#enumeration — Public Fediverse posts

Wer mit Java arbeitet, trifft früher oder später auf sogenannte Enums. Für Einsteiger wirken sie anfangs vielleicht etwas seltsam – man könnte ja auch einfach Konstanten mit public static final definieren. Doch Enums bieten viel mehr: sie sind typsicher, leicht erweiterbar und lassen sich herv

https://magicmarcy.de/enums-enumset-enummap-in-java

#enum #enummap #java #konstanten #enumeration

Threat Actors Leverage AI-Generated Scripts to Accelerate Active Directory Attacks

Cyber attackers are now using AI-generated scripts to supercharge their Active Directory attacks, allowing them to quickly map and exploit sensitive domains, users, and computers. This alarming trend was uncovered by Huntress researchers, who analyzed a sophisticated PowerShell script that bore…

https://osintsights.com/threat-actors-leverage-ai-generated-scripts-to-accelerate-active-directory-attac?utm_source=mastodon&utm_medium=social

#ActiveDirectoryAttacks #AigeneratedScripts #PowershellScript #Enumeration #ThreatActors

Recently, I wrote a write-up for the vulnerable machine from #VulNyx called Controler. It’s a medium-level #Windows machine. #Enumeration begins with the Kerberos account, which I use to gain initial system access. Through further Active Directory enumeration, I #exploit replication rights, ultimately extracting the Domain Administrator’s password hash and gaining full administrative control.

Solving this machine took me some time, but I learned a lot. I touched on new tools like #BloodHound, delved a bit deeper into Active Directory, and, in general, kept my #pentesting skills in check.

If you are starting in #cybersecurity, I would definitely recommend checking some VMs from VulNyx.

https://medium.com/@thecybercraft/vulnyx-controler-writeup-b9ada8e12fdd

Vulnerability Allowed Scraping of 3.5 Billion WhatsApp Accounts https://www.securityweek.com/vulnerability-allowed-scraping-of-3-5-billion-whatsapp-accounts/ #Vulnerabilities #DataProtection #enumeration #databreach #dataleak #WhatsApp

STM32 Short #8 - Understanding USB Enumeration (re-enumeration)

In this videi we will cover the topic of USB Enumeration and how to trigger a USB Host to re-enumerate a STM32 USB Device (or Gadget).

#STM32 #Tutorial #STM32CubeIDE #STM32CubeMX #USB #Enumeration #STM32World

https://www.youtube.com/watch?v=osNf6gyF_zY

🤔 Ever wonder how to escape from a container? Or how security tools know what permissions they have from inside that same container? It's nice to have a great script for #enumeration ... but what does it check for and why does it matter?

• Who am I? - Let’s get oriented and figure out what we have in our container. (https://some-natalie.dev/container-escapes-whoami/)

• Our shared kernel - #Containers are processes that share a kernel. What can we see about our host? (https://some-natalie.dev/container-escapes-shared-kernel/)

• Are we capable? - What sort of capabilities do we have? (https://some-natalie.dev/container-escapes-capabilities/)

• Seccomp is your friend - #Seccomp filters what a container can do. Let’s learn what’s been set for us. (https://some-natalie.dev/container-escapes-seccomp/)

• Are we in a microVM? - With #microVM runtimes gaining popularity, how do you know if you’re in a container? (https://some-natalie.dev/blog/microvm-or-container/)

(or, I did a little editing and put my workshop from @appsec_village at #DEFCON33 up) :heart_cybre:

Subdomain enumeration is an essential OSINT technique. Amass and Subfinder are well-known enumeration tools, but they have limitations. Explore this comprehensive database with over 200 sources.

https://osintteam.com/passive-subdomain-enumeration-uncovering-more-subdomains-than-subfinder-amass/

#OSINT #Subdomains #Domains #DNS #enumeration

In this week's Linux Update newsletter, Chris Binnie looks at the enumeration tools feroxbuster and ffuf for automating search during a cyberattack
https://www.linux-magazine.com/Issues/2025/290/Enumerating-Resources
#security #tools #feroxbuster #ffuf #enumeration #cyberattack #automation #fuzzing

Oh boy. A simple #enumeration #attack could be used to read credit offers at #CHECK24 and #verivox, two big German portal offering a lot of things around comparing credit offers, insurance contracts and other things.

This is such a trivial mistake, it nearly feels deliberate. This should never ever happend. And for sure this should have be a red flag in any #securityaudit. I wonder how they can state "No indications of miss use.". #cybersecurity

Article in German:
https://correctiv.org/aktuelles/datenschutz/2024/09/17/kreditvermittlung-bei-check24-und-verivox-kritische-datenlecks-entdeckt/

🚨 New blog post: Preparing a National Sampling Frame: capacity strengthening in Cameroon

A report on our recent #preEA and #QGIS workshop with #ins_cameroun

#geospatial #census #statistics #Enumeration #MINRESI_CM

https://www.worldpop.org/blog/preparing-a-national-sampling-frame-capacity-strengthening-in-cameroon/

Weekend project: try to solve some #combinatorics #enumeration problems by reduction to #SharpSAT. (Which, to be clear, I thought was unlikely to succeed!)

I picked c2d http://reasoning.cs.ucla.edu/c2d/ because it scored highly in the 2020 Model Counting Competition https://arxiv.org/abs/2012.01323 but I am not sure this is the same version. The one I got is dated 2005 and was 32-bit only. It ran out of memory on this 364-variable 942-clause instance (corresponding to 6 playing cards chosen from a standard 52-card deck.)

Looking at the 2023 competition instead, I think I should try SharpSAT-TD https://github.com/Laakeri/sharpsat-td but it is not as well documented. For example, I don't know if it supports the "eclauses" (exactly-one clauses) extension of the Dimacs CNF format.

#Satisfiability

All sets of integer lattice points symmetric along the X and Y axes, and connected allowing diagonals, of size 14 and 15.

Code here: https://gist.github.com/mgritter/8cfc41a7325f85b75c029f77915a2f44

Inspired by this Quora question, https://www.quora.com/On-an-XY-array-of-lattice-points-how-many-patterns-of-N-connected-points-are-mirror-symmetric-in-both-X-and-Y-Adjacency-connections-are-1-in-X-1-in-Y-or-1-1-in-X-Y-I-do-not-know-the-answer, although I misinterpreted what he was asking for. That was closer to all polyominoes, allowing diagonal connections, which are horizontally and vertically symmetric. But I don't allow the line of symmetry to run down a half-integer value.

#enumeration #integer_lattice #polyominoes

Lista użytkowników Wordpress dostępna przez API ( https://nfsec.pl/pentest/6215 ) #wordpress #user #enumeration #badbot #twittermigration

Point-in-Time count shows homeless numbers up over 9% in Victoria, BC region

This year’s count identified 1,665 people who were experiencing homelessness, versus 1,523 in 2020

Homeless include many seniors, Indigenous and people with disabilities

https://www.timescolonist.com/local-news/point-in-time-count-shows-homeless-numbers-up-slightly-7366592

#homeless #housing #AffordableHousing #enumeration #PointInTime #yyjpoli #bcpoli #buildhomes #buildjustice

There has to be a better way, right? Brute force can’t be the best way to enumerate zones of subdomains. #pentesting #hacking #dns #zone #enumeration #hackthebox

25 Recon Tools for Hacking & BugBounty 🔎

#cybersecurity #Pentesting #Hacking #bugbountytips #infosec #CTF #pwn #cybersecuritytips #redteam #coding #100DaysOfHacking #vulnerabilities #BugBounty #recon #enumeration #100DaysOfCyberSecurity #CyberSecurityAwareness

I recently made a highly efficient subdomain discovery wordlist by scanning the entire IPv4 space for SSL certs.

I've written a full article on the project, which is, in fact, my first public InfoSec article ever!

I would love to hear what you think!

You can read it here:
https://n0kovo.github.io/posts/subdomain-enumeration-creating-a-highly-efficient-wordlist-by-scanning-the-entire-internet/

(boosts and shares highly appreciated ❤️)

#infosec #writeup #redteam #pentesting #recon #reconnaissance #enumeration #subdomain #subdomains #wordlist #masscan #osint #bugbounty #bughunter #hacking

I wrote a script to resolve lists of domains from stdin, since dnsx and the like does not like my VPN settings.

(feedback appreciated - Bash noob)

https://github.com/n0kovo/dnsplz

#BugBounty #DNS #DnsRecon #Bash #ShellScript #ShellScripting #BashScript #Enumeration #DnsEnumeration #InfoSec

#hack100days : day 41 : Tinkered around with Docker some more. Experimenting with building an image w/enumeration tools. Getting rust onto the system for feroxbuster has me a bit stymied. #infosec #enumeration

Enumeration - I have just completed this room! Check it out: https://tryhackme.com/room/enumerationpe #tryhackme #security #enumeration #processes #services #post-exploitation #users #enumerationpe via @RealTryHackMe

Red Team Tips February 1st: #OPSEC Safe Active Directory #Enumeration with #SilentHound https://m.youtube.com/watch?v=MRLZO17ZrmA

Would anyone know if Mimecast works for on prem Exchange servers? I am working on enumerating a domain and have found a Microsoft TXT record, but can't find much outside of the MX being tied to Mimecast.

What I am trying to confirm now is if Mimecast would be sitting in front of Exchange in the cloud or if it can even support on prem.

Any input would be extremely helpful. Thanks!

#security #DNS #MX #email #mimecast #phishing #enumeration

New project - led by Dr Sarchil Qader and Edith Darin - Exploring the automatic pre-Enumeration Areas Tool for surveys on forced displacement - #Refugees #Cameroon #UNHCR #Enumeration #Survey https://www.worldpop.org/current-projects/exploring-the-automatic-pre-enumeration-areas-tool-for-surveys-on-forced-displacement-refugees/

I recently made a highly efficient subdomain discovery wordlist by scanning the entire IPv4 space for SSL certs.

I've written a full article on the project, which is, in fact, my first public InfoSec article ever!

I would love to hear what you think!

You can read it here:
https://n0kovo.github.io/posts/subdomain-enumeration-creating-a-highly-efficient-wordlist-by-scanning-the-entire-internet/

(boosts and shares highly appreciated ❤️)

#infosec #writeup #redteam #pentesting #recon #reconnaissance #enumeration #subdomain #subdomains #wordlist #masscan #osint #bugbounty #bughunter #hacking

#Web #Fundamentals -> #Subdomain #Enumeration

Wieder nur ganz kurz TryHackMe. Weiterhin Subdomains. Ab morgen werde ich mich wieder intensiver drum kümmern!

[20🔥] #tryhackme

#Web #Fundamentals -> #Subdomain #Enumeration

Heute nur ganz kurz in TryHackMe reingeschaut. Muss mich auf Prüfungen vorberbereiten...dennoch etwas über Subdomains ist hängen geblieben. 👀 😅

[19🔥] #tryhackme

Need a quick way to find related domains?

I did, so I wrote a quick #OSINT tool that abuses the SecurityTrails domain search suggestion API to grab a list of domains that start with [string].

I call it DomainDouche, since it's clearly using their API in a very unintended way and they probably wouldn't like it.

Grab it while it still works :)

https://github.com/n0kovo/DomainDouche

#infosec #tool #domains #enumeration #recon #reconnaissance #InformationGathering #attacksurface #pentesting #redteam

Subdomain Enumeration using #assetfinder, #dnsgen & #puredns

assetfinder site.com --subs-only | dnsgen - | puredns resolve -q | httpx -silent

https://github.com/tomnomnom/assetfinder
https://github.com/d3mondev/puredns
https://github.com/projectdiscovery/httpx

#bugbounty #bugbountytips #enumeration

Here's another tool, a crawler/spider to find all of those endpoints https://github.com/projectdiscovery/katana #bugbounty #enumeration #cybersecurity

I guess I should make a quick post about this, but if you're doing a quick image analysis try Aper'Solve: https://www.aperisolve.com

It will run an image against zsteg, steghide, outguess, exiftool, binwalk, foremost, strings and pngcheck all at once in one shot.

It's quick, fast and does the job (and it has captured me flags within seconds).

#enumeration #infosec #capturetheflag #ctf #osint #hacking