hacking: security in practice
Understanding CVE-2019-9053

https://external-preview.redd.it/9BUC9FyVq8T6FLhLloF1xQRmU5xqx6ILKhQMgSNF-d4.jpg?width=640&crop=smart&auto=webp&s=312ec115b3011e865711ff5cc0909c00a1e8213f submitted by /u/pythonpsycho1337
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Oversimplified — Bug Bounty

Undoubtedly, most of us believe that finding vulnerabilities in software looking something like the image above. “Hacking” has always been…Continue reading on Medium »
Read more...

Wanna earn from bugs?

It’s a rainy day. You’re coming back home after a tedious day at your office. You’re hungry, but you don’t wanna cook now, you decide to…Continue reading on Medium »
Read more...

A Bug’s Life

IntroductionContinue reading on Medium »
Read more...

My Journey into Bug Bounty

This is a blog about my first glimpses into vast ocean of opportunities bug bounty and cyber security provides. A journey initiated by a…Continue reading on Medium »
Read more...

My Experience with bug hunting

Hey Folks! I am Rishu Yadav👋, an undergrad student pursuing Computer Science at the time of writing this article. I recently participated…Continue reading on Medium »
Read more...

What The Bug- My Bugédex Journey.

Last Sunday, I attended Bugédex- a workshop on bug bounty organized by CSI-VIT in collaboration with CloudSEK. It left me pondering and…Continue reading on Medium »
Read more...

How I got $500 with Open redirect

Hei Everyone:) Hope you are fine.Today i will gonna share you How i find open redirect Bug on example.com website.I think everyone can get…Continue reading on Medium »
Read more...

A Taste of Bug Bounty with BugéDex

Last Sunday, I had the opportunity to attend a workshop on Bug Bounty and Reporting. CSI-VIT (Computer Society of India, VIT Vellore…Continue reading on Medium »
Read more...

Lights, Camera, BugéDex!

The scene is set. A drowsy teenager awakens from his umpteen hours of sleep. He’s been looking forward to something. Maybe he wants to…Continue reading on Medium »
Read more...

Hacking on Medium
Attacking the ‘3 Random Words’ password format: A practical example of its flaws

https://cdn-images-1.medium.com/max/743/1*RBeJGWspY8IADX4Z0Eqstg.png
Preamble

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hack This Site: Realistic Web Mission — Level 12

https://cdn-images-1.medium.com/max/2000/0*XdsvxumOo1Pf00j1
Welcome to HaXeZ where today we’re looking at Hack This Site Realistic Web Mission 12. This mission requires us to use the built-in…

Continue reading on Geek Culture »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The Ultimate Git & GitHub Cheatsheet

https://cdn-images-1.medium.com/max/800/0*_1wP291H9ca_UJJf
Git is a free and open source distributed version control system designed to handle everything from small to very large projects with…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

FUSE - A Penetration Testing Tool For Finding File Upload Bugs
http://www.kitploit.com/2021/10/fuse-penetration-testing-tool-for.html

___________________________
@hacking_Attack
@Hacking_Video

FUSE is a penetration testing (https://www.kitploit.com/search/label/Penetration%20Testing) system designed to identify Unrestricted Executable File Upload (UEFU) vulnerabilities. The details of the testing strategy is in our paper (https://wsp-lab.github.io/papers/lee-fuse-ndss20.pdf), "FUSE: Finding File Upload Bugs via Penetration Testing", which appeared in NDSS 2020. To see how to configure and execute FUSE, see the followings.
Setup

Install
FUSE currently works on Ubuntu 18.04 and Python 2.7.15. Install dependencies # apt-get install rabbitmq-server
# apt-get install python-pip
# apt-get install git
Clone and build FUSE $ git clone https://github.com/WSP-LAB/FUSE
$ cd FUSE && pip install -r requirements.txt
If you plan to leverage headless (https://www.kitploit.com/search/label/Headless) browser verification using selenium, please install Chrome and Firefox web driver by refering selenium document (https://selenium.dev/selenium/docs/api/py/index.html).
Usage

Configuration
FUSE uses a user-provided configuration file (https://github.com/WSP-LAB/FUSE/blob/master/configs/default-credential.conf) that specifies parameters for a target PHP application. The script must be filled out before testing a target Web application. You can check out README (https://github.com/WSP-LAB/FUSE/blob/master/configs/README.md) file and example configuration files (https://github.com/WSP-LAB/FUSE/blob/master/configs). Configuration for File Monitor (Optional) $ vim filemonitor.py

...
10 MONITOR_PATH='/var/www/html/' <- Web root of the target application
11 MONITOR_PORT=20174 <- Default port of File Monitor
12 EVENT_LIST_LIMITATION=8000 <- Maxium number of elements in EVENT_LIST
...

Execution
FUSE $ python framework.py [Path of configuration file]
File Monitor $ python filemonitor.py
Result When FUSE completes the penetration testing, a [HOST] directory and a [HOST_report.txt] file are created. A [HOST] folder stores files that have been attempted to upload. A [HOST_report.txt] file contains test results and information related to files that trigger U(E)FU.
CVEs
If you find UFU and UEFU bugs and get CVEs by running FUSE, please send a PR for README.md (https://github.com/WSP-LAB/FUSE/blob/master/README.md) Application CVEs Elgg CVE-2018-19172 ECCube3 CVE-2018-18637 CMSMadeSimple CVE-2018-19419, CVE-2018-18574 CMSimple CVE-2018-19062 Concrete5 CVE-2018-19146 GetSimpleCMS CVE-2018-19420, CVE-2018-19421 Subrion CVE-2018-19422 OsCommerce2 CVE-2018-18572, CVE-2018-18964, CVE-2018-18965, CVE-2018-18966 Monstra CVE-2018-6383, CVE-2018-18694 XE XEVE-2019-001
Author
This research project (https://www.kitploit.com/search/label/Research%20Project) has been conducted by WSP Lab (https://wsp-lab.github.io/) at KAIST. Taekjin Lee Seongil Wi (https://seongil-wi.github.io/) Suyoung Lee (https://leeswimming.com/) Sooel Son (https://sites.google.com/site/ssonkaist/home)
Citing FUSE
To cite our paper: Distributed System Security Symposium}, year = 2020 } ">@INPROCEEDINGS{lee:ndss:2020,
author = {Taekjin Lee and Seongil Wi and Suyoung Lee and Sooel Son},
title = {{FUSE}: Finding File Upload Bugs via Penetration Testing},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = 2020
}


Download FUSE (https://github.com/WSP-LAB/FUSE)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
FUSE - A Penetration Testing Tool For Finding File Upload Bugs

https://blogger.googleusercontent.com/img/a/AVvXsEhqamkOtMsV-aRAr4_S9CfR5DGaxCzwhGuVGrbw2PCFmAHQzWsLeYRCZRLhO3sWirSajYzf3r1g-RluL3zxSIBwQzfQysM7hYs00ZSJ_KacbMvljgwgjIeCR71e0O_GixRKuC0gmHPHjKpFtpkbouiwLVpkz7qmdTWxYrTjwwGrxuOpgWPGT8HO348H-Q=w640-h340 FUSE is a penetration testing system designed to identify Unrestricted Executable File Upload (UEFU) vulnerabilities. The details of the testing strategy is in our paper, "FUSE: Finding File Upload Bugs via Penetration Testing", which appeared in NDSS 2020. To see how to configure and execute FUSE, see the followings. SetupInstallFUSE currently works on Ubuntu 18.04 and Python 2.7.15.

1. Install dependencies # apt-get install rabbitmq-server
# apt-get install python-pip
# apt-get install git 1. Clone and build FUSE $ git clone https://github.com/WSP-LAB/FUSE
$ cd FUSE && pip install -r requirements.txt * If you plan to leverage headless browser verification using selenium, please install Chrome and Firefox web driver by refering selenium document. UsageConfiguration*
FUSE uses a user-provided configuration file that specifies parameters for a target PHP application. The script must be filled out before testing a target Web application. You can check out README file and example configuration files.

*
Configuration for File Monitor (Optional) $ vim filemonitor.py

...
10 MONITOR_PATH='/var/www/html/' <-
11 MONITOR_PORT=20174 <-
12 EVENT_LIST_LIMITATION=8000 <-
... Execution* FUSE $ python framework.py [Path of configuration file] * File Monitor $ python filemonitor.py * Result
* When FUSE completes the penetration testing, a [HOST] directory and a [HOST_report.txt] file are created.
* A [HOST] folder stores files that have been attempted to upload.
* A [HOST_report.txt] file contains test results and information related to files that trigger U(E)FU. CVEsIf you find UFU and UEFU bugs and get CVEs by running FUSE, please send a PR for README.md
Application CVEs Elgg CVE-2018-19172 ECCube3 CVE-2018-18637 CMSMadeSimple CVE-2018-19419, CVE-2018-18574 CMSimple CVE-2018-19062 Concrete5 CVE-2018-19146 GetSimpleCMS CVE-2018-19420, CVE-2018-19421 Subrion CVE-2018-19422 OsCommerce2 CVE-2018-18572, CVE-2018-18964, CVE-2018-18965, CVE-2018-18966 Monstra CVE-2018-6383, CVE-2018-18694 XE XEVE-2019-001 AuthorThis research project has been conducted by WSP Lab at KAIST.

* Taekjin Lee
* Seongil Wi
* Suyoung Lee
* Sooel Son Citing FUSETo cite our paper:

Distributed System Security Symposium}, year = 2020 } ">@INPROCEEDINGS{lee:ndss:2020,
author = {Taekjin Lee and Seongil Wi and Suyoung Lee and Sooel Son},
title = {{FUSE}: Finding File Upload Bugs via Penetration Testing},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = 2020
} Download FUSE

___________________________
@hacking_Attack
@Hacking_Video