• Facebook
• Twitter
• Reddit
• LinkedIn

Metasploitation es una web dónde publican entradas sobre técnicas de explotación usando Metasploit. Las publicaciones no son escritas, sino en formato audiovisual.

Las publicaciones las tienen agrupadas en distintas categorías:

• Browser AutoPwn2
• Exploiting – Unix
• Exploiting – Windows 10
• Exploiting – Windows 7
• Exploiting – Windows XP
• Google Hacking
• KALI 2.0
• Perl Scripts
• Post Exploitation – Unix
• Post Exploitation – Windows XP
• SET – Social Engineering Toolkit
• WPS – WordPress Scan

• Metasploit Full Tutorials - Evade AVIRA AntiVirus with Magic Unicorn
• Metasploit Full Tutorials - Evade BitDefender AntiVirus with Magic Unicorn
• Metasploit Full Tutorials - Gain 'SYSTEM' FROM STDRD USER, Evade AV KAPERSKY with SYSRET
• Metasploit Full Tutorials - Gain SYSTEM and Evade AV KAPERSKY with Magic Unicorn
• Metasploit Full Tutorials - Gain SYSTEM and Evade AV ESETNOD32 with Magic Unicorn
• Metasploit Full Tutorials - Gain SYSTEM and Evade AV AVG with Magic Unicorn
• Metasploit Full Tutorials - Upgrade Shells with PowerShell, Architecture Migration
• Metasploit Full Tutorials - BRUTE MSSQL , Post exploit, Upgrade Shell Privileges
• Metasploit Architecture Migrate - Metepreter Tips and Tricks
• MSSQL EXPLOITING WEAK PASSWORDS to GAIN METERPRETER SHELL PART 2
• MSSQL EXPLOITING WEAK PASSWORDS to GAIN METERPRETER SHELL PART 1
• Samba "Username Map Script" Metasploit Exploit
• FULLY GUIDED SQL Injection Interactive Learning by Seeing & Doing
• Ingreslock Backdoor with Telnet Port 1524
• SQL Injection Basics Level 1 - SQL Injection
• SQL Injection Basics Level 2 - Verbose Table Modification
• Shell To Meterpreter Session Upgrade
• Bypass UAC Privilege Escalation Techniques in Metasploit
• Metasploit - Creating & Setting AutoRunScripts for Post Exploitation
• How To: Veil-Evasion BYPASS Anti Virus with Encrypted Payloads 2015 Kali 2.0
• MSFVenom 30 Times Encoded Payload! in Metasploit And Kali 2.0
• How to: OBTAIN FTP CREDENTIALS AS UNPRIVILEGED USER in Metasploit!
• Kali2 - DOS Attack ACCIDENT in Windows7 with Process Migration!
• Kali2 - DOS Attack ACCIDENT in XP with Process Migration!
• Kali2 - Cracking Windows LM Password Hashes in Metasploit
• Trusted Sec Magic Unicorn Installation
• Gaining A Shell with Adobe Flash NellyMoser Exploit - Metasploit Tutorial
• Evade Antivirus with Kali 2.0 Hack Win 7 SP1 - Veil Evasion
• Evade Anti Virus with Veil Evasion - The Installation Guide in Kali 2.0
• How to Exploit Badly Configured NFS Shares in Linux
• Kali 2.0 - Exploit SNMP Devices
• Kali 2.0 - VirtualBox Guest Additions Install
• Kali Linux 2.0 - Moving Around the GUI Interface
• Kali Linux 2.0 - Installation Walkthrough
• Metasploit Basics - Information Gathering PART2
• Metasploit Basics - Information Gathering PART1
• Metasploit Browser Attacks with Autopwn2!
• Metasploit Browser Autopwn
• Hack with crafted Adobe PDF Exploit with Metasploit
• Adobe Flash Player Exploit 2015 - Use After Free Vulnerability CVE-2015-0311
• MS15-051 - Windows Kernel Mode Drivers Elevation of Privilege Technique
• Firefox Version 31 - 34 Javascript Injection Exploit
• WPS - WordPress Scan. How to Hack Wordpress Overview
• MS15-034: Vulnerability in HTTP.sys Could Allow Remote Code Execution
• Easy File Management Web Server 5.3 - Stack Buffer Overflow
• MS04-007 Kill Bill Bitstring Heap Overflow
• CVE 2012-1823 - PHP CGI Argument Injection
• cSploit 1.5.0 It's Metasploit on Android! Installation & Overview
• Exploiting VNC with Hydra & Metasploit
• Exploiting PostgreSQL VIA Default Passwords List
• Exploiting rlogin with Root Credentials
• CVE-2007-2447 Samba "Username Map Script" Exploit
• CVE-2010-2075 UnrealIRCD 3.2.8.1 Backdoor Command Execution
• Windows 10 Exploit! - Multihandler Remote Execution Vulnerability
• Metasploit - Windows 7 Remote Code Execution
• CVE-2003-0352 MS03-026 Microsoft RPC DCOM Interface Overflow
• CVE-2003-0818 MS04-007 MS ASN.1 Library Bitstring Heap Overflow
• CVE-2008-4250 MS08-067 Microsoft Server Service Relative Path Stack Corruption
• Metasploit - PART 2 - DistCC Daemon to Root Escalation Techniques
• DistCC Daemon Exploit!
• OSVDB-73573 VSFTPD v2.3.4 Backdoor Command Execution
• Metasploit - Exploiting Java RMI Server Configuration Code Execution

• Facebook
• Twitter
• Reddit
• LinkedIn

Xtreme Vulnerable Web Application es una aplicación web con muchos fallos de seguridad implementados de forma intencionada.

Ésta es otra más de las muchas que ya existen. Está escrita en PHP y contiene fallos de seguridad de los siguientes tipos:

• SQL Injection – Error Based
• SQL Injection – Blind
• OS Command Injection
• XPATH Injection
• Unrestricted File Upload
• Reflected Cross Site Scripting
• Stored Cross Site Scripting
• DOM Based Cross Site Scripting
• Server Side Request Forgery (Cross Site Port Attacks)
• File Inclusion
• Session Issues
• Insecure Direct Object Reference
• Missing Functional Level Access Control
• Cross Site Request Forgery (CSRF)
• Cryptography
• Unvalidated Redirect & Forwards
• Server Side Template Injection

Suponiendo que tienes Docker instalado en tu máquina, todo lo que tienes que hacer es ejecutar:

sudo docker run –name xvwa -d -p 80:80 tuxotron/xvwa

Una vez tengas el contenedor corriendo navega hasta: http://localhost/xvwa y sigue las instrucciones desde la propia aplicación o desde la documentación de XVWA.

• Facebook
• Twitter
• Reddit
• LinkedIn

Ya se encuentran disponibles las presentaciones y los vídeos de BruCON 0x07 (2015).

• Creating REAL Threat Intelligence ... with Evernote - L. Grecs (slides)
• Unified DNS View to Track Threats - Dhia Mahjoub & Thomas Mathew
• Desired state: compromised - Ryan Kazanciyan & Matt Hastings (slides)
• Shims For The Win - Willi Ballenthin & Jon Tomczak (slides)
• Hacking as Practice for Transplanetary Life in the 21st Century - Richard Thieme
• CVE-Search - Alexandre Dulaunoy & Pieter-Jan Moreels (slides)
• OSXCollector: Automated forensic evidence collection & analysis for OS X - Kuba Sendor (slides)
• Keynote - Looking Forward - Finding the right balance for INFOSEC - David Kennedy (slides)
• Advanced WiFi Attacks using Commodity Hardware - Mathy Vanhoef (slides)
• The .11 Veil, Camouflage & Covert! Invisible WiFi, Revealed - R. Nandedkar & A. Iyer (slides)
• Nightmares of a Pentester - Chris Nickerson (slides)
• Levelling Up Security @ Riot Games - Mark Hillick (slides)
• SSO: It's the SAML SAML Situation - David Mortman
• Brain Waves Surfing - (In)Security in EEG Technologies - Alejandro Hernandez (slides)
• Keynote - What BASE Jumping Taught Me about Risk - Shyama Rose (slides)
• Didier_Stevens_SDR_Intro.pdf (no vídeo)
• Javier_Marcos_Ted_Reed_OSQuery_Workshop.pdf (no vídeo)
• PDanhieux_EVanBuggenhout_IR_Workshop_Slides.pdf (no vídeo)