![Emanuele Picariello](/img/default-banner.jpg)
- Видео 90
- Просмотров 153 577
Emanuele Picariello
Нидерланды
Добавлен 4 фев 2022
Creative Hacker | Join me in hacking daily and building a better world!
Global Security Voices | Episode 3 Devon Edward From the U.S. to Japan: Nation-State Jumper Journey
🌐 In this episode, we talk with Devon Edward, a Cyber Warfare Officer turned penetration tester, who shares his unique journey from the US Navy 🇺🇸 to Secura B.V. in the Netherlands, and now working in Japan with Money Forward Inc. 💻.
Devon discusses his career shift to offensive security, his experiences in cybersecurity operations, and his advice for aspiring security professionals. 🔐
Host:
www.linkedin.com/in/devon-edward-35b186108/
👉 Don’t forget to like, comment, and subscribe for more inspiring cybersecurity journeys! 🚀🔔
Follow and support the journey: www.youtube.com/@emanuelepicariello
www.linkedin.com/in/emanuele-picariello-520231199/
#Cybersecurity #PenetrationTesting #OffensiveSecurity...
Devon discusses his career shift to offensive security, his experiences in cybersecurity operations, and his advice for aspiring security professionals. 🔐
Host:
www.linkedin.com/in/devon-edward-35b186108/
👉 Don’t forget to like, comment, and subscribe for more inspiring cybersecurity journeys! 🚀🔔
Follow and support the journey: www.youtube.com/@emanuelepicariello
www.linkedin.com/in/emanuele-picariello-520231199/
#Cybersecurity #PenetrationTesting #OffensiveSecurity...
Просмотров: 40
Видео
GLOBAL SECURITY VOICES: EPISODE 2: Panagiotis Bellonias the CTF master (Obi-Wan Kenobi)
Просмотров 224Месяц назад
GLOBAL SECURITY VOICES: EPISODE 2: Panagiotis Bellonias the CTF master (Obi-Wan Kenobi)
Global Security Voices | Episode 1: Henry Valencia’s Cybersecurity Journey from Colombia
Просмотров 108Месяц назад
Global Security Voices | Episode 1: Henry Valencia’s Cybersecurity Journey from Colombia
I passed OSEP 2024 - Offsec Experienced Penetration Tester - Active directory - Network Pivoting
Просмотров 508Месяц назад
I passed OSEP 2024 - Offsec Experienced Penetration Tester - Active directory - Network Pivoting
BEWARE OF DOCM FILES - Episode 3: Process Hollowing
Просмотров 822 месяца назад
BEWARE OF DOCM FILES - Episode 3: Process Hollowing
BEWARE OF DOCM FILES - Episode 2: Remote connection via powershell loaded into memory
Просмотров 1063 месяца назад
BEWARE OF DOCM FILES - Episode 2: Remote connection via powershell loaded into memory
BEWARE OF DOCM FILES - Episode 1: Introduction to Malicious DOCM Files
Просмотров 1334 месяца назад
BEWARE OF DOCM FILES - Episode 1: Introduction to Malicious DOCM Files
The Intersection of AI and Entrepreneurship - Free Courses to master AI
Просмотров 836 месяцев назад
The Intersection of AI and Entrepreneurship - Free Courses to master AI
I passed OSCP 2023/2024 - Offsec Certified Professional - Tips and thoughts - Active directory
Просмотров 4,1 тыс.6 месяцев назад
I passed OSCP 2023/2024 - Offsec Certified Professional - Tips and thoughts - Active directory
Providing Ground Educated - Solution - XAMPP - Source Code Review - Mobile - JADX
Просмотров 1537 месяцев назад
Providing Ground Educated - Solution - XAMPP - Source Code Review - Mobile - JADX
Providing Ground Practice: Fractal - Solution
Просмотров 1849 месяцев назад
Providing Ground Practice: Fractal - Solution
Race Conditions: Exploiting time-sensitive vulnerabilities
Просмотров 933Год назад
Race Conditions: Exploiting time-sensitive vulnerabilities
Race Conditions: Single-endpoint race conditions
Просмотров 703Год назад
Race Conditions: Single-endpoint race conditions
Race Conditions: Partial construction race conditions
Просмотров 1,1 тыс.Год назад
Race Conditions: Partial construction race conditions
Race Conditions: Multi-endpoint race conditions
Просмотров 1,3 тыс.Год назад
Race Conditions: Multi-endpoint race conditions
Race Conditions: Bypassing rate limits via race conditions
Просмотров 1,3 тыс.Год назад
Race Conditions: Bypassing rate limits via race conditions
Race Conditions: Limit overrun race condition
Просмотров 714Год назад
Race Conditions: Limit overrun race condition
GraphQL API Vulnerabilities: Finding a hidden GraphQL endpoint
Просмотров 978Год назад
GraphQL API Vulnerabilities: Finding a hidden GraphQL endpoint
GraphQL API Vulnerabilities: Bypassing GraphQL brute force protections
Просмотров 1 тыс.Год назад
GraphQL API Vulnerabilities: Bypassing GraphQL brute force protections
GraphQL API Vulnerabilities: Performing CSRF exploits over GraphQL
Просмотров 1,2 тыс.Год назад
GraphQL API Vulnerabilities: Performing CSRF exploits over GraphQL
GraphQL API Vulnerabilities: Accidental exposure of private GraphQL fields
Просмотров 362Год назад
GraphQL API Vulnerabilities: Accidental exposure of private GraphQL fields
GraphQL API Vulnerabilities: Accessing private GraphQL posts
Просмотров 807Год назад
GraphQL API Vulnerabilities: Accessing private GraphQL posts
eWPTx - elearning Web Application Penetration Tester eXtreme - Review - Tips and Thoughts
Просмотров 2,2 тыс.Год назад
eWPTx - elearning Web Application Penetration Tester eXtreme - Review - Tips and Thoughts
eWPT - elearning Web Application Penetration Tester - Review - Tips and Thoughts
Просмотров 4 тыс.Год назад
eWPT - elearning Web Application Penetration Tester - Review - Tips and Thoughts
Quick Logger Server set up in PHP with ngrook
Просмотров 245Год назад
Quick Logger Server set up in PHP with ngrook
Prototype Pollution: Client-side prototype pollution via flawed sanitization
Просмотров 1,3 тыс.Год назад
Prototype Pollution: Client-side prototype pollution via flawed sanitization
Prototype Pollution: Client-side prototype pollution via browser APIs
Просмотров 3,1 тыс.Год назад
Prototype Pollution: Client-side prototype pollution via browser APIs
Prototype Pollution: Client-side prototype pollution in third-party libraries
Просмотров 2 тыс.Год назад
Prototype Pollution: Client-side prototype pollution in third-party libraries
Prototype Pollution: DOM XSS via an alternative prototype pollution vector
Просмотров 1,8 тыс.Год назад
Prototype Pollution: DOM XSS via an alternative prototype pollution vector
Noice
@@SleepyAizawa69 Thanks! Would you like to see more about it?
Someone sent me a link that I have a dhl coming I clicked the link but I don't write something or log in something. I reported as spam when I check there is a reply coming from me which I did not send to the recipient there is the code or something I don't know... Can you help me?
Be careful on opening links, I think the best option to follow at moment is to change your email password or dhl password. Hopefully, they are not the same. Please, use another phone or computer to perform the following. Another risk of opening links, I hope this is not the case. It’s that your current phone or computer is not completely updated or eventually the browser. Which could lead at a complete compromise of the system. I hope this could help you and your problem is not this kind of size of complexity!
I don't see the phollowDLL in your github. Is there another place I can find it?
@@vpntest5260 Hi, I think, I wrongly deleted the project, but I can see if I can find something similar in the next days. I’ll try
ysoserial tool is not working
@@SubhashBose-x7c try an old version or more recent. It’s possible that the version that you are using is having some changes that the one that I used
Grande brother 😎
@@kablanfoundation grazie 😝
Hello did you use other ressources fir preparation ? Htb,THM, etc.
@@H4ck3er01, no I mainly follow the learning path suggested by Port Swigger portswigger.net/web-security/certification/how-to-prepare. These are enough, but do all the labs and take notes about them. If you want to improve your knowledge, doing other labs is always fun. I strongly recommend it. But, to successfully pass the exam you need to fully understand the vulnerabilities explained in the academy. Hope this helps!
Congratulations for your OSCP!!!
@@wolfrevokcats7890 Thanks mate!
Oh Man, Process Hollowing!!! Your youtube content is good, however the font is very small hard to see If you ever see John Hammond's content, he's making all font bigger on purpose I'm subscribing anyway, hoping too see bigger font in the future :D
@@wolfrevokcats7890 Thanks for the feedback 😁. I’ll do my best for the next one!
Improvement for the next video: Make the font size bigger, zoom on the specific command and not the whole terminal as it's very difficult to see the small font
@@wolfrevokcats7890 thanks, yes, that was long long time ago. But you are right, for the videos similar to this I’ll use the suggestions 😃
@@emanuelepicariello awesome, did not expect you to response this fast
thank you for sharing, a quick question, which cookie you replaced into the browser can see all user's access token, this one can't really follow, thanks
@@raymondli3240 Hi, Sorry what do you mean? In this lab, you should adjust the length of the string of each fields, before you encode in base64 the string. But, I did not get your question correctly, I think, please let me know. Thanks
Congratulations! It's amazing how you have completed both OSCP and OSEP within 6 months! I am also planning to take OSCP may I know did you take the one-time bundle or the learn one plan for exams and which one would you recommend to me?
I took the 90 days access with one exam attempt, I recommend that but don’t underestimate the time given for accessing the labs, so you can get 10 bonus points and knowledge as well from the labs.😝 If you have more budget and you are aming for OSCP and OSEP then one-time bundle can be more interesting for you. Hope this helps you!
thanks for the invite, I had a good time!
@@henryvalencia9711 Happy to hear that!! 🍀😝🇨🇴
Great episode! Keep up the excellent content. Looking forward to the future guests💪
@@nonloso-b1j Thanks hahaha, keep an eye on it 👀😝
Neo I am lost on the matrix 👨💻👨💻
🕵🏽♂️🌎
Congratulations Emanuele 🎉 Thanks for the amazing video
@@jacoposcannella5492 glad to help, let’s make the change!
You don't need to do all this stuff with changing the username to administrator. Changing the access token's value to the integer 0 is enough.
Hi @@manondu44, Thanks for spotting this, you are right there are other alternatives solutions. 😝
why does the page not display an alert if i change the url after invader shows me a proof of concept?
Hi connann, I believe, the alert might not be showing because of a few reasons. Try clearing your cache or using incognito mode, as old data might be causing issues. Ensure the URL is correctly formatted like this: <script> location="{}/#__proto__[hitCallback]=alert%28document.cookie%29" </script> Some security features in browsers might block the script, so check for any protections like Content Security Policy. Make sure you’re identifying the right prototype pollution vectors and gadgets using DOM Invader, and try to follow all lab steps in Burp’s built-in browser, if possible. Keep in mind that these labs are simulations and might occasionally miss key parts, leading to unexpected behavior. Hope this helps! 😁
@@emanuelepicariello Yeah it was old data, it works if I load a new instance. Thank you for responding.
@@conanngan645 😝
You didnt made this skeleton 😂
What do you mean? 😂😂
Thank you for this but you are not explaining essential steps. This lab is about serialization and you focus more on the SQL injection. I believe I was able to understand most of the lab. But I was not able to understand 1 thing - why do we need to create a "productcatalog" subfolder in the Java structure? How am I supposed to know that? How would you find that normally?
@@lyubenpetrov6430 Thank you for your feedback. You are right, and I appreciate your patience. At that time, my focus was primarily on the solution itself rather than providing a comprehensive explanation of each step. To clarify, creating the “productcatalog” subfolder is necessary because the ProductTemplate class used in the lab is part of the data.productcatalog package. In Java, packages are used to group related classes and provide a namespace management system. The productcatalog subfolder corresponds to this package and ensures that the Java compiler and runtime environment can locate and use the ProductTemplate class correctly. Normally, you would determine the need for such a subfolder by examining the package declaration at the top of the Java source files. In this case, the ProductTemplate.java file includes a line like package data.productcatalog;, indicating that it belongs to the data.productcatalog package. I hope this clears up the confusion! 🙏🏾
@@emanuelepicariello thank you so much for the clarification! Sorry if my tone came across as harsh in my earlier message. I had been working on this lab for a whole day and I was at my wit's end. Your explanation clears everything up. Thanks again and keep up the great work. I will subscribe for sure!
@@lyubenpetrov6430 Thanks for the support and no worries at all. Feel free to ask always!
why do you need the carriage return?
@@MichaelKali-sq6il Thank you for your question. The carriage return is essential in this context because it ensures proper formatting and readability of the serialized PHP object and the resulting signed cookie. In PHP, when working with serialized objects and manipulating strings, ensuring that the formatting remains intact is crucial to avoid syntax errors or malformed data. The carriage return can sometimes be a part of the serialized data, especially if the object contains multiline strings or if specific formatting is required by the framework or tool being used, like PHPGGC in this lab. In summary, the carriage return helps maintain the integrity and readability of the serialized data, ensuring it works correctly when used in the exploit. I hope now it’s more clear 😁
Grande emanuele, dall'accento ho subito riconosciuto che sei italiano e sono corso a vedere <3
Ahahhaha grande, sisi qui stavo ancora prendendo padronanza 😝
Hi, can u rate from 1 to 10 the difficulty about all your exam? eWPT, eWPTXv2, BurpCertificate, OSCP? Thnk What Will be your next certification to improve your appsec skills?
Hi @vitopotenza141, Thanks for your question! Here’s how I would rate the difficulty of the exams on a scale from 1 to 10: • eWPT: 6/10 - It’s challenging, especially if you’re new to web application penetration testing, but it’s very manageable with thorough study and practice. • eWPTXv2: 8/10 - This is more advanced and builds on the eWPT, requiring a deeper understanding and more complex exploitation techniques. • Burp Suite Certified Practitioner: 8/10 - This exam is tough because it requires both a deep knowledge of Burp Suite and practical application skills. • OSCP: 9/10 - Known for its rigorous practical exam, it demands a solid grasp of various penetration testing techniques and a lot of hands-on practice. I recently took the OSEP and a video will be out soon! 😝 As for my next certification to improve my AppSec skills, I’m considering the OSWE or OSED Hope this helps!
Thank you for this ! Do you know if it's possible to use DOM invader to identify gadgets even when he is not capable of finding the sources ? The idea would be that you find the source manually, but you can still use DOM invader to find the gadgets
Hi manondu, Thank you for your question! Yes, it is possible to use DOM Invader to identify gadgets even when it cannot find the sources directly. The idea would be to first try to manually identify potential gadgets by examining the JavaScript files loaded by the target site. Once you have an idea of the possible gadgets, you can then use DOM Invader to test these manually identified gadgets for vulnerabilities. This combined approach can help you effectively find and exploit DOM-based XSS vulnerabilities. Hope this helps!
Thank you for sharing your experience, I hope to take this maybe next year or so, and these videos really help.
Thanks for the kind world and good luck for your journey! Smash it!
thx but bro. you need to train to explain that part Object.defineProperty(...) better and why /?__proto__[value]=data:,alert(1) but /?__proto__[bla]=data:,alert(1) not
Hi Eduard, Sorry at that time, I was still a newbie hahahha 😄. Here a brief explanation. "Object.defineProperty()" makes "transport_url" unwritable and unconfigurable but doesn’t set its "value". So, it can fall back to the prototype chain. When you use "/?__proto__[value]=data:,alert(1)", you add a value property to "Object.prototype". The script looks for "transport_url's" value, finds your injected "value", and uses it, which triggers the alert. Using /?__proto__[bla]=data:,alert(1) adds a bla property, but the script doesn’t look for bla, so it has no effect. Hope this helps!
@@emanuelepicariellodefinitly. Thx :)
Say little loud bro 😅
Yeah, apologies. It was old content and I was still finding my way on doing things! 😁
@@emanuelepicariello It's okay brother 👍
Congrats and thanks for your sharing!! Really helpful !
Thanks you are welcome!
The link for Literal Solution_Practice Exam is not working. Do you have any other link for that?
Hi 😁, Thanks for pointing it out! When something is not available on the internet try to used web archive or similar: web.archive.org/web/20230311004317/www.r00tpgp.com/2021/08/burp-suite-certified-practitioner-exam.html 😝
Can I google it during the exam?
Yes sure!!
Nice video!
Thanks 😝
Bro, are there any free certifications for burp suite
Hi, The only one available at the moment is this one for now
@@emanuelepicariello it's not free right
@@sanath4099 Not it costs 100 bucks ish: portswigger.net/web-security/certification
Can i use "Burp Suite Professional (Trial)" for exam?
or cracked
Yes sure!
@@_ILunar 🤣
@@emanuelepicariello thanks bro
@@_ILunar You are welcome and good luck for the exam 🍀💪🏾
In a real-life scenario, how would I know which method/function causes to occur this vulnerability?
Hi, A possible scenario involves a malicious actor retrieving sensitive information from the server and potentially finding an entry point into the system, where they can perform lateral movements or other actions. In this case, the entry point is the avatar link. Hope this example clarify and show the risks!
Promo sm
Why do we need to use two sets of session IDs and CSRF tokens? Why can't I sovle the lab using the same session ID and CSRF token?
Hi, The requests are processed one per time due the PHP backend, therefore to trigger the gitter time and then the vulnerability, the requests need to be sent with different session id and CSRF token
@@emanuelepicariello Thank U!
@@robstark4759 You are welcome!
how do you do the scan and how do you exploit it automatically ?
Hi, You can attempt the scan with the embedded browser in Burp and run the prototype pollution scan, but it is not 100% successful all the time. It is always good to rely on manual testing! Hope this helps 😁
If I do this in Windows, it doesn't work. It only works when I use the PHPGGC in Kali and also write the cookie-generating script in Kali 😂 Probably something to do with CRLF difference is my hunch. The final payloads also differ slightly when generated from Windows vs Kali
Hi! I think that possibly this difference is given by the PHP version running on your system. I believe
Congratulations and thanks for sharing your perspective.
You are welcome!
Spacca sto video e la musica di meditazione in sottofondo .. Let's goo brother
Hahahaha thanks bro!
tanks bro
You are welcome, glad to help 😝
Congrats brooo!!! I'm following you since last year, really good progress mate! Thanks for sharing
Thanks mate, happy to share progress and motivate others people 😝
Haha, Glad i watched this. 💪
Practically this lab made no sense to me, i tried to approach it by buying a gift card and intercepting the redeem gift card request before the gift card could be redeemed, unfortunately sending them in parallel only had the rest of the request render an invalid coupon code. Do you think bruteforcing on intruder with a wordlist of possible giftcard codes would work? I will also try solving it with your approach :)
Brute forcing can be an option, unless there is a WAF or request throttling option in place, you can try. You need to reduce the cache response also before sending the requests in parallel, this will reduce the “gitter” time. Hope this helps!
Great job, thanks for sharing your thoughts.
Thanks!
We take practice exam free before pay for real exam ?
Yes, I strongly suggest to do so 😁
Congratulations man
Thanks 😝
I just graduated from high school and want to get into the field of cybersecurity do you have any tips
Hi, that’s is a complex question, but, I try to answer. Generally I suggest to start either some basic Cybersecurity foundation starting from TryHackMe. As a next step, I suggest to start with WebSecuryAcademy by Port Swigger and go for the BSCP. This was my path: BSCP eWPT eWPTx OSCP You can take a look at these videos before going for these certs and need some info. ruclips.net/p/PL16wrrijM0H8itX3BOdUbKksKAGuiZoZA&si=Y3ZOSoo0UqdEqwkq Hope this helps you!
The journey is amazing! Seeing you improve is giving me motivation. Gj bro, keep it up
We are all to improve together! 💪🏾🪖
Nice bro, thanks for sharing your tips.
Thanks 😝, are you going to take the exam soon?
@@emanuelepicariello im in the middle of the labs, so i think i'll take it at the end of april
I wish you good luck!!@@s4yhii
Great job, keep it up
🪖😝