Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

dataLoc: A POC Tool for Finding Payment Cards Stored in MSSQL

netspi.com | blog | #pci-dss | #tooling | #mssql | #dataloc | #data-discovery | #payment-cards

Summary

Introduces dataLoc, a standalone tool that scans live MSSQL databases for payment card data using pattern scoring and Luhn checks instead of keywords, aimed at DBAs, auditors, and testers.
Published
Collected

original ↗

Related coverage

blog · netspi.com
Identifying Payment Cards at Rest – Going Beyond the Key Word Search
Uses MSSQL's native string functions to rule out tables and columns that cannot hold cardholder data, pairing card-number patterns and Luhn validation to cut the cost of cardholder data discovery.
blog · netspi.com
ADPathFinder: OpenGraph Attack Path Mapping in BloodHound CE
ADPathFinder extends BloodHound CE by unifying SharpHound with OpenGraph collectors, mapping privilege escalation paths across AD, ADCS, MSSQL, and SCCM plus context-aware password audits.
blog · netspi.com
Legacy Meets Modern: Breaking AD Through NIS & MFA Infrastructure
An engagement walkthrough: root access via Apache NiFi, recovered NIS hashes and Duo Auth Proxy secrets, decrypted MFA traffic, then a DA MSSQL relay via xp_cmdshell to domain admin and DCSync.
blog · netspi.com
Automating Managed Identity Token Extraction in Azure Container Registries
NetSPI shows how malicious Azure Container Registry tasks can generate and export tokens for attached Managed Identities, releasing a MicroBurst tool, Invoke-AzACRTokenGenerator, to automate it.
blog · netspi.com
Burp Suite Extension: AWS Signer 2.0 Release
AWS Signer 2.0 for Burp Suite signs or re-signs AWS API requests with SigV4 as they pass through the proxy, adding a new UI, profile management, and multi-source profile import for pentesters.
blog · netspi.com
NetblockTool: The Easy Way to Find IP Addresses Owned by a Company
NetblockTool is a Python tool that automates netblock discovery, scraping Google dorks, ARIN, and IPinfo to build a confidence-ranked list of IP ranges owned by a company and its subsidiaries.
back