regexploit-py "my-project/**/*.py" --glob
Javascript / Typescript
This will use the bundled NodeJS package in regexploit/bin/javascript which parses your JavaScript as an AST with eslint (https://github.com/typescript-eslint/typescript-eslint/tree/master/packages/parser) and prints out all regexes. Those regexes are fed into the python ReDoS finder. regexploit-js my-module/my-file.js another/file.js some/folder/
regexploit-js "my-project/node_modules/**/*.js" --glob N.B. there are differences between javascript and python regex parsing so there may be some errors. I'm not sure I want (https://hackernoon.com/the-madness-of-parsing-real-world-javascript-regexps-d9ee336df983) to write a JS regex AST!
Python imports
Search for regexes in all the python modules currently installed in your path / env. This means you can pip install whatever modules you are interested in and they will be analysed. Cpython code is included. regexploit-python-env N.B. this doesn't parse the python code to an AST and will only find regexes compiled automatically on module import. Modules are actually imported, so code in the modules will be executed. This is helpful for finding regexes which are built up from smaller strings on load e.g. CVE-2021-25292 in Pillow (https://github.com/python-pillow/Pillow/commit/3bce145966374dd39ce58a6fc0083f8d1890719c)
JSON / YAML
Yaml support requires pyyaml, which can be installed with pip install regexploit[yaml]. regexploit-json *.json
regexploit-yaml *.yaml
C# (.NET)
regexploit-csharp something.cs
Bugs reported CVE-2020-5243: uap-core (https://github.com/ua-parser/uap-core/security/advisories/GHSA-cmcx-xhr8-3w9p) affecting uap-python, uap-ruby (https://github.com/ua-parser/uap-ruby/security/advisories/GHSA-pcqq-5962-hvcw), etc. (User-Agent header parsing) CVE-2020-8492: cpython's urllib.request (https://github.com/python/cpython/commit/0b297d4ff1c0e4480ad33acae793fbaf4bf015b4) (WWW-Authenticate header parsing) CVE-2021-21236: CairoSVG (https://github.com/advisories/GHSA-hq37-853p-g5cf) (SVG parsing) CVE-2021-21240: httplib2 (https://github.com/httplib2/httplib2/security/advisories/GHSA-93xj-8mrv-444m) (WWW-Authenticate header parsing) CVE-2021-25292: python-pillow (https://github.com/python-pillow/Pillow/commit/3bce145966374dd39ce58a6fc0083f8d1890719c) (PDF parsing) CVE-2021-26813: python-markdown2 (https://github.com/trentm/python-markdown2/pull/387) (Markdown parsing) CVE-2021-27290: npm/ssri (https://doyensec.com/resources/Doyensec_Advisory_ssri_redos.pdf) (SRI parsing) CVE-2021-27291: pygments (https://github.com/pygments/pygments/commit/2e7e8c4a7b318f4032493773732754e418279a14) lexers for ADL, CADL, Ceylon, Evoque, Factor, Logos, Matlab, Octave, ODIN, Scilab & Varnish VCL (Syntax highlighting) CVE-2021-27292: ua-parser-js (https://github.com/faisalman/ua-parser-js/commit/809439e20e273ce0d25c1d04e111dcf6011eb566) (User-Agent header parsing) CVE-2021-27293: RestSharp (https://github.com/restsharp/RestSharp/issues/1556) (JSON deserialisation in a .NET C# package) bpo-38804: cpython's http.cookiejar (https://github.com/python/cpython/pull/17157) (Set-Cookie header parsing) SimpleCrawler (archived) (https://doyensec.com/resources/Doyensec_Advisory_simplecrawler_redos.pdf) (HTML parsing) CVE-2021-28092: is-svg (https://github.com/sindresorhus/is-svg/commit/01f8a087fab8a69c3ac9085fbb16035907ab6a5b) (SVG parsing) nuget.org, NuGetGallery (https://github.com/NuGet/NuGetGallery/commit/25d2d3b32b2d9f0b1ca6e0a105b0210c2c4820f4) and NuGet.Client (https://github.com/NuGet/NuGet.Client/commit/a0671e946ce71dc59def5cc8a67c6457d66f33bf) (Parsing NuGet package IDs) markdown (python) (https://github.com/Python-Markdown/markdown/pull/1130) (Markdown parsing) ansi-html (nodejs) (https://github.com/Tjatse/ansi-html/issues/19) (ANSI parsing) Plus unpublished bugs in a handful of pypi, npm, ruby and nuget packages
Credits

___________________________
@hacking_Attack
@Hacking_Video

This tool has been created by Ben Caller of Doyensec LLC (https://www.doyensec.com/) during research time.

___________________________
@hacking_Attack
@Hacking_Video

Download Regexploit (https://github.com/doyensec/regexploit)

___________________________
@hacking_Attack
@Hacking_Video

Hacking the dlink DIR-615 for fun and no profit Part 2: CVE-2020–10215
https://noob3xploiter.medium.com/hacking-the-dlink-dir-615-for-fun-and-no-profit-part-2-cve-2020-10215-586204d42bba?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hi. This is my second writeup on my hacking the dlink dir-615 series as i try to get my first cve. I found more vulns and will also make a…Continue reading on Medium » (https://noob3xploiter.medium.com/hacking-the-dlink-dir-615-for-fun-and-no-profit-part-2-cve-2020-10215-586204d42bba?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What’s the general consensus here on hak5 and omglol hardware?

Just for a bit of background but I’ll try not to make this too long. TL:DR at the bottom.

I’m completely new to both hacking and programming, despite having worked in I.T for most of my working life (~14 years - all of the tools I used were company created so I never had a reason to learn programming to a deep extent, but now I’ve got the interest and desire to understand).

Currently, I’m working through a Kali tools (I know, I know) course and Python course simultaneously. I have no intention on being a script kiddie and have a huge amount of languages that I want to learn once I start to have a decent understanding of Python as well as plan on getting into CTF challenges shortly.

What I think I will struggle with most is hardware and circuit board building, so I have been checking out hak5 tools and omglol cables.

Through some older threads on here, there have been mixed messages with some products being really decent and others being overpriced.

So from your perspective, are there any tools that either of these companies provide that are worthwhile? Which would you recommend building myself vs finding cheap alternatives for such as badUSB’s?

I’m interested in trying lots of different hardware to discover my own vibe/art/style as I learn languages and pen testing skills so don’t have a specific attack or setup in mind - I know that’s vague but I honestly want to try a bit of everything.

Just wanted to get the 2021 opinions, especially since some new and updated products recently came out. Appreciate your thoughts in advance and sorry for the ramble.

TL:DR - What hak5 and omglol hardware is worth it (if any), and what cheap alternatives should I consider without having to do too much fiddling on circuits?

submitted by /u/FlyingWithAnimals
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Saudi Aramco encountered a massive Databreach; after 1TB of stolen data hosted on Darknet | Secure Blink

https://external-preview.redd.it/neTZm5Bs7e8qxpGkG_r9gypiGAhuQx1BOc--hhCN1Xc.jpg?width=640&crop=smart&auto=webp&s=9ee4e60c570727fd18d4e0e15f40de4c50859520 submitted by /u/vishalthevaxus
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

HTML Injection To Free Ticket Cyber Security Event

Hello everyone my name is Mohammad Alfin Hidayatullah, i am a junior bug hunter and i am from Indonesia.Continue reading on Medium »
Read more...

Exploit Collector
Microsoft Windows WFP Default Rules AppContainer Capability Bypass Privilege Escalation

https://3.bp.blogspot.com/-D2NV3HnXxpM/WWlu9YoBNhI/AAAAAAAAIJs/rLrqFdeLLWYSGUQPyN0O7DuhnXu7T_FjQCLcBGAs/s1600/h114.png
The default rules for the WFP connect layers permit certain executables to connect TCP sockets in AppContainers without capabilities leading to elevation of privilege.

MD5 | 37069deaf47980f1a4c39f62bc13ce25

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Webmin 1.973 Cross Site Request Forgery

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Concrete5 8.5.5 Phar Deserialization

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress KN Fix Your Title 1.0.1 Cross Site Scripting

https://3.bp.blogspot.com/-sRAbWielMtM/WWlvVvmDA-I/AAAAAAAAIN8/PunzJUFKKskcHl_zTOrA6xP6ETTvhbejQCLcBGAs/s1600/h46.png
WordPress KN Fix Your Title plugin version 1.0.1 suffers from a cross site scripting vulnerability.

MD5 | 563d1383d6850947d9ba0854d82026d7

Download
# Exploit Title: WordPress Plugin KN Fix Your Title 1.0.1 - 'Separator' Stored Cross-Site Scripting (XSS)
# Date: 19/07/2021
# Exploit Author: Aakash Choudhary
# Software Link: https://wordpress.org/plugins/kn-fix-your/
# Version: 1.0.1
# Category: Web Application
# Tested on Mac

How to Reproduce this Vulnerability:

1. Install WordPress 5.7.2
2. Install and activate KN Fix Your Title
3. Navigate to Fix Title under Settings Tab >> Click on I have done this and enter the XSS payload into the Separator input field.
4. Click Save Changes.
5. You will observe that the payload successfully got stored into the database and when you are triggering the same functionality at that time JavaScript payload is executing successfully and we are getting a pop-up.
6. Payload Used: ">

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

HTML Injection To Free Ticket Cyber Security Event
https://alpinnnnnn13.medium.com/html-injection-to-free-ticket-cyber-security-event-da1806934f88?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello everyone my name is Mohammad Alfin Hidayatullah, i am a junior bug hunter and i am from Indonesia.Continue reading on Medium » (https://alpinnnnnn13.medium.com/html-injection-to-free-ticket-cyber-security-event-da1806934f88?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video