This is my story of bypassing File upload feature to achieve Remote Code Execution (RCE) vulnerability on a Dutch government website.Continue reading on Medium » (https://medium.com/@nayeems3c/unveiling-rce-on-dutch-government-website-f001a1c5b4fb?source=rss------bug_bounty-5)

Wifi Soft Unibox Administration 3.0 Login Page Exploit
https://medium.com/@shubhamrooter/wifi-soft-unibox-administration-3-0-login-page-exploit-a3baa369ffb1?source=rss------bug_bounty-5

IntroductionContinue reading on Medium » (https://medium.com/@shubhamrooter/wifi-soft-unibox-administration-3-0-login-page-exploit-a3baa369ffb1?source=rss------bug_bounty-5)

Dark Reading: Attacks/Breaches
Thoma Bravo's 'Practical' Decision to Merge ForgeRock into Ping Identity

The private equity from has invested billions of dollars in identity and access management (IAM) but now it’s on Ping founder and CEO Andre Durand and his team to rationalize overlapping product lines.

Quick-Lookup-Ptrun - Quick Lookup Plugin For PowerToys Run (Wox)
http://www.kitploit.com/2023/09/quick-lookup-ptrun-quick-lookup-plugin.html

This plugin for PowerToys Run (https://learn.microsoft.com/en-us/windows/powertoys/run) allows you to quickly search for an IP address, domain name, hash or any other data points in a list of Cyber (https://www.kitploit.com/search/label/Cyber) Security tools. It's perfect for security analysts, penetration testers, or anyone else who needs to quickly lookup information when investigating artifacts or alerts.
Installation To install the plugin: Navigate to your Powertoys Run Plugin folder For machine wide install of PowerToys: C:\Program Files\PowerToys\modules\launcher\Plugins For per user install of PowerToys: C:\Users\\AppData\Local\PowerToys\modules\launcher\Plugins Create a new folder called QuickLookup Extract the contents of the zip file into the folder you just created Restart PowerToys and the plugin should be loaded under the Run tool settings and work when promted with ql

Usage To use the plugin, simply open PowerToys Run by pressing Alt+Space and type the activation command ql followed by the tool category and the data you want to lookup.

The plugin will open the data searched in a new tab in your default browser for each tool registered with that category.

Default Tools This plugin currently comes default with the following tools: Shodan (https://www.shodan.io/) - IP Lookup GreyNoise (https://viz.greynoise.io/) - IP Lookup Spur (https://spur.us/) - IP Lookup VirusTotal (https://www.virustotal.com/) - IP, Domain & Hash Lookup Censys (https://search.censys.io/) - IP & Domain Lookup CriminalIP (https://www.criminalip.io/) - IP & Domain Lookup Whois (https://www.whois.com/whois) - Whois Lookup EasyCounter (https://whois.easycounter.com/) - Whois Lookup Whoisology (https://whoisology.com/) - Whois Lookup Configuration NOTE: Prior to version 1.3.0 tools.conf was the default configuration file used. The plugin will now automatically convert the tools.conf list to tools.json if it does not already exist (https://www.kitploit.com/search/label/EXIST) in JSON (https://www.kitploit.com/search/label/JSON) form and will then default to using that instead.
The legacy (https://www.kitploit.com/search/label/Legacy) config file will remain however will not be used and will not be included in future builds starting from v1.3.0 By default, the plugin will use the precofigured tools listed above. You can modify these settings by editing the tools.json file in the plugin folder.
The format for the configuration file follows the below standard: {
"Name": "VirusTotal",
"URL": "https://www.virustotal.com/gui/search/{0}",
"Categories": [ "ip", "domain", "hash"],
"Enabled": true
} In the URL, {0} will be replace with the search input. As such, only sites that work based on URL data (GET Requests) are supported for now.
For example, https://www.virustotal.com/gui/search/{0} would become https://www.virustotal.com/gui/search/1.1.1.1

Download Quick-Lookup-Ptrun (https://github.com/GTGalaxi/quick-lookup-ptrun)

Leaked Database and SMTP credentials through .env file

IntroductionContinue reading on Medium »
Read more...

CVE-2023-38831 - WinRAR Zero-Day Vulnerability manually Exploit

Hi Friends!!! This is Rahad Chowdhury. I am a cyber security researcher from Bangladesh.Continue reading on Medium »
Read more...

Single XSS with Earn $600

my name is ye yint htet i’m bug bounty hunter from myanmar today i’m sharing how i’m found xss vuln and this bug with i’m earned $600Continue reading on Medium »
Read more...

Black Hat Ethical Hacking
OSINT Tool: Photon

OSINT Tool: Photon
Post Views: 83 Premium Content
Subscribe to Patreon to watch this episode. https://www.blackhatethicalhacking.com/wp-content/uploads/2023/08/Patreon.png Reading Time: 2 Minutes Description

Photon by s0md3v is an advanced web crawler and osint tool for thorough website analysis. It’s capable of scanning websites comprehensively to uncover valuable information. It has the ability to identify endpoints, collect potential vulnerabilities, and gather sensitive data efficiently.

It can help you whether you’re conducting security assessments, bug bounty hunting, or simply exploring a website’s hidden corners.
See Also: So you want to be a hacker? Offensive Security Course Key Features Data Extraction

Photon can extract the following data while crawling:

* URLs (in-scope & out-of-scope)
* URLs with parameters (example.com/gallery.php?id=2)
* Intel (emails, social media accounts, amazon buckets etc.)
* Files (pdf, png, xml etc.)
* Secret keys (auth/API keys & hashes)
* JavaScript files & Endpoints present in them
* Strings matching custom regex pattern
* Subdomains & DNS related data
The extracted information is saved in an organized manner or can be exported as json.

https://www.blackhatethicalhacking.com/wp-content/uploads/2023/09/68747470733a2f2f696d6167652e6962622e636f2f64533142714b2f636172626f6e5f322e706e67-1024x229.png
See Also: Offensive Security Tool: SSTImap
See Also: Offensive Security Tool: SecretOpt1c Flexible

Control timeout, delay, add seeds, exclude URLs matching a regex pattern and other cool stuff. The extensive range of options provided by Photon lets you crawl the web exactly the way you want. Genius

Photon’s smart thread management and refined logic gives you top notch performance.

Still, crawling can be resource intensive but Photon has some tricks up it’s sleeves. You can fetch URLs archived by archive.org to be used as seeds by using –wayback option. Plugins

* wayback
* dnsdumpster
* Exporter Docker

Photon can be launched using a lightweight Python-Alpine (103 MB) Docker image. $ git clone https://github.com/s0md3v/Photon.git$ cd Photon$ docker build -t photon .$ docker run -it --name photon photon:latest -u google.comTo view results, you can either head over to the local docker volume, which you can find by running docker inspect photon or by mounting the target loot folder: $ docker run -it --name photon -v "$PWD:/Photon/google.com" photon:latest -u google.comClone the repo from here: GitHub Link
See Also: Write up: Primer on Broken Access Control vulnerabilities and how to find them https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent Tools
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/09/Dirhunt-300x150.png Recon Tool: Dirhunt
September 1, 2023
Dirhunt is a web crawler optimize for search and analyze …

* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/08/BruteSpray-300x150.png Offensive Security Tool: BruteSpray
August 25, 2023
BruteSpray a tool that automates and accelerates the testing of …

* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/08/Recox-300x150.png Recon Tool: RecoX
August 4, 2023
Recox is a powerful tool for finding vulnerabilities in web …

* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/ScrapPy-300x150.png Digital Forensics Tool: ScrapPy
July 21, 2023
ScrapPY is a Python utility for scraping manuals, documents, and … https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking Course

Begin the learning curve of hacking now! https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Solutions.png Information Security Solutions

Find out how Pentesting Services can help you.
The post OSINT Tool: Photon first appeared on Black Hat Ethical Hacking.

Leaked Database and SMTP credentials through .env file
https://medium.com/@nithissh/leaked-database-and-smtp-credentials-through-env-file-d003df418313?source=rss------bug_bounty-5