Bypass Mobile Phone verification using Mobile website
https://jowin922.medium.com/bypass-mobile-phone-verification-using-mobile-website-e18c4db87292?source=rss------bug_bounty-5

I was invited to security test an e-commerce website. Mobile phone number verification is mandatory on the website and customers are not…Continue reading on Medium » (https://jowin922.medium.com/bypass-mobile-phone-verification-using-mobile-website-e18c4db87292?source=rss------bug_bounty-5)

Unveiling RCE on Dutch Government Website
https://medium.com/@nayeems3c/unveiling-rce-on-dutch-government-website-f001a1c5b4fb?source=rss------bug_bounty-5

This is my story of bypassing File upload feature to achieve Remote Code Execution (RCE) vulnerability on a Dutch government website.Continue reading on Medium » (https://medium.com/@nayeems3c/unveiling-rce-on-dutch-government-website-f001a1c5b4fb?source=rss------bug_bounty-5)

Wifi Soft Unibox Administration 3.0 Login Page Exploit
https://medium.com/@shubhamrooter/wifi-soft-unibox-administration-3-0-login-page-exploit-a3baa369ffb1?source=rss------bug_bounty-5

IntroductionContinue reading on Medium » (https://medium.com/@shubhamrooter/wifi-soft-unibox-administration-3-0-login-page-exploit-a3baa369ffb1?source=rss------bug_bounty-5)

Dark Reading: Attacks/Breaches
Thoma Bravo's 'Practical' Decision to Merge ForgeRock into Ping Identity

The private equity from has invested billions of dollars in identity and access management (IAM) but now it’s on Ping founder and CEO Andre Durand and his team to rationalize overlapping product lines.

Quick-Lookup-Ptrun - Quick Lookup Plugin For PowerToys Run (Wox)
http://www.kitploit.com/2023/09/quick-lookup-ptrun-quick-lookup-plugin.html

This plugin for PowerToys Run (https://learn.microsoft.com/en-us/windows/powertoys/run) allows you to quickly search for an IP address, domain name, hash or any other data points in a list of Cyber (https://www.kitploit.com/search/label/Cyber) Security tools. It's perfect for security analysts, penetration testers, or anyone else who needs to quickly lookup information when investigating artifacts or alerts.
Installation To install the plugin: Navigate to your Powertoys Run Plugin folder For machine wide install of PowerToys: C:\Program Files\PowerToys\modules\launcher\Plugins For per user install of PowerToys: C:\Users\\AppData\Local\PowerToys\modules\launcher\Plugins Create a new folder called QuickLookup Extract the contents of the zip file into the folder you just created Restart PowerToys and the plugin should be loaded under the Run tool settings and work when promted with ql

Usage To use the plugin, simply open PowerToys Run by pressing Alt+Space and type the activation command ql followed by the tool category and the data you want to lookup.

The plugin will open the data searched in a new tab in your default browser for each tool registered with that category.

Default Tools This plugin currently comes default with the following tools: Shodan (https://www.shodan.io/) - IP Lookup GreyNoise (https://viz.greynoise.io/) - IP Lookup Spur (https://spur.us/) - IP Lookup VirusTotal (https://www.virustotal.com/) - IP, Domain & Hash Lookup Censys (https://search.censys.io/) - IP & Domain Lookup CriminalIP (https://www.criminalip.io/) - IP & Domain Lookup Whois (https://www.whois.com/whois) - Whois Lookup EasyCounter (https://whois.easycounter.com/) - Whois Lookup Whoisology (https://whoisology.com/) - Whois Lookup Configuration NOTE: Prior to version 1.3.0 tools.conf was the default configuration file used. The plugin will now automatically convert the tools.conf list to tools.json if it does not already exist (https://www.kitploit.com/search/label/EXIST) in JSON (https://www.kitploit.com/search/label/JSON) form and will then default to using that instead.
The legacy (https://www.kitploit.com/search/label/Legacy) config file will remain however will not be used and will not be included in future builds starting from v1.3.0 By default, the plugin will use the precofigured tools listed above. You can modify these settings by editing the tools.json file in the plugin folder.
The format for the configuration file follows the below standard: {
"Name": "VirusTotal",
"URL": "https://www.virustotal.com/gui/search/{0}",
"Categories": [ "ip", "domain", "hash"],
"Enabled": true
} In the URL, {0} will be replace with the search input. As such, only sites that work based on URL data (GET Requests) are supported for now.
For example, https://www.virustotal.com/gui/search/{0} would become https://www.virustotal.com/gui/search/1.1.1.1

Download Quick-Lookup-Ptrun (https://github.com/GTGalaxi/quick-lookup-ptrun)

Leaked Database and SMTP credentials through .env file

IntroductionContinue reading on Medium »
Read more...

CVE-2023-38831 - WinRAR Zero-Day Vulnerability manually Exploit

Hi Friends!!! This is Rahad Chowdhury. I am a cyber security researcher from Bangladesh.Continue reading on Medium »
Read more...