Tweet

This Thread may be Removed Anytime!

Twitter may remove this content at anytime! Save it as PDF for later use!

More from @NandanLohitaksh

Lohitaksh Nandan

@NandanLohitaksh

Nov 19

Malware Attack Infection Chain
🧵👇🏻

#cybersecurity #infosec #hacking

During the investigation of the campaign, researchers found that the attackers employed the extensive use of both dual-use and living-off-the-land tools. Also, some of the indications say that APT hackers initially attacked and exploited the publicly facing systems and further

moved to the victim’s networks.

There are several publicly available tools of the following have been used in this attack:-

• AdFind – A publicly available tool that is used to query Active Directory.
• Winmail – Can open winmail.dat files.

Read 8 tweets

Lohitaksh Nandan

@NandanLohitaksh

Nov 19

Learn Malware Analysis 🚀

⚡️Abusing dll misconfigurations :bit.ly/3g68h6v
Red Canary: bit.ly/3hGbB97
SANS: bit.ly/3hDmk4b
Publicly disclosed DLL Hijacking opportunities:bit.ly/3AbIlNA

#cybersecurity #infosec #hacking

Pentestlab : bit.ly/2FxVQeR
itm4n's blog: bit.ly/3EuLZ8b
Exploiting DLL Hijacking by DLL Proxying : bit.ly/3g2NkcS
DLL Hijack Scanner: lnkd.in/dXb5ymbS
UAC bypass - DLL hijacking: bit.ly/3AdqC8N

⚡️Blogs :
SANS Malware Analysis: Tips & Tricks Poster: bit.ly/3AeXRZo
Binary Posters: bit.ly/3UNnSqg
RE Malware Methodology:bit.ly/3GdaI1K
APT Notes:bit.ly/3UB2ipi
Harlan Carvey's Blog:bit.ly/3E1IEvD

Read 13 tweets

Lohitaksh Nandan

@NandanLohitaksh

Nov 16

Hacking resources that are free but are worth thousands:

#bugbounty #cybersecurity #infosec #hacking

@PortSwigger

Web Security Academy from @PortSwigger

After years of pentesting, I still come back to exercises in these labs on a regular basis for reference.

portswigger.net/web-security

@OpenSecTraining

All courses from @OpenSecTraining, especially the ones on x86_64 ASM and OS internals. I have used these quite a lot while learning xdev/RE.

opensecuritytraining.info/About.html

Read 5 tweets

Lohitaksh Nandan

@NandanLohitaksh

Nov 14

30 Search Engines for Cybersecurity Researchers:

1. Dehashed—View leaked credentials.
2. SecurityTrails—Extensive DNS data.
3. DorkSearch—Really fast Google dorking.
4. ExploitDB—Archive of various exploits.

#cybersecurity #infosec #bugbounty

5. ZoomEye—Gather information about targets.
6. Pulsedive—Search for threat intelligence.
7. GrayHatWarefare—Search public S3 buckets.
8. PolySwarm—Scan files and URLs for threats.
9. Fofa—Search for various threat intelligence.
10. LeakIX—Search publicly indexed information.

11. DNSDumpster—Search for DNS records quickly.
13. FullHunt—Search and discovery attack surfaces.
14. AlienVault—Extensive threat intelligence feed.
12. ONYPHE—Collects cyber-threat intelligence data.
15. Grep App—Search across a half million git repos.

Read 8 tweets

Lohitaksh Nandan

@NandanLohitaksh

Nov 14

17 platforms where you can begin cybersecurity:

1. HackXpert - Free labs and training.
2. TryHackMe - Hands-on exercises and labs.
3. CyberSecLabs - High quality training labs.
4. Cybrary - Videos, labs, and practice exams.

#cybersecurity #infosec #hacking #bugbounty

5. LetsDefend - Blue team training platform.
6. Root Me - Over 400 cybersecurity challenges.
7. RangeForce - Interactive and hands-on platform.
8. Certified Secure - Loads of different challenges.

9. Vuln Machines - Real world scenarios to practice.
10. Try2Hack - Play a game based on the real attacks.
11. TCM Security - Entry level courses for cybersecurity.
12. EchoCTF - Train your offensive and defensive skills.
13. Hack The Box - Cybersecurity training platform.

Read 5 tweets

Lohitaksh Nandan

@NandanLohitaksh

Nov 13

Introducing 24 web-application hacking tools

1. Burp Suite - Framework.
2. ZAP Proxy - Framework.
3. Dirsearch - HTTP bruteforcing.
4. Nmap - Port scanning.
5. Sublist3r - Subdomain discovery.
6. Amass - Subdomain discovery.

#bugbounty #bugbountytips #cybersecurity

7. SQLmap - SQLi exploitation.
8. Metasploit - Framework.
9. WPscan - WordPress exploitation.
10. Nikto - Webserver scanning.
11. HTTPX - HTTP probing.
12. Nuclei - YAML based template scanning.
13. FFUF - HTTP probing.
14. Subfinder - Subdomain discovery.

15. Masscan - Mass IP and port scanner.
16. Lazy Recon - Subdomain discovery.
18. XSS Hunter - Blind XSS discovery.
19. Aquatone - HTTP based recon.
20. LinkFinder - Endpoint discovery through JS files.
21. JS-Scan - Endpoint discovery through JS files.

Read 5 tweets

Share this page!

Lohitaksh Nandan

People who liked this thread also liked...

Try unrolling a thread yourself!

More from @NandanLohitaksh

Lohitaksh Nandan

Lohitaksh Nandan

Lohitaksh Nandan

Lohitaksh Nandan

Lohitaksh Nandan

Lohitaksh Nandan

Did Thread Reader help you today?

Don't want to be a Premium member but still want to support us?

Send Email!