bypass restricted command prompt for none-privileged users

intro The Windows Command Prompt (sometimes called the DOS prompt) is a tool that allows administrators to invoke system-wide commands to make administration easier and more efficient. The average user has little use for this tool. many administration prevents users to have a command prompt enabled for their access, as too is considered good practice … Read more

Web attacks payloads collections

a collection of commonly used payloads needed for web application testing (fuzzing), the payloads have been collected from different resources and will be updated frequently. if you wanna contribute by sharing your own payloads don’t hesitate to join our channel on telegram intruder payloads XSS payloads https://0xsp.com/storageCenter/1589118426.txt XXE Payloads https://0xsp.com/storageCenter/1589118968.txt Command injection payloads windows https://0xsp.com/storageCenter/1589119529.txt … Read more

Bypass Symantec Email Security.cloud

During attack Simulation, you may face Symantec Email Security Cloud (Message Lab ) while conducting a phishing campaign. Message Lab stops known and unknown techniques while delivering malicious email content. The Email Security.cloud service helps organizations combat these threats through advanced perimeter defenses and our proprietary SkepticTM technologies. Operating at the Internet level with automatic … Read more

offensive cheatsheet

Gathering information Stage port scanning Nmap Network exploration tool and security/ port scanner nmap [Scan Type] [Options] {target specification} HOST DISCOVERY: -sL: List Scan – simply list targets to scan -sn/-sP: Ping Scan – disable port scan -Pn: Treat all hosts as online — skip host discovery SCAN TECHNIQUES: -sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans -sU: UDP … Read more

Smuggling via Windows services display name – Lateral movement

Introduction During red teaming operation, Lateral movement or known as an east-west movement refers to the technique to move deeper into a network. Such an attack allows a threat actor to avoid detection and retain persistent access. This newly published research explains how to take advantage of windows services, it details how to mimic windows … Read more

Local administrator is not just with Razer.. it is possible for ALL

There is more? Recently a Security researcher @jonhat discovered a zero-day vulnerability in the plug-and-play Razer Synapse installation that allows users to gain SYSTEM privileges on a Windows device quickly. by plugging the Razer mouse into the system, windows 10 will download the suitable software and start the process of driver installation. Since the process … Read more