When identifying XSS (Cross-site Scripting) within a target application, I often choose to go beyond a proof-of-concept exploit such as popping an alert box. I find that the best payloads are those which exploit functionality within the application which require authentication, such as adding a new user when logged in as an administrator. Other useful…
Categories
n00py Blog
- Protected: The Dangers of Endpoint Discovery in VIPRE Endpoint Security
- Dumping LAPS Passwords from Linux
- Alternative ways to Pass the Hash (PtH)
- Password Spraying Secure Logon for F5 Networks
- Extracting files from Burp Intruder Output
- Exploiting LDAP Server NULL Bind
- Managing Active Directory groups from Linux
- Zero day vulnerabilities in Determine Selectica Contract Lifecycle Management (SCLM) v5.4
- Password Spraying Dell SonicWALL Virtual Office
- Introducing Slackor, a Remote Access Tool Using Slack as a C2 Channel
Archives