The key lines are as follows: This is the same as -k with curl and –no-check-certificate for wget.
Continue ReadingWindows Pentesting Tools / Exploit Repositories
Mimikatz BloodHound Empire Nishang Responder CrackMapExec PSExec WindowsEnum Gdog Windows-Kernel-Exploits
Continue ReadingWindows Run-As Reverse Shell
You got user credentials, they might even be admin, what next? Shell of course, here is how to run as…
Continue ReadingTop 3 Hacking Tips
You may notice that the following tips are non-technical, that’s because I honestly believe my best hacking tips are not…
Continue ReadingWindows API Calls for Process Injection / Manipulation / Migration
Essential Win API Functions OpenProcess() for opening the remote process VirtualAllocEx() for allocating memory in remote process WriteProcessMemory() for writing shellcode in…
Continue ReadingRegistry Passwords – Windows Post Exploitation
What is The Windows Registry? The Windows Registry is a hierarchical database that stores low-level settings for the Microsoft Windows…
Continue ReadingDiggin’ for Gold – Windows Post Exploitation
We have all been there, you see a post or a script that says grep for this or search for…
Continue ReadingWindows Messages, Message Queues & The Infamous Win32 Shatter Attack
Unlike MS-DOS-based applications, Windows-based applications are event-driven. They do not make explicit function calls (such as C run-time library calls)…
Continue ReadingExploit access() with Symlinks
About access() The access() system call checks the accessibility of the file specified in pathname based on a process’s real…
Continue ReadingModsploit
I have forked an old Modbus testing framework that I will be adding to, keep checking back for updates. What…
Continue ReadingPentesting ICS (Profinet)
What is Profinet? Testing Profinet Use profinet_scanner.py to detect devices on a network! SCADA-safe scanner: https://www.rapid7.com/db/modules/auxiliary/scanner/scada/profinet_siemens Once the devices are identiied, MiTM, packet…
Continue ReadingPentesting ICS (DNP3)
What is DNP3? DNP3 Simulators C++: https://github.com/automatak/dnp3 Docs: https://www.automatak.com/opendnp3/docs/guide/current/build/cmake/ Use –recursive when cloning: Qt4: https://sourceforge.net/projects/dnp/ DNP3 Identification: Shodanhq dork: port:20000 Using nmap with script dnp3-info.nse: https://github.com/sjhilt/Nmap-NSEs/blob/master/dnp3-info.nse When you identified the…
Continue ReadingPentesting ICS (S7comm)
What is S7comm? Siemens S7 PLC simulator If you wanna play around, you can install an S7 simulator written on…
Continue ReadingPentesting ICS (BACnet)
What is BACnet Simulators http://bacnet.sourceforge.net/ -> http://bacnet4linux.sourceforge.net/ Download -> UnTar then $ make clean all $ sudo ./bacnet4linux -D4 -m2 -p5555 -v5556…
Continue ReadingMySql User-Defined Function (UDF) Privilege Escalation (Windows & Linux)
We will get in to making our own functions in later posts but for now the UDF compiled shared objects…
Continue Reading