Jump to content

SirGod

Moderators
  • Content Count

    730
  • Joined

  • Last visited

  • Days Won

    12

Everything posted by SirGod

  1. Daca vrei sa inveti SMTP: https://tools.ietf.org/html/rfc5321 Daca vrei sa "aduni SMTP": https://www.shodan.io/ Daca vrei sa faci spam, mai gandeste-te: https://rstforums.com/forum/topic/100304-regulamentul-forumului/ https://www.legi-internet.ro/articole-drept-it/spamul-aspecte-legislative-si-jurisprudentiale.html https://www.dataprotection.ro/
  2. In anul 2019 si voi tot dupa nologine si root-uri.
  3. A făcut fix ce ți-a zis @Nytro mai sus. A pus console.log, document.write sau orice altceva în loc de eval. In felul asta, îți afișează codul în loc sa îl execute. Asta e doar primul pas. Ce poți faci mai departe e sa înlocuiești toate string-urile de forma '\x20\x22...' Sunt reprezentate în hex după cum notația cu \x le dă de gol. Poți face asta simplu cu un hex decoder sau automatizezi puțin cu un regex și faci replace în masă în tot fișierul. Apoi urmează partea grea. Urmărești codul și încerci sa înțelegi ce face. Când crezi ca ai înțeles ce face o variabila sau o funcție pune-i și un nume. Urmărește ce face codul dintr-un debugger (DevTools din Chrome e suficient), într-o sesiune curata de browser (e.g. incognito) și trece-l și prin Burp sau alt proxy local cum ți s-a zis mai sus. Pana ii dai de cap vezi dacă face ceva request-uri, dacă scrie ceva (fie elemente în DOM, fie valori în cookies, localstorage, sessionstorage etc.). E mult cod, mult de munca. Dacă timpul pe care îl petreci > valoarea pe care o aduce... Pierzi timpul. Dar măcar e educativ. Dacă ai nevoie de ajutor la chestii punctuale te ajut eu.
  4. Fa-ti forum de barbati adevarati si ragaie acolo.
  5. SirGod

    Facultate IT ID

    La Universitatea din București există informatica la ID. http://fmi.unibuc.ro/ro/idd/
  6. SirGod

    ..

    Când e vorba de prosteala, va adunați cu toții.
  7. Hai sa nu ne batem joc de comunitatea asta.
  8. Update: cautam si oameni cu experienta, nu doar junior.
  9. Deja doua bug-uri penibile, cam mare coincidenta ca să fie doar bug-uri. Poate asta e noua versiune de backdoor. Simplu, la vedere, "din greșeala". /teoriaconspiratiei
  10. Posturi insuficiente pentru Market. Categorie gresita. Gunoi.
  11. Posturi insuficiente pentru Market. Categorie gresita. Gunoi.
  12. Categorie gresita. Posturi insuficiente pentru market. Gunoi.
  13. Despre HTTPS si headere. Mai exact: HTTP Public Key Pinning HTTP Strict Transport Security Certificate Transparency Expect-CT OCSP Stapling Must-Staple Expect-Staple Certificate Authority Authorization Content Security Policy Secure Cookie Directive Link: https://depthsecurity.com/blog/pins-and-staples-enhanced-ssl-security
  14. Summary: In response to issues identified by external researchers, Intel has performed an in-depth comprehensive security review of our Intel® Management Engine (ME), Intel® Server Platform Services (SPS), and Intel® Trusted Execution Engine (TXE) with the objective of enhancing firmware resilience. As a result, Intel has identified security vulnerabilities that could potentially place impacted platforms at risk. Description: In response to issues identified by external researchers, Intel has performed an in-depth comprehensive security review of its Intel® Management Engine (ME), Intel® Trusted Execution Engine (TXE), and Intel® Server Platform Services (SPS) with the objective of enhancing firmware resilience. As a result, Intel has identified several security vulnerabilities that could potentially place impacted platforms at risk. Systems using ME Firmware versions 11.0/11.5/11.6/11.7/11.10/11.20, SPS Firmware version 4.0, and TXE version 3.0 are impacted. Affected products: 6th, 7th & 8th Generation Intel® Core™ Processor Family Intel® Xeon® Processor E3-1200 v5 & v6 Product Family Intel® Xeon® Processor Scalable Family Intel® Xeon® Processor W Family Intel® Atom® C3000 Processor Family Apollo Lake Intel® Atom Processor E3900 series Apollo Lake Intel® Pentium™ Celeron™ N and J series Processors Based on the items identified through the comprehensive security review, an attacker could gain unauthorized access to platform, Intel® ME feature, and 3rd party secrets protected by the Intel® Management Engine (ME), Intel® Server Platform Service (SPS), or Intel® Trusted Execution Engine (TXE). This includes scenarios where a successful attacker could: Impersonate the ME/SPS/TXE, thereby impacting local security feature attestation validity. Load and execute arbitrary code outside the visibility of the user and operating system. Cause a system crash or system instability. For more information, please see this Intel Support article Link Advisory: https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086&languageid=en-fr
  15. During a black-box penetration test we encountered a Java web application which presented us with a login screen. Even though we managed to bypass the authentication mechanism, there was not much we could do. The attack surface was still pretty small, there were only a few things we could tamper with. 1. Identifying the entry point In the login page I noticed a hidden POST parameter that was being sent for every login request: <input type="hidden" name="com.ibm.faces.PARAM" value="rO0..." /> The famous Base64 rO0 (ac ed in HEX) confirmed us that we were dealing with a Base64 encoded Java serialized object. The Java object was actually an unencrypted JSF ViewState. Since deserialization vulnerabilities are notorious for their trickiness, I started messing with it. Full Article: https://securitycafe.ro/2017/11/03/tricking-java-serialization-for-a-treat/
  16. Sfat pentru Veracrypt. Sa faci și un recovery USB. Eu am reușit o data cumva sa corupt ceva partiție/sector și n-am avut ce sa ii mai fac. Full disk wipe.
  17. O lista cu câteva zeci de metode de bypass pentru AppLocker. Se actualizează constant. Link: https://github.com/api0cradle/UltimateAppLockerByPassList
  18. O sa fie inlocuit cu Expect-CT. https://scotthelme.co.uk/a-new-security-header-expect-ct/ https://www.certificate-transparency.org/what-is-ct
  19. Se pare ca HPKP o sa dispara din Chrome. Link: https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/he9tr7p3rZ8
  20. Numai posturi cu joburi dubioase și spam prin e-mail și sms. Nu e bine. Ban.
  21. The vulnerability It is a known issue that Microsoft NTLM architecture has some failures, hash stealing is not something new, it is one of the first things a pentester tries when attacking a Microsoft environment. But, most of these techniques require user intervention or traffic interception to fulfill the attack. These new attacks require no user interaction, everything is done from the attacker’s side, but of course, there are some conditions that need to be met to be successful with this attack. Link articol: http://www.sysadminjd.com/adv170014-ntlm-sso-exploitation-guide/
  22. Oferă mai multe detalii sau ajunge la gunoi.
  23. Salut, Cautam un Junior Penetration Tester/Ethical Hacker pentru a se alatura echipei noastre in Bucuresti. Daca vreti sa lucrati in echipa cu 3 membri RST ( @TheTime, @dancezar si eu), trimiteti-mi CV-ul prin PM. Pentru alte detalii (non-confidentiale) astept PM. Un profil oficial (general) al job-ului ar fi urmatorul: Job Brief We are looking for a Junior Penetration Tester to join our Penetration Testing team and work in our Lab in Bucharest. Responsibilities • Identify security vulnerabilities in web applications (e.g. Internet Banking web applications, e-commerce websites, web portals) • Conduct internal network penetration testing - simulate a malicious individual (e.g. guest, temporary personnel) who already has access to our client's internal network of our client. Starting only from a simple network port access, you should gain access to sensitive information from the client's internal network, gain Domain Admin access or reach other flags • Perform mobile application penetration tests on Android, iOS, or Windows applications • Exploit the identified vulnerabilities and identify specific, meaningful risk to clients based on industry and business focus • Write comprehensive reports including assessment-based findings, outcomes and recommendations for further security enhancement Requirements • Experience in identifying and reporting security vulnerabilities • Familiarity with web related technologies (Web applications, Web Services) and of network/web related protocols • Detailed technical knowledge of at least one of: software security, operating systems security, network security • Understanding of the latest security principles, techniques and protocols • Should have excellent English written and verbal skills • Bachelor’s degree in Computer Science or related field • Problem solving skills and ability to work under pressure • Should be able to work individually or as member of a team Benefits • Attractive salary package, including meal tickets and health insurance • Work with like-minded, driven and smart team members • Encouraged to perform research and participate at security conferences • Work flexibility • Private, dedicated workspace for security related projects
  24. 2017-10-10 10:42:21,086 fail2ban.actions: WARNING [ssh] Ban meteor
×
×
  • Create New...