key to Heaven — Note: Due to a lack of free time, I am only able to work on this article now, even though it was originally intended to be published on May 18th. In the ever-evolving digital landscape, safeguarding our online presence and personal information has become increasingly crucial. Password managers play a…

Understanding the “Potato” Attack — Introduction: In the realm of cybersecurity, privilege escalation attacks pose a significant threat to system security. One such vulnerability that gained attention in recent years is the “Potato” attack (CVE-2023–21746). This attack exploits a security flaw in Windows’ NTLM, allowing attackers to elevate their privileges to the SYSTEM level. …

Are you Attacking Web Apps Admin Panels The Right Way? — You should start here: Part_1 Intro Picking up from where we left off in part two. This time, we are on a Windows Server. Personally, I’m not a big fan of Windows Servers, and once you try to become a professional Red Teamer, you will understand why. …

Not Attacking Web Apps Admin Panels The Right Way? — You should start here: Part_1 Here is Part_3 Tools: Msfvenom Metasploit PHP Kali Linux Intro Picking up from where we left off in part one, let’s assume you have gained access to a panel control. Now, we will attempt to gain access to the server being use to control that website using a reverse shell. There are…

Attacking Web Apps Admin Panels The Right Way — Note:Tutorial Not too Beginner Friendly With some tweaking what you will be learning here can be apply to any Web App. This Tutorial will cover regular CMS and WordPress as a bonus. Tools: Proxychains hashid Cewl John The Repper Wpscan VM Kali Hydra Part 1: By taking a quick look at the source…