Una nueva técnica permite a los hackers ocultar vulnerabilidades en el código fuente https://unaaldia.hispasec.com/2021/11/una-nueva-tecnica-permite-a-los-hackers-ocultar-vulnerabilidades-en-el-codigo-fuente.html

[webapps] PHP Laravel 8.70.1 - Cross Site Scripting (XSS) to Cross Site Request Forgery (CSRF)
PHP Laravel 8.70.1 - Cross Site Scripting (XSS) to Cross Site Request Forgery (CSRF)
https://www.exploit-db.com/exploits/50525

Vamos con todo en esta #HackForAll
Orgulloso de nuestros Sponsors!!
Aún pueden enviar sus Papers hasta el 30 de Noviembre
CFP: hack.for.all.evento@gmail.com

Participa en nuestros en el CTF y los Sorteos.
Inscribite aqui 👇🏻
https://forms.gle/eeCeh1RX27XrVN7U9

Esta web de la NASA te permite observar la Tierra desde el espacio y descubrir qué hacen nuestros satélites
https://computerhoy.com/noticias/tecnologia/web-nasa-te-permite-observar-tierra-espacio-descubrir-hacen-principales-satelites-966117

Location: Republic of Korea 🇰🇷
IP: 14.48.197.145

Uptime : 4 Days

Type : UDP 1195

Cisco Common Services Platform Collector SQL Injection Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CSPC-SQLI-unVPTn5?vs_f=Cisco%20Security%20Advisory&vs_cat=Security%20Intelligence&vs_type=RSS&vs_p=Cisco%20Common%20Services%20Platform%20Collector%20SQL%20Injection%20%20Vulnerability&vs_k=1

A vulnerability in the configuration dashboard of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to submit a SQL query through the CSPC configuration dashboard.
This vulnerability is due to insufficient input validation of uploaded files. An attacker could exploit this vulnerability by uploading a file containing a SQL query to the configuration dashboard. A successful exploit could allow the attacker to read restricted information from the CSPC SQL database.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CSPC-SQLI-unVPTn5



Security Impact Rating: Medium



CVE: CVE-2021-40129

Utilizan plantillas y archivos RTF para phishing y malware
https://blog.segu-info.com.ar/2021/12/utilizan-plantillas-y-archivos-rtf-para.html

[local] MilleGPG5 5.7.2 Luglio 2021 - Local Privilege Escalation
MilleGPG5 5.7.2 Luglio 2021 - Local Privilege Escalation
https://www.exploit-db.com/exploits/50558

Detecting Privilege Escalation Zero Day (CVE-2021-41379)
https://www.logpoint.com/en/blog/detecting-privilege-escalation-zero-day-cve-2021-41379/

Location: Japan 🇯🇵
IP: 219.100.37.134

Uptime : 19 Days

Type : UDP 1195

Les comparto.

https://github.com/Anonimo501/nfs_shares/blob/main/README.md

Nueva entrada en el blog THW: https://thehackerway.com/2021/12/02/post-explotacion-en-sistemas-windows-con-winpeas/

⛔️⛔️TRYHACKME ROADMAP⛔️⛔️



# Level 1 - Intro
- [ ] OpenVPN https://tryhackme.com/room/openvpn
- [ ] Welcome https://tryhackme.com/jr/welcome
- [ ] Intro to Researching https://tryhackme.com/room/introtoresearch
- [ ] Learn Linux https://tryhackme.com/room/zthlinux
- [ ] Crash Course Pentesting https://tryhackme.com/room/ccpentesting

Introductory CTFs to get your feet wet

- [ ] Google Dorking https://tryhackme.com/room/googledorking
- [ ] OHsint https://tryhackme.com/room/ohsint
- [ ] Shodan.io https://tryhackme.com/room/shodan

# Level 2 - Tooling
- [ ] Tmux https://tryhackme.com/room/rptmux
- [ ] Nmap https://tryhackme.com/room/rpnmap
- [ ] Web Scanning https://tryhackme.com/room/rpwebscanning
- [ ] Sublist3r https://tryhackme.com/room/rpsublist3r
- [ ] Metasploit https://tryhackme.com/room/rpmetasploit
- [ ] Hydra https://tryhackme.com/room/hydra
- [ ] Linux Privesc https://tryhackme.com/room/linuxprivesc
- [ ] Web Scanning https://tryhackme.com/room/rpwebscanning

More introductory CTFs
- [ ] Vulnversity - https://tryhackme.com/room/vulnversity
- [ ] Blue - https://tryhackme.com/room/blue
- [ ] Simple CTF https://tryhackme.com/room/easyctf
- [ ] Bounty Hacker https://tryhackme.com/room/cowboyhacker

# Level 3 - Crypto & Hashes with CTF practice
- [ ] Crack the hash https://tryhackme.com/room/crackthehash
- [ ] Agent Sudo https://tryhackme.com/room/agentsudoctf
- [ ] The Cod Caper https://tryhackme.com/room/thecodcaper
- [ ] Ice https://tryhackme.com/room/ice
- [ ] Lazy Admin https://tryhackme.com/room/lazyadmin
- [ ] Basic Pentesting https://tryhackme.com/room/basicpentestingjt

# Level 4 - Web
- [ ] OWASP top 10 https://tryhackme.com/room/owasptop10
- [ ] Inclusion https://tryhackme.com/room/inclusion
- [ ] Injection https://tryhackme.com/room/injection
- [ ] Vulnversity https://tryhackme.com/room/vulnversity
- [ ] Basic Pentesting https://tryhackme.com/room/basicpentestingjt
- [ ] Juiceshop https://tryhackme.com/room/owaspjuiceshop
- [ ] Ignite https://tryhackme.com/room/ignite
- [ ] Overpass https://tryhackme.com/room/overpass
- [ ] Year of the Rabbit https://tryhackme.com/room/yearoftherabbit
- [ ] DevelPy https://tryhackme.com/room/bsidesgtdevelpy
- [ ] Jack of all trades https://tryhackme.com/room/jackofalltrades
- [ ] Bolt https://tryhackme.com/room/bolt

# Level 5 - Reverse Engineering
- [ ] Intro to x86 64 https://tryhackme.com/room/introtox8664
- [ ] CC Ghidra https://tryhackme.com/room/ccghidra
- [ ] CC Radare2 https://tryhackme.com/room/ccradare2
- [ ] CC Steganography https://tryhackme.com/room/ccstego
- [ ] Reverse Engineering https://tryhackme.com/room/reverseengineering
- [ ] Reversing ELF https://tryhackme.com/room/reverselfiles
- [ ] Dumping Router Firmware https://tryhackme.com/room/rfirmware

# Level 6 - PrivEsc
- [ ] Sudo Security Bypass https://tryhackme.com/room/sudovulnsbypass
- [ ] Sudo Buffer Overflow https://tryhackme.com/room/sudovulnsbof
- [ ] Windows Privesc Arena https://tryhackme.com/room/windowsprivescarena
- [ ] Linux Privesc Arena https://tryhackme.com/room/linuxprivescarena
- [ ] Windows Privesc https://tryhackme.com/room/windows10privesc
- [ ] Blaster https://tryhackme.com/room/blaster
- [ ] Ignite https://tryhackme.com/room/ignite
- [ ] Kenobi https://tryhackme.com/room/kenobi
- [ ] Capture the flag https://tryhackme.com/room/c4ptur3th3fl4g
- [ ] Pickle Rick https://tryhackme.com/room/picklerick

# Level 7 - CTF practice
- [ ] Post Exploitation Basics https://tryhackme.com/room/postexploit
- [ ] Smag Grotto https://tryhackme.com/room/smaggrotto
- [ ] Inclusion https://tryhackme.com/room/inclusion
- [ ] Dogcat https://tryhackme.com/room/dogcat
- [ ] LFI basics https://tryhackme.com/room/lfibasics
- [ ] Buffer Overflow Prep https://tryhackme.com/room/bufferoverflowprep
- [ ] Overpass https://tryhackme.com/room/overpass
- [ ] Break out the cage https://tryhackme.com/room/breakoutthecage1
- [ ] Lian Yu https://tryhackme.com/room/lianyu

Un nuevo malware usa procesos de Nginx para pasar desapercibido

https://unaaldia.hispasec.com/2021/12/un-nuevo-malware-usa-procesos-de-nginx-para-pasar-desapercibido.html

[webapps] WordPress Plugin All-in-One Video Gallery plugin 2.4.9 - Local File Inclusion (LFI)
WordPress Plugin All-in-One Video Gallery plugin 2.4.9 - Local File Inclusion (LFI)
https://www.exploit-db.com/exploits/50562

Location: Japan 🇯🇵
IP: 219.100.37.52

Uptime : 298 Days

Type : TCP 443

AutoSUID - Linux Privilege Escalation

#PrivilegesEscalating #SUID #Linux

https://reconshell.com/auto-suid-linux-privilege-escalation/