Hacking on Medium
Integer Overflow to RCE — ManageEngine Asset Explorer Agent (CVE-2021–20082)

https://cdn-images-1.medium.com/max/1916/1*SaeyIS-iymwcyXsgJdwlng.gif
A couple months back, Chris Lyne and I had a look at ManageEngine ServiceDesk Plus. This product consists of a server / agent model in…

Continue reading on Tenable TechBlog »

Hacking on Medium
BASIC SPLUNK 101 WALKTHROUGH TRYHACKME

https://cdn-images-1.medium.com/max/678/1*jgwlpn5quO2hxfrsZIKFWA.jpeg
SIEM stands for security information and event management and provides organizations with next-generation detection, analytics and…

Continue reading on InfoSec Write-ups »

Hacking on Medium
Hub Weekly Digest: Hub Partners with Trilogy Networks, Increase in Healthcare Attacks and Pipeline…

https://cdn-images-1.medium.com/max/2600/1*-3fgsfXOn2967XKJPPECIg.jpeg
HUB Security’s weekly digest covers top stories happening around the world related to cyber attacks, threats and global cybersecurity news.

Continue reading on HUB Security »

Hacking on Medium
Stored XSS to RCE Chain as SYSTEM in ManageEngine ServiceDesk Plus

https://cdn-images-1.medium.com/max/741/0*cMit04EjHUXj1PkK
Gaining SYSTEM access via the help desk software

Continue reading on Tenable TechBlog »

Hacking on Medium
School security has to include cyber too

https://cdn-images-1.medium.com/max/2600/1*N7MGxGONknhyzhvAQO66FQ.jpeg
Physical security at schools, from disease and violence, is important. But so is cybersecurity.

Continue reading on Nerd For Tech »

Hacking on Medium
Everything you need you know about Ethical Hacking Certifications

Pen Testing Certs Roundup (eJPT, eCPT, PNPT, OSCP, OSCE, eWPT, etc)

Continue reading on Medium »

Hacking on Medium
Un millón de tarjetas de crédito filtradas en un foro de ciberdelincuencia de forma gratuita.

https://cdn-images-1.medium.com/max/903/0*2T4Fy3Gbny8G2ckh
POR EHACKING

Continue reading on Medium »

Pentesting an API for Fun and Learning

Want to learn API pentesting? This post will answer most of the questions you have been craving for and give great tips on API pentesting!Continue reading on Medium »
Read more...

Pentesting an API for Fun and Learning
https://securitygoat.medium.com/pentesting-an-api-for-fun-and-learning-b7b4801ff12?source=rss------bug_bounty-5

Want to learn API pentesting? This post will answer most of the questions you have been craving for and give great tips on API pentesting!Continue reading on Medium » (https://securitygoat.medium.com/pentesting-an-api-for-fun-and-learning-b7b4801ff12?source=rss------bug_bounty-5)

Exploit Collector
Cyberoam NetGenie Cross Site Scripting

https://4.bp.blogspot.com/-4IgemuXxvlQ/WWlvJOAjEHI/AAAAAAAAIL4/GJdo6H5fQo4z7HKyurc-fIH3InSyWxX3gCLcBGAs/s1600/h145.png
Cyberoam NetGenie with a firmware version of C0101B1-20141120-NG11VO suffers from a cross site scripting vulnerability.

MD5 | 23d3c96b793c9e3fb0836031803341da

Download
# Title: Cyberoam NetGenie (C0101B1-20141120-NG11VO) - Reflected Cross Site Scripting (XSS)
# Date: 14.08.2021
# Credit: Gionathan "John" Reale
# Firmware Version: C0101B1-20141120-NG11VO
# CVE-2021-38702
################################################################################

DESCRIPTION:

Cyberoam NetGenie C0101B1-20141120-NG11VO devices through 2021-08-14 allow tweb/ft.php?u=[XSS] attacks.

POC:

After connecting to the network via the NetGenie router a page is displayed suggesting a redirect, within the redirect parameter it is possible to execute reflected Cross Site Scripting, the component affected is "hxxp:/URL/tweb/ft.php?u="

Source:packetstormsecurity.com