Hacking Theory & Tips @HackingTheory

it's good to know the theory Joined July 2020

Tweets

21
Followers

204
Following

1
Likes

1

Hacking Theory & Tips @HackingTheory

4 years ago

If the Secure File Privilege is enabled and restricting the use of "INTO OUTFILE" for the creation of a malicious web-shell, in some cases, you can update the GENERAL_LOG & GENERAL_LOG_FILE variables from within the MySQL console to reach RCE. Highlighted by @_nt_tnt.

0 7 19 0 2

Download Image

Hacking Theory & Tips @HackingTheory

5 years ago

Extremely short always true SQL payload, down to 5 bytes by @SecGus '|0;#

2 45 145 0 45

Download Image

Hacking Theory & Tips @HackingTheory

5 years ago

Command execution WAFs are usually much easier to bypass if you make your goal to write to a file and run the file, instead of running the commands directly. This can be achieved by decoding base64 into a file, or even downloading the file with a tool such as wget or curl.

0 0 2 0 1

Hacking Theory & Tips @HackingTheory

5 years ago

Good to learn one liner for a fully tty shell prompt: python -c 'import pty; pty.spawn("/bin/bash");' Alternatively: /bin/bash -i

0 0 1 0 0

Hacking Theory & Tips @HackingTheory

5 years ago

The Vary header is used to tell any HTTP cache which parts of the request (other than the path and the host header) to make note of when looking for the correct object. It can disclose non-default headers that work on the application to an attacker, I.E. X-HTTP-Method-Override

0 0 1 0 0

Hacking Theory & Tips @HackingTheory

5 years ago

HttpOnly cookie attribute ensures the cookie with said attribute is only shared with the server. This means it cannot be accessed by any client side software, such as in-browser JavaScript execution. This can combat attacks such as session stealing via XSS.