handshake,” according to the advisory. “An attacker could exploit this vulnerability by using data from the SSL client hello packet to communicate with an external server.”

The spam-quarantine-related vulnerability affects Cisco Secure Email and Web Manager releases earlier than Release 14.1. It could allow an authenticated, remote attacker to gain unauthorized access and modify the spam quarantine settings of another user, so that malicious messages could get through or attackers could read messages.

“This vulnerability exists because access to the spam quarantine feature is not properly restricted,” according to the advisory. “An attacker could exploit this vulnerability by sending malicious requests to an affected system.”

The third bug exists in the Link Layer Discovery Protocol (LLDP) implementation for Cisco Video Surveillance 7000 Series IP Cameras with firmware release 2.12.4. Exploitation could allow an unauthenticated, adjacent attacker to cause a DoS condition.

“This vulnerability is due to improper management of memory resources, referred to as a double free,” according to Cisco. “An attacker could exploit this vulnerability by sending crafted LLDP packets to an affected device.” See Also: Hacking Stories: Andrian Lamo – The ‘homeless’ HackerThe last two vulnerabilities exist in the Expressway and TelePresence products and can be exploited by authenticated, remote attackers to execute code.

The first of these allows RCE with internal user privileges on the underlying operating system; it affects users running a release earlier than the first fixed release (the bug was introduced when support for validation of SHA512 checksums was introduced in Release X8.8).

The second allows RCE on the underlying operating system as the root user. It affects releases earlier than the first fixed release if users are running Release X8.6 or later.
Source: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Bug-Digital-90x90.jpg Unpatched Fortinet Bug Allows Firewall Takeovers1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-1-90x90.png Bug in Millions of Flawed IoT Devices Lets Attackers Eavesdrop2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Steam-logo-90x90.jpg Critical Valve Bug Lets Gamers Add Unlimited Funds to Steam Wallets3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/tmobile-header-90x90.webp Hacker claims to steal data of 100 million T-mobile customers4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/depositphotos_40325161-stock-photo-microsoft-building-90x90.jpg Microsoft Warns: Another Unpatched PrintNightmare Zero-Day7 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/crypto-hack-90x90.jpg Crypto Hack Earned Crooks $600 Million1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/msft-microsoft-logo-2-3-90x90.webp Actively Exploited Windows Zero-Day Gets a Patch1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/botnet-90x90.jpg Auth Bypass Bug Exploited, Affecting Millions of Routers1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/cisco-patch-90x90.png Critical Cisco Bug in VPN Routers Allows Remote Takeover2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/delete-telegram-message-e1628177080885-90x90.jpg MacOS Flaw in Telegram Retrieves Deleted Messages2 weeks ago
style="display:block; text-align:center;"
data-ad-layout="in-article"
data-ad-format="fluid"
data-ad-client="ca-pub-6620833063853657"
data-ad-slot="4517761481">
The post Critical Cisco Bug in Small Business Routers to Remain Unpatched first appeared on Black Hat Ethical Hacking.

How To Start Bug Bounty Hunting
https://therceman.medium.com/how-to-start-bug-bounty-hunting-94b1ff3dda27?source=rss------bug_bounty-5

Short & Basic Intro to Bug Bounty WorldContinue reading on Medium » (https://therceman.medium.com/how-to-start-bug-bounty-hunting-94b1ff3dda27?source=rss------bug_bounty-5)

Tip #1 of Cyber Security
https://cyberdessy.medium.com/tip-1-of-cyber-security-d36b3c8d300e?source=rss------bug_bounty-5

Penetration testing and cyber security in general is not a 9am to 5pm job, and if you’re in this line of work for the money, then it is…Continue reading on Medium » (https://cyberdessy.medium.com/tip-1-of-cyber-security-d36b3c8d300e?source=rss------bug_bounty-5)

Bug
https://bhexchain.medium.com/bug-19aaae00fa9e?source=rss------bug_bounty-5

Bug bounty with Slow Mist, a blockchain security auditing company.‌Continue reading on Medium » (https://bhexchain.medium.com/bug-19aaae00fa9e?source=rss------bug_bounty-5)

How To Start Bug Bounty Hunting

Short & Basic Intro to Bug Bounty WorldContinue reading on Medium »
Read more...

Tip #1 of Cyber Security

Penetration testing and cyber security in general is not a 9am to 5pm job, and if you’re in this line of work for the money, then it is…Continue reading on Medium »
Read more...

Bug

Bug bounty with Slow Mist, a blockchain security auditing company.‌Continue reading on Medium »
Read more...

hacking: security in practice
DIT - A tool to perform DTLS MitM attacks

As part of my master thesis I have developed a tool to intercept, manipulate and/or suppress datagrams between two DTLS endpoint. The tool is meant to make analyzing/fuzzing DTLS encrypted iot communication easier but it works on any kind of DTLS communication. While it is possible to decrypt DTLS traffic in Wireshark (when the PSK is known) I was not able to find any tools that were able to intercept and manipulate DTLS traffic that has been initialized using certificate-based authentication schemes - so I built one of my own.

The tool is named DIT (DTLS Interception Tool) and is supposed to work a lot like mitmproxy works for HTTPS. It does not break DTLS in any way - just like mitmproxy does not break TLS. So if you do not know the PSK and certificates are validated you won't be able to pull off a MitM attack. You can take a look at the tool right here if you are interested:

https://github.com/CountablyInfinite/dit

I was able to intercept and manipulate local DTLS traffic from products of the IKEA TRADFRI and the PHILIPS HUE series that rely on DTLS to secure their communication.

submitted by /u/WasZurHecke
[link] [comments]

hacking: security in practice
how do i get someone's discord account

a friend of my friend keeps saying some of my friends talk behind my back and i want to find out who. is there anyway I can hack into his account?

submitted by /u/FlatMuffin2
[link] [comments]

hacking: security in practice
How easy would it be to have something removed from a government agency ?

Having a rejection removed from the cbp database or having it changed.

submitted by /u/cocainecarolina28
[link] [comments]

FisherMan - CLI Program That Collects Information From Facebook User Profiles Via Selenium
http://www.kitploit.com/2021/08/fisherman-cli-program-that-collects.html

Search for public profile information on Facebook
Installation
# clone the repo
$ git clone https://github.com/Godofcoffe/FisherMan

# change the working directory to FisherMan
$ cd FisherMan

# install the requirements
$ python3 -m pip install -r requirements.txt

Pre-requisites
Make sure you have the executable "geckodriver" installed on your machine.
Usage
facebook profiles. (Version 3.4.0) optional arguments: -h, --help show this help message and exit --version Shows the current version of the program. -u USERNAME [USERNAME ...], --username USERNAME [USERNAME ...] Defines one or more users for the search. -i ID [ID ...], --id ID [ID ...] Set the profile identification number. --use-txt TXT_FILE Replaces the USERNAME parameter with a user list in a txt. -S USER, --search USER It does a shallow search for the username. Replace the spaces with '.'(period). -sf, --scrape-family If this parameter is passed, the information from family members will be scraped if available. --specify {0,1,2,3,4,5} [{0,1,2,3,4,5} ...] Use the index number to return a specific part of the page. about: 0,about_contact_and_basic_info: 1,about_family_and_relationships: 2,about_details: 3,about_work_and_education: 4,about_places: 5. -s, --several Returns extra data like profile picture, number of followers and friends. -b, --browser Opens the browser/bot. --email EMAIL If the profile is blocked, you can define your account, however you have the search user in your friends list. --password PASSWORD Set the password for your facebook account, this parameter has to be used with --email. -o, --file-output Save the output data to a .txt file. -c, --compact Compress all .txt files. Use together with -o. -v, -d, --verbose, --debug It shows in detail the data search process. -q, --quiet Eliminates and simplifies some script outputs for a simpler and more discrete visualization. ">$ python3 fisherman.py --help
usage: fisherman.py [-h] [--version] [-u USERNAME [USERNAME ...] | -i ID
[ID ...] | --use-txt TXT_FILE | -S USER] [-sf]
[--specify {0,1,2,3,4,5} [{0,1,2,3,4,5} ...]] [-s] [-b]
[--email EMAIL] [--password PASSWORD] [-o] [-c] [-v | -q]

FisherMan: Extract information from facebook profiles. (Version 3.4.0)

optional arguments:
-h, --help show this help message and exit
--version Shows the current version of the program.
-u USERNAME [USERNAME ...], --username USERNAME [USERNAME ...]
Defines one or more users for the search.
-i ID [ID ...], --id ID [ID ...]
Set the profile identification number.
--use-txt TXT_FILE Replaces the USERNAME parameter with a user list in a
txt.
-S USER, --search USER
It does a shallow search for the username. Replace the
spaces with '.'(period).
-sf, --scrape-family If this parameter is passed, the information from
family members will be scraped if available.
--specify {0,1,2,3,4,5} [{0,1,2,3,4,5} ...]
Use the index number to return a specific part of the
page. about: 0,about_contact_and_basic_info:
1,about_family_and_relationships: 2,about_details:
3,about_work_and_education: 4,about_places: 5.

-s, --several Returns extra data like profile picture, number of
followers and friends.
-b, --browser Opens the browser/bot.
--email EMAIL If the profile is blocked, you can define your
account, however you have the search user in your
fri ends list.
--password PASSWORD Set the password for your facebook account, this
parameter has to be used with --email.
-o, --file-output Save the output data to a .txt file.
-c, --compact Compress all .txt files. Use together with -o.
-v, -d, --verbose, --debug
It shows in detail the data search process.
-q, --quiet Eliminates and simplifies some script outputs for a
simpler and more discrete visualization.
To search for a user: User name: python3 fisherman.py -u name name.profile name.profile2 ID: python3 fisherman.py -i 000000000000 The username (https://www.kitploit.com/search/label/Username) must be found on the facebook profile link, such as: https://facebook.com/name.profile/
It is also possible to load multiple usernames (https://www.kitploit.com/search/label/Usernames) from a .txt file, this can be useful for a brute force (https://www.kitploit.com/search/label/Brute%20Force) output type: python3 fisherman.py --use-txt filename.txt
Some profiles are limited to displaying your information for any account, so you can use your account to extract. Note: this should be used as the last hypothesis, and the target profile must be on your friends list: python3 fisherman.py --email youremail@email.com --password yourpass

Some situations:
For complete massive scrape: python3 fisherman.py --use-txt file -o -c -sf
With a file with dozens of names on each line, you can make a complete "scan" taking your information and even your family members and will be compressed into a .zip at the output. For specific parts of the account: Basic data: python3 fisherman.py -u name --specify 0 Family and relationship: python3 -u name --specify 2 It is still possible to mix: python3 fisherman.py -u name --specify 0 2 To get additional things like profile picture, how many followers and how many friends: python3 fisherman.py -u name -s

This tool only extracts information that is public, not use for private or illegal purposes.

LICENSE
BSD 3-Clause © FisherMan Project Original Creator - Godofcoffe (https://github.com/Godofcoffe)

Download FisherMan (https://github.com/Godofcoffe/FisherMan)