MayorSec - Home of The Mayor

🔖

Penetration Testing Resources

Windows Host Commands

Windows Network Exploitation

Linux Host Commands

Web Application Testing

PowerShell Commands

Links and more https://twitter.com/joehelle

https://youtube.com/c/JoeHellethemayor

https://github.com/dievus

https://medium.themayor.tech

https://discord.gg/aceeFEHkmA

https://twitch.tv/themayor11

🖇️

Educational Courses and Sponsorships

Learn by Doing - Python3 Command and Control How To Guide

Movement, Pivoting, and Persistence

🗞️

Recent News, Articles, and Videos

CVE Hunting Tips #004

Observable Response and Timing Discrepancies

medium.themayor.tech

CVE Hunting Tips #003

Rack Attack Rack Attack is a "middleware for blocking and throttling" in Ruby on Rails code ( rack/rack-attack: Rack middleware for blocking & throttling (github.com). Rack attack allows a developer to set various rules in the configuration for allowing, blocking, and throttling requests.

medium.themayor.tech

CVE Hunting Tips #002

Text Input Denials of Service Countless websites allow users to input characters in any number of locations. These can be usernames, passwords, about me sections, or in the case of today's finding, a notetaking section in an inventory management system. These inputs are needed for effective usage and management of web applications are vital to operations.

medium.themayor.tech

CVE Hunting Tips #000

Finding Projects Bug hunting, in the eyes of companies like HackerOne and Bugcrowd, is all about impact. It's been beaten into people's heads that low-hanging fruit issues aren't accepted or aren't worth your time.

medium.themayor.tech

Internal Persistence Techniques - TCM Security

The majority of our internal penetration tests are at least a week long. While we generally have a drop box sent to the client to enable our access to the network, we have to consider efficiency as well.

tcm-sec.com

Internal Persistence Techniques - TCM Security

eCPTX Exam Review

eLearnSecurity Certified Penetration Tester eXtreme I recently decided to take the eLearnSecurity Certified Penetration Tester eXtreme (eCPTX) exam. I have been feeling confident with pentesting active directory environments and felt I would be able to give it a shot. Here are my thoughts.

medium.themayor.tech

Windows Persistence Using WSL2

I don't think this is what it was meant for Consider supporting my work at https://ko-fi.com/themayor . I really enjoy exploitation in Windows environments. It is a landscape that is ripe with opportunities for privilege escalation, exploitation, and persistence opportunities.

medium.com

Domain Domination With Windows Shortcuts

Wait, what? How? Consider supporting my work at https://ko-fi.com/themayor . I've recently had the necessity to learn about a feature in Microsoft Windows that we take for granted everyday - Shortcuts. We use them all the time to access things like search engines, web sites, and file shares.

medium.com

Domain Domination With Windows Shortcuts

How I Was Bored One Night and Found Two CVEs

I'm regularly asked by people how to break into penetration testing who are in the same position I was in not long ago. It was less than a year ago I was at my wit's end. I thought I was unemployable in IT in general, not just pentesting.

medium.com

How I Was Bored One Night and Found Two CVEs

Boost Your Security Program for WFH Employees - TCM Security

With communities beginning to open back up, companies are considering the decision to stay remote. And this comes with good reasons. The cost of leasing space might be prohibitive and downsizing to host only necessary business functions could help with expenses.

tcm-sec.com

ZeroPointSecurity Certified Red Team Operator Course (CRTO) Review

Continuing my education in all things hacking, I recently decided to give Rastamouse's CRTO course a go. There isn't much to go off of from other reviews, so it's one of the first courses I've taken in some time where someone I know couldn't provide any advice or experiences.

medium.com

ZeroPointSecurity Certified Red Team Operator Course (CRTO) Review

eLearnSecurity eWPT Certification

As with anything in life, we do ourselves a disservice if we don't spend considerable time trying to improve those things we struggle with. It's no secret among my various circles that my weak area in penetration testing is web applications. I find them challenging more or less because I lack a complete interest in pentesting websites.

medium.com

Hacking MS-SQL - From SQLi to Server Administrator

In this video we conduct initial scanning and enumeration on a Windows Server, discover a SQL injection vulnerability in a website, exploit it, and gain acce...

www.youtube.com

Hacking MS-SQL - From SQLi to Server Administrator

Pentester Academy Certified Red Team Professional (CRTP) Review

Early this year I purchased and completed Pentester Academy's Attacking and Defending Active Directory course. The coursework prepares the student to take the Certified Red Team Professional exam, which is a comprehensive, multi-domain challenge consisting of multiple machines to exploit across a forest trust.

medium.com

Pentester Academy Certified Red Team Professional (CRTP) Review

Relevant Walkthrough - TryHackMe

Please consider supporting me on Patreon at https://www.patreon.com/themayorThe video walkthrough for Relevant on TryHackMe. I created Relevant to show that...

youtu.be

Integration Partners discovers Zero-Day vulnerability in Web Application | Integration Partners | Lexington, MA

Zero-Day vulnerability discovered by Joe Helle, Security Engineer at Integration Partners On November 8th, 2020 our newest Security Engineer, Joe Helle, was issued a CVE (Common Vulnerability and Exposures) number for a Zero-Day Reflected Cross-Site Scripting vulnerability in a...Read More

integrationpartners.com