Tweetovi

Blokirali ste korisnika/cu @Xsimpa

Jeste li sigurni da želite vidjeti te tweetove? Time nećete deblokirati korisnika/cu @Xsimpa

  1. proslijedio/la je Tweet
    1. velj

    Another box solved the unintended way: RE. Once I had RCE after dropping an aspx webshell with the Winrar CVE, I used the UsoSvc service to gain SYSTEM and impersonated the Coby user to decrypt the root flag. Great box by .

    Poništi
  2. proslijedio/la je Tweet
    1. velj

    RE just retired from . As the creator of the box, I tried to bring phishing/macro obfuscation concepts to the initial access. The intended privescs were the WinRar ACE file exploit, and XXE in Ghidra. I'll show two unintended privescs too.

    Poništi
  3. proslijedio/la je Tweet
    25. sij

    AI just retired from HTB. It was a neat theme exploiting an AI / smart home like device using audio to perform an SQL injection. Then I'll use Java Debug to escalate to root.

    Poništi
  4. proslijedio/la je Tweet
    25. sij

    AI video is now online. A really cool "out of band" style of an SQL Injection using "Speech To Text". So you need to Verbally Speak out the injection. Once on the box do a pretty cool privesc via Java Debugging.

    Poništi
  5. proslijedio/la je Tweet
    24. sij

    Open Wifi Security (Friday evening rant) 1) Yes, at our hotels we have open wifi as standard. No Client<->AP encryption (WPA/23), and no captive portal to logon to. Let me first explain some obvious reasons for doing so. (Often disregarded by infosec pros.)

    Prikaži ovu nit
    Poništi
  6. proslijedio/la je Tweet
    18. sij

    Player from required enumeration and several interesting exploits to slowly build a full shell. Root was a good chance to play with PHP deserialization. There were several alternative paths as well.

    Poništi
  7. proslijedio/la je Tweet
    18. sij

    I had a hard time finding the initial source code file for the launcher page on the Player box but I liked the LFI part using ffmpeg and the PHP deserialization priv esc at the end.

    Poništi
  8. proslijedio/la je Tweet
    18. sij

    Player has been retired. This was a really fun box, discovering the backups on the webserver was surprisingly difficult so I added a new module to GoBuster. The unintended privesc was also super cool.

    Poništi
  9. proslijedio/la je Tweet
    17. sij

    We have roughly 250 team slots left. To reiterate: No, there's no limit on team size, and no, you don't have to use Metasploit for the challenges. Come play with us!

    Poništi
  10. proslijedio/la je Tweet
    17. sij

    Added support for MonetDB

    Poništi
  11. proslijedio/la je Tweet
    15. sij

    Registration for the 2020 Metasploit community CTF is now open. 1,000 teams, four days to find flags, unlimited shells. Play starts January 30. NOTE: Teams only need to register ONE account. Get it:

    Poništi
  12. proslijedio/la je Tweet
    13. sij

    Sources say Microsoft on Tuesday will fix an extraordinarily scary flaw in all Windows versions, in a core cryptographic component that could be abused to spoof the source of digitally signed software. Apparently DoD & a few others got an advance patch

    Prikaži ovu nit
    Poništi
  13. proslijedio/la je Tweet
    12. sij

    No wrap-up this week thanks to CTF challenge dev. The -ctf Slack channel is now up; game details and registration should be up later this week.

    Poništi
  14. proslijedio/la je Tweet
    11. sij

    Let's do the 20k giveaway! Up for grabs: (1) Burp Suite Pro license (5) Udemy PEH course seats Rules: -1 entry per person -Must have retweeted and be a follower on Twitter at the time of the giveaway -Donation of first born child optional

    Poništi
  15. proslijedio/la je Tweet
    11. sij

    Bitlab video is up! A medium level linux box with two ways to root. .

    Poništi
  16. proslijedio/la je Tweet
    9. sij

    Howdy, folks. We'll be hosting another community CTF at the end of January. Stay tuned for a registration announcement next week.

    Poništi
  17. proslijedio/la je Tweet

    So the thing to remember about MD5 and SHA-1 issues is that SSL certificates that were issued using those hashes are still secure, but new certificates that use them are not.

    Prikaži ovu nit
    Poništi
  18. proslijedio/la je Tweet
    4. sij

    Craft video is now online. A fun linux box that involved pillaging old git commits to find a JWT Token, then doing some source code analysis to exploit a Eval() vulnerability.

    Poništi
  19. proslijedio/la je Tweet
    28. pro 2019.

    Better late than never! HackTheBox Smasher2 video is now up. I don’t go over the intended method with the dereferencing but still tons of good stuff.

    Poništi
  20. proslijedio/la je Tweet
    13. pro 2019.

    🔴 WE ARE LIVE! 🔴 The gates to Elf University are open at

    Poništi

Čini se da učitavanje traje već neko vrijeme.

Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.

    Možda bi vam se svidjelo i ovo:

    ·