SQLMap
mitmproxy
Our great sponsors
SQLMap | mitmproxy | |
---|---|---|
40 | 152 | |
30,300 | 34,063 | |
1.7% | 1.7% | |
8.7 | 9.4 | |
3 days ago | 4 days ago | |
Python | Python | |
GNU General Public License v3.0 or later | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
SQLMap
-
Best Hacking Tools for Beginners 2024
sqlmap
-
Restful API Testing (my way) with Express, Maria DB, Docker Compose and Github Action
A few weeks ago, I took a short cyber security course on Udemy. SQL injection was a section of the course. I knew about the concept though, I hadn't tried it. I was planning to make a Restful API server and tried SQL injection using a tool sqlmap, which was introduced in the course. While I could have used existing server code, I decided to build one from scratch. It's been a while since I worked on a Restful API server, and I wanted to refresh my knowledge for learning purposes.
-
[GitHub Action]: Wrappers for sqlmap, bbot and nikto
Its not that much of a tool than wrappers of few awesome tools that most of you probably know and use today - sqlmap, bbot and nikto.
-
[GitHub Action][Release]: Add DAST and OSINT to your security pipelines
I'm excited to share with you my latest contributions to the GitHub community: a collection of free GitHub Actions designed to streamline and enhance security practices utilizing DAST and OSINT tooling that is widely used - sqlmap, bbot and nikto. There were no GH Actions that I could find, so I made them for my use case, but figured everyone can benefit from those awesome tools.
-
The 36 tools that SaaS can use to keep their product and data safe from criminal hackers (manual research)
SQLMap
-
AI-powered Bing Chat spills its secrets via prompt injection attack
It's very interesting that AppSec may now begin to include "prompt injection" attacks as something of relevance.
Specifically with libraries like LangChain[0] that allow for you to perform complex actions ("What's the weather?" -> makes HTTP request to fetch weather) then we end up in a world where injection attacks can have side effects with security implications.
I've been thinking about what security might look like for a post-ChatGPT world and how I'd attempt to defend against it. I'd probably start by building a database of attack prompts, kind of like this[1] fuzz list but for AI, then I'd train a second neural net that acts like an adversarial neural network[2] to try to exploit the system based on those payloads. The end result would sort of like SQLMap[3] but for AI systems where it can automatically "leak" hidden prompts and potentially find "bypasses" to escape the sandbox.
Has anybody else spent any time thinking about how to defend systems against prompt injection attacks that have possible side effects (like making an HTTP request)?
0: https://langchain.readthedocs.io/en/latest/modules/agents/ex...
1: https://github.com/1N3/IntruderPayloads
2: https://en.wikipedia.org/wiki/Generative_adversarial_network
-
Pentesting Tools I Use Everyday
Learn more about sqlmap here: https://sqlmap.org/
-
How attackers use exposed Prometheus server to exploit Kubernetes clusters
In the first scenario, the exposed application is running on a Kubernetes cluster and the attacker wants to access the data without authorization. The first thing the attacker could check is if the application can be exploited through normal pentesting techniques, for example, with SQLmap the attacker can try to gain access to the data.
-
Web Pentesting Learning - Beginner edition
sqlmap
-
WebGoat - SQL Injection (advanced) Part 5 - I'm having trouble to get the columns of any table
──(kali㉿kali)-[~/Documents] └─$ sqlmap --threads 10 -r webgoat-sql-register-request.txt -p username_reg -v 1 -D user001 -T SQL_CHALLENGE_USERS --columns ___ __H__ ___ ___[)]_____ ___ ___ {1.6.4#stable} |_ -| . [.] | .'| . | |___|_ [']_|_|_|__,| _| |_|V... |_| https://sqlmap.org [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program [*] starting @ 04:07:48 /2022-08-15/ [04:07:48] [INFO] parsing HTTP request from 'webgoat-sql-register-request.txt' [04:07:48] [INFO] resuming back-end DBMS 'hsqldb' [04:07:48] [INFO] testing connection to the target URL sqlmap resumed the following injection point(s) from stored session: --- Parameter: username_reg (PUT) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: username_reg=Tom' AND 6674=6674 AND 'fIDT'='fIDT&[email protected]&password_reg=1&confirm_password_reg=1 --- [04:07:48] [INFO] the back-end DBMS is HSQLDB back-end DBMS: HSQLDB 1.7.2 [04:07:48] [INFO] fetching columns for table 'SQL_CHALLENGE_USERS' in database 'user001' [04:07:48] [INFO] retrieved: [04:07:49] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' [04:07:49] [ERROR] unable to retrieve the number of columns for table 'SQL_CHALLENGE_USERS' in database 'user001' [04:07:49] [WARNING] unable to retrieve column names for table 'SQL_CHALLENGE_USERS' in database 'user001' do you want to use common column existence check? [y/N/q] [04:07:51] [INFO] fetched data logged to text files under '/home/kali/.local/share/sqlmap/output/localhost' [*] ending @ 04:07:51 /2022-08-15/
mitmproxy
- Bruno
-
mitmproxy VS petep - a user suggested alternative
2 projects | 3 Oct 2023
-
How to implement SSL/TLS pinning in Node.js
A great way to test the effectiveness of a pinning implementation is by simulating an MITM attack. Tools like Mitmproxy or Wireshack allow us to create a test environment to monitor, intercept, and proxy network requests for a test host.
- Evading JavaScript Anti-Debugging Techniques
-
“Our paying customers need X, when will you fix it?”
Actually, reading the issue I think the IBM request is a lot more reasonable than this tweet makes it seem.[1] The issue is essentially that a mitmproxy dependency has a CVE, mitmproy updated the dependency (in March), but hasn't made a stable release yet with this update, and IBM guy is asking "when do you plan to tag a release? Do you have a timeline for this?"
Notably it's NOT asking for a fix; "when will you fix it?" is not accurate as there is nothing to be fixed. It's just asking "when do you plan to make a new release with this dependency update?"
update
mhils: "@FrugalGuy has just sent me genuine apology, which I truly appreciate. Please be nice and assume good intentions. :heart: "
https://github.com/mitmproxy/mitmproxy/issues/6051#issuecomm...
-
Is there a tool that can help me automate downloading JSON responses from the Network tab in developer tools?
You can programatically extract XHR request URLs: https://github.com/wkeeling/selenium-wire#intercepting-requests-and-responses It uses https://github.com/mitmproxy/mitmproxy which you could also script.
-
Backup apollo app version 0.15.9 if you want to use it after June 30th without sideloading
Once you uninstalled mitmproxy go to https://mitmproxy.org
-
All browsers - is it possible to replace specific image url with another?
In /etc/hosts file you put only IP addresses and hostnames, i.e. 127.0.0.1 cdn.cloudflare.steamstatic.com. Then you have to set up a web server on localhost port 80 and put your image at http://localhost/steamcommunity/public/images/apps/753/1d0167575d746dadea7706685c0f3c01c8aeb6d8.jpg as well as other files from https://cdn.cloudflare.steamstatic.com. You also have to keep the URLs updated when they change upstream. It's not worth it. Better use a local proxy server like mitmproxy or requestly.
What are some alternatives?
Wireshark - Read-only mirror of Wireshark's Git repository at https://gitlab.com/wireshark/wireshark. ⚠️ GitHub won't let us disable pull requests. ⚠️ THEY WILL BE IGNORED HERE ⚠️ Upload them at GitLab instead.
Shadowrocket-ADBlock-Rules - 提供多款 Shadowrocket 规则,带广告过滤功能。用于 iOS 未越狱设备选择性地自动翻墙。
bettercap - The Swiss Army knife for 802.11, BLE, IPv4 and IPv6 networks reconnaissance and MITM attacks.
nuclei - Fast and customizable vulnerability scanner based on simple YAML based DSL.
sslstrip - A tool for exploiting Moxie Marlinspike's SSL "stripping" attack.
Metasploit - Metasploit Framework
ZAP - The ZAP core project
IOXY - MQTT intercepting proxy
setoolkit - The Social-Engineer Toolkit (SET) repository from TrustedSec - All new versions of SET will be deployed here.
commix - Automated All-in-One OS Command Injection Exploitation Tool.
mockttp - Powerful friendly HTTP mock server & proxy library