Does Windows use Bluetooth Authenticated pairing with encryption automatically when you connect Bluetooth devices like earbuds to it? Is that Level 4? If it’s not automatic, how do I get Windows to do that?
Is there any way to prevent othe…
Tool that automates cracking of WPA-2 Wi-Fi credentials using client-server architecture Requirements Airstrike uses Hashcat Brain Architecture, aircrack-ng suite, entr utility and some helper scripts. You can use install.sh script to downl…
I need some help with an SQL injection at an API.
Webserver IIS 8.5
The GET request looks like this
…
https://example.com/api/Search?q=Landing
The Response looks like this
HTTP/1.1 200 OK
…
[{"pageId":1,"pageName":…
We are currently shipping a product to our customers that is server-client-based running on Windows server 2016 (server) and Windows 10 (clients).
The server is installed on-premise in our customer’s infrastructure.
We are always installin…
Use Terraform to create your own vulnerable by design AWS IAM privilege escalation playground. IAM Vulnerable uses the Terraform binary and your AWS credentials to deploy over 250 IAM resources into your selected AWS account. Within minutes, you c…
I have been trying to understand how CSRF tokens work and from my research, it looks like it is common for the server to provide both a CSRF cookie and a token to the end user. The user then returns it with the subsequent request and the s…
This is a PoC for bypassing UAC using DLL hijacking and abusing the “Trusted Directories” verification. Generate Header from CSV The python script CsvToHeader.py can be used to generate a header file. By default it will use the CSV file dll_hijacki…
Enterprise software provider Zoho on Friday warned that a newly patched critical flaw in its Desktop Central and Desktop Central MSP is being actively exploited by malicious actors, marking the third security vulnerability in its products to be abused…
A series of malicious campaigns have been leveraging fake installers of popular apps and games such as Viber, WeChat, NoxPlayer, and Battlefield as a lure to trick users into downloading a new backdoor and an undocumented malicious Google Chrome exten…
IDA2Obj is a tool to implement SBI (Static Binary Instrumentation). The working flow is simple: Dump object files (COFF) directly from one executable binary. Link the object files into a new binary, almost the same as the old one. During the du…
