Aggregator

HackTheBox Absolute [AS-Rep-Roast + Kerberos Authentication + ACLs Modification + KrbRelay](link is external)

fdvoid0's blog
1 year 10 months ago
简述

本文是insane难度的HTB absolute机器的域渗透部分，其中大量的Kerberos，ACL，KrbRelay，bloodhound，Shadow Credentials Attack，ldap enumeration，PTH，GROUPS权限修改，interactive session等域渗透只是细节是此box的特色，主要参考0xdf’s blog absolute walkthrough和HTB的absolute官方writeup paper记录这篇博客加深记忆和理解，及供后续做深入研究查阅，备忘。

253

ChatGPT Plugin Exploit Explained: From Prompt Injection to Accessing Private Data(link is external)

Embrace The Red
1 year 10 months ago
If you are building ChatGPT plugins, LLM agents, tools or integrations this is a must read. This post explains how the first exploitable Cross Plugin Request Forgery was found in the wild and the fix which was applied. Indirect Prompt Injections Are Now A Reality With plugins and browsing support Indirect Prompt Injections are now a reality in the ChatGPT ecosystem. The real-world examples and demos provided by others and myself to raise awarness about this increasing problem have been mostly amusing and harmless, like making Bing Chat speak like a pirate, make ChatGPT add jokes at the end or having it do a Rickroll when reading YouTube transcripts.

Managed ad