Log4j Flaw ☠️👀

LATEST TECHNOLOGY AND CYBERNEWS

BY @cybermonkeyofficials

🌐NFTs OF WORLD'S FIRST EVER TEXT MESSAGE TO BE AUCTIONED BY VODAFONE

🌐META BANS INDIA'S BELLTROX , 6 OTHER FIRMS FOR SPYING ON 50,000 PEOPLE

🌐LOG4J SECURITY FLAW PROMPTING 100 NEW HACKING ATTEMPTS EVERY MINUTE

🌐RUSSIA FINES META 1.3 CR, TWITTER 1 CR FOR NOT DELETING BANNED CONTENT

🌐SpaceX LAUNCHES 52 STARLINK SATELLITES FROM CALIFORNIA BASE

🌐HOUSE PANEL MOOTS PENALTIES UP TO RS 15 CRORE FOR DATA VIOLATIONS

🌐US RECOMMENDS APPROVING GOOGLE, META UNDERSEA DATA CABLE TO ASIA

🌐ISRO SIGNED SIX AGREEMENTS WITH FOUR COUNTRIES FOR LAUNCHING FOREIGN SATELLITES
DURING 2021-2021:CENTRE

🌐RUSSIAN HACKERS LEAK CONFIDENTIAL UK POLICE DATA ON THE DARK WEB AFTER THEIR RANSOM WAS REJECTED

🌐ANDROID WARNING AS MORE THAN 500,000 USERS DOWNLOAD APP INFECTED WITH NOTORIOUS 'JOKER' MALWARE

🌐APPLE REMOVES CONTROVERSIAL CHILD ABUSE DETECTION TOOL FROM WEBPAGE

DO FOLLOW @cybermonkeyofficials ON INSTAGRAM TO LEARN MORE

LINK TO OUR NEWS CHANNEL
https://www.instagram.com/p/CW-larLFFsc/?utm_medium=copy_link

TELEGRAM SUPPORT
https://t.me/cybermonkeyofficials

Log4j vulnerability CVSS details
CVE-2021-44228 (CVSS score: 10.0) - A remote code execution vulnerability affecting Log4j versions from 2.0-beta9 to 2.14.1 (Fixed in version 2.15.0)

CVE-2021-45046 (CVSS score: 9.0) - An information leak and remote code execution vulnerability affecting Log4j versions from 2.0-beta9 to 2.15.0, excluding 2.12.2 (Fixed in version 2.16.0)

CVE-2021-45105 (CVSS score: 7.5) - A denial-of-service vulnerability affecting Log4j versions from 2.0-beta9 to 2.16.0 (Fixed in version 2.17.0)

CVE-2021-4104 (CVSS score: 8.1) - An untrusted deserialization flaw affecting Log4j version 1.2 (No fix available; Upgrade to version 2.17.0)


❤️❤️ Enjoy and Share ❤️❤️

Support Us ❤️
Channel : @freelearningtech
Group : @freelearningtech21
Website : https://freelearningtech.in/

⚙️Some ways to find company admin panels 💻

1. Using Google Dorks:

site: target.com inurl: admin | administrator | adm | login | l0gin | wp-login

intitle: "login" "admin" site: target.com

intitle: "index of / admin" site: target.com

inurl: admin intitle: admin intext: admin

2. Using httpx and a wordlist:

httpx -l hosts.txt -paths /root/admin-login.txt -threads 100 -random-agent -x GET, POST -tech-detect -status-code -follow-redirects -title -content-length

httpx -l hosts.txt-ports 80,443,8009,8080,8081,8090,8180,8443 -paths /root/admin-login.txt -threads 100 -random-agent -x GET, POST -tech-detect -status- code -follow-redirects -title -content-length

3. Using utilities:

https://github.com/the-c0d3r/admin-finder
https://github.com/RedVirus0/Admin-Finder
https://github.com/mIcHyAmRaNe/okadminfinder3
https://github.com/penucuriCode/findlogin
https://github.com/fnk0c/cangibrina

4. Using search engines:

Shodan:

ssl.cert.subject.cn:"company.com "http.title:" admin "

ssl: "company.com" http.title: "admin"

ssl.cert.subject.cn:"company.com "admin

ssl: "company.com" admin

Fofa:

cert = "company.com" && title = "admin"

cert.subject = "company" && title = "admin"

cert = "company.com" && body = "admin"

cert.subject = "company" && body = "admin"

ZoomEye:

ssl: company.com + title: "admin"

ssl: company.com + admin

Censys (IPv4):

(services.tls.certificates.leaf_data.issuer.common_name: company.com) AND services.http.response.html_title: admin

(services.tls.certificates.leaf_data.issuer.common_name: company.com) AND services.http.response.body: admin

Log4jScan 4 Burp

it was removed from git but it's the best out there.

just add the extension in BURP and Burp's yo' uncle.

Also has bypasses and reverse DNS's

🔰Red Team RoadMap 🔰

Ⓜ What is the best courses,certificates and skill for red team roadmap From Zero to Hero ?

Ejpt PTS (elearn security)

PTP (ElearnSecurity)
|
|
V
WPT (ElearnSecurity)
|
|
V
WAPTX (ElearnSecurity)
|
|
V
OSCP (Offensive Security) New Release
OR
CRTP (Pentester Academy)
|
|
V
OSWE (Offensive Security)
|
|
V
CRTE (Pentester Academy)
|
|
V
(ZeroPoint Security)
|
|
V
GCB | Pentester Academy - Global Central Bank (GCB)
|
|
V
PTX (ElearnSecurity)
|
|
V
PACES | Pentester Academy Certified Enterprise Security Specialist
|
|
V
Sector7 | RED TEAM Operator: Malware Development Essentials
|
|
V
Sector7 | RED TEAM Operator: Malware Development Intermediate Course
|
|
V
Windows internal Pavel Yosifovich
|
|
V
OSEP (Offensive Security)
|
|
V
Windows system programming Pavel Yosifovich
|
|
V
SilentBreakSecurity | DARK SIDE OPS 1 - MALWARE DEV
|
|
V
SilentBreakSecurity | DARK SIDE OPS 2 - ADVERSARY
|
|
V
MDSec | Adversary Simulation and Red Team Tactics
|
|
V
any course for azure ad attacks too

➖➖ ➖➖

Log4j payloads

https://gist.github.com/ZephrFish/32249cae56693c1e5484888267d07d39


❤️❤️ Enjoy and Share ❤️❤️

Support Us ❤️
Channel : @freelearningtech
Group : @freelearningtech21
Website : https://freelearningtech.in/

LATEST TECHNOLOGY AND CYBERNEWS

BY @cybermonkeyofficials

🌐US WOMAN GIVES BIRTH IN TESLA CAR DRIVING ON AUTOPILOT IN A WORLD FIRST

🌐RBI TELLS BOARD IT FAVOURS A COMPLETE BAN ON CRYPTO: REPORT

🌐OVER 35,000 JAVA PACKAGES IMPACTED BY LOG4J VULNERABILITIES: GOOGLE

🌐FACEBOOK PAYS 17 MILLION RUBLES TO RUSSIA OVER CONTENT VIOLATION

🌐PUBG CREATOR KRAFTON INVESTS $5MN IN INDIAN DATING APP 'FRND'

🌐WIPRO TO ACQUIRE CYBERSECURITY CONSULTING PROVIDER EDGILE FOR $230 MILLION

🌐WHATSAPP MAY GIVE 'NEW POWER' TO GROUP ADMINS MAY HAVE MORE CONTROL OVER MEMBER CHATS

🌐RUSSIAN MAN CHARGED IN USD 82 MILLION HACKING, INSIDER TRADING SCHEME

🌐TEEN HACKER SCOOPS $4500 BUG BOUNTY FOR FACEBOOK FLAW THAT ALLOWED ATTACKERS TO UNMASK PAGE ADMINS

🌐UK DONATES 225 MILLION STOLEN PASSWORDS TO HACK-CHECKING SITE

DO FOLLOW @cybermonkeyofficials ON INSTAGRAM TO LEARN MORE

LINK TO OUR NEWS CHANNEL
https://www.instagram.com/p/CW-larLFFsc/?utm_medium=copy_link

TELEGRAM SUPPORT
https://t.me/cybermonkeyofficials

🔰|| NEW TOOL FOR PHONE UNLOCK PATTERNS AND PINS ||🔰

Ⓜ️REQUIREMENTS :

Internet : 50 MB
php
Storage : 50 MB

ngrok Features :

[+] Real pattern hacking !
[+] Updated maintainence !
[+] Ngrok link
[+] Easy for Beginners !

INSTALLATION [Termux] :

$ apt-get update -y

$ apt-get upgrade -y

$ pkg install python -y

$ pkg install python2 -y

$ pkg install git -y

$ pip install lolcat

$ git clone https://github.com/noob-hackers/hacklock

$ cd $HOME

$ ls

$ cd hacklock

$ ls

$ bash setup

$ bash hacklock.sh

[+]--Now you need internet connection to continue further process and Turn on your device hotspot to get link...

[+]--You will recieve patter pin in below image you can see pattern with numbers

[+]--You can select any option by clicking on your keyboard

[+]--Note:- Don't delete any of the scripts included in core

https://www.youtube.com/channel/UCnoCvpNUAbU2L60GzhElP0Q


Hey we will start YouTube channel again and uploading videos again so you must subscribe our YouTube channel


If you want to learn about Cyber security then subscribe this channel


❤️❤️ Enjoy and Share ❤️❤️

Support Us ❤️
Channel : @freelearningtech
Group : @freelearningtech21
Website : https://freelearningtech.in/

LATEST TECHNOLOGY AND CYBERNEWS

BY @cybermonkeyofficials

🌐MADRAS HC LAWYER CAUGHT GETTING INTIMATE WITH WOMAN DURING VIRTUAL HEARING; SUSPENDED

🌐WORLD'S FIRST SMS SELLS FOR 107,000 AS AN NFT AT AN AUCTION

🌐APPLE STARTS TRIAL PRODUCTION OF IPHONE 13 IN INDIA

🌐WORLD'S LONGEST FLEXIBLE FIBRE BATTERY MADE BY MIT ENGINEERS

🌐GOVT BLOCKS 20 PAK SPONSORED YOUTUBE CHANNELS SPREADING ANTI-INDIA PROPAGANDA
WIPRO TO ACQUIRE

🌐US-BASED CYBERSECURITY FIRM EDGILE FOR $230 MILLION

🌐GOVT NOTIFIES NEW SEMICONDUCTOR POLICY

🌐MICROSOFT $16 BILLION NUANCE BID GETS EU ANTITRUST APPROVAL

🌐FACEBOOK BLOCKS SEVEN MALWARE PURVEYORS, DELETES HUNDREDS OF ACCOUNTS, NOTIFIES 50000 POTENTIAL HACKING TARGETS

🌐HACKERS BYPASS PATCHED MICROSOFT OFFICE FLAW TO INJECT FORMBOOK MALWARE

DO FOLLOW @cybermonkeyofficials ON INSTAGRAM TO LEARN MORE

LINK TO OUR NEWS CHANNEL
https://www.instagram.com/p/CW-larLFFsc/?utm_medium=copy_link

TELEGRAM SUPPORT
https://t.me/cybermonkeyofficials

⚡ China has suspended its partnership with Alibaba Cloud Services — whose researcher discovered the critical Log4j vulnerability — because the company did not first report this flaw to the government as required by the country's new law.

Read: https://thehackernews.com/2021/12/china-suspends-deal-with-alibaba-for.html