​​CVE-2023-27842

eXtplorer 2.1.15 - Insecure Permissions following RCE (Authenticated)

https://github.com/tristao-marinho/CVE-2023-27842

#cve #poc #RCE
@Pfk_git

منابع-برای-شکارچیان-باگ-مبتدی

فهرستی از منابع برای کسانی که علاقه مند به شروع باگ Bounties هستند.

https://github.com/nahamsec/Resources-for-Beginner-Bug-Bounty-Hunters

#pentesting #bugbounty
@pfk_git

ابزار شمارش پروکسی وب (WebPET)

https://github.com/RootUp/WebPET
#web
@pfk_git

​​Ultimate DevSecOps library

This library contains list of tools and methodologies accompanied with resources. The main goal is to provide to the engineers a guide through opensource #DevSecOps tooling. This repository covers only #cybersecurity in the cloud and the DevSecOps scope.

https://github.com/sottlmarek/DevSecOps
@pfk_git

​​WinSpoof

This PoC code demostrate how TpAllocWork, TpPostWork and TpReleaseWork can be used to execute machine code, the code start a image file by calling:

https://github.com/mobdk/WinSpoof

#cybersecurity #infosec
@pfk_git

همه چیز در مورد باگ بانتی

اینها یادداشت‌های پاداش باگ من است که از منابع مختلف جمع‌آوری کرده‌ام، شما هم می‌توانید در این مخزن مشارکت کنید!

https://github.com/daffainfo/AllAboutBugBounty

#bugbounty #pentest #infosec
@pfk_git

​​Authentication Token Obtain and Replace Extender

The plugin is created to help automated scanning using Burp in the following scenarios:

▫️ Access/Refresh token
▫️ Token replacement in XML,JSON body
▫️ Token replacement in cookies
▫️ The above can be achieved using complex macro, session rules or Custom Extender in some scenarios. The rules become tricky and do not work in scenarios where the replacement text is either JSON, XML.

https://github.com/portswigger/ator
@pfk_git

​​Nuclei Wordfence CVE

https://github.com/topscoder/nuclei-wordfence-cve

#cybersecurity #infosec #cve #pentest
@pfk_git

​​(ISC)2 Certified in Cybersecurity

The content in this repo is based on the self-paced course called Certified in #Cybersecurity from (ISC)2, which is a preparation for (ISC)2 Certified in Cybersecurity.

In this entry-level cybersecurity certification, the domains included are: Security Principles, Business Continuity, Disaster Recovery & Incident Response Concepts, Access Controls Concepts, Network Security and Security Operations.

https://github.com/cyberfascinate/ISC2-CC-Study-Material

#ISC
@Pfk_git

​​#DevOps Guide

Development to Production all configurations with basic notes to debug efficiently.

https://github.com/Tikam02/DevOps-Guide
@pfk_git

#گزارش های حسابرسی

مجموعه ای از گزارش های حسابرسی انفرادی توسط کارشناسان امنیت web3. هرزنامه های روابط عمومی برای اضافه کردن گزارش های هر محقق امنیتی مستقلی که می شناسید.

https://github.com/chinmay-farkya/solo-audit-reports

#cybersecurity #infosec #Audit
@pfk_git

چک لیست حسابرسی قرارداد هوشمند

https://github.com/vishnuram1999/Smart-Contract-Auditing-Checklist

#bugbounty #pentest #Audit
@pfk_git

فهرست کلمات عبور

فهرست کلمات عبور و قوانین هش کت برای شکستن آفلاین گذرواژه های طولانی و پیچیده.

https://github.com/initstring/passphrase-wordlist

#password #bugbounty #cybersecurity #infosec
@pfk_git

​​LeakySAB-PoC

PoC of 'LeakySAB' a vulnerability allowing extraction of usenet provider password from a SABnzbd instance.

https://github.com/rlaphoenix/LeakySAB-PoC

#cybersecurity #infosec
@Pfk_Git

برنامه ای که بررسی می کند آیا فهرستی از دامنه ها را می توان بر اساس رکوردهای SPF و DMARC جعل کرد یا خیر.

https://github.com/MattKeeley/Spoofy

#bugbounty #pentest
@pfk_git

Bash noscript that crawls a target URL to get a better image of what is tied to a website.

https://github.com/NeverWonderLand/wildcrawl

#bugbounty #pentest
@pfk_git

​​Arc

A manager for your secrets made of arc, a RESTful API server written in Go which exposes read and write primitives for encrypted records, and arc, the client application implemented in HTML5 and javanoscript, which runs in every modern browser and it is served by arc itself.

Records are generated, encrypted and decrypted client side by arc (with AES256 in GCM mode, using 10000 iterations for the PBKDF2 key derivation function, everything WebCrypto based ), which offers an intuitive management system equipped with UI widgets including:👇

https://github.com/evilsocket/arc

#cybersecurity #infosec
@pfk_git

​​idfk

•  Indirect syscalls via HellsHall. Only did it for the protect call and some other common ones, too lazy for others
•   Producing Shellcode (via ShellcodeTemplate), exes, dlls.
•   Sleep encryption via Ekko. Only works on Exes and Shellcode. I don't think DLL can sleep encrypt properly cause CFG, just a guess though
•  I managed to injected to explorer/locally and it works, but if theres more than one instance of the shellcode is already there, only one of them will cycle.

https://github.com/susMdT/fictional-invention

#cybersecurity #infosec
@pfk_git

​​Defender-For-Endpoint-Queries

This repo contains the queries for defender for endpoint detection queries also hunting queries.

https://github.com/le0li9ht/Defender-For-Endpoint-Queries

#cybersecurity #infosec
@pfk_git

Svn-Extractor

اسکریپت ساده برای استخراج تمام منابع وب با استفاده از پوشه .SVN در معرض شبکه.

https://github.com/anantshri/svn-extractor

#cybersecurity #infosec #bugbounty #pentest
@pfk_git

​​TokenUniverse

An advanced tool for working with access tokens and Windows security policy.

https://github.com/diversenok/TokenUniverse

#cybersecurity #infosec
@pfk_git