Leaderboard

Web Application Penetration Testing Phase 1 – History 1. History of Internet - https://www.youtube.com/watch?v=9hIQjrMHTv4 Phase 2 – Web and Server Technology 2. Basic concepts of web applications, how they work and the HTTP protocol - https://www.youtube.com/watch?v=RsQ1tFLwldY&t=7s 3. HTML basics part 1 - https://www.youtube.com/watch?v=p6fRBGI_BY0 4. HTML basics part 2 - https://www.youtube.com/watch?v=Zs6lzuBVK2w 5. Difference between static and dynamic website - https://www.youtube.com/watch?v=hlg6q6OFoxQ 6. HTTP protocol Understanding - https://www.youtube.com/watch?v=JFZMyhRTVt0 7. Parts of HTTP Request -https://www.youtube.com/watch?v=pHFWGN-upGM 8. Parts of HTTP Response - https://www.youtube.com/watch?v=c9sMNc2PrMU 9. Various HTTP Methods - https://www.youtube.com/watch?v=PO7D20HsFsY 10. Understanding URLS - https://www.youtube.com/watch?v=5Jr-_Za5yQM 11. Intro to REST - https://www.youtube.com/watch?v=YCcAE2SCQ6k 12. HTTP Request & Response Headers - https://www.youtube.com/watch?v=vAuZwirKjWs 13. What is a cookie - https://www.youtube.com/watch?v=I01XMRo2ESg 14. HTTP Status codes - https://www.youtube.com/watch?v=VLH3FMQ5BIQ 15. HTTP Proxy - https://www.youtube.com/watch?v=qU0PVSJCKcs 16. Authentication with HTTP - https://www.youtube.com/watch?v=GxiFXUFKo1M 17. HTTP basic and digest authentication - https://www.youtube.com/watch?v=GOnhCbDhMzk 18. What is “Server-Side” - https://www.youtube.com/watch?v=JnCLmLO9LhA 19. Server and client side with example - https://www.youtube.com/watch?v=DcBB2Fp8WNI 20. What is a session - https://www.youtube.com/watch?v=WV4DJ6b0jhg&t=202s 21. Introduction to UTF-8 and Unicode - https://www.youtube.com/watch?v=sqPTR_v4qFA 22. URL encoding - https://www.youtube.com/watch?v=Z3udiqgW1VA 23. HTML encoding - https://www.youtube.com/watch?v=IiAfCLWpgII&t=109s 24. Base64 encoding - https://www.youtube.com/watch?v=8qkxeZmKmOY 25. Hex encoding & ASCII - https://www.youtube.com/watch?v=WW2SaCMnHdU Phase 3 – Setting up the lab with BurpSuite and bWAPP MANISH AGRAWAL 26. Setup lab with bWAPP - https://www.youtube.com/watch?v=dwtUn3giwTk&index=1&list=PLv95pq8fEyuivHeZB2jeC435tU3_1YGzV 27. Set up Burp Suite - https://www.youtube.com/watch?v=hQsT4rSa_v0&list=PLv95pq8fEyuivHeZB2jeC435tU3_1YGzV&index=2 28. Configure Firefox and add certificate - https://www.youtube.com/watch?v=hfsdJ69GSV4&index=3&list=PLv95pq8fEyuivHeZB2jeC435tU3_1YGzV 29. Mapping and scoping website - https://www.youtube.com/watch?v=H-_iVteMDRo&index=4&list=PLv95pq8fEyuivHeZB2jeC435tU3_1YGzV 30. Spidering - https://www.youtube.com/watch?v=97uMUQGIe14&list=PLv95pq8fEyuivHeZB2jeC435tU3_1YGzV&index=5 31. Active and passive scanning - https://www.youtube.com/watch?v=1Mjom6AcFyU&index=6&list=PLv95pq8fEyuivHeZB2jeC435tU3_1YGzV 32. Scanner options and demo - https://www.youtube.com/watch?v=gANi4Kt7-ek&index=7&list=PLv95pq8fEyuivHeZB2jeC435tU3_1YGzV 33. Introduction to password security - https://www.youtube.com/watch?v=FwcUhcLO9iM&list=PLv95pq8fEyuivHeZB2jeC435tU3_1YGzV&index=8 34. Intruder - https://www.youtube.com/watch?v=wtMg9oEMTa8&list=PLv95pq8fEyuivHeZB2jeC435tU3_1YGzV&index=9 35. Intruder attack types - https://www.youtube.com/watch?v=N5ndYPwddkQ&index=10&list=PLv95pq8fEyuivHeZB2jeC435tU3_1YGzV 36. Payload settings - https://www.youtube.com/watch?v=5GpdlbtL-1Q&index=11&list=PLv95pq8fEyuivHeZB2jeC435tU3_1YGzV 37. Intruder settings - https://www.youtube.com/watch?v=B_Mu7jmOYnU&list=PLv95pq8fEyuivHeZB2jeC435tU3_1YGzV&index=12 ÆTHER SECURITY LAB 38. No.1 Penetration testing tool - https://www.youtube.com/watch?v=AVzC7ETqpDo&list=PLq9n8iqQJFDrwFe9AEDBlR1uSHEN7egQA&index=1 39. Environment Setup - https://www.youtube.com/watch?v=yqnUOdr0eVk&index=2&list=PLq9n8iqQJFDrwFe9AEDBlR1uSHEN7egQA 40. General concept - https://www.youtube.com/watch?v=udl4oqr_ylM&list=PLq9n8iqQJFDrwFe9AEDBlR1uSHEN7egQA&index=3 41. Proxy module - https://www.youtube.com/watch?v=PDTwYFkjQBE&list=PLq9n8iqQJFDrwFe9AEDBlR1uSHEN7egQA&index=4 42. Repeater module - https://www.youtube.com/watch?v=9Zh_7s5csCc&list=PLq9n8iqQJFDrwFe9AEDBlR1uSHEN7egQA&index=5 43. Target and spider module - https://www.youtube.com/watch?v=dCKPZUSOlr8&list=PLq9n8iqQJFDrwFe9AEDBlR1uSHEN7egQA&index=6 44. Sequencer and scanner module - https://www.youtube.com/watch?v=G-v581pXerE&list=PLq9n8iqQJFDrwFe9AEDBlR1uSHEN7egQA&index=7 Phase 4 – Mapping the application and attack surface 45. Spidering - https://www.youtube.com/watch?v=97uMUQGIe14&list=PLv95pq8fEyuivHeZB2jeC435tU3_1YGzV&index=5 46. Mapping application using robots.txt - https://www.youtube.com/watch?v=akuzgZ75zrk 47. Discover hidden contents using dirbuster - https://www.youtube.com/watch?v=--nu9Jq07gA 48. Dirbuster in detail - https://www.youtube.com/watch?v=2tOQC68hAcQ 49. Discover hidden directories and files with intruder - https://www.youtube.com/watch?v=4Fz9mJeMNkI 50. Directory bruteforcing 1 - https://www.youtube.com/watch?v=ch2onB_LFoI 51. Directory bruteforcing 2 - https://www.youtube.com/watch?v=ASMW_oLbyIg 52. Identify application entry points - https://www.youtube.com/watch?v=IgJWPZ2OKO8&t=34s 53. Identify application entry points - https://www.owasp.org/index.php/Identify_application_entry_points_(OTG-INFO-006) 54. Identify client and server technology - https://www.youtube.com/watch?v=B8jN_iWjtyM 55. Identify server technology using banner grabbing (telnet) - https://www.youtube.com/watch?v=O67M-U2UOAg 56. Identify server technology using httprecon - https://www.youtube.com/watch?v=xBBHtS-dwsM 57. Pentesting with Google dorks Introduction - https://www.youtube.com/watch?v=NmdrKFwAw9U 58. Fingerprinting web server - https://www.youtube.com/watch?v=tw2VdG0t5kc&list=PLxLRoXCDIalcRS5Nb1I_HM_OzS10E6lqp&index=10 59. Use Nmap for fingerprinting web server - https://www.youtube.com/watch?v=VQV-y_-AN80 60. Review webs servers metafiles for information leakage - https://www.youtube.com/watch?v=sds3Zotf_ZY 61. Enumerate applications on web server - https://www.youtube.com/watch?v=lfhvvTLN60E 62. Identify application entry points - https://www.youtube.com/watch?v=97uMUQGIe14&list=PLDeogY2Qr-tGR2NL2X1AR5Zz9t1iaWwlM 63. Map execution path through application - https://www.youtube.com/watch?v=0I0NPiyo9UI 64. Fingerprint web application frameworks - https://www.youtube.com/watch?v=ASzG0kBoE4c Phase 5 – Understanding and exploiting OWASP top 10 vulnerabilities 65. A closer look at all owasp top 10 vulnerabilities - https://www.youtube.com/watch?v=avFR_Af0KGk IBM 66. Injection - https://www.youtube.com/watch?v=02mLrFVzIYU&index=1&list=PLoyY7ZjHtUUVLs2fy-ctzZDSPpawuQ28d 67. Broken authentication and session management - https://www.youtube.com/watch?v=iX49fqZ8HGA&index=2&list=PLoyY7ZjHtUUVLs2fy-ctzZDSPpawuQ28d 68. Cross-site scripting - https://www.youtube.com/watch?v=x6I5fCupLLU&index=3&list=PLoyY7ZjHtUUVLs2fy-ctzZDSPpawuQ28d 69. Insecure direct object reference - https://www.youtube.com/watch?v=-iCyp9Qz3CI&list=PLoyY7ZjHtUUVLs2fy-ctzZDSPpawuQ28d&index=4 70. Security misconfiguration - https://www.youtube.com/watch?v=cIplXL8idyo&list=PLoyY7ZjHtUUVLs2fy-ctzZDSPpawuQ28d&index=5 71. Sensitive data exposure - https://www.youtube.com/watch?v=rYlzTQlF8Ws&index=6&list=PLoyY7ZjHtUUVLs2fy-ctzZDSPpawuQ28d 72. Missing functional level access controls - https://www.youtube.com/watch?v=VMv_gyCNGpk&list=PLoyY7ZjHtUUVLs2fy-ctzZDSPpawuQ28d&index=7 73. Cross-site request forgery - https://www.youtube.com/watch?v=_xSFm3KGxh0&list=PLoyY7ZjHtUUVLs2fy-ctzZDSPpawuQ28d&index=8 74. Using components with known vulnerabilities - https://www.youtube.com/watch?v=bhJmVBJ-F-4&index=9&list=PLoyY7ZjHtUUVLs2fy-ctzZDSPpawuQ28d 75. Unvalidated redirects and forwards - https://www.youtube.com/watch?v=L6bYKiLtSL8&index=10&list=PLoyY7ZjHtUUVLs2fy-ctzZDSPpawuQ28d F5 CENTRAL 76. Injection - https://www.youtube.com/watch?v=rWHvp7rUka8&index=1&list=PLyqga7AXMtPPuibxp1N0TdyDrKwP9H_jD 77. Broken authentication and session management - https://www.youtube.com/watch?v=mruO75ONWy8&index=2&list=PLyqga7AXMtPPuibxp1N0TdyDrKwP9H_jD 78. Insecure deserialisation - https://www.youtube.com/watch?v=nkTBwbnfesQ&index=8&list=PLyqga7AXMtPPuibxp1N0TdyDrKwP9H_jD 79. Sensitive data exposure - https://www.youtube.com/watch?v=2RKbacrkUBU&index=3&list=PLyqga7AXMtPPuibxp1N0TdyDrKwP9H_jD 80. Broken access control - https://www.youtube.com/watch?v=P38at6Tp8Ms&list=PLyqga7AXMtPPuibxp1N0TdyDrKwP9H_jD&index=5 81. Insufficient logging and monitoring - https://www.youtube.com/watch?v=IFF3tkUOF5E&index=10&list=PLyqga7AXMtPPuibxp1N0TdyDrKwP9H_jD 82. XML external entities - https://www.youtube.com/watch?v=g2ey7ry8_CQ&list=PLyqga7AXMtPPuibxp1N0TdyDrKwP9H_jD&index=4 83. Using components with known vulnerabilities - https://www.youtube.com/watch?v=IGsNYVDKRV0&index=9&list=PLyqga7AXMtPPuibxp1N0TdyDrKwP9H_jD 84. Cross-site scripting - https://www.youtube.com/watch?v=IuzU4y-UjLw&index=7&list=PLyqga7AXMtPPuibxp1N0TdyDrKwP9H_jD 85. Security misconfiguration - https://www.youtube.com/watch?v=JuGSUMtKTPU&index=6&list=PLyqga7AXMtPPuibxp1N0TdyDrKwP9H_jD LUKE BRINER 86. Injection explained - https://www.youtube.com/watch?v=1qMggPJpRXM&index=1&list=PLpNYlUeSK_rkrrBox-xvSkm5lgaDqKa0X 87. Broken authentication and session management - https://www.youtube.com/watch?v=fKnG15BL4AY&list=PLpNYlUeSK_rkrrBox-xvSkm5lgaDqKa0X&index=2 88. Cross-site scripting - https://www.youtube.com/watch?v=ksM-xXeDUNs&index=3&list=PLpNYlUeSK_rkrrBox-xvSkm5lgaDqKa0X 89. Insecure direct object reference - https://www.youtube.com/watch?v=ZodA76-CB10&list=PLpNYlUeSK_rkrrBox-xvSkm5lgaDqKa0X&index=4 90. Security misconfiguration - https://www.youtube.com/watch?v=DfFPHKPCofY&index=5&list=PLpNYlUeSK_rkrrBox-xvSkm5lgaDqKa0X 91. Sensitive data exposure - https://www.youtube.com/watch?v=Z7hafbGDVEE&list=PLpNYlUeSK_rkrrBox-xvSkm5lgaDqKa0X&index=6 92. Missing functional level access control - https://www.youtube.com/watch?v=RGN3w831Elo&list=PLpNYlUeSK_rkrrBox-xvSkm5lgaDqKa0X&index=7 93. Cross-site request forgery - https://www.youtube.com/watch?v=XRW_US5BCxk&list=PLpNYlUeSK_rkrrBox-xvSkm5lgaDqKa0X&index=8 94. Components with known vulnerabilities - https://www.youtube.com/watch?v=pbvDW9pJdng&list=PLpNYlUeSK_rkrrBox-xvSkm5lgaDqKa0X&index=9 95. Unvalidated redirects and forwards - https://www.youtube.com/watch?v=bHTglpgC5Qg&list=PLpNYlUeSK_rkrrBox-xvSkm5lgaDqKa0X&index=10 Phase 6 – Session management testing 96. Bypass authentication using cookie manipulation - https://www.youtube.com/watch?v=mEbmturLljU 97. Cookie Security Via httponly and secure Flag - OWASP - https://www.youtube.com/watch?v=3aKA4RkAg78 98. Penetration testing Cookies basic - https://www.youtube.com/watch?v=_P7KN8T1boc 99. Session fixation 1 - https://www.youtube.com/watch?v=ucmgeHKtxaI 100. Session fixation 2 - https://www.youtube.com/watch?v=0Tu1qxysWOk 101. Session fixation 3 - https://www.youtube.com/watch?v=jxwgpWvRUSo 102. Session fixation 4 - https://www.youtube.com/watch?v=eUbtW0Z0W1g 103. CSRF - Cross site request forgery 1 - https://www.youtube.com/watch?v=m0EHlfTgGUU 104. CSRF - Cross site request forgery 2 - https://www.youtube.com/watch?v=H3iu0_ltcv4 105. CSRF - Cross site request forgery 3 - https://www.youtube.com/watch?v=1NO4I28J-0s 106. CSRF - Cross site request forgery 4 - https://www.youtube.com/watch?v=XdEJEUJ0Fr8 107. CSRF - Cross site request forgery 5 - https://www.youtube.com/watch?v=TwG0Rd0hr18 108. Session puzzling 1 - https://www.youtube.com/watch?v=YEOvmhTb8xA 109. Admin bypass using session hijacking - https://www.youtube.com/watch?v=1wp1o-1TfAc Phase 7 – Bypassing client-side controls 110. What is hidden forms in HTML - https://www.youtube.com/watch?v=orUoGsgaYAE 111. Bypassing hidden form fields using tamper data - https://www.youtube.com/watch?v=NXkGX2sPw7I 112. Bypassing hidden form fields using Burp Suite (Purchase application) - https://www.youtube.com/watch?v=xahvJyUFTfM 113. Changing price on eCommerce website using parameter tampering - https://www.youtube.com/watch?v=A-ccNpP06Zg 114. Understanding cookie in detail - https://www.youtube.com/watch?v=_P7KN8T1boc&list=PLWPirh4EWFpESKWJmrgQwmsnTrL_K93Wi&index=18 115. Cookie tampering with tamper data- https://www.youtube.com/watch?v=NgKXm0lBecc 116. Cookie tamper part 2 - https://www.youtube.com/watch?v=dTCt_I2DWgo 117. Understanding referer header in depth using Cisco product - https://www.youtube.com/watch?v=GkQnBa3C7WI&t=35s 118. Introduction to ASP.NET viewstate - https://www.youtube.com/watch?v=L3p6Uw6SSXs 119. ASP.NET viewstate in depth - https://www.youtube.com/watch?v=Fn_08JLsrmY 120. Analyse sensitive data in ASP.NET viewstate - https://msdn.microsoft.com/en-us/library/ms972427.aspx?f=255&MSPPError=-2147217396 121. Cross-origin-resource-sharing explanation with example - https://www.youtube.com/watch?v=Ka8vG5miErk 122. CORS demo 1 - https://www.youtube.com/watch?v=wR8pjTWaEbs 123. CORS demo 2 - https://www.youtube.com/watch?v=lg31RYYG-T4 124. Security headers - https://www.youtube.com/watch?v=TNlcoYLIGFk 125. Security headers 2 - https://www.youtube.com/watch?v=ZZUvmVkkKu4 Phase 8 – Attacking authentication/login 126. Attacking login panel with bad password - Guess username password for the website and try different combinations 127. Brute-force login panel - https://www.youtube.com/watch?v=25cazx5D_vw 128. Username enumeration - https://www.youtube.com/watch?v=WCO7LnSlskE 129. Username enumeration with bruteforce password attack - https://www.youtube.com/watch?v=zf3-pYJU1c4 130. Authentication over insecure HTTP protocol - https://www.youtube.com/watch?v=ueSG7TUqoxk 131. Authentication over insecure HTTP protocol - https://www.youtube.com/watch?v=_WQe36pZ3mA 132. Forgot password vulnerability - case 1 - https://www.youtube.com/watch?v=FEUidWWnZwU 133. Forgot password vulnerability - case 2 - https://www.youtube.com/watch?v=j7-8YyYdWL4 134. Login page autocomplete feature enabled - https://www.youtube.com/watch?v=XNjUfwDmHGc&t=33s 135. Testing for weak password policy - https://www.owasp.org/index.php/Testing_for_Weak_password_policy_(OTG-AUTHN-007) 136. Insecure distribution of credentials - When you register in any website or you request for a password reset using forgot password feature, if the website sends your username and password over the email in cleartext without sending the password reset link, then it is a vulnerability. 137. Test for credentials transportation using SSL/TLS certificate - https://www.youtube.com/watch?v=21_IYz4npRs 138. Basics of MySQL - https://www.youtube.com/watch?v=yPu6qV5byu4 139. Testing browser cache - https://www.youtube.com/watch?v=2T_Xz3Humdc 140. Bypassing login panel -case 1 - https://www.youtube.com/watch?v=TSqXkkOt6oM 141. Bypass login panel - case 2 - https://www.youtube.com/watch?v=J6v_W-LFK1c Phase 9 - Attacking access controls (IDOR, Priv esc, hidden files and directories) Completely unprotected functionalities 142. Finding admin panel - https://www.youtube.com/watch?v=r1k2lgvK3s0 143. Finding admin panel and hidden files and directories - https://www.youtube.com/watch?v=Z0VAPbATy1A 144. Finding hidden webpages with dirbusater - https://www.youtube.com/watch?v=--nu9Jq07gA&t=5s Insecure direct object reference 145. IDOR case 1 - https://www.youtube.com/watch?v=gci4R9Vkulc 146. IDOR case 2 - https://www.youtube.com/watch?v=4DTULwuLFS0 147. IDOR case 3 (zomato) - https://www.youtube.com/watch?v=tCJBLG5Mayo Privilege escalation 148. What is privilege escalation - https://www.youtube.com/watch?v=80RzLSrczmc 149. Privilege escalation - Hackme bank - case 1 - https://www.youtube.com/watch?v=g3lv__87cWM 150. Privilege escalation - case 2 - https://www.youtube.com/watch?v=-i4O_hjc87Y Phase 10 – Attacking Input validations (All injections, XSS and mics) HTTP verb tampering 151. Introduction HTTP verb tampering - https://www.youtube.com/watch?v=Wl0PrIeAnhs 152. HTTP verb tampering demo - https://www.youtube.com/watch?v=bZlkuiUkQzE HTTP parameter pollution 153. Introduction HTTP parameter pollution - https://www.youtube.com/watch?v=Tosp-JyWVS4 154. HTTP parameter pollution demo 1 - https://www.youtube.com/watch?v=QVZBl8yxVX0&t=11s 155. HTTP parameter pollution demo 2 - https://www.youtube.com/watch?v=YRjxdw5BAM0 156. HTTP parameter pollution demo 3 - https://www.youtube.com/watch?v=kIVefiDrWUw XSS - Cross site scripting 157. Introduction to XSS - https://www.youtube.com/watch?v=gkMl1suyj3M 158. What is XSS - https://www.youtube.com/watch?v=cbmBDiR6WaY 159. Reflected XSS demo - https://www.youtube.com/watch?v=r79ozjCL7DA 160. XSS attack method using burpsuite - https://www.youtube.com/watch?v=OLKBZNw3OjQ 161. XSS filter bypass with Xenotix - https://www.youtube.com/watch?v=loZSdedJnqc 162. Reflected XSS filter bypass 1 - https://www.youtube.com/watch?v=m5rlLgGrOVA 163. Reflected XSS filter bypass 2 - https://www.youtube.com/watch?v=LDiXveqQ0gg 164. Reflected XSS filter bypass 3 - https://www.youtube.com/watch?v=hb_qENFUdOk 165. Reflected XSS filter bypass 4 - https://www.youtube.com/watch?v=Fg1qqkedGUk 166. Reflected XSS filter bypass 5 - https://www.youtube.com/watch?v=NImym71f3Bc 167. Reflected XSS filter bypass 6 - https://www.youtube.com/watch?v=9eGzAym2a5Q 168. Reflected XSS filter bypass 7 - https://www.youtube.com/watch?v=ObfEI84_MtM 169. Reflected XSS filter bypass 8 - https://www.youtube.com/watch?v=2c9xMe3VZ9Q 170. Reflected XSS filter bypass 9 - https://www.youtube.com/watch?v=-48zknvo7LM 171. Introduction to Stored XSS - https://www.youtube.com/watch?v=SHmQ3sQFeLE 172. Stored XSS 1 - https://www.youtube.com/watch?v=oHIl_pCahsQ 173. Stored XSS 2 - https://www.youtube.com/watch?v=dBTuWzX8hd0 174. Stored XSS 3 - https://www.youtube.com/watch?v=PFG0lkMeYDc 175. Stored XSS 4 - https://www.youtube.com/watch?v=YPUBFklUWLc 176. Stored XSS 5 - https://www.youtube.com/watch?v=x9Zx44EV-Og SQL injection 177. Part 1 - Install SQLi lab - https://www.youtube.com/watch?v=NJ9AA1_t1Ic&index=23&list=PLkiAz1NPnw8qEgzS7cgVMKavvOAdogsro 178. Part 2 - SQL lab series - https://www.youtube.com/watch?v=TA2h_kUqfhU&index=22&list=PLkiAz1NPnw8qEgzS7cgVMKavvOAdogsro 179. Part 3 - SQL lab series - https://www.youtube.com/watch?v=N0zAChmZIZU&list=PLkiAz1NPnw8qEgzS7cgVMKavvOAdogsro&index=21 180. Part 4 - SQL lab series - https://www.youtube.com/watch?v=6pVxm5mWBVU&index=20&list=PLkiAz1NPnw8qEgzS7cgVMKavvOAdogsro 181. Part 5 - SQL lab series - https://www.youtube.com/watch?v=0tyerVP9R98&index=19&list=PLkiAz1NPnw8qEgzS7cgVMKavvOAdogsro 182. Part 6 - Double query injection - https://www.youtube.com/watch?v=zaRlcPbfX4M&index=18&list=PLkiAz1NPnw8qEgzS7cgVMKavvOAdogsro 183. Part 7 - Double query injection cont.. - https://www.youtube.com/watch?v=9utdAPxmvaI&index=17&list=PLkiAz1NPnw8qEgzS7cgVMKavvOAdogsro 184. Part 8 - Blind injection boolean based - https://www.youtube.com/watch?v=u7Z7AIR6cMI&index=16&list=PLkiAz1NPnw8qEgzS7cgVMKavvOAdogsro 185. Part 9 - Blind injection time based - https://www.youtube.com/watch?v=gzU1YBu_838&index=15&list=PLkiAz1NPnw8qEgzS7cgVMKavvOAdogsro 186. Part 10 - Dumping DB using outfile - https://www.youtube.com/watch?v=ADW844OA6io&index=14&list=PLkiAz1NPnw8qEgzS7cgVMKavvOAdogsro 187. Part 11 - Post parameter injection error based - https://www.youtube.com/watch?v=6sQ23tqiTXY&list=PLkiAz1NPnw8qEgzS7cgVMKavvOAdogsro&index=13 188. Part 12 - POST parameter injection double query based - https://www.youtube.com/watch?v=tjFXWQY4LuA&index=12&list=PLkiAz1NPnw8qEgzS7cgVMKavvOAdogsro 189. Part 13 - POST parameter injection blind boolean and time based - https://www.youtube.com/watch?v=411G-4nH5jE&list=PLkiAz1NPnw8qEgzS7cgVMKavvOAdogsro&index=10 190. Part 14 - Post parameter injection in UPDATE query - https://www.youtube.com/watch?v=2FgLcPuU7Vw&list=PLkiAz1NPnw8qEgzS7cgVMKavvOAdogsro&index=11 191. Part 15 - Injection in insert query - https://www.youtube.com/watch?v=ZJiPsWxXYZs&list=PLkiAz1NPnw8qEgzS7cgVMKavvOAdogsro&index=9 192. Part 16 - Cookie based injection - https://www.youtube.com/watch?v=-A3vVqfP8pA&list=PLkiAz1NPnw8qEgzS7cgVMKavvOAdogsro&index=8 193. Part 17 - Second order injection -https://www.youtube.com/watch?v=e9pbC5BxiAE&list=PLkiAz1NPnw8qEgzS7cgVMKavvOAdogsro&index=7 194. Part 18 - Bypassing blacklist filters - 1 - https://www.youtube.com/watch?v=5P-knuYoDdw&index=6&list=PLkiAz1NPnw8qEgzS7cgVMKavvOAdogsro 195. Part 19 - Bypassing blacklist filters - 2 - https://www.youtube.com/watch?v=45BjuQFt55Y&list=PLkiAz1NPnw8qEgzS7cgVMKavvOAdogsro&index=5 196. Part 20 - Bypassing blacklist filters - 3 - https://www.youtube.com/watch?v=c-Pjb_zLpH0&index=4&list=PLkiAz1NPnw8qEgzS7cgVMKavvOAdogsro 197. Part 21 - Bypassing WAF - https://www.youtube.com/watch?v=uRDuCXFpHXc&list=PLkiAz1NPnw8qEgzS7cgVMKavvOAdogsro&index=2 198. Part 22 - Bypassing WAF - Impedance mismatch - https://www.youtube.com/watch?v=ygVUebdv_Ws&list=PLkiAz1NPnw8qEgzS7cgVMKavvOAdogsro&index=3 199. Part 23 - Bypassing addslashes - charset mismatch - https://www.youtube.com/watch?v=du-jkS6-sbo&list=PLkiAz1NPnw8qEgzS7cgVMKavvOAdogsro&index=1 NoSQL injection 200. Introduction to NoSQL injection - https://www.youtube.com/watch?v=h0h37-Dwd_A 201. Introduction to SQL vs NoSQL - Difference between MySQL and MongoDB with tutorial - https://www.youtube.com/watch?v=QwevGzVu_zk 202. Abusing NoSQL databases - https://www.youtube.com/watch?v=lcO1BTNh8r8 203. Making cry - attacking NoSQL for pentesters - https://www.youtube.com/watch?v=NgsesuLpyOg Xpath and XML injection 204. Introduction to Xpath injection - https://www.youtube.com/watch?v=2_UyM6Ea0Yk&t=3102s 205. Introduction to XML injection - https://www.youtube.com/watch?v=9ZokuRHo-eY 206. Practical 1 - bWAPP - https://www.youtube.com/watch?v=6tV8EuaHI9M 207. Practical 2 - Mutillidae - https://www.youtube.com/watch?v=fV0qsqcScI4 208. Practical 3 - webgoat - https://www.youtube.com/watch?v=5ZDSPVp1TpM 209. Hack admin panel using Xpath injection - https://www.youtube.com/watch?v=vvlyYlXuVxI 210. XXE demo - https://www.youtube.com/watch?v=3B8QhyrEXlU 211. XXE demo 2 - https://www.youtube.com/watch?v=UQjxvEwyUUw 212. XXE demo 3 - https://www.youtube.com/watch?v=JI0daBHq6fA LDAP injection 213. Introduction and practical 1 - https://www.youtube.com/watch?v=-TXFlg7S9ks 214. Practical 2 - https://www.youtube.com/watch?v=wtahzm_R8e4 OS command injection 215. OS command injection in bWAPP - https://www.youtube.com/watch?v=qLIkGJrMY9k 216. bWAAP- OS command injection with Commiux (All levels) - https://www.youtube.com/watch?v=5-1QLbVa8YE Local file inclusion 217. Detailed introduction - https://www.youtube.com/watch?v=kcojXEwolIs 218. LFI demo 1 - https://www.youtube.com/watch?v=54hSHpVoz7A 219. LFI demo 2 - https://www.youtube.com/watch?v=qPq9hIVtitI Remote file inclusion 220. Detailed introduction - https://www.youtube.com/watch?v=MZjORTEwpaw 221. RFI demo 1 - https://www.youtube.com/watch?v=gWt9A6eOkq0 222. RFI introduction and demo 2 - https://www.youtube.com/watch?v=htTEfokaKsM HTTP splitting/smuggling 223. Detailed introduction - https://www.youtube.com/watch?v=bVaZWHrfiPw 224. Demo 1 - https://www.youtube.com/watch?v=mOf4H1aLiiE Phase 11 – Generating and testing error codes 225. Generating normal error codes by visiting files that may not exist on the server - for example visit chintan.php or chintan.aspx file on any website and it may redirect you to 404.php or 404.aspx or their customer error page. Check if an error page is generated by default web server or application framework or a custom page is displayed which does not display any sensitive information. 226. Use BurpSuite fuzzing techniques to generate stack trace error codes - https://www.youtube.com/watch?v=LDF6OkcvBzM Phase 12 – Weak cryptography testing 227. SSL/TLS weak configuration explained - https://www.youtube.com/watch?v=Rp3iZUvXWlM 228. Testing weak SSL/TLS ciphers - https://www.youtube.com/watch?v=slbwCMHqCkc 229. Test SSL/TLS security with Qualys guard - https://www.youtube.com/watch?v=Na8KxqmETnw 230. Sensitive information sent via unencrypted channels - https://www.youtube.com/watch?v=21_IYz4npRs Phase 12 – Business logic vulnerability 231. What is a business logic flaw - https://www.youtube.com/watch?v=ICbvQzva6lE&list=PLWoDr1kTbIxKZe_JeTDIcD2I7Uy1pLIFI 232. The Difficulties Finding Business Logic Vulnerabilities with Traditional Security Tools - https://www.youtube.com/watch?v=JTMg0bhkUbo&list=PLWoDr1kTbIxKZe_JeTDIcD2I7Uy1pLIFI&index=2 233. How To Identify Business Logic Flaws - https://www.youtube.com/watch?v=FJcgfLM4SAY&list=PLWoDr1kTbIxKZe_JeTDIcD2I7Uy1pLIFI&index=3 234. Business Logic Flaws: Attacker Mindset - https://www.youtube.com/watch?v=Svxh9KSTL3Y&list=PLWoDr1kTbIxKZe_JeTDIcD2I7Uy1pLIFI&index=4 235. Business Logic Flaws: Dos Attack On Resource - https://www.youtube.com/watch?v=4S6HWzhmXQk&list=PLWoDr1kTbIxKZe_JeTDIcD2I7Uy1pLIFI&index=5 236. Business Logic Flaws: Abuse Cases: Information Disclosure - https://www.youtube.com/watch?v=HrHdUEUwMHk&list=PLWoDr1kTbIxKZe_JeTDIcD2I7Uy1pLIFI&index=6 237. Business Logic Flaws: Abuse Cases: iPod Repairman Dupes Apple - https://www.youtube.com/watch?v=8yB_ApVsdhA&list=PLWoDr1kTbIxKZe_JeTDIcD2I7Uy1pLIFI&index=7 238. Business Logic Flaws: Abuse Cases: Online Auction - https://www.youtube.com/watch?v=oa_UICCqfbY&list=PLWoDr1kTbIxKZe_JeTDIcD2I7Uy1pLIFI&index=8 239. Business Logic Flaws: How To Navigate Code Using ShiftLeft Ocular - https://www.youtube.com/watch?v=hz7IZu6H6oE&list=PLWoDr1kTbIxKZe_JeTDIcD2I7Uy1pLIFI&index=9 240. Business Logic Security Checks: Data Privacy Compliance - https://www.youtube.com/watch?v=qX2fyniKUIQ&list=PLWoDr1kTbIxKZe_JeTDIcD2I7Uy1pLIFI&index=10 241. Business Logic Security Checks: Encryption Compliance - https://www.youtube.com/watch?v=V8zphJbltDY&list=PLWoDr1kTbIxKZe_JeTDIcD2I7Uy1pLIFI&index=11 242. Business Logic Security: Enforcement Checks - https://www.youtube.com/watch?v=5e7qgY_L3UQ&list=PLWoDr1kTbIxKZe_JeTDIcD2I7Uy1pLIFI&index=12 243. Business Logic Exploits: SQL Injection - https://www.youtube.com/watch?v=hcIysfhA9AA&list=PLWoDr1kTbIxKZe_JeTDIcD2I7Uy1pLIFI&index=13 244. Business Logic Exploits: Security Misconfiguration - https://www.youtube.com/watch?v=ppLBtCQcYRk&list=PLWoDr1kTbIxKZe_JeTDIcD2I7Uy1pLIFI&index=15 245. Business Logic Exploits: Data Leakage - https://www.youtube.com/watch?v=qe0bEvguvbs&list=PLWoDr1kTbIxKZe_JeTDIcD2I7Uy1pLIFI&index=16 246. Demo 1 - https://www.youtube.com/watch?v=yV7O-QRyOao 247. Demo 2 - https://www.youtube.com/watch?v=mzjTG7pKmQI 248. Demo 3 - https://www.youtube.com/watch?v=A8V_58QZPMs 249. Demo 4 - https://www.youtube.com/watch?v=1pvrEKAFJyk 250. Demo 5 - https://hackerone.com/reports/145745 251. Demo 6 - https://hackerone.com/reports/430854 Sursa: https://drive.google.com/file/d/11TajgAcem-XI5H8Pu8Aa2GiUofyM0oQm/view

Iti trebuie capital mare pentru bancile din ch. taxele de administrare sunt si alea mari. Dar o poti da bine prin insule si iti faci obiect de activitate exchange sau mai blana, protocol fees ca la astea nu iti cere nimeni explicatii. Am deviat. Zi faina!

Man, din ce ti-am dat in primul link, nu vad sa fie thumbnail in metadatele pozei. De unde ai scos asta ca thumbnaiulul e in meta? Din ce stiu eu, thumbnailurile se genereaza cand ai o pagina web, de ex cu o lista de poze, si ca sa nu il futi pe client side, in pagina web descarca thumburile si daca boul da click pe o poza atunci descarca si poza reala. In felul asta thumburile se genereaza on the fly. Ps: am cautat thumbnail in primul link si sunt ceva informatii. Pune-te pe documentat. Bafta!

Incearca la băncile din Elveția https://corporatefinanceinstitute.com/resources/careers/companies/banks-in-switzerland/

Daca chiar e asa cum zici si ai facut totul legal poti trimite un complaint si daca nu esti satisfacut deschizi caz apoi la Financial Ombudsman - https://www.financial-ombudsman.org.uk/ - care sunt independenti si adjudeca. In 2 privinte, in trecut, cu alt fel de firme care incercau sa ma ia de fraier, am primit drept de castig la ei + "despagubiri morale" si o dobanda modica pentru perioada cat mi-au fost retinute fondurile. E un fel de alternativa ieftina si convenabila decat mersu la judecata. Asta DACA e totul asa cum zici tu...

L-am pus aici ca in bookmarks nu prea le gasesc. Sursa: http://www.pentest.guru/index.php/2016/01/28/best-books-tutorials-and-courses-to-learn-about-exploit-development/ The best resources for learning exploit development Exploit development is considered to be the climax in the learning path of an ethical hacker or security professional. It is strongly advisable to have mastered the basics before delving into this topic. Exploit development is hard and it’s not something you learn at school or university (usually), not something any of your geek friends will talk about all day long. Only those who are brave to study hard can achieve the joy of controlling the EIP, popping a shell and taking control of a machine while the oblivious user yells at Microsoft for the nth crash of his beloved program. What are the prerequisites for learning about exploit development? Well, if you want to comprehend and hopefully start developing your own exploits you should have at least a basic knowledge of x86/64 bit system architecture (Windows, Linux or Mac according to your target), low level programming, possibly assembly, C/C++ or Python is fine as well for many tasks, then you should have in mind how the computer memory works (RAM), the concept of stack, heap, CPU registers, the most common operations, system calls, segmentation fault, buffer overflow, race condition and so on. You also should be familiar with disassemblers and a background in reverse engineering or malware analysis may be useful before starting to develop your own exploits. Let’s see some resources that can help you to be prepared before attempting the big jump onto the high level world of exploit development, the Olympus of the Godly Hackers. x86/64 bit system architecture: Introductory Intel x86: Architecture, Assembly, Applications, & Alliteration Introductory Intel x86-64: Architecture, Assembly, Applications, & Alliteration Intermediate Intel x86: Architecture, Assembly, Applications, & Alliteration Assembly language: http://www.drpaulcarter.com/pcasm/ Assembly Language Step-by-Step: Programming with Linux The Art of Assembly Language Windows Assembly Language Megaprimer Assembly Language Megaprimer for Linux C/C++: C Programming Absolute Beginner’s Guide The C Programming Language Introduction to Computer Science CS50x Programming: Principles and Practice Using C++ C++ Primer Accelerated C++: Practical Programming by Example Python: Python has a wonderful official documentation, apart from that you can use the following books/courses: Learn Python the hard way How to think like a computer scientist Learning Python Introduction to computer science and programming using Python MITx 6.00.1x When you feel comfortable with the prerequisites, then you can start learning exploit developmentfollowing these great resources! I compiled a list of books, tutorials, courses, tools and vulnerable applications that you can use for your study. BOOKS Hacking – The art of exploitation A bug Hunter’s Diary: A Guided Tour Through the Wilds of Software Security The Shellcoder’s Handbook: Discovering and Exploiting Security Holes Sockets, shellcode, Porting, and coding: reverse engineering Exploits and Tool coding for security professionals Writing Security tools and Exploits Buffer overflow attacks: Detect, exploit, Prevent Metasploit toolkit for Penetration Testing, exploit Development, and vulnerability research TUTORIALS Corelan.be https://www.corelan.be/index.php/2009/07/19/exploit-writing-tutorial-part-1-stack-based-overflows/ https://www.corelan.be/index.php/2009/07/23/writing-buffer-overflow-exploits-a-quick-and-basic-tutorial-part-2/ https://www.corelan.be/index.php/2009/07/25/writing-buffer-overflow-exploits-a-quick-and-basic-tutorial-part-3-seh/ https://www.corelan.be/index.php/2009/07/28/seh-based-exploit-writing-tutorial-continued-just-another-example-part-3b/ https://www.corelan.be/index.php/2009/08/12/exploit-writing-tutorials-part-4-from-exploit-to-metasploit-the-basics/ https://www.corelan.be/index.php/2009/09/05/exploit-writing-tutorial-part-5-how-debugger-modules-plugins-can-speed-up-basic-exploit-development/ https://www.corelan.be/index.php/2009/09/21/exploit-writing-tutorial-part-6-bypassing-stack-cookies-safeseh-hw-dep-and-aslr/ https://www.corelan.be/index.php/2009/11/06/exploit-writing-tutorial-part-7-unicode-from-0x00410041-to-calc/ https://www.corelan.be/index.php/2010/01/09/exploit-writing-tutorial-part-8-win32-egg-hunting/ https://www.corelan.be/index.php/2010/02/25/exploit-writing-tutorial-part-9-introduction-to-win32-shellcoding/ https://www.corelan.be/index.php/2010/06/16/exploit-writing-tutorial-part-10-chaining-dep-with-rop-the-rubikstm-cube/ https://www.corelan.be/index.php/2011/12/31/exploit-writing-tutorial-part-11-heap-spraying-demystified/ https://www.corelan.be/index.php/2010/01/26/starting-to-write-immunity-debugger-pycommands-my-cheatsheet/ https://www.corelan.be/index.php/2010/03/22/ken-ward-zipper-exploit-write-up-on-abysssec-com/ https://www.corelan.be/index.php/2010/03/27/exploiting-ken-ward-zipper-taking-advantage-of-payload-conversion/ https://www.corelan.be/index.php/2011/01/30/hack-notes-rop-retnoffset-and-impact-on-stack-setup/ https://www.corelan.be/index.php/2011/05/12/hack-notes-ropping-eggs-for-breakfast/ https://www.corelan.be/index.php/2011/07/03/universal-depaslr-bypass-with-msvcr71-dll-and-mona-py/ https://www.corelan.be/index.php/2011/11/18/wow64-egghunter/ https://www.corelan.be/index.php/2012/02/29/debugging-fun-putting-a-process-to-sleep/ https://www.corelan.be/index.php/2012/12/31/jingle-bofs-jingle-rops-sploiting-all-the-things-with-mona-v2/ https://www.corelan.be/index.php/2013/02/26/root-cause-analysis-memory-corruption-vulnerabilities/ https://www.corelan.be/index.php/2013/01/18/heap-layout-visualization-with-mona-py-and-windbg/ https://www.corelan.be/index.php/2013/02/19/deps-precise-heap-spray-on-firefox-and-ie10/ https://www.corelan.be/index.php/2013/07/02/root-cause-analysis-integer-overflows/ Opensecuritytraining.info http://opensecuritytraining.info/Exploits1.html http://opensecuritytraining.info/Exploits2.html Securitytube.net http://www.securitytube.net/groups?operation=view&groupId=7 exploit research megaprimer http://www.securitytube.net/groups?operation=view&groupId=4 buffer overflow exploitation for linux megaprimer http://www.securitytube.net/groups?operation=view&groupId=3 Format string vulnerabilities megaprimer Massimiliano Tomassoli’s blog http://expdev-kiuhnm.rhcloud.com/2015/05/11/contents/ Samsclass.info https://samsclass.info/127/127_F15.shtml Securitysift.com http://www.securitysift.com/windows-exploit-development-part-1-basics/ http://www.securitysift.com/windows-exploit-development-part-2-intro-stack-overflow/ http://www.securitysift.com/windows-exploit-development-part-3-changing-offsets-and-rebased-modules/ http://www.securitysift.com/windows-exploit-development-part-4-locating-shellcode-jumps/ http://www.securitysift.com/windows-exploit-development-part-5-locating-shellcode-egghunting http://www.securitysift.com/windows-exploit-development-part-6-seh-exploits http://www.securitysift.com/windows-exploit-development-part-7-unicode-buffer-overflows Justbeck.com http://www.justbeck.com/getting-started-in-exploit-development/ 0xdabbad00.com http://0xdabbad00.com/2012/12/09/hurdles-for-a-beginner-to-exploit-a-simple-vulnerability-on-modern-windows/ fuzzysecurity.com Part 1: Introduction to Exploit Development Part 2: Saved Return Pointer Overflows Part 3: Structured Exception Handler (SEH) Part 4: Egg Hunters Part 5: Unicode 0x00410041 Part 6: Writing W32 shellcode Part 7: Return Oriented Programming Part 8: Spraying the Heap [Chapter 1: Vanilla EIP] Part 9: Spraying the Heap [Chapter 2: Use-After-Free] sploitfun.wordpress.com https://sploitfun.wordpress.com/2015/06/26/linux-x86-exploit-development-tutorial-series/ sneakerhax.com http://sneakerhax.com/jumping-into-exploit-development/ community.rapid7.com https://community.rapid7.com/community/metasploit/blog/2012/07/05/part-1-metasploit-module-development–the-series resources.infosecinstitute.com http://resources.infosecinstitute.com/debugging-fundamentals-for-exploit-development/ rafayhackingarticles.net http://www.rafayhackingarticles.net/2011/07/from-minor-bug-to-zero-day-exploit.html Smashing the stack for fun and for profit: revived Automating format string exploits IT-Sec catalog 2.0 (Exploit development) by Arthur Gerkis NCCGroup.trust https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2016/june/writing-exploits-for-win32-systems-from-scratch/ Desc0n0cid0.blogspot.it https://desc0n0cid0.blogspot.it/2016/09/stack-based-buffer-overflow.html https://desc0n0cid0.blogspot.it/2016/09/stack-based-buffer-overflow_28.html https://desc0n0cid0.blogspot.it/2016/09/stack-based-buffer-overflow_29.html https://desc0n0cid0.blogspot.it/2016/10/part-4-stack-based-buffer-overflow.html Stack Based Overflow Articles. Win32 Buffer Overflows (Location, Exploitation and Prevention) – by Dark spyrit [1999] Writing Stack Based Overflows on Windows – by Nish Bhalla’s [2005] Heap Based Overflow Articles. Third Generation Exploitation smashing heap on 2k – by Halvar Flake [2002] Exploiting the MSRPC Heap Overflow Part 1 – by Dave Aitel (MS03-026) [September 2003] Exploiting the MSRPC Heap Overflow Part 2 – by Dave Aitel (MS03-026) [September 2003] Windows heap overflow penetration in black hat – by David Litchfield [2004] Kernel Based Exploit Development Articles. How to attack kernel based vulns on windows was done – by a Polish group called “sec-labs” [2003] Sec-lab old whitepaper Sec-lab old exploit Windows Local Kernel Exploitation (based on sec-lab research) – by S.K Chong [2004] How to exploit Windows kernel memory pool – by SoBeIt [2005] Exploiting remote kernel overflows in windows – by Eeye Security Kernel-mode Payloads on Windows in uninformed – by Matt Miller Exploiting 802.11 Wireless Driver Vulnerabilities on Windows BH US 2007 Attacking the Windows Kernel Remote and Local Exploitation of Network Drivers Exploiting Comon Flaws In Drivers I2OMGMT Driver Impersonation Attack Real World Kernel Pool Exploitation Exploit for windows 2k3 and 2k8 Alyzing local privilege escalations in win32k Intro to Windows Kernel Security Development There’s a party at ring0 and you’re invited Windows kernel vulnerability exploitation Windows memory protections Introduction Articles. Data Execution Prevention /GS (Buffer Security Check) /SAFESEH ASLR SEHOP Windows memory protections Bypass Methods Articles. Third Generation Exploitation smashing heap on 2k – by Halvar Flake [2002] Creating Arbitrary Shellcode In Unicode Expanded Strings – by Chris Anley Advanced windows exploitation – by Dave Aitel [2003] Defeating the Stack Based Buffer Overflow Prevention Mechanism of Microsoft Windows 2003 Server – by David Litchfield Reliable heap exploits and after that Windows Heap Exploitation (Win2KSP0 through WinXPSP2) – by Matt Conover in cansecwest 2004 Safely Searching Process Virtual Address Space – by Matt Miller [2004] IE exploit and used a technology called Heap Spray Bypassing hardware-enforced DEP – by Skape (Matt Miller) and Skywing (Ken Johnson) [October 2005] Exploiting Freelist[0] On XP Service Pack 2 – by Brett Moore [2005] Kernel-mode Payloads on Windows in uninformed Exploiting 802.11 Wireless Driver Vulnerabilities on Windows Exploiting Comon Flaws In Drivers Heap Feng Shui in JavaScript by Alexander sotirov [2007] Understanding and bypassing Windows Heap Protection – by Nicolas Waisman [2007] Heaps About Heaps – by Brett moore [2008] Bypassing browser memory protections in Windows Vista – by Mark Dowd and Alex Sotirov [2008] Attacking the Vista Heap – by ben hawkes [2008] Return oriented programming Exploitation without Code Injection – by Hovav Shacham (and others ) [2008] Token Kidnapping and a super reliable exploit for windows 2k3 and 2k8 – by Cesar Cerrudo [2008] Defeating DEP Immunity Way – by Pablo Sole [2008] Practical Windows XP2003 Heap Exploitation – by John McDonald and Chris Valasek [2009] Bypassing SEHOP – by Stefan Le Berre Damien Cauquil [2009] Interpreter Exploitation : Pointer Inference and JIT Spraying – by Dionysus Blazakis[2010] Write-up of Pwn2Own 2010 – by Peter Vreugdenhil All in one 0day presented in rootedCON – by Ruben Santamarta [2010] DEP/ASLR bypass using 3rd party – by Shahin Ramezany [2013] Typical windows exploits Real-world HW-DEP bypass Exploit – by Devcode Bypassing DEP by returning into HeapCreate – by Toto First public ASLR bypass exploit by using partial overwrite – by Skape Heap spray and bypassing DEP – by Skylined First public exploit that used ROP for bypassing DEP in adobe lib TIFF vulnerability Exploit codes of bypassing browsers memory protections PoC’s on Tokken TokenKidnapping . PoC for 2k3 -part 1 – by Cesar Cerrudo PoC’s on Tokken TokenKidnapping . PoC for 2k8 -part 2 – by Cesar Cerrudo An exploit works from win 3.1 to win 7 – by Tavis Ormandy KiTra0d Old ms08-067 metasploit module multi-target and DEP bypass PHP 6.0 Dev str_transliterate() Buffer overflow – NX + ASLR Bypass SMBv2 Exploit – by Stephen Fewer TRAININGS Opensecuritytraining.info http://opensecuritytraining.info/Exploits1.html http://opensecuritytraining.info/Exploits2.html Module 12 of Advanced penetration testing cource on Cybrary.it https://www.cybrary.it/course/advanced-penetration-testing/ Securitytube.net http://www.securitytube.net/groups?operation=view&groupId=7 research megaprimer http://www.securitytube.net/groups?operation=view&groupId=4 exploitation for linux megaprimer http://www.securitytube.net/groups?operation=view&groupId=3 Format string vulnerabilities megaprimer infiniteskills.com http://www.infiniteskills.com/training/reverse-engineering-and-exploit-development.html COURSES Corelan https://www.corelan-training.com Offensive Security https://www.offensive-security.com/information-security-training/advanced-windows-exploitation/ AWE (Advanced Windows Exploitation) SANS https://www.sans.org/course/advance-exploit-development-pentetration-testers SANS SEC760: Advanced Exploit Development for Penetration Testers Ptrace Security http://www.ptrace-security.com/training/courses/advanced-software-exploitation/ Advanced Software Exploitation Udemy https://www.udemy.com/windows-exploit-development-megaprimer/learn/#/Windows exploit Development Megaprimer by Ajin Abraham VIDEOS LiveOverflow Youtube channel TOOLS IDA Pro – Windows disassembler and debugger, with a free evaluation version. OllyDbg – An assembly-level debugger for Windows executables. WinDbg – Windows debugger Mona.py – Immunity debugger helper angr – Platform-agnostic binary analysis framework developed at UCSB’s Seclab. BARF – Multiplatform, open source Binary Analysis and Reverse engineering Framework. binnavi – Binary analysis IDE for reverse engineering based on graph visualization. Bokken – GUI for Pyew and Radare. Capstone – Disassembly framework for binary analysis and reversing, with support for many architectures and bindings in several languages. codebro – Web based code browser using clang to provide basic code analysis. dnSpy – .NET assembly editor, decompiler and debugger. Evan’s Debugger (EDB) – A modular debugger with a Qt GUI. GDB – The GNU debugger. GEF – GDB Enhanced Features, for exploiters and reverse engineers. hackers-grep – A utility to search for strings in PE executables including imports, exports, and debug symbols. Immunity Debugger – Debugger for malware analysis and more, with a Python API. ltrace – Dynamic analysis for Linux executables. objdump – Part of GNU binutils, for static analysis of Linux binaries. PANDA – Platform for Architecture-Neutral Dynamic Analysis PEDA – Python Exploit Development Assistance for GDB, an enhanced display with added commands. pestudio – Perform static analysis of Windows executables. Process Monitor – Advanced monitoring tool for Windows programs. Pyew – Python tool for malware analysis. Radare2 – Reverse engineering framework, with debugger support. SMRT – Sublime Malware Research Tool, a plugin for Sublime 3 to aid with malware analyis. strace – Dynamic analysis for Linux executables. Udis86 – Disassembler library and tool for x86 and x86_64. Vivisect – Python tool for malware analysis. X64dbg – An open-source x64/x32 debugger for windows. afl – American Fuzzy Lop fuzzer gef – enhanced gdb debugger honggfuzz – general purpose fuzzer libheap – python gdb library for examining glibc heap (ptmalloc) pwndbg – enhanced gdb framework for exploit development pwntools – exploit development and CTF toolkit qira – parallel, timeless debugger ropper – rop gadget finder rp++ – rop gadget finder xrop – rop gadget finder shellnoob – shellcode writing helper shellsploit – exploit development toolkitSploitKit – a suite of cli tools to automate the tedious parts of exploit development ROP Injector – rop injector HEAP EXPLOITATION TECHNIQUES https://github.com/shellphish/how2heap VULNERABLE APPLICATIONS Exploit-exercises.com https://exploit-exercises.com/protostar/ Protostar https://exploit-exercises.com/fusion/ Fusion StackSmash – A collection of toy programs for teaching buffer overflow vulnerabilities CTF-Workshop – challenges for binary exploitation workshop28 hacking sites to practise your skills in a legal wayhttps://www.peerlyst.com/blog-post/practise-your-infosec-skill-on-these-legal-28-hacking-sites EXPLOITS DATABASE https://www.exploit-db.com https://www.milw00rm.com http://0day.today https://packetstormsecurity.com http://www.securityfocus.com http://www.windowsexploits.com http://iedb.ir http://www.macexploit.com COLLABORATE! Do you have other fantastic resources to share that could be part of this list? Then check out my projecton Github and send me a pull request!

@CD-RAY Din curiozitate, de ce pui 3 virgule la inceputul orcarui post? 😀 E un fel de semnatura? Sau le dai cititorilor sa le puna unde vor ei? 😅