Hakai Offensive Security

GLPI - SQL injection through dynamic reports

exploit Featured

GLPI - SQL injection through dynamic reports

This post details the journey of our Research Team in uncovering a SQL Injection vulnerability in GLPI, an open-source ITSM tool predominantly used in Brazil and France. We observed many companies using GLPI, and we decided to focus on finding vulnerabilities that could allow access to users' credentials and potentially

Illuminating the Dark Corners

BEERUS.APK - Spotlighting sandbox exfiltration

Local mobile storage is vulnerable to RATs and theft, risking data breaches. Our team creates tools to demonstrate such risks, promoting secure data practices and increasing security awareness.

Hunting for Nginx Alias Traversals in the wild

Hunting for Nginx Alias Traversals in the wild

Nginx, a versatile web server pivotal to numerous internet infrastructures, has held a dominant market share since its inception in 2004, with widespread adoption across websites and Docker containers. This article delves into the intricacies of Nginx, focusing on the location and alias directives that are central to how Nginx

Coffee: A COFF loader made in Rust

Coffee: A COFF loader made in Rust

Abstract COFF stands for Common Object File Format, it is the file format generated by compilers after the code-generation stage, they typically only include the machine code or assembly code generated from the corresponding source code without any external dependencies. beacon_inline_execute is a custom Windows COFF loader made

The right solution to the right problem: Microsoft Service accounts

The right solution to the right problem: Microsoft Service accounts

Introduction In this article, I will discuss the use of managed service accounts, including their implementation, characteristics, and benefits. The goal is to prevent attacks such as Kerberoasting. Furthermore, I will provide a method to monitor and identify Kerberoasting attacks using Windows EventViewer. My intention is to highlight the benefits

Reconnaissance like a cyber scout - Part 3. Final.

The final part of the reconnaissance like a cyber scout series.

Reconnaissance like a cyber scout - Part 2.

Salutations fellas! I'm back for the second part of our series on perimeter reconnaissance. Remembering that we reached half of our content, which will be concluded in the third part. Host discovery and vulnerability identification The way we treat data is an important point for our creativity, and it is

Reconnaissance like a cyber scout - Part 1.

Greetings dear readers, how are you?! May the god of hacking be present in your lives! All kidding aside, through this article, which will actually be a 3-part series, I'll be covering the topic of reconnaissance and information gathering. As the theme is very extensive and deep and to avoid

Purple Team Tips and Tricks: Revisiting Kerberos Enum

Purple Team Tips and Tricks: Revisiting Kerberos Enum

There are different methodologies proposed to define the stages of a Red Team assessment, regardless of the chosen methodology, most agree on the importance of the reconnaissance and enumeration phase, in the initial and internal phases. By performing the enumeration, we are able to validate collected information or obtain new

Fortigate - Authentication Bypass Lead to Full Device Takeover

Fortigate - Authentication Bypass Lead to Full Device Takeover

1Day vulnerability research by Hakai - Research Team This post is about the journey to create a Proof-of-concept about CVE-2022-40684, this vulnerability has been assigned by Fortinet as an authentication bypass using an alternate path or channel vulnerability [CWE-288]. Timeline 07/10/2022 - First news about the vulnerability, on

SQL Injection and XSS Vulnerability on Centreon

SQL Injection and XSS Vulnerability on Centreon

I'm Daniel França Lima and i'm a penetration tester Jr and vulnerability researcher at Hakai Offensive Security. In order to help the hacking community, companies and also improve my skills, I periodically look for flaws in market applications with the goal of achieving responsible disclosure. Centreon is a system and

Let's Talk DNS: Designing a DNS Profile for Mythic C2

Some months ago I decided to play with Mythic and to be honest, I've had a great experience with it, not only related to the stability of the framework but also the way the code is structured. It's fairly easy to implement custom profiles, custom agents, custom communication (encryption/decryption)