What do mean by Bug Bounty?Continue reading on Medium » (https://avinashicss.medium.com/become-a-pro-as-a-bug-bounty-programmer-icss-457e44f18df9?source=rss------bug_bounty-5)

Learn Best Bug Bounty Program from India Cyber Security Solutions-ICSS
https://avinashicss.medium.com/learn-best-bug-bounty-program-from-india-cyber-security-solutions-icss-84e1cca79df3?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

What do mean by Bug Bounty?Continue reading on Medium » (https://avinashicss.medium.com/learn-best-bug-bounty-program-from-india-cyber-security-solutions-icss-84e1cca79df3?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
VMware Sounds Ransomware Alarm Over Critical Severity Bug

https://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg VMware Sounds Ransomware Alarm Over Critical Severity BugPost Views: 20
Reading Time: 1 Minute
VMware patched a critical bug impacting its vCenter Server platform with a severity rating of 9.8 out of 10. The company said the flaw could allow a remote attacker to exploit its products and take control of a company’s affected system.
VMware went a step further on Tuesday, calling on IT security teams – already on high alert over an uptick in costly and destructive ransomware attacks – to patch systems fast.

“In this era of ransomware it is safest to assume that an attacker is already inside the network somewhere, on a desktop and perhaps even in control of a user account, which is why we strongly recommend declaring an emergency change and patching as soon as possible,” wrote VMware’s Bob Plankers, technical marketing architect in a Tuesday post. Critical Bug Impacts Critical Mass?The vulnerability, tracked as CVE-2021-21985, impacts vCenter Server platforms, which is in widespread use and used to administer VMware’s market leading vSphere and ESXi host products.

Claire Tills, a senior research engineer with Tenable wrote in a post commenting on the bug, “patching these flaws should be a top priority. Successful exploitation would allow an attacker to execute arbitrary commands on the underlying vCenter host.”
See Also: PDF Feature ‘Certified’ Widely Vulnerable to Attack Tills note exploiting the vulnerability is trivial. All an attacker would need to do is be able to access vCenter Server over port 443, she wrote. “Even if an organization has not exposed vCenter Server externally, attackers can still exploit this flaw once inside a network.”

Kenna Security’s director of security research Jerry Gamblin, however noted estimates of how many networks are vulnerable attacks is relatively small.

“Some early research from Rapid 7 shows that only around 6K’s VCenters are exposed directly to the internet, which makes the ‘blast radius’ tiny and the initial entry point into a network unlikely with this pair of CVES,” Gamblin wrote in an email commentary to Threatpost.

Gamblin is referring to both the critical CVE-2021-21985 bug and a second vulnerability reported by VMware on Tuesday, CVE-2021-21986. This second bug has a medium CVSS severity rating of 6.5 and is tied to an authentication mechanism issue in vCenter Server plugins.
See Also: Offensive Security Tool: Snallygaster Breaking Down the Critical BugWorkarounds and updates are available to mitigate both flaws, according to VMware.

“The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server,” VMware’s security bulletin states for the critical (CVE-2021-21985) bug. “The affected Virtual SAN Health Check plug-in is enabled by default in all vCenter Server deployments, whether or not vSAN is being used.”

VMware’s Virtual San (or vSAN) is a software-defined storage solution that typically supports hyper-converged infrastructure. The Health Check plug-in “checks to monitor the status of cluster components, diagnose issues, and troubleshoot problems,” according to a VMware description of the tool.

VMware credited the researcher identified only as “Ricter Z” of 360 Noah Lab for finding the bug. See Also: Hacking Stories: Xbox UndergroundSource: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Untitled[...]

___________________________
@hacking_Attack
@Hacking_Video

-design-6-90x90.png PDF Feature ‘Certified’ Widely Vulnerable to Attack1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/vulnerability-e1621953424713-90x90.jpg Pulse Secure VPNs Get Quick Fix for Critical RCE2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Untitled-design-5-90x90.png 100M Android Users Hit By Rampant Cloud Leaks3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Untitled-design-3-2-90x90.png WP Statistics Bug Allows Attackers to Lift Data from WordPress Sites4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Untitled-design-4-90x90.png Windows PoC Exploit Released for Wormable RCE1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Untitled-design-3-1-90x90.png Microsoft, Google Clouds Hijacked for Gobs of Phishing1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Untitled-design-2-2-90x90.png Microsoft, Adobe Exploits Top List of Crooks’ Wish List1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Untitled-design-3-90x90.png Bizarro Banking Trojan Sports Sophisticated Backdoor1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Safari_Browser-90x90.jpg ‘Scheme Flooding’ Allows Websites to Track Users Across Browsers2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Mac-Malware-90x90.jpg Apple’s ‘Find My’ Network Exploited via Bluetooth2 weeks ago
The post VMware Sounds Ransomware Alarm Over Critical Severity Bug first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hey WAF! Better Luck Next Time!

https://cdn-images-1.medium.com/max/700/1*gmACyFYVDw-fAL5XDqhb2A.jpeg
SQL Injection + WAF Bypass

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
HTB - Baby Auth [Web]

https://cdn-images-1.medium.com/max/600/1*0EDAm72ketLmqohhvB08hQ.png
Baby Auth is a very simple web challenge of Hack The Box.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Ethical Hacking

https://cdn-images-1.medium.com/max/1122/1*tb6vu609x7jV8vL4JTUiyQ.jpeg
What is ethical hacking?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Is there any companies you would recommend for Pentesting? (UK)
https://www.reddit.com/r/Pentesting/comments/nmuic7/is_there_any_companies_you_would_recommend_for/

Just trying to look for some recommendation for a pentest company to check my network security. ​ Many thanks in advance submitted by /u/Revivalinks (https://www.reddit.com/user/Revivalinks)
[link] (https://www.reddit.com/r/Pentesting/comments/nmuic7/is_there_any_companies_you_would_recommend_for/) [comments] (https://www.reddit.com/r/Pentesting/comments/nmuic7/is_there_any_companies_you_would_recommend_for/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Zip Bomb VS VirtualBox

Will a zip bomb opened on virtualbox crash the virtual pc or your actual pc? i've been wondering for quite a while, but i don't feel like testing it myself

submitted by /u/Nervous_Ear_5269
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
R77 Rootkit : Fileless Ring 3 Rootkit With Installer And Persistence

R77 is a ring 3 Rootkit that hides following entities from all processes: Files, directories, junctions, named pipes, scheduled tasks Processes CPU usage Registry keys & values Services TCP & UDP connections It is compatible with Windows 7 and Windows 10 in both x64 and x86 editions. Hiding By Prefix All entities where the name […]

The post R77 Rootkit : Fileless Ring 3 Rootkit With Installer And Persistence appeared first on Kali Linux Tutorials.

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Laboratory HackTheBox Walkthrough

Today we are going to crack a machine called the Laboratory. It was created by 0xc45. This is a Capture the Flag type of challenge. This machine is hosted on HackTheBox. Let’s get cracking! Penetration Testing Methodology· Network Scanningo Nmap ScanEnumerationo Enumerating HTTPS service Exploitationo Exploiting GitLab RCEPrivilege Escalationo Enumerating SUID permissionsWalkthroughTo Attack any machine, we need the IP Address. Machine hosted on HackTheBox have a static IP Address.IP Address assigned: 10.129.148.89Now that we have the IP Address. We need to enumerate open ports on the machine. For this, we will be running a nmap scan.nmap -A 10.129.148.89https://1.bp.blogspot.com/-ulsi3pB7IbQ/YLC54IhJsAI/AAAAAAAAwRc/B91Y1WB9OdsmanKtJX1tjFQgUYMpS8uxgCLcBGAsYHQ/s16000/1.png The Nmap scan quickly gave us some great information. It positively informed that the following ports and services are running: SSH (22), HTTP (80), HTTPS (443). Upon reading the nmap scan it was observed that the Common Name is laboratory.htb. We make the entry in the /etc/hosts file with the IP address. Enumeration Since we have added an entry in the /etc/hosts file with the IP Address, we can use the laboratory.htb in the Web browser to enumerate the HTTPS service. The website that is hosted is created to promote a company that is dedicated to Security and Development Services. https://laboratory.htbhttps://1.bp.blogspot.com/-q0v3W4mGUrc/YLC58zKQcqI/AAAAAAAAwRg/Dr15S5k-Q3YFwkJ4gveMtNTfIQbqaGOWACLcBGAsYHQ/s16000/2.png We got a clue from the nmap scan that there is possibility of subdomains from the details that were enumerated while checking the certificate information. To confirm the suspicion and to potentially enumerate for any other subdomains. We use gobuster for this task. We can see that we have successfully enumerated the git.laboratory.htb.gobuster dir --url https://laboratory.htb/ --wordlist /usr/share/dirbuster/wordlists/directory-list-lowcase-2.3-small.txt -t 50https://1.bp.blogspot.com/-gQ2XTjp8jHQ/YLC6AhelXSI/AAAAAAAAwRk/7j6DSRgn9gsWg9O-tXSZSmhi3kz0fbpqwCLcBGAsYHQ/s16000/3.png As we have found this new subdomain, we need to make an edit in our /etc/hosts file so that we are able to access it on our web browser. nano /etc/hostshttps://1.bp.blogspot.com/-LIJSu6g5xHw/YLC6EAzJh2I/AAAAAAAAwRo/5Xf9J9nZUkwHKKfvcdAJxWSEDc_7PiGKwCLcBGAsYHQ/s16000/4.1.png Upon opening the git.laboratory.htb we see that it is an installation of GitLab. https://git.laboratory.htb/users/sign_inhttps://1.bp.blogspot.com/-brOkcdzD5Ys/YLC6HJEpvcI/AAAAAAAAwRs/suEXWkG2KFs9BIVYyAgQJJG4s8DsmwLDQCLcBGAsYHQ/s16000/4.png Since, we didn’t have any credentials for the users, we tired to register for a new user. But we are given an error that the email domain is not the one that it would accept. So, in order to circumvent this error, we tried to change the email address to the domain of the application i.e., laboratory.htb.___________________________
@hacking_Attack
@Hacking_Video

GAsYHQ/s16000/6.png After logging in with the newly created credentials, we see that we have the GitLab Community Edition installed on the target machine. The version is 12.8.1.ExploitationAfter, going through some exploration for the version of the GitLab, we found that this version is vulnerable to Remote Code Execution Attack. It is possible to use a direct exploit that can be found on exploitdb. However, we found that it is possible to use an exploit this vulnerability using Metasploit. It requires some set parameters such as the IP Address and port of the target machine, vhost which is the git.laboratory.htb. Then it requires the username and password that was created earlier. After running for a moment, the exploit provides with a shell on the target machine. We prompt the shell to the bash which tells us that the session that we have procured is for the user git. use exploit/multi/http/gitlab_file_read_rceHow to reset user password | GitLab - GitLab Docsbash -ihttps://1.bp.blogspot.com/-rfKNiRYyU8s/YLC6bk7D6TI/AAAAAAAAwSM/Nq7kyK1NMGAWcfY1ZP9sweaixPQUyXd7gCLcBGAsYHQ/s16000/16.png Now that we have the access for the user dexter user account, we get back to the GitLab instance on our Web Browser and login using the credentials for dexter. After a successful login, we start to enumerate the files that are accessible for the dexter user and find a SSH private key as shown in the image below.Privilege EscalationWe copy the private key and create a key on the Kali Linux and named it key. We used this key to connect to the target machine via the SSH. You can read the User flag at this point. After logging in, one of the first enumeration task we did was check for the SUID permissions. It prints a huge list of binaries, among which we find the docker-security. It can be used to elevate our access to root. ssh -i key dexter@10.129.148.89/dev/nullhttps://1.bp.blogspot.com/-zdUZIP4rkRc/YLC6mp4VnjI/AAAAAAAAwSc/IlPCym7Cro4ADe9JrHCkvbO22lm4s8EZQCLcBGAsYHQ/s16000/18.png Since, it’s a binary that we are not that familiar with, the usual course of action is to reverse engineer it. Although you can use ltrace com[...]

___________________________
@hacking_Attack
@Hacking_Video

mand to understand the working of the binary. It will tell you that it runs the command chmod to change the permissions for /usr/bin/docker. Since it doesn’t use the complete path of the chmod, we can exploit by creating a chmod with shell invocation in the same directory and run the binary. Rather than using the original chmod, it will use the chmod that we created and give us the root access on the machine. We now can read the root flag and conclude this machine.echo “/bin/bash” > chmodhttps://1.bp.blogspot.com/-fvQG_LWSnsc/YLC6vIAwqgI/AAAAAAAAwSg/scOOiBSD2Xs7mD0Dfe6R2HrMnPIldvbIQCLcBGAsYHQ/s16000/19.png ___________________________
@hacking_Attack
@Hacking_Video