Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Decrypting WebLogic Passwords

netspi.com | blog | #pentesting | #lateral-movement | #oracle | #credential-recovery | #weblogic | #password-decryption

Summary

An exposed Samba share revealed a WebLogic install during an internal pentest; this walkthrough decrypts credentials from WebLogic configs to pivot to Oracle databases and other systems.
Published
Collected

original ↗

Related coverage

vulnerability · netspi.com
Oracle WebLogic Server Proxy Plugin (CVE-2026-21962): Overview & Takeaways
CVE-2026-21962 (CVSS 10.0) lets unauthenticated attackers bypass security in Oracle HTTP Server and WebLogic proxy plugins for Apache and IIS, exposing backend WebLogic systems in the DMZ.
vulnerability · bishopfox.com
Oracle WebLogic Node Manager allows arbitrary configuration via UNC path
Bishop Fox advisory: WebLogic Node Manager 10.3.3 and earlier let unauthenticated attackers redirect its config and password files to an attacker-controlled UNC path, then run commands; fixed in 2011.
blog · netspi.com
DEF CON 33: NetSPI’s “Access Everywhere” Experience
NetSPI security experts share key insights from DEF CON 33's "Access Everywhere" theme, from networking with hackers to expanding security expertise through sessions and workshops.
blog · netspi.com
Pivoting Clouds in AWS Organizations – Part 1: Leveraging Account Creation, Trusted Access, and Delegated Admin
Part one on pivoting across AWS Organizations: account boundaries, the 'easy win' of attacker-created member accounts, and abuse of trusted access, delegated administration and IAM Access Analyzer.
blog · netspi.com
Lateral Movement in Azure App Services
From command execution on an Azure App Services host, attackers can inspect the environment, reach storage and Azure SQL, and abuse Managed Identity tokens to access Key Vaults and escalate.
blog · netspi.com
Limiting The Exposure of Plain Text Passwords in C#
NetSPI shows why .NET SecureString still leaks passwords in memory via NetworkCredential, and demonstrates safer login handling using pinned mutable byte arrays instead of immutable strings.
back