Hacking on Medium
Brute Force attack on a Web server’s login Page

https://cdn-images-1.medium.com/max/675/1*4nVfy6fjDajGtWxcNBfnMw.png
When i am trying out CTF challenges i.e.: Hack The Box, once i have completed my reconnaissance i,e: nmap, dirb. This is a process i…

Continue reading on Medium »

Hacking on Medium
Vulnerabilidad crítica de RCE encontrada en el software Apache OFBiz ERP: Parchar ahora.

https://cdn-images-1.medium.com/max/957/0*eyp2F-RuXyYKQ2vx
La Apache Software Foundation abordó el viernes una vulnerabilidad de alta gravedad en Apache OFBiz que podría haber permitido que un…

Continue reading on Medium »

Hacking Articles
Thick Client Penetration Testing on DVTA

In the previous article, we have seen some methods to Analyze the Traffic of Thick Client Applications specifically in DVTA. You can take a look at that article by browsing this link: – https://www.hackingarticles.in/thick-client-penetration-testing-traffic-analysis/ In this article, we will perform some attacks to pen-test the application. Table of Content Prerequisites

The post Thick Client Penetration Testing on DVTA appeared first on Hacking Articles.

rustyIron - MobileIron MDM Authentication Tooling
https://www.reddit.com/r/redteamsec/comments/mav7uu/rustyiron_mobileiron_mdm_authentication_tooling/

submitted by /u/emptynebuli (https://www.reddit.com/user/emptynebuli)
[link] (https://github.com/optiv/rustyIron) [comments] (https://www.reddit.com/r/redteamsec/comments/mav7uu/rustyiron_mobileiron_mdm_authentication_tooling/)

hacking: security in practice
What is Zero Trust Model?

https://b.thumbs.redditmedia.com/Ge1Sv7OJ9xdvDbHwnuBXG1lJnm88WBVts9vU2SXizoQ.jpg submitted by /u/umuttosun
[link] [comments]

hacking: security in practice
Acer Faced With Ransom Up To $100 Million After Hackers Breach Network

https://b.thumbs.redditmedia.com/3P8Ou5KLSh_JtIqzLrnTjXpCWzA1TCDkc3k6WF2orUA.jpg submitted by /u/s_kaw
[link] [comments]

hacking: security in practice
Random domain name hijacking at DigitalOcean DNS as easy as ABC

In my line of work, I found an obvious vulnerability in the Digital Ocean panel. I wrote more about it in my blog.

This allows you to bind someone else's domain to your server, which points to the digital ocean but is not bound to the server

If you write a simple WHOIS parser, you can exploit random domains!

I don't understand why the team of Digital Ocean doesn't care about this?

submitted by /u/smeshny
[link] [comments]

hacking: security in practice
It is kaspersky actually bad?

Why some infosec experts on tw say that Kasperky isnt reliable at all?

submitted by /u/sandfoxJ
[link] [comments]

ProxyLogon - PoC Exploit for Microsoft Exchange

PoC Exploit for Microsoft Exchange Launche Original PoC: https://github.com/testanullHow to use: python proxylogon.py <name or IP of server> <user@fqdn> Example: python proxylogon.py primary administrator@lab.local If successful you will be dropped into a webshell. exit or quit to escape from the webshell (or ctrl+c) By default, it will create a file test.aspx. This can be changed. Special Thanks and resources: @Flangvik @Testanull https://www.praetorian.com/blog/reproducing-proxylogon-exploit/ Download ProxyLogon
Read more...

ProxyLogon - PoC Exploit for Microsoft Exchange
http://www.kitploit.com/2021/03/proxylogon-poc-exploit-for-microsoft.html

PoC Exploit for Microsoft Exchange Launche Original PoC: https://github.com/testanull
How to use:
python proxylogon.py
Example:
python proxylogon.py primary administrator@lab.local If successful you will be dropped into a webshell. exit or quit to escape from the webshell (or ctrl+c) By default, it will create a file test.aspx. This can be changed.
Special Thanks and resources:
@Flangvik @Testanull https://www.praetorian.com/blog/reproducing-proxylogon-exploit/

Download ProxyLogon (https://github.com/hausec/ProxyLogon)