Porch-Pirate - The Most Comprehensive Postman Recon / OSINT Client And Framework That Facilitates The Automated Discovery And Exploitation Of API Endpoints And Secrets Committed To Workspaces, Collections, Requests, Users And Teams

Porch Pirate started as a tool to quickly uncover Postman secrets, and has slowly begun to evolve into a multi-purpose reconaissance / OSINT framework for Postman. While existing tools are great proof of concepts, they only attempt to identify very specific keywords as "secrets", and in very...

Design/Logic Flaw

reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities. A vulnerability has been identified in reconftw where inadequate validation of retrieved subdomains may lead to a Remote Code Execution R...

Smoke Loader Botnet Drops Location Tracker Whiffy Recon Malware

By Deeba Ahmed The new Whiffy Recon Malware was identified by cybersecurity researchers at Secureworks. This is a post from HackRead.com Read the original post: Smoke Loader Botnet Drops Location Tracker Whiffy Recon Malware...

CVE-2022-2416

CVE-2022-2416 affects Octopus Deploy. A low-privileged guest can craft a request that allows enumeration of an environment, per the CVE descriptions across NVD/Red Hat/other sources. The connected documents confirm the existence of the vulnerability and its basic impact (environment enumeration) ...

CVE-2022-2416

In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows enumeration/recon of an environment...

ReconAIzer - A Burp Suite Extension To Add OpenAI (GPT) On Burp And Help You With Your Bug Bounty Recon To Discover Endpoints, Params, URLs, Subdomains And More!

ReconAIzer is a powerful Jython extension for Burp Suite that leverages OpenAI to help bug bounty hunters optimize their recon process. This extension automates various tasks, making it easier and faster for security researchers to identify and exploit vulnerabilities. Once installed, ReconAIzer...

HardHatC2 - A C# Command And Control Framework

A cross-platform, collaborative, Command & Control framework written in C, designed for red teaming and ease of use. HardHat is a multiplayer C .NET-based command and control framework. Designed to aid in red team engagements and penetration testing. HardHat aims to improve the quality of life...

CVE-2023-21768

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability...

Analyzing attacks using the Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082

October 1, 2022 update – Added information about Exploit:Script/ExchgProxyRequest.A, Microsoft Defender AV’s robust detection for exploit behavior related to this threat. We also removed a section on MFA as a mitigation, which was included in a prior version of this blog as standard guidance...

SDomDiscover - A Easy-To-Use Python Tool To Perform DNS Recon

/ // \ / \ \ / / / / / / / / / / / / \ | / / / / / / // / // / / / / / / // / // // / |/ / / / ///// // ///////|/// A easy-to-use python tool to perform dns recon with multiple options Installation: It can be installed in any OS with python3 Manual installation git clone...

Cloud OSINT. Finding Interesting Resources

Locating sensitive information, personally identifiable information PII and questionable assets in the cloud. TL; DR I had a curiosity driven excursion into the public clouds of AWS and Azure to find what is publicly hosted and who by. As anticipated, the results were extremely broad and...

Jeeves - Time-Based Blind SQLInjection Finder

Jeeves is made for looking to Time-Based Blind SQLInjection through recon. - Installation & Requirements: Installing Jeeves  $ go install github.com/ferreiraklet/Jeeves@latest OR $ git clone https://github.com/ferreiraklet/Jeeves.git $ cd Jeeves $ go build jeeves.go $ chmod +x jeeves $ ./jeeves...

Your cloud? My cloud now

A true story on taking over a client’s Azure tenant via a successful phish. TL;DR A tempting phish got lots of users to disclose their passwords, and a lack of training resulted in the victims accepting the Microsoft push-based multi-factor authentication. This resulted in gaining access to Slack...

What the Rise in Cyber-Recon Means for Your Security Strategy

As we move into 2022, bad actors are ramping up their reconnaissance efforts to ensure more successful and more impactful cyberattacks. And that means more zero-day exploits are on the horizon. When seen through an attack chain such as the MITRE ATT&CK framework, campaigns are frequently discusse...

GHSA-GC37-9G7F-96FX Apache Ozone exposes OM, SCM and Datanode metadata

In Apache Ozone before 1.2.0, Recon HTTP endpoints provide access to OM, SCM and Datanode metadata. Due to a bug, any unauthenticated user can access the data from these endpoints...

org.apache.hadoop:hadoop-ozone-dist (0.4.1-alpha), org.apache.hadoop:hadoop-ozone-integration-test (0.4.1-alpha) +2 more potentially affected by CVE-2021-39236 via org.apache.hadoop:hadoop-ozone-ozone-manager (0.4.1-alpha)

org.apache.hadoop:hadoop-ozone-ozone-manager MAVEN version 0.4.1-alpha is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hadoop:hadoop-ozone-ozone-manager and may be impacted: - org.apache.hadoop:hadoop-ozone-dist 0.4.1-alpha -...

org.apache.hadoop:hadoop-ozone-insight (0.5.0-beta), org.apache.hadoop:hadoop-ozone-integration-test (0.5.0-beta) +2 more potentially affected by CVE-2021-39236 via org.apache.hadoop:hadoop-ozone-ozone-manager (0.5.0-beta)

org.apache.hadoop:hadoop-ozone-ozone-manager MAVEN version 0.5.0-beta is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hadoop:hadoop-ozone-ozone-manager and may be impacted: - org.apache.hadoop:hadoop-ozone-insight 0.5.0-beta -...

org.apache.hadoop:hadoop-ozone-insight (>=1.0.0, <=1.1.0), org.apache.hadoop:hadoop-ozone-integration-test (>=1.0.0, <=1.1.0) +2 more potentially affected by CVE-2021-39236 via org.apache.hadoop:hadoop-ozone-ozone-manager (>=1.0.0, <=1.1.0)

org.apache.hadoop:hadoop-ozone-ozone-manager MAVEN version =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.1.0 Source cves: CVE-2021-39236 Source advisory: OSV:GHSA-5993-WWPG-M92C...

Information Disclosure

hadoop-ozone-recon is vulnerable to information disclosure. The vulnerability exists because Recon NSSummaryEndpoint and ContainerEndpoint are not restricted only for admin which allows an attacker to access data from the end points...

Registry-Recon - Cobalt Strike Aggressor Script That Performs System/AV/EDR Recon

Cobalt Strike Aggressor Script that Performs System/AV/EDR Recon. Author: Jess Hires Description As a red-team practitioner, we are often using tools that attempt to fingerprint details about a compromised system, preferably in the most stealthy way possible. Some of our usual tooling for this...