uphiago
Showing 61–81 of 81 skills · Page 2 of 2
uphiago / wordpress-cors-xmlrpc-rce-chain
1.3kUse when verified WordPress CORS, XML-RPC, role, upload, and execution behaviors may form one authorized attack path.
uphiago / wordpress-full-compromise
1.3kUse when verified WordPress findings may combine into an authorized path to administrative or server control.
uphiago / attack-patterns-reference
1.3kUse when classifying a verified web or WordPress behavior and selecting a related validation skill.
uphiago / 401-403-bypass-techniques
1.3kUse when protected HTTP routes return 401 or 403.
uphiago / cors-credential-wordpress
1.3kExploit WP CORS credential reflection for data theft.
uphiago / docker-privesc
1.3kEscape Docker containers to host root via 5 techniques.
uphiago / error-log-mining
1.3kMine error_log for creds, paths, SQL when leak hunt finds.
uphiago / gitlab-public-recon
1.3kMine GitLab for secrets, CI tokens when subdomain found.
uphiago / iot-camera-recon
1.3kAttack cameras via RTSP, ONVIF, Axis config when 554 open.
uphiago / jwt-attack
1.3kDecode, forge, brute JWTs when Bearer auth header is seen.
uphiago / phpinfo-to-rce
1.3kChain phpinfo to RCE via exec check when info.php exposed.
uphiago / port-mass-scan
1.3kPort scan /8-/24 with Masscan+RustScan and nmap banners.
uphiago / recon-sector
1.3kParameterized sector recon using sector database.
uphiago / saml-sso-attack
1.3kAttack SAML SSO via XSW, signature strip, metadata extract.
uphiago / sector-recon-methodology
1.3kPick sectors, compile targets, batch recon for campaigns.
uphiago / source-leak-hunt
1.3kMass scan for exposed env files, backups, and git configs.
uphiago / staging-subdomain-hunt
1.3kHunt staging via crt.sh when production is WAF-hardened.
uphiago / subdomain-enumeration
1.3kMap subdomains via crt.sh and subfinder at recon kickoff.
uphiago / wordpress-plugin-hunt
1.3kHunt WP plugins via REST, exploit CVEs when version known.
uphiago / wp-mass-recon
1.3kBatch WP recon: users, CORS, XMLRPC, leaks across domains.
uphiago / zimbra-attack
1.3kZimbra SOAP user enum, CVE-2022-37042, SSRF when webmail.