SQL Server – Link... Link... Link... and Shell: How to Hack Database Links in SQL Server!

https://www.netspi.com/blog/entryid/197/how-to-hack-database-links-in-sql-server

(Read More..)

Abusing Oracle’s CREATE DATABASE LINK privilege for fun and profit!

http://www.notsosecure.com/blog/2014/07/08/abusing-oracles-create-database-link-privilege-for-fun-and-profit/

(Read More..)

peepdf

peepdf is a Python tool to explore PDF files in order to find out if the file can be harmful or not. The aim of this tool is to provide all the necessary components that a security researcher could need in a PDF analysis without using 3 or 4 tools to make all the tasks. With peepdf it's possible to see all the objects in the document showing the suspicious elements, supports all the most used filters and encodings, it can parse different versions of a file, object streams and encrypted files. With the installation of PyV8 and Pylibemu it provides Javascript and shellcode analysis wrappers too. Apart of this it's able to create new PDF files and to modify/obfuscate existent ones.

The main functionalities of peepdf are the following:

https://code.google.com/p/peepdf/

(Read More..)

Python tools for Pentesters

http://hack-tools.blackploit.com/2013/11/python-tools-for-pentesters.html

(Read More..)

Still Passing the Hash 15 Years Later

http://passing-the-hash.blogspot.com/2014/02/pre-rsa-conference-demo-win-81-attack.html

(Read More..)

Examination of the Bitsquatting Attack Surface (PDF):

https://indico.dns-oarc.net/indico/getFile.py/access?contribId=5&resId=3&materialId=slides&confId=0

(Read More..)

Hacking Instagram Accounts using OAuth vulnerability

http://thehackernews.com/2013/05/hacking-instagram-accounts-using-oauth.html

(Read More..)

Powersploit

https://github.com/mattifestation

(Read More..)

Shellcode Execution in .NET using MSIL-based JIT Overwrite

http://www.exploit-monday.com/

(Read More..)

Hackersh 0.1 Release Announcement

I am pleased to announce the Official 0.1 launch of Hackersh ("Hacker Shell") - a shell (command interpreter) written in Python with built-in security commands, and out of the box wrappers for various security tools. It uses Pythonect as its scripting engine. Since it's the first release of Hackersh, I'd like to take this opportunity to explain how it works and why you should be using it.

Hackersh is an interactive console for security research and testing. It uses Pythonect as its scripting language. Pythonect is a new, experimental, general-purpose high-level dataflow programming language based on Python. It aims to combine the intuitive feel of shell scripting (and all of its perks like implicit parallelism) with the flexibility and agility of Python. The combination of the two makes:

1	"http://localhost" -> url -> nmap -> w3af -> print

http://blog.ikotler.org/2013/04/hackersh-01-release-announcement.html  https://github.com/ikotler/hackersh

(Read More..)

PowerShell for Penetration Testers

http://www.slideshare.net/nikhil_mittal/power-shell-forpenetrationtesters

(Read More..)

PoC Keylogger android : Inserting keylogger code in Android SwiftKey using apktool

http://www.android-app-development.ie/blog/2013/03/06/inserting-keylogger-code-in-android-swiftkey-using-apktool/

(Read More..)

Java native code injection

http://www.lexsi-leblog.fr/audit/java-native-code-injection.html

(Read More..)

Facebook OAuth flaw allows gaining full control over any Facebook account

http://thehackernews.com/2013/02/facebook-oauth-flaw-allows-gaining-full.html#_

(Read More..)

What’s in Your Folder: Security Cheat Sheets

http://blog.securitymonks.com/2009/08/15/whats-in-your-folder-security-cheat-sheets/

(Read More..)

Jingle BOFs, Jingle ROPs, Sploiting all the things… with Mona v2 !!

https://www.corelan.be/index.php/2012/12/31/jingle-bofs-jingle-rops-sploiting-all-the-things-with-mona-v2/

(Read More..)

MadMACs: MAC Address Spoofing and Host Name Randomizing App for Windows 7 (Should work in Windows Vista and Windows 8 too)

http://www.irongeek.com/i.php?page=security/madmacs-mac-spoofer

(Read More..)

ARP Poisoning Script

http://pentestlab.wordpress.com/2012/12/22/arp-poisoning-script/

(Read More..)

Attacking Ruby Session

Ruby on Rails Sessions

http://phenoelit.org/blog/archives/2012/12/21/let_me_github_that_for_you/index.html

(Read More..)

Configuring the Social-Engineer Toolkit (SET) to use valid SSL certificates

http://skeletonkeysecurity.com/post/36794099613/configuring-the-social-engineer-toolkit-set-to-use

(Read More..)