Hi bug hunters! this article is about my last finding on Facebook.Continue reading on Medium » (https://dewcode.medium.com/force-browsing-bug-at-facebook-business-plan-500-bounty-73d1bb4883af?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

https://a.thumbs.redditmedia.com/yeM66DfvhWS8urd8Pz1g5lv5knmRjuGBCKYHXTojtM4.jpg Here is the command I launch and the result:

​

https://preview.redd.it/0a25zrzd4gq71.png?width=771&format=png&auto=webp&s=753e3930f7c9038ecbb0c086871d3301083a458c

The zip file secret_files.zipcontains three files, file1.txtcontaining the string "blablabla", and files 2 and 3 containing nothing. The password of the archive is listed in the dictionary provided. What am I doing wrong?

submitted by /u/ultome
[link] [comments]

hacking: security in practice
New way for malware to evade detection (involves attacking digital signature)

https://cybersecuritynews.com/hackers-have-figured-out-a-new-malware-evasion-technique-to-fly-under-the-radar/

submitted by /u/JDrisc3480
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Bounty Hacker Tryhackme Walkthrough

Hello guys and welcome back , Ayush this side, today we’ll talk about one of the tryhackme room “Bounty Hacker”, it’s a quite easy room in…
Read more...

ASP.NET CORE Path Traversal

A path traversal attack (also known as directory traversal) aims to access files and directories that are stored outside the webroot…
Read more...

Hacking on Medium
h@cktivitycon 2021 CTF writeup: Reactor Android Challenge

https://cdn-images-1.medium.com/max/600/1*v-8D_EkkYDx5SD3CfqiwBg.png
Hey there, HackerOne hosted h@activitycon 2021 CTF a few weeks back. I got time to play around with a few challenges. Here is the write-up…

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Introduction to Windows Stack Buffer Overflow — TryHackMe Brainpan Walkthrough

https://cdn-images-1.medium.com/max/2000/0*JXqkTHvdMH_Ojj08.png
The OSCP exam consists of a 25 point Buffer Overflow machine. Some people make the mistake of leaving out this topic, even though these…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Force Browsing bug at Facebook business plan ($500 Bounty)

https://cdn-images-1.medium.com/max/723/1*zfptnHV8R_ejILPooxIZZA.png
Hi bug hunters! this article is about my last finding on Facebook.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
La decisión del FBI de retener las claves de descifrado del ransomware Kaseya despierta debate.

https://cdn-images-1.medium.com/max/1388/0*EcqSjZ6DRXJbQ5NE
PUBLICADO EN 29 SEPTIEMBRE, 2021POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Love HacktheBox Walkthrough

Love is a CTF hosted on Hack the Box with Beginner categories. The objective for the participant is to identify the files user.txt and root.txt on the victim’s system. Penetration MethodlogiesRecon1stMethodNmapLet's begin with a Nmap version scan to discover open and running services and their versions.Enumeration Then, in the web browser, we investigate the target IP through port 443, but it returns Forbidden and prevents us from accessing that page.DirbWithout further ado, we will do a web directory brute force attack using dirb, which will return two web directories: /admin and /image. ExploitReturning to the File Scanner web page, we'll attempt to test SSRF by scanning the following URL.Server Side Request Forgery (SSRF), leading in the display of the Password Dashboard. As a response, it will give credentials to the administrator, which we may use to access the voting system.___________________________
@hacking_Attack
@Hacking_Video

Besides the update profile option, the admin dashboard contains no relevant information when logging into the web app.Unrestricted File Upload to RCEWe discovered upload feature for uploading profile photographs while updating the admin profile. We'll attempt to upload a PHP backdoor here.Reverse ShellLet's try the reverse connection by running metasploit payload via simple-backdoor.php. In this case, we will utilise the following module to create a malicious HTA file.Post EnumerationYou will find your first flag at C:\Users\Phoebe\Desktop. Let's crawl some more and look for weak or misconfigured links in order to elevate privilege for Phoebe.Winpeas.exeIn order to elevate privileges, we need to enumerate different files, directories, permissions, logs and SAM files. The number of files inside a Windows OS is very overwhelming. We will be using winpeasto enumerate vulnerable vector that can be exploited for privilege escalation.Privilege EscalationBecause AlwaysInstallElevated was enabled, we may do post-exploitation using the metas[...]

___________________________
@hacking_Attack
@Hacking_Video

ploit module shown below.2ndMethod Exploitation We can use arbitrary RCE to inject a malicious exe file onto the target system. For this, we will use msfvenom to build a malicious exe with the command given below, and then establish a Python HTTP server to send data.shell.exe Privilege EscalationWhen you run winpeas.exe, it will identify misconfigurations that may assist you obtain the vector vulnerable to privilege escalation. The system was improperly configured to ALwaysInstallElevated privileges. priv.msi___________________________
@hacking_Attack
@Hacking_Video

wCLcBGAsYHQ/s16000/59.png You will get new netcat session with administrative privileges.___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
Love HacktheBox Walkthrough

Love is a CTF hosted on Hack the Box with Beginner categories. The objective for the participant is to identify the files user.txt and root.txt on the victim’s system. Penetration Methodlogies 1st Method Recon Nmap Enumeration Dirb Exploit SSRF Unrestricted file upload to RCE Reverse Shell via Metasploit Post Enumeration

The post Love HacktheBox Walkthrough appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video