Black Hat Ethical Hacking
Apache fixes actively exploited zero-day vulnerability, patch now

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Apache fixes actively exploited zero-day vulnerability, patch nowPost Views: 160
Reading Time: 1 Minute
The Apache Software Foundation has released version 2.4.50 of the HTTP Web Server to address two vulnerabilities, one of which is an actively exploited path traversal and file disclosure flaw.
The Apache HTTP Server is an open-source, cross-platform web server that is extremely popular for being versatile, robust, and free. As such, any vulnerability in the product has widespread consequences.

The actively exploited zero-day vulnerability is tracked as CVE-2021-41773 and it enables actors to map URLs to files outside the expected document root by launching a path traversal attack.

Path traversal attacks involve sending requests to access backend or sensitive server directories that should be out of reach. Normally, these requests are blocked, but in this case, the filters are bypassed by using encoded characters (ASCII) for the URLs.

Additionally, exploits of this flaw may lead to the leaking of the source of interpreted files such as CGI scripts.
See Also: Complete Offensive Security and Ethical Hacking Course For the attack to work, the target has to run Apache HTTP Server 2.4.49, and also has to have the “require all denied” access control parameter disabled. Unfortunately, this appears to be the default configuration.

Earlier Apache Server versions or those having a different access configuration aren’t vulnerable to this flaw.

Since the disclosure of the vulnerability, security researchers have been able to reproduce the vulnerability and warned that admins should patch immediately.
🔥 We have reproduced the fresh CVE-2021-41773 Path Traversal vulnerability in Apache 2.4.49.

If files outside of the document root are not protected by "require all denied" these requests can succeed.

Patch ASAP! https://t.co/6JrbayDbqG pic.twitter.com/AnsaJszPTE

— PT SWARM (@ptswarm) October 5, 2021
See Also: Apple Pay with VISA lets hackers force payments on locked iPhones A Shodan search revealed that there are over a hundred thousand Apache HTTP Server 2.4.49 deployments online, many of which could be vulnerable to exploitation, so updating your software as soon as possible should be considered exigent.
https://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/apache_number.jpg
___________________________
@hacking_Attack
@Hacking_Video

This flaw too only exists in Apache Server version 2.4.49, but it’s not under active exploitation. It was discovered three weeks ago, fixed late last month, and incorporated now in version 2.4.50.
See Also: Hacking stories – Operation Aurora: When China hacked Google Source: www.bleepingcomputer.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/security-breach-freepik-90x90.jpg Encrypted & Fileless Malware Sees Big Growth1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/Digital-Wallet-90x90.jpg MFA Glitch Leads to 6K+ Coinbase Customers Getting Robbed2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/shutterstock_1156765921-900x506-1-90x90.jpg Google pushes emergency Chrome update to fix two zero-days5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/ezgif.com-gif-maker-2-90x90.jpg Apple Pay with VISA lets hackers force payments on locked iPhones6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/gamma-finfisher-hacked-tool-90x90.jpg FinFisher malware hijacks Windows Boot Manager with UEFI bootkit1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/computer-3923644_1920_1627303851339_1632808464296-90x90.jpg New malware steals Steam, Epic Games Store, and EA Origin accounts1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/VMware-90x90.jpg Hackers exploiting critical VMware vCenter CVE-2021-22005 bug1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/malware-800x449-1-90x90.jpg Malware devs trick Windows validation with malformed certs2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/ezgif.com-gif-maker-1-1-90x90.jpg Unpatched Apple Zero-Day in macOS Finder Allows Code Execution2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/ezgif.com-gif-maker-1-90x90.jpg New macOS zero-day bug lets attackers run commands remotely2 weeks ago
The post Apache fixes actively exploited zero-day vulnerability, patch now first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

How bugs can be good for you: An introduction to bug bounty.
https://medium.com/@suharthshetty/how-bugs-can-be-good-for-you-an-introduction-to-bug-bounty-88be9b050282?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

In the coding community, we know bugs are something that need to be avoided.Continue reading on Medium » (https://medium.com/@suharthshetty/how-bugs-can-be-good-for-you-an-introduction-to-bug-bounty-88be9b050282?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

What Are the Different Types of Bugs in Software Testing?
https://securebug.medium.com/what-are-the-different-types-of-bugs-in-software-testing-37b1288decb0?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

We have all grown up watching Disney and Pixar movies featuring bug characters as cute little creatures. Back then, the world seemed full…Continue reading on Medium » (https://securebug.medium.com/what-are-the-different-types-of-bugs-in-software-testing-37b1288decb0?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

How bugs can be good for you: An introduction to bug bounty.

In the coding community, we know bugs are something that need to be avoided.Continue reading on Medium »
Read more...

What Are the Different Types of Bugs in Software Testing?

We have all grown up watching Disney and Pixar movies featuring bug characters as cute little creatures. Back then, the world seemed full…Continue reading on Medium »
Read more...

hacking: security in practice
How do you know you got hacked?

I get now and then an weird call or emails. So I have an suspicion that my contract information is being sold or stolen.

How can you check if your info is being misuesed and sold on the Internet? And how do you know you got hacked in general?

submitted by /u/the_dutch_geek
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Viewing the list of blocked sites

I am studying in a very networking-restrictive(oppressive, if you will) college(where sites like twitch.tv, kali.org, blackarch.org, steam(basically anything related to entertainment), fandom wiki, and even chess.com is blocked). Outgoing ssh port 22 is also blocked so I cannot ssh into any of my servers outside the university network nor use git by ssh. VPN is blocked but thankfully wireguard isn't so I can bypass it.

The enterprise network is a PEAP, mschapv2, with no certificate validation(so basically android 10+ users cannot even use it). We know more about IT than the IT department themselves these days(the head Network guy thinks ssh is a mail protocol to give you a taste).

I actually have a couple of questions,

1. Is there a way to see how many websites are blocked by our network?
2. Is there any way to stick it to em? (You don't have to answer this, I'm just really really pissed :( .)

submitted by /u/SHUT_MOUTH_HAMMOND
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Boundless Bug Bashing at Bugédex!
https://medium.com/@parthk1224/boundless-bug-bashing-at-bug%C3%A9dex-a11a07719aae?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

This past weekend, I got the chance to dive into the world of cybersecurity and bug catching at Bugédex, and to say it was thrilling would…Continue reading on Medium » (https://medium.com/@parthk1224/boundless-bug-bashing-at-bug%C3%A9dex-a11a07719aae?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hacking Netflix Eureka!

https://cdn-images-1.medium.com/max/712/1*VS43RoGDt4MHWMv0kdSuJA.png
TL;DR SSRF, internal traffic hijack, XSS

Continue reading on Backbase »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Setting up VPS for Bug-bounty Automation.

https://cdn-images-1.medium.com/max/1641/1*gdOziEYxfm7rOoXtx-s9Ng.png
Hey Guys!! How are you? I hope everyone is safe in Current Covid-19 Pandemic Situation. I am back with another Blog. Hope you will learn…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video