@Phantasm_Lab – Telegram
@Phantasm_Lab
2.56K subscribers
712 photos
34 videos
671 files
2.71K links
- Red x Blue Security
- Bug Bounty 💷 💵
- Exploitable tools
- Programming Languages
- Malware Analysis

🇺🇸 🇧🇷 🇪🇸

since 2017 ©


Parceiros:
@TIdaDepressaoOficial @acervoprivado @ReneGadesx @G4t3w4y
Download Telegram
Forwarded from SHELL SHOCK
securing-node-applications.pdf
5.3 MB
Forwarded from T.I. da Depressão (Nerd Codefail🐧)
Gambiarras + gambiarras
Why is Hong Kong the Perfect Setting for Cyberpunk?

Hong Kong is the most cyberpunk place in the world. Hong Kong has been featured in the most popular and influential Cyberpunk films. In this video I discussed why Hong Kong is such a preferred destination fro cyberpunk filmmakers.

https://www.youtube.com/watch?v=G93eQ9HXNdg

🕴 @Phantasm_Lab
Cross Site Scripting Vulnerability in Oracle

So as you already know that Cross Site Scripting is an attack in which we can inject custom JavaScript codes & the browser executes them as the part of the page. So for the proof of concept I used a simple alert(document.domain) payload, but the exploitation is not limited.

https://www.ifrahiman.com/2018/02/cross-site-noscripting-vulnerability-in.html#more

🧠 @Phantasm_Lab
Webinar: Tips on Building a World Class Bug Bounty Program From Senior Red Team Expert, Mack Staples

There’s nothing more important than protecting the lifeblood of your business: customer data. No one takes this more seriously than Zenefits, the All-in-One HR Platform. Zenefits holds sensitive personal and financial data for over 10,000 small and medium businesses. That’s a lot of high risk customer data, including Personally Identifiable Information (PII) and Protected Health Information (PHI). Thankfully, Zenefits has a world-class security program and a Red Team that knows, like many other companies with similarly sensitive data, they must be on their game 24/7. Mack Staples, Senior Manager of Zenefits' Red Team, walks through some best practices they use to enable bug bounties as a core product security strategy. He discusses tips, practical advice, and insights into how they’ve built their world-class bug bounty program into one of the top program’s on the HackerOne platform.

https://www.youtube.com/watch?v=USRi1M2mlm8

🕴 @Phantasm_Lab
Official Black Hat Arsenal Tools Github Repository
XXE Recursive Download

This tool exploits XXE to retrieve files from a target server. It obtains directory listings and recursively downloads file contents.

https://github.com/GDSSecurity/xxe-recursive-download
QRLJacking - A New Social Engineering Attack Vector

QRLJacking or Quick Response Code Login Jacking is a simple social engineering attack vector capable of session hijacking affecting all applications that rely on the “Login with QR code” feature as a secure way to login into accounts. In a nutshell, the victim scans the attacker’s QR code which results in session hijacking.

https://github.com/OWASP/QRLJacking

🕴🏼 @PhantasmLab