[webapps] PHP Laravel 8.70.1 - Cross Site Scripting (XSS) to Cross Site Request Forgery (CSRF)
PHP Laravel 8.70.1 - Cross Site Scripting (XSS) to Cross Site Request Forgery (CSRF)
https://www.exploit-db.com/exploits/50525
PHP Laravel 8.70.1 - Cross Site Scripting (XSS) to Cross Site Request Forgery (CSRF)
https://www.exploit-db.com/exploits/50525
Exploit Database
PHP Laravel 8.70.1 - Cross Site Scripting (XSS) to Cross Site Request Forgery (CSRF)
PHP Laravel 8.70.1 - Cross Site Scripting (XSS) to Cross Site Request Forgery (CSRF). CVE-2021-43617 . webapps exploit for PHP platform
Forwarded from Hack For All - Hack y Comunidad
This media is not supported in your browser
VIEW IN TELEGRAM
Vamos con todo en esta #HackForAll
Orgulloso de nuestros Sponsors!!
Aún pueden enviar sus Papers hasta el 30 de Noviembre
CFP: hack.for.all.evento@gmail.com
Participa en nuestros en el CTF y los Sorteos.
Inscribite aqui 👇🏻
https://forms.gle/eeCeh1RX27XrVN7U9
Orgulloso de nuestros Sponsors!!
Aún pueden enviar sus Papers hasta el 30 de Noviembre
CFP: hack.for.all.evento@gmail.com
Participa en nuestros en el CTF y los Sorteos.
Inscribite aqui 👇🏻
https://forms.gle/eeCeh1RX27XrVN7U9
Esta web de la NASA te permite observar la Tierra desde el espacio y descubrir qué hacen nuestros satélites
https://computerhoy.com/noticias/tecnologia/web-nasa-te-permite-observar-tierra-espacio-descubrir-hacen-principales-satelites-966117
https://computerhoy.com/noticias/tecnologia/web-nasa-te-permite-observar-tierra-espacio-descubrir-hacen-principales-satelites-966117
ComputerHoy
Esta web de la NASA te permite observar la Tierra desde el espacio y descubrir qué hacen nuestros satélites
La página muestra 21 satélites que actualmente orbitan nuestro planeta. Para saber más cobre ellos, sólo hay que hacer clic en la pestaña Misiones y disfrutar.
Cisco Common Services Platform Collector SQL Injection Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CSPC-SQLI-unVPTn5?vs_f=Cisco%20Security%20Advisory&vs_cat=Security%20Intelligence&vs_type=RSS&vs_p=Cisco%20Common%20Services%20Platform%20Collector%20SQL%20Injection%20%20Vulnerability&vs_k=1
A vulnerability in the configuration dashboard of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to submit a SQL query through the CSPC configuration dashboard.
This vulnerability is due to insufficient input validation of uploaded files. An attacker could exploit this vulnerability by uploading a file containing a SQL query to the configuration dashboard. A successful exploit could allow the attacker to read restricted information from the CSPC SQL database.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CSPC-SQLI-unVPTn5
Security Impact Rating: Medium
CVE: CVE-2021-40129
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CSPC-SQLI-unVPTn5?vs_f=Cisco%20Security%20Advisory&vs_cat=Security%20Intelligence&vs_type=RSS&vs_p=Cisco%20Common%20Services%20Platform%20Collector%20SQL%20Injection%20%20Vulnerability&vs_k=1
A vulnerability in the configuration dashboard of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to submit a SQL query through the CSPC configuration dashboard.
This vulnerability is due to insufficient input validation of uploaded files. An attacker could exploit this vulnerability by uploading a file containing a SQL query to the configuration dashboard. A successful exploit could allow the attacker to read restricted information from the CSPC SQL database.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CSPC-SQLI-unVPTn5
Security Impact Rating: Medium
CVE: CVE-2021-40129
Cisco
Cisco Security Advisory: Cisco Common Services Platform Collector SQL Injection Vulnerability
A vulnerability in the configuration dashboard of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to submit a SQL query through the CSPC configuration dashboard.
This vulnerability is due to insufficient input…
This vulnerability is due to insufficient input…
Utilizan plantillas y archivos RTF para phishing y malware
https://blog.segu-info.com.ar/2021/12/utilizan-plantillas-y-archivos-rtf-para.html
https://blog.segu-info.com.ar/2021/12/utilizan-plantillas-y-archivos-rtf-para.html
Segu-Info - Ciberseguridad desde 2000
Utilizan plantillas y archivos RTF para phishing y malware
[local] MilleGPG5 5.7.2 Luglio 2021 - Local Privilege Escalation
MilleGPG5 5.7.2 Luglio 2021 - Local Privilege Escalation
https://www.exploit-db.com/exploits/50558
MilleGPG5 5.7.2 Luglio 2021 - Local Privilege Escalation
https://www.exploit-db.com/exploits/50558
Exploit Database
MilleGPG5 5.7.2 Luglio 2021 - Local Privilege Escalation
MilleGPG5 5.7.2 Luglio 2021 - Local Privilege Escalation.. local exploit for Windows platform
Detecting Privilege Escalation Zero Day (CVE-2021-41379)
https://www.logpoint.com/en/blog/detecting-privilege-escalation-zero-day-cve-2021-41379/
https://www.logpoint.com/en/blog/detecting-privilege-escalation-zero-day-cve-2021-41379/
Logpoint
Detecting Privilege Escalation Zero Day (CVE-2021-41379)
On November 22, 2021, Security researcher Abdelhamid Naceri dropped PoC for a privilege escalation vulnerability (CVE-2021-41379) in the Windows installer that Microsoft had patched in November's Patch Tuesday. The PoC works on all supported versions of Windows.
Nueva entrada en el blog THW: https://thehackerway.com/2021/12/02/post-explotacion-en-sistemas-windows-con-winpeas/
Seguridad en Sistemas y Técnicas de Hacking. TheHackerWay (THW)
Post-explotación en sistemas Windows con WinPEAS
Demostración en vídeo del post Existen varias utilidades y herramientas que ayudan en los procesos de post-explotación en sistemas Windows, la mayoría de ellas permiten detectar malas configuracion…
⛔️⛔️TRYHACKME ROADMAP⛔️⛔️
# Level 1 - Intro
- [ ] OpenVPN https://tryhackme.com/room/openvpn
- [ ] Welcome https://tryhackme.com/jr/welcome
- [ ] Intro to Researching https://tryhackme.com/room/introtoresearch
- [ ] Learn Linux https://tryhackme.com/room/zthlinux
- [ ] Crash Course Pentesting https://tryhackme.com/room/ccpentesting
Introductory CTFs to get your feet wet
- [ ] Google Dorking https://tryhackme.com/room/googledorking
- [ ] OHsint https://tryhackme.com/room/ohsint
- [ ] Shodan.io https://tryhackme.com/room/shodan
# Level 2 - Tooling
- [ ] Tmux https://tryhackme.com/room/rptmux
- [ ] Nmap https://tryhackme.com/room/rpnmap
- [ ] Web Scanning https://tryhackme.com/room/rpwebscanning
- [ ] Sublist3r https://tryhackme.com/room/rpsublist3r
- [ ] Metasploit https://tryhackme.com/room/rpmetasploit
- [ ] Hydra https://tryhackme.com/room/hydra
- [ ] Linux Privesc https://tryhackme.com/room/linuxprivesc
- [ ] Web Scanning https://tryhackme.com/room/rpwebscanning
More introductory CTFs
- [ ] Vulnversity - https://tryhackme.com/room/vulnversity
- [ ] Blue - https://tryhackme.com/room/blue
- [ ] Simple CTF https://tryhackme.com/room/easyctf
- [ ] Bounty Hacker https://tryhackme.com/room/cowboyhacker
# Level 3 - Crypto & Hashes with CTF practice
- [ ] Crack the hash https://tryhackme.com/room/crackthehash
- [ ] Agent Sudo https://tryhackme.com/room/agentsudoctf
- [ ] The Cod Caper https://tryhackme.com/room/thecodcaper
- [ ] Ice https://tryhackme.com/room/ice
- [ ] Lazy Admin https://tryhackme.com/room/lazyadmin
- [ ] Basic Pentesting https://tryhackme.com/room/basicpentestingjt
# Level 4 - Web
- [ ] OWASP top 10 https://tryhackme.com/room/owasptop10
- [ ] Inclusion https://tryhackme.com/room/inclusion
- [ ] Injection https://tryhackme.com/room/injection
- [ ] Vulnversity https://tryhackme.com/room/vulnversity
- [ ] Basic Pentesting https://tryhackme.com/room/basicpentestingjt
- [ ] Juiceshop https://tryhackme.com/room/owaspjuiceshop
- [ ] Ignite https://tryhackme.com/room/ignite
- [ ] Overpass https://tryhackme.com/room/overpass
- [ ] Year of the Rabbit https://tryhackme.com/room/yearoftherabbit
- [ ] DevelPy https://tryhackme.com/room/bsidesgtdevelpy
- [ ] Jack of all trades https://tryhackme.com/room/jackofalltrades
- [ ] Bolt https://tryhackme.com/room/bolt
# Level 5 - Reverse Engineering
- [ ] Intro to x86 64 https://tryhackme.com/room/introtox8664
- [ ] CC Ghidra https://tryhackme.com/room/ccghidra
- [ ] CC Radare2 https://tryhackme.com/room/ccradare2
- [ ] CC Steganography https://tryhackme.com/room/ccstego
- [ ] Reverse Engineering https://tryhackme.com/room/reverseengineering
- [ ] Reversing ELF https://tryhackme.com/room/reverselfiles
- [ ] Dumping Router Firmware https://tryhackme.com/room/rfirmware
# Level 6 - PrivEsc
- [ ] Sudo Security Bypass https://tryhackme.com/room/sudovulnsbypass
- [ ] Sudo Buffer Overflow https://tryhackme.com/room/sudovulnsbof
- [ ] Windows Privesc Arena https://tryhackme.com/room/windowsprivescarena
- [ ] Linux Privesc Arena https://tryhackme.com/room/linuxprivescarena
- [ ] Windows Privesc https://tryhackme.com/room/windows10privesc
- [ ] Blaster https://tryhackme.com/room/blaster
- [ ] Ignite https://tryhackme.com/room/ignite
- [ ] Kenobi https://tryhackme.com/room/kenobi
- [ ] Capture the flag https://tryhackme.com/room/c4ptur3th3fl4g
- [ ] Pickle Rick https://tryhackme.com/room/picklerick
# Level 7 - CTF practice
- [ ] Post Exploitation Basics https://tryhackme.com/room/postexploit
- [ ] Smag Grotto https://tryhackme.com/room/smaggrotto
- [ ] Inclusion https://tryhackme.com/room/inclusion
- [ ] Dogcat https://tryhackme.com/room/dogcat
- [ ] LFI basics https://tryhackme.com/room/lfibasics
- [ ] Buffer Overflow Prep https://tryhackme.com/room/bufferoverflowprep
- [ ] Overpass https://tryhackme.com/room/overpass
- [ ] Break out the cage https://tryhackme.com/room/breakoutthecage1
- [ ] Lian Yu https://tryhackme.com/room/lianyu
# Level 1 - Intro
- [ ] OpenVPN https://tryhackme.com/room/openvpn
- [ ] Welcome https://tryhackme.com/jr/welcome
- [ ] Intro to Researching https://tryhackme.com/room/introtoresearch
- [ ] Learn Linux https://tryhackme.com/room/zthlinux
- [ ] Crash Course Pentesting https://tryhackme.com/room/ccpentesting
Introductory CTFs to get your feet wet
- [ ] Google Dorking https://tryhackme.com/room/googledorking
- [ ] OHsint https://tryhackme.com/room/ohsint
- [ ] Shodan.io https://tryhackme.com/room/shodan
# Level 2 - Tooling
- [ ] Tmux https://tryhackme.com/room/rptmux
- [ ] Nmap https://tryhackme.com/room/rpnmap
- [ ] Web Scanning https://tryhackme.com/room/rpwebscanning
- [ ] Sublist3r https://tryhackme.com/room/rpsublist3r
- [ ] Metasploit https://tryhackme.com/room/rpmetasploit
- [ ] Hydra https://tryhackme.com/room/hydra
- [ ] Linux Privesc https://tryhackme.com/room/linuxprivesc
- [ ] Web Scanning https://tryhackme.com/room/rpwebscanning
More introductory CTFs
- [ ] Vulnversity - https://tryhackme.com/room/vulnversity
- [ ] Blue - https://tryhackme.com/room/blue
- [ ] Simple CTF https://tryhackme.com/room/easyctf
- [ ] Bounty Hacker https://tryhackme.com/room/cowboyhacker
# Level 3 - Crypto & Hashes with CTF practice
- [ ] Crack the hash https://tryhackme.com/room/crackthehash
- [ ] Agent Sudo https://tryhackme.com/room/agentsudoctf
- [ ] The Cod Caper https://tryhackme.com/room/thecodcaper
- [ ] Ice https://tryhackme.com/room/ice
- [ ] Lazy Admin https://tryhackme.com/room/lazyadmin
- [ ] Basic Pentesting https://tryhackme.com/room/basicpentestingjt
# Level 4 - Web
- [ ] OWASP top 10 https://tryhackme.com/room/owasptop10
- [ ] Inclusion https://tryhackme.com/room/inclusion
- [ ] Injection https://tryhackme.com/room/injection
- [ ] Vulnversity https://tryhackme.com/room/vulnversity
- [ ] Basic Pentesting https://tryhackme.com/room/basicpentestingjt
- [ ] Juiceshop https://tryhackme.com/room/owaspjuiceshop
- [ ] Ignite https://tryhackme.com/room/ignite
- [ ] Overpass https://tryhackme.com/room/overpass
- [ ] Year of the Rabbit https://tryhackme.com/room/yearoftherabbit
- [ ] DevelPy https://tryhackme.com/room/bsidesgtdevelpy
- [ ] Jack of all trades https://tryhackme.com/room/jackofalltrades
- [ ] Bolt https://tryhackme.com/room/bolt
# Level 5 - Reverse Engineering
- [ ] Intro to x86 64 https://tryhackme.com/room/introtox8664
- [ ] CC Ghidra https://tryhackme.com/room/ccghidra
- [ ] CC Radare2 https://tryhackme.com/room/ccradare2
- [ ] CC Steganography https://tryhackme.com/room/ccstego
- [ ] Reverse Engineering https://tryhackme.com/room/reverseengineering
- [ ] Reversing ELF https://tryhackme.com/room/reverselfiles
- [ ] Dumping Router Firmware https://tryhackme.com/room/rfirmware
# Level 6 - PrivEsc
- [ ] Sudo Security Bypass https://tryhackme.com/room/sudovulnsbypass
- [ ] Sudo Buffer Overflow https://tryhackme.com/room/sudovulnsbof
- [ ] Windows Privesc Arena https://tryhackme.com/room/windowsprivescarena
- [ ] Linux Privesc Arena https://tryhackme.com/room/linuxprivescarena
- [ ] Windows Privesc https://tryhackme.com/room/windows10privesc
- [ ] Blaster https://tryhackme.com/room/blaster
- [ ] Ignite https://tryhackme.com/room/ignite
- [ ] Kenobi https://tryhackme.com/room/kenobi
- [ ] Capture the flag https://tryhackme.com/room/c4ptur3th3fl4g
- [ ] Pickle Rick https://tryhackme.com/room/picklerick
# Level 7 - CTF practice
- [ ] Post Exploitation Basics https://tryhackme.com/room/postexploit
- [ ] Smag Grotto https://tryhackme.com/room/smaggrotto
- [ ] Inclusion https://tryhackme.com/room/inclusion
- [ ] Dogcat https://tryhackme.com/room/dogcat
- [ ] LFI basics https://tryhackme.com/room/lfibasics
- [ ] Buffer Overflow Prep https://tryhackme.com/room/bufferoverflowprep
- [ ] Overpass https://tryhackme.com/room/overpass
- [ ] Break out the cage https://tryhackme.com/room/breakoutthecage1
- [ ] Lian Yu https://tryhackme.com/room/lianyu
TryHackMe
OpenVPN
A guide to connecting to our network using OpenVPN.
Un nuevo malware usa procesos de Nginx para pasar desapercibido
https://unaaldia.hispasec.com/2021/12/un-nuevo-malware-usa-procesos-de-nginx-para-pasar-desapercibido.html
https://unaaldia.hispasec.com/2021/12/un-nuevo-malware-usa-procesos-de-nginx-para-pasar-desapercibido.html
Una al Día
Un nuevo malware usa procesos de Nginx para pasar desapercibido
Un nuevo tipo de malware que usa los procesos de Nginx para no ser detectado por las soluciones de seguridad implementadas por las compañías.
[webapps] WordPress Plugin All-in-One Video Gallery plugin 2.4.9 - Local File Inclusion (LFI)
WordPress Plugin All-in-One Video Gallery plugin 2.4.9 - Local File Inclusion (LFI)
https://www.exploit-db.com/exploits/50562
WordPress Plugin All-in-One Video Gallery plugin 2.4.9 - Local File Inclusion (LFI)
https://www.exploit-db.com/exploits/50562
Exploit Database
WordPress Plugin All-in-One Video Gallery plugin 2.4.9 - Local File Inclusion (LFI)
WordPress Plugin All-in-One Video Gallery plugin 2.4.9 - Local File Inclusion (LFI).. webapps exploit for PHP platform
AutoSUID - Linux Privilege Escalation
#PrivilegesEscalating #SUID #Linux
https://reconshell.com/auto-suid-linux-privilege-escalation/
#PrivilegesEscalating #SUID #Linux
https://reconshell.com/auto-suid-linux-privilege-escalation/
Penetration Testing Tools, ML and Linux Tutorials
Auto SUID - Linux Privilege Escalation - Penetration Testing Tools, ML and Linux Tutorials
AutoSUID application is the Open-Source project, the main idea of which is to automate harvesting the SUID executable files and to find a way for further