Logical Flaw Resulting Path Hijacking

Hello, amazing peoples, hope you are doing well, I am back with my new writeup. In this write-up, I am going to explain a logical flaw that…
Read more...

Logical Flaw Resulting Path Hijacking
https://infosecwriteups.com/logical-flaw-resulting-path-hijacking-dd4d1e1e832f?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello, amazing peoples, hope you are doing well, I am back with my new writeup.Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/logical-flaw-resulting-path-hijacking-dd4d1e1e832f?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Logical Flaw Resulting Path Hijacking

Hello, amazing peoples, hope you are doing well, I am back with my new writeup.Continue reading on InfoSec Write-ups »
Read more...

Account Take Over with HTTP Pollution Attack at Reset Password Functionality
https://medium.com/@yoshimlutfi/account-take-over-with-http-pollution-attack-at-reset-password-functionality-9f683bc0bdd?source=rss------bug_bounty-5

First of all, this is my first write up about finding or bug when I work as cyber security. and also I try to write this post with English…Continue reading on Medium » (https://medium.com/@yoshimlutfi/account-take-over-with-http-pollution-attack-at-reset-password-functionality-9f683bc0bdd?source=rss------bug_bounty-5)

KitPloit - PenTest Tools!
Exploit_Mitigations - Knowledge Base Of Exploit Mitigations Available Across Numerous Operating Systems, Architectures And Applications And Versions

The goal is to list exploitation mitigations added over time in various operating systems, software, libraries or hardware. It becomes handy to know if a given vulnerability is easily exploitable or not depending on exploitation mitigations in place.

An example is the following: http://3.bp.blogspot.com/-ooYBRdiYPFA/YOZh0RoZbNI/AAAAAAAAiEI/w3vi0ASy65AI2QkKmiYiE8yQZc1Uly-LwCK4BGAYYCw/w640-h180/exploit_mitigations_1_example-749208.png Supported targetsWe currently support the following operating systems:

* Microsoft Windows
* Linux
* Google Android
* Apple iPhone OS (iOS)
* OpenBSD
* FreeBSD

and the following software:

* Mozilla Firefox
* Microsoft Edge
* Google Chrome
* Microsoft Office

and the following libraries:

* glibc

and the following hardware:

* ARM MotivationsIt has become challenging to follow when certain mitigations are added in an update and/or backported to some older versions of various software and hardware.

Sometimes, online content becomes deprecated due to mitigation changes and it can be hard to keep up. Also, it is easy to forget after a short time if you don't work on a specific software/hardware.

We have been filling this gap by tracking all the mitigations in summary tables that hold the mitigations names and linking to online references to get technical information about them.

The shared information has demonstrated to be useful for several years to exploit developers. Does my current environment have mitigation X?This is a common question any exploit developer may have when trying to develop an exploit for a given target.

E.g. let's say you want to exploit a Windows kernel driver on Windows 7 x64 containing a kernel NULL pointer dereference bug. Is it exploitable?

Checking our table, we read the "NULL page mitigation" was introduced in "Windows 8 32-bit/64-bit and backported to Vista+ 64-bit". Now we know it depends if our target Windows 7 x64 is up-to-date or not, more precisely, we can focus on figuring out which KB introduces this mitigation and check our target against that KB! Final wordsWe do accept pull requests so feel free to do so :)

We do have other targets in our private pipeline too so reach out if you are interested in another particular one :) Download Exploit_Mitigations

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Account Take Over with HTTP Pollution Attack at Reset Password Functionality

https://cdn-images-1.medium.com/max/824/1*Nppfs8y4Tbj8tKd2b1d2EA.png
First of all, this is my first write up about finding or bug when I work as cyber security. and also I try to write this post with English…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Phishing Attacks

https://cdn-images-1.medium.com/max/899/1*GbRdoSAuN8zy6DNKd7RKkA.png
Hello everyone. We have made a project with my colleagues on phishing attacks. It was made for educational purposes for our lecture. Let’s…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Exploit\_Mitigations - Knowledge Base Of Exploit Mitigations Available Across Numerous Operating Systems, Architectures And Applications And Versions

The goal is to list exploitation mitigations added over time in various operating systems, software, libraries or hardware. It becomes handy to know if a given vulnerability is easily exploitable or not depending on exploitation mitigations in place. An example is the following: Supported targets We currently support the following operating systems: Microsoft Windows Linux Google Android Apple iPhone OS (iOS) OpenBSD FreeBSD and the following software: Mozilla Firefox Microsoft Edge Google Chrome Microsoft Office and the following libraries: glibc and the following hardware: ARM Motivations It has become challenging to follow when certain mitigations are added in an update and/or backported to some older versions of various software and hardware. Sometimes, online content becomes deprecated due to mitigation changes and it can be hard to keep up. Also, it is easy to forget after a short time if you don't work on a specific software/hardware. We have been filling this gap by tracking all the mitigations in summary tables that hold the mitigations names and linking to online references to get technical information about them. The shared information has demonstrated to be useful for several years to exploit developers. Does my current environment have mitigation X? This is a common question any exploit developer may have when trying to develop an exploit for a given target. E.g. let's say you want to exploit a Windows kernel driver on Windows 7 x64 containing a kernel NULL pointer dereference bug. Is it exploitable? Checking our table, we read the "NULL page mitigation" was introduced in "Windows 8 32-bit/64-bit and backported to Vista+ 64-bit". Now we know it depends if our target Windows 7 x64 is up-to-date or not, more precisely, we can focus on figuring out which KB introduces this mitigation and check our target against that KB! Final words We do accept pull requests so feel free to do so :) We do have other targets in our private pipeline too so reach out if you are interested in another particular one :) Download Exploit_Mitigations
Read more...

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Reverse shells and IP addresses

I’ve always been curious about how hackers maintain persistence once they have obtained a reverse shell on a targets computer. From my limited knowledge, the hacker gets the target to connect to the attacker computer which requires the attacking computer’s IP address.

How does the hacker work around the fact that their IP may not be static, and as such their initial reverse shell exploit is trying to connect to a deprecated IP so to speak?

Forgive me if I’ve oversimplified the process

submitted by /u/0no-Sendai
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is Whitehacker on Wickr Me legit?

Saw some posts about him on Reddit and Quora but they are posted from profiles with only one post about the service itself so it seems pretty sketchy. Should I trust them?

submitted by /u/realtheeasy8s
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Challenge Site Dedicated To Hardware Hacking Education

Hey all!
A buddy and I are working towards launching a new service that will provide intentionally vulnerable hardware and IoT devices. The goal is to provide a safe place to hack hardware and post writeups, as current laws vary so much from country to country and the barrier to entry in the field has grown so much. We are looking for feedback from potential users on the idea, so let me know your thoughts. If you are interested in being a part of the "testing" round, feel free to head over to our landing page at hackmehardware.mailchimpsites.com, drop your email, and check that you are interested in being a part of the beta testing round.

submitted by /u/0xcalico
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Exploit_Mitigations - Knowledge Base Of Exploit Mitigations Available Across Numerous Operating Systems, Architectures And Applications And Versions
http://www.kitploit.com/2021/07/exploitmitigations-knowledge-base-of.html

The goal is to list exploitation (https://www.kitploit.com/search/label/Exploitation) mitigations added over time in various operating systems, software, libraries or hardware. It becomes handy to know if a given vulnerability (https://www.kitploit.com/search/label/Vulnerability) is easily exploitable or not depending on exploitation mitigations in place. An example is the following:

___________________________
@hacking_Attack
@Hacking_Video

Supported targets
We currently support the following operating systems: Microsoft Windows (https://github.com/nccgroup/exploit_mitigations/blob/master/windows_mitigations.md) Linux (https://github.com/nccgroup/exploit_mitigations/blob/master/linux_mitigations.md) Google Android (https://github.com/nccgroup/exploit_mitigations/blob/master/android_mitigations.md) Apple iPhone OS (iOS) (https://github.com/nccgroup/exploit_mitigations/blob/master/iphone_mitigations.md) OpenBSD (https://github.com/nccgroup/exploit_mitigations/blob/master/openbsd_mitigations.md) FreeBSD (https://github.com/nccgroup/exploit_mitigations/blob/master/freebsd_mitigations.md) and the following software: Mozilla Firefox (https://github.com/nccgroup/exploit_mitigations/blob/master/firefox_mitigations.md) Microsoft Edge (https://github.com/nccgroup/exploit_mitigations/blob/master/edge_mitigations.md) Google Chrome (https://github.com/nccgroup/exploit_mitigations/blob/master/chrome_mitigations.md) Microsoft Office (https://github.com/nccgroup/exploit_mitigations/blob/master/office_mitigations.md) and the following libraries: glibc (https://github.com/nccgroup/exploit_mitigations/blob/master/glibc_mitigations.md) and the following hardware: ARM (https://github.com/nccgroup/exploit_mitigations/blob/master/arm_mitigations.md)
Motivations
It has become challenging to follow when certain mitigations are added in an update and/or backported to some older versions of various software and hardware. Sometimes, online content becomes deprecated due to mitigation changes and it can be hard to keep up. Also, it is easy to forget after a short time if you don't work on a specific software/hardware. We have been filling this gap by tracking all the mitigations in summary tables that hold the mitigations names and linking to online references to get technical information about them. The shared information has demonstrated to be useful for several years to exploit developers.
Does my current environment have mitigation X?
This is a common question any exploit developer may have when trying to develop an exploit for a given target. E.g. let's say you want to exploit a Windows kernel driver on Windows 7 x64 containing a kernel NULL pointer dereference bug. Is it exploitable? Checking our table, we read the "NULL page mitigation" was introduced in "Windows 8 32-bit/64-bit and backported to Vista+ 64-bit". Now we know it depends if our target Windows 7 x64 is up-to-date (https://www.kitploit.com/search/label/Up-to-date) or not, more precisely, we can focus on figuring out which KB introduces this mitigation and check our target against that KB!
Final words
We do accept pull requests so feel free to do so :) We do have other targets in our private pipeline (https://www.kitploit.com/search/label/Pipeline) too so reach out if you are interested in another particular one :)

Download Exploit_Mitigations (https://github.com/nccgroup/exploit_mitigations)

___________________________
@hacking_Attack
@Hacking_Video