Hacking on Medium
Compile it ⚙️ , Debug it  , Hack it it’s the Linux kernel

https://cdn-images-1.medium.com/max/1019/1*btGcd52Fh1k3SwGkz4ljFA.jpeg
in this blog, we will see how to download the kernel source, compile it, and prepare for debugging with KGDB/GDB

Continue reading on Medium »

Hacking on Medium
What You Need to Know About the Latest Chase Bank Security Hack

https://cdn-images-1.medium.com/max/840/1*iWxU6QKyff13cu3NoJAgyQ.jpeg
Do you know you can hire a money transfer hacker ? 🌐Visit Our Website: phantomhacker.su 📧Email Us to Order: phantomhackings@gmail.com

Continue reading on Medium »

Hacking on Medium
Hacking Social Media Accounts with Zphisher

https://cdn-images-1.medium.com/max/1280/1*DqwJyJ9o1DDuHH4jDpyW3w.jpeg
In this tutorial, you’ll learn the dangers of phishing and see how easy it is to create a fake phishing website that can steal the login…

Continue reading on System Weakness »

Unveiling RCE on Dutch Government Website

IntroductionContinue reading on Medium »
Read more...

Wifi Soft Unibox Administration 3.0 Login Page Exploit

IntroductionContinue reading on Medium »
Read more...

Kali Linux Tutorials
CatSniffer – The Ultimate Multiprotocol IoT Attack Tool in USB Form

CatSniffer is an original multiprotocol, and multiband board made for sniffing, communicating, and attacking IoT (Internet of Things) devices.

It was designed as a highly portable USB stick that integrates the new chips TI CC1352, Semtech SX1262, Microchip SAMD21E17 V2 or previous, and RP2040 V3 or later.

This board is a Swiss army knife for IoT security researchers, developers, and enthusiasts.

The board can be used with different types of software, including third-party sniffers such as SmartRF Packet Sniffer, Sniffle, zigbee2mqtt, Z-Stack firmware, Ubiqua Protocol Analyzer, our custom firmware, or you can even write your own software for your specific needs. CatSniffer Can Operate At Three Different Frequencies:

* LoRa
* Sub-1 GHz
* 2.4 GHz

This work was inspired by our friend’s work, Michael Ossmann, as a tribute to his outstanding job in Greatscott Gadgets, making devices like the YardStick, GreatFET, HackRF, and Ubertooth.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhH5mottBVeXa4sXacDoLMVOQ12DdQ7PhDxOvPek6F1sN9UCjaSGdFVorTI80OGLRS4YQIOsHisbdNMNMD-xL1yfiQSjN2KWzQJJrnCwrDVkS0S71pCT523qq_qV9EGgFkzfJFUwXHWifAiKC-RffwhGAy1rOO-dd5HmuI7GYUteJwqchZ7yHhEPaRE8HSF/s16000/68747470733a2f2f656c656374726f6e6963636174732e636f6d2f77702d636f6e74656e742f75706c6f6164732f62616467655f73746f72652e706e67%20(1).webp Protocols

* Thread
* Zigbee
* Bluetooth 5 Low Energy (BLE)
* IEEE 802.15.4g
* 6LoWPAN (IPv6 over low-power Wireless Personal Area Networks)
* Sub-1 GHz and patented systems
* LoRa/LoRaWAN Features

* “The SimpleLinkTM CC1352P1F3RGZ device is a multiprotocol and multi-band Sub-1 GHz and 2.4 GHz wireless microcontroller (MCU) supporting Thread, Zigbee®, Bluetooth® 5.2 Low Energy, IEEE 802.15.4g, IPv6-enabled smart objects (6LoWPAN), MIOTY®, Wi-SUN®, and proprietary systems”.
* CatSniffer uses Microchip SAMD21E17 (V2 or previous) and RP2040 (V3 or later) as a USB-UART bridge to communicate with the CC1352 chip; it’s not necessary for a manual driver installation (exceptions could exist).
* Compatible OS: Windows and Linux
* Auto-program through the bootloader from TI CC (as long as it’s not disabled in the code).
* There is no need for an external programmer, and it can be debugged with cJTAG through the default pin.
* Antenna SMA port for an Antenna of your choice
* LEDs for general-purpose
* Reset button for RP2040, SAMD21, and CC1352; Boot of CC1352; and one more for general purpose. Wiki And Getting Started Getting Started in our Wiki Compatible Software

* TI PACKET-SNIFFER-2 v1.8
* Flash Programmer 2 and Uniflash from TI
* zigbee2mqtt
* Z-Stack-firmware
* Sniffle 1.6
* Ubiqua Protocol Analyzer Pre-Requisites For Building Firmware

* CCS version: The packet sniffer firmware has been tested with CCS 10.2
* SimpleLink CC13x2 and CC26x2 SDK
* Python 3

Kali Linux Tutorials
Scan4All: A Next-Gen Automated Vulnerability Detection Security Tool

Scan4All is at the vanguard of modern cybersecurity solutions, offering a comprehensive suite of tools for automated vulnerability detection and threat analysis.

Built on a robust Golang framework, this cross-platform toolkit seamlessly integrates with various systems, elevating the standard for next-generation security measures. Features

* What Is Scan4all: integrated vscan, nuclei, ksubdomain, subfinder, etc., fully automated and intelligent team tools? Code-level optimization, parameter optimization, and individual modules, such as vscan filefuzz, have been rewritten for these integrated projects.
* In principle, do not repeat the wheel unless there are bugs or problems
* Cross-Platform: based on golang implementation, lightweight, highly customizable, open source, supports Linux, windows, mac os, etc.

* Support [23] password blasting, support custom dictionary, open by “priorityNmap”: true

* RDP
* VNC
* SSH
* Socks5
* rsh-spx
* Mysql
* MsSql
* Oracle
* Postgresql
* Redis
* FTP
* Mongodb

* SMB also detect MS17-010 (CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, CVE-2017-0147, CVE-2017-0148), and SmbGhost (CVE-2020-0796)

* Telnet
* Snmp
* Wap-wsp (Elasticsearch)
* RouterOs
* HTTP BasicAuth (authorization) contains the WebdavSVN (Apache Subversion) crack
* Weblogic, enable nuclei through enableNuclei=true at the same time, support T3, IIOP and other detection
* Tomcat
* Jboss
* Winrm(wsman)
* POP3/POP3S
* By default, http password intelligent blasting is enabled, and it will be automatically activated when an HTTP password is required, without manual intervention
* Detect whether there is nmap in the system and enable nmap for fast scanning through priorityNmap=true, which is enabled by default, and the optimized nmap parameters are faster than masscan.

* Disadvantages of using nmap: Is the network bad because the traffic network packet is too large, which may lead to incomplete results? Using nmap additionally requires setting the root password to an environment variable export PPSSWWDD=yourRootPswd More references: config/doNmapScan.sh By default, naabu is used to complete port scanning. Use -stats=true to view the scanning progress Can I not scan Ports? noScan=true ./scan4all -l list.txt -v
# nmap result default noScan=true
./scan4all -l nmapRssuilt.xml -v* With fast 15000+ POC detection capabilities, PoCs include:
* nuclei POC Nuclei Templates: Top 10 Statistics
TAGCOUNTAUTHORCOUNTDIRECTORYCOUNTSEVERITYCOUNTTYPECOUNTcve1430daffainfo631cves1407info1474http3858panel655dhiyaneshdk584exposed-panels662high1009file76edb563pikpikcu329vulnerabilities509medium818network51lfi509pdteam269technologies282critical478dns17xss491geeknik187exposures275low225wordpress419dwisiswant0169misconfiguration237unknown11exposure4070x_akoko165token-spray230cve2021352princechaddha151workflows189rce337ritikchaddha137default-logins103wp-plugin316pussycat0x133file76
281 Directories, 3922 Files

* vscan POC
* vscan POC includes: xray 2.0 300+ POC, go POC, etc.

* scan4all POC
* Support 7000+ web fingerprint scanning and identification:
* httpx fingerprint
* vscan fingerprint
* Vscan Fingerprint: including EHoleFinger, LocalFinger, etc.

* scan4all fingerprint

* Support 146 protocols and 90000+ rule port scanning
* Depends on protocols and fingerprints supported by nmap

* Fast HTTP-sensitive file detection, customizable dictionary
* Landing page detection
* Supports multiple types of input: STDIN, HOST, IP, CIDR, URL, and TXT
* Supports multiple output types: JSON, TXT, CSV, and STDOUT
* Highly Integratable: Configurable unified storage of results in Elasticsearch [strongly recommended]
* Smart SSL Analysis:
* In-depth analysis will automatically correlate the scanning of domain names in SSL information, such as *.xxx.c[...]

om, and complete subdomain traversal according to the configuration, and the result will automatically add the target to the scanning list
* Support the *.xx.com subdomain traversal function in smart SSL information, export EnableSubfinder=true, or adjust in the configuration file

* Automatically identify the case of multiple IPs associated with a domain (DNS) and automatically scan the associated multiple IPs
* Smart Processing:
1. When the IPs of multiple domain names in the list are the same, merge port scans to improve efficiency

* Automated supply chain identification, analysis and scanning
* Link python3 log4j-scan
* This version blocks the bug in which your target information is passed to the DNS Log Server to avoid exposing vulnerabilities
* Added the ability to send results to Elasticsearch for batch, touch typing
* There will be time in the future to implement the Golang version. mkdir ~/MyWork/;cd ~/MyWork/;git clone https://github.com/hktalent/log4j-scan* Intelligently identify honeypots and skip Targets. By default, this feature is off. You can set EnableHoneyportDetection=true to enable
* Highly Customizable: allow to define your own dictionary through config/config.json configuration, or control more details, including but not limited to: nuclei, httpx, naabu, etc.
* Support HTTP Request Smuggling: CL-TETE-CLTE-TE、CL_CL、BaseErr

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhj9LIKIzDAGROMUfO0_ZLf13emC5LIdt_o2cP1JtxUxBSGnAETKPLsekuuWtyuesLSewAiswEyKdZpx03RdMm67GkytYGtNMDWO9btVnnsU_dPyHXB37z-Z6aUJxrk_YFe-kkZ_ARcrMDt6Z5uwQ-FDrvhw5EOKxNfm0PwOutWjpEtzDRKWvDTVIq6e8uA/s16000/182503765-1307a634-61b2-4f7e-9631-a4184ec7ac25.webp
* Support via parameter Cookie=’PHPSession=xxxx./scan4all -host xxxx.com, compatible with nuclei, httpx, go-poc, x-ray POC, filefuzz, http Smuggling Work Process

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhgkG3GEHst2gdOmse_Q7y7b9XEfVvamGwKCXf4kNJYuTrq6TcYYy5Ya7-of89CVeGkyIS2qchgN09BqGFwRKO7EKcLgUEYPUdUh1fzj6dN5g1tRFPyw3m_Z8evyM-h6t-phBX6xb8IKIEd4okBMbvvJRXvEGydfUb786T2udF5c1vV_qhwn5GvevuFZgNa/s16000/workflow.webp How To Install

download from Releases go install github.com/hktalent/scan4all@2.6.9
scan4all -hHow To Use

1. Start Elasticsearch; of course, you can use the traditional way to output results mkdir -p logs data
docker run --restart=always --ulimit nofile=65536:65536 -p 9200:9200 -p 9300:9300 -d --name es -v $PWD/logs:/usr/share/elasticsearch/logs -v $PWD /config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml -v $PWD/config/jvm.options:/usr/share/elasticsearch/config/jvm.options -v $PWD/data:/ usr/share/elasticsearch/data hktalent/elasticsearch:7.16.2
# Initialize the es index, the result structure of each tool is different, and it is stored separately
./config/initEs.sh

# Search syntax, more query methods, learn Elasticsearch by yourself
http://127.0.0.1:9200/nmap_index/_doc/_search?q=_id:192.168.0.111
where 92.168.0.111 is the target to query Please install nmap by yourself before use Using Help go build
# Precise scan szUrl list UrlPrecise=true
UrlPrecise=true ./scan4all -l xx.txt
# Disable adaptation to nmap and use naabu port to scan its internally defined http-related Ports
priorityNmap=false ./scan4all -tp http -list allOut.txt -vWork Plan

* Integrate web-cache-vulnerability-scanner to realize HTTP smuggling smuggling and cache poisoning detection
* Linkage with metasploit-framework, on the premise that the system has been installed, cooperate with tmux, and complete the linkage with the macos environment as the best practice
* Integrate more fuzzers , such as linking sqlmap
* Integrate chromedp to achieve screenshots of landing pages, detection of front-end landing pages with pure js and js architecture, and corresponding crawlers (sensitive information detection, page crawling)
* Integrate nmap-go to improve execution efficiency, dynamically parse the result stream,[...]

and integrate it into the current task waterfall
* Integrate ksubdomain to achieve faster subdomain blasting
* Integrate spiders to find more bugs
* Semi-automatic fingerprint learning to improve accuracy; specify fingerprint name, configure Star

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiQBdo0UmddvLeGPlJgq_vhHabTkzmgTIrnC1FwzXleuSILHaxDgVzsPruTvZb7Zre6NZInokj2aGjLqs_j_skfBh7Wdq5mSAfDcri2qH4g2duij58OVWVm38fYLg9RorgehEn0Jdn96Hs7ZKPM1jWxcHwj5jmwR1vTN-_mcdvEfLV8ezdiSWmuqW3AU3Yr/s16000/fghj.webp

Bypass Mobile Phone verification using Mobile website
https://jowin922.medium.com/bypass-mobile-phone-verification-using-mobile-website-e18c4db87292?source=rss------bug_bounty-5

I was invited to security test an e-commerce website. Mobile phone number verification is mandatory on the website and customers are not…Continue reading on Medium » (https://jowin922.medium.com/bypass-mobile-phone-verification-using-mobile-website-e18c4db87292?source=rss------bug_bounty-5)

Unveiling RCE on Dutch Government Website
https://medium.com/@nayeems3c/unveiling-rce-on-dutch-government-website-f001a1c5b4fb?source=rss------bug_bounty-5

This is my story of bypassing File upload feature to achieve Remote Code Execution (RCE) vulnerability on a Dutch government website.Continue reading on Medium » (https://medium.com/@nayeems3c/unveiling-rce-on-dutch-government-website-f001a1c5b4fb?source=rss------bug_bounty-5)

Wifi Soft Unibox Administration 3.0 Login Page Exploit
https://medium.com/@shubhamrooter/wifi-soft-unibox-administration-3-0-login-page-exploit-a3baa369ffb1?source=rss------bug_bounty-5