Welcome to the wiki where you will find each hacking trick/technique/whatever I have learnt from CTFs, real life apps, reading researches, and news.
exploit.education provides a variety of resources that can be used to learn about vulnerability analysis, exploit development, software debugging, binary analysis, and general cyber security issues.
GTFOBins is a curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systems.
Vu ici: https://twitter.com/bluetouff/status/1746971240907055571
Un outil tout frais et bien pratique pour retrouver les exploits associés aux #CVE (pensez à pip install tabulate si vous ne l'avez pas déjà installé)
Extraction du firmware, analyse statique et dynamique (émulation) et reporting des vulnérabilités
EMBArk: l'environnement de scan https://github.com/e-m-b-a/embark
Via Blutetouff https://twitter.com/bluetouff/status/1645365068639399937
Overview As part of our continued goal to provide safer products for enterprises and consumers, we at McAfee Advanced Threat Research (ATR) recently
Description :-D
https://mastodon.gougere.fr/@bortzmeyer/106221715789827603
Bon, sinon, la faille de cybersécurité de la semaine, tendance « on va tous mourir », se nomme #FragAttacks et… elle a un logo ! https://www.fragattacks.com/
Executive summary: le protocole #WiFi n'est pas terrible, les produits Wifi, c'est de la daube et l'Internet des Objets, je ne vous dis pas.
Annonce: https://twitter.com/vanhoefm/status/1392182736673075200
(voir tout le fil)
déroulé ici https://threadreaderapp.com/thread/1392182736673075200.html
Exploitation de failles en local
dont la majorité de https://gtfobins.github.io/
(équivalent pour Windows tps://lolbas-project.github.io/# )
Tsunami is a general purpose network security scanner with an extensible plugin system for detecting high severity vulnerabilities with high confidence.
https://opensource.googleblog.com/2020/06/tsunami-extensible-network-scanning.html
État des vulnérabilités SSL/TLS
Raccoon is a tool made for reconnaissance and information gathering with an emphasis on simplicity.
It will do everything from fetching DNS records, retrieving WHOIS information, obtaining TLS data, detecting WAF presence and up to threaded dir busting and subdomain enumeration. Every scan outputs to a corresponding file.
Sometimes, our jaws hit the floor. We see some pretty bad things in IoT security, but this has to take the biscuit. After the WeVibe lawsuit and settlement, we