Hacking on Medium
Hack This Site: Realistic Web Mission — Level 12

https://cdn-images-1.medium.com/max/2000/0*XdsvxumOo1Pf00j1
Welcome to HaXeZ where today we’re looking at Hack This Site Realistic Web Mission 12. This mission requires us to use the built-in…

Continue reading on Geek Culture »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The Ultimate Git & GitHub Cheatsheet

https://cdn-images-1.medium.com/max/800/0*_1wP291H9ca_UJJf
Git is a free and open source distributed version control system designed to handle everything from small to very large projects with…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

FUSE - A Penetration Testing Tool For Finding File Upload Bugs
http://www.kitploit.com/2021/10/fuse-penetration-testing-tool-for.html

___________________________
@hacking_Attack
@Hacking_Video

FUSE is a penetration testing (https://www.kitploit.com/search/label/Penetration%20Testing) system designed to identify Unrestricted Executable File Upload (UEFU) vulnerabilities. The details of the testing strategy is in our paper (https://wsp-lab.github.io/papers/lee-fuse-ndss20.pdf), "FUSE: Finding File Upload Bugs via Penetration Testing", which appeared in NDSS 2020. To see how to configure and execute FUSE, see the followings.
Setup

Install
FUSE currently works on Ubuntu 18.04 and Python 2.7.15. Install dependencies # apt-get install rabbitmq-server
# apt-get install python-pip
# apt-get install git
Clone and build FUSE $ git clone https://github.com/WSP-LAB/FUSE
$ cd FUSE && pip install -r requirements.txt
If you plan to leverage headless (https://www.kitploit.com/search/label/Headless) browser verification using selenium, please install Chrome and Firefox web driver by refering selenium document (https://selenium.dev/selenium/docs/api/py/index.html).
Usage

Configuration
FUSE uses a user-provided configuration file (https://github.com/WSP-LAB/FUSE/blob/master/configs/default-credential.conf) that specifies parameters for a target PHP application. The script must be filled out before testing a target Web application. You can check out README (https://github.com/WSP-LAB/FUSE/blob/master/configs/README.md) file and example configuration files (https://github.com/WSP-LAB/FUSE/blob/master/configs). Configuration for File Monitor (Optional) $ vim filemonitor.py

...
10 MONITOR_PATH='/var/www/html/' <- Web root of the target application
11 MONITOR_PORT=20174 <- Default port of File Monitor
12 EVENT_LIST_LIMITATION=8000 <- Maxium number of elements in EVENT_LIST
...

Execution
FUSE $ python framework.py [Path of configuration file]
File Monitor $ python filemonitor.py
Result When FUSE completes the penetration testing, a [HOST] directory and a [HOST_report.txt] file are created. A [HOST] folder stores files that have been attempted to upload. A [HOST_report.txt] file contains test results and information related to files that trigger U(E)FU.
CVEs
If you find UFU and UEFU bugs and get CVEs by running FUSE, please send a PR for README.md (https://github.com/WSP-LAB/FUSE/blob/master/README.md) Application CVEs Elgg CVE-2018-19172 ECCube3 CVE-2018-18637 CMSMadeSimple CVE-2018-19419, CVE-2018-18574 CMSimple CVE-2018-19062 Concrete5 CVE-2018-19146 GetSimpleCMS CVE-2018-19420, CVE-2018-19421 Subrion CVE-2018-19422 OsCommerce2 CVE-2018-18572, CVE-2018-18964, CVE-2018-18965, CVE-2018-18966 Monstra CVE-2018-6383, CVE-2018-18694 XE XEVE-2019-001
Author
This research project (https://www.kitploit.com/search/label/Research%20Project) has been conducted by WSP Lab (https://wsp-lab.github.io/) at KAIST. Taekjin Lee Seongil Wi (https://seongil-wi.github.io/) Suyoung Lee (https://leeswimming.com/) Sooel Son (https://sites.google.com/site/ssonkaist/home)
Citing FUSE
To cite our paper: Distributed System Security Symposium}, year = 2020 } ">@INPROCEEDINGS{lee:ndss:2020,
author = {Taekjin Lee and Seongil Wi and Suyoung Lee and Sooel Son},
title = {{FUSE}: Finding File Upload Bugs via Penetration Testing},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = 2020
}


Download FUSE (https://github.com/WSP-LAB/FUSE)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
FUSE - A Penetration Testing Tool For Finding File Upload Bugs

https://blogger.googleusercontent.com/img/a/AVvXsEhqamkOtMsV-aRAr4_S9CfR5DGaxCzwhGuVGrbw2PCFmAHQzWsLeYRCZRLhO3sWirSajYzf3r1g-RluL3zxSIBwQzfQysM7hYs00ZSJ_KacbMvljgwgjIeCR71e0O_GixRKuC0gmHPHjKpFtpkbouiwLVpkz7qmdTWxYrTjwwGrxuOpgWPGT8HO348H-Q=w640-h340 FUSE is a penetration testing system designed to identify Unrestricted Executable File Upload (UEFU) vulnerabilities. The details of the testing strategy is in our paper, "FUSE: Finding File Upload Bugs via Penetration Testing", which appeared in NDSS 2020. To see how to configure and execute FUSE, see the followings. SetupInstallFUSE currently works on Ubuntu 18.04 and Python 2.7.15.

1. Install dependencies # apt-get install rabbitmq-server
# apt-get install python-pip
# apt-get install git 1. Clone and build FUSE $ git clone https://github.com/WSP-LAB/FUSE
$ cd FUSE && pip install -r requirements.txt * If you plan to leverage headless browser verification using selenium, please install Chrome and Firefox web driver by refering selenium document. UsageConfiguration*
FUSE uses a user-provided configuration file that specifies parameters for a target PHP application. The script must be filled out before testing a target Web application. You can check out README file and example configuration files.

*
Configuration for File Monitor (Optional) $ vim filemonitor.py

...
10 MONITOR_PATH='/var/www/html/' <-
11 MONITOR_PORT=20174 <-
12 EVENT_LIST_LIMITATION=8000 <-
... Execution* FUSE $ python framework.py [Path of configuration file] * File Monitor $ python filemonitor.py * Result
* When FUSE completes the penetration testing, a [HOST] directory and a [HOST_report.txt] file are created.
* A [HOST] folder stores files that have been attempted to upload.
* A [HOST_report.txt] file contains test results and information related to files that trigger U(E)FU. CVEsIf you find UFU and UEFU bugs and get CVEs by running FUSE, please send a PR for README.md
Application CVEs Elgg CVE-2018-19172 ECCube3 CVE-2018-18637 CMSMadeSimple CVE-2018-19419, CVE-2018-18574 CMSimple CVE-2018-19062 Concrete5 CVE-2018-19146 GetSimpleCMS CVE-2018-19420, CVE-2018-19421 Subrion CVE-2018-19422 OsCommerce2 CVE-2018-18572, CVE-2018-18964, CVE-2018-18965, CVE-2018-18966 Monstra CVE-2018-6383, CVE-2018-18694 XE XEVE-2019-001 AuthorThis research project has been conducted by WSP Lab at KAIST.

* Taekjin Lee
* Seongil Wi
* Suyoung Lee
* Sooel Son Citing FUSETo cite our paper:

Distributed System Security Symposium}, year = 2020 } ">@INPROCEEDINGS{lee:ndss:2020,
author = {Taekjin Lee and Seongil Wi and Suyoung Lee and Sooel Son},
title = {{FUSE}: Finding File Upload Bugs via Penetration Testing},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = 2020
} Download FUSE

___________________________
@hacking_Attack
@Hacking_Video

How I got $500 with Open redirect
https://medium.com/@mamunwhh/how-i-got-500-with-open-redirect-48fd80c82631?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hei Everyone:) Hope you are fine.Today i will gonna share you How i find open redirect Bug on example.com website.I think everyone can get…Continue reading on Medium » (https://medium.com/@mamunwhh/how-i-got-500-with-open-redirect-48fd80c82631?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

FUSE - A Penetration Testing Tool For Finding File Upload Bugs

FUSE is a penetration testing system designed to identify Unrestricted Executable File Upload (UEFU) vulnerabilities. The details of the testing strategy is in our paper, "FUSE: Finding File Upload Bugs via Penetration Testing", which appeared in NDSS 2020. To see how to configure and execute FUSE, see the followings. Setup Install FUSE currently works on Ubuntu 18.04 and Python 2.7.15. Install dependencies # apt-get install rabbitmq-server# apt-get install python-pip# apt-get install git Clone and build FUSE $ git clone https://github.com/WSP-LAB/FUSE$ cd FUSE && pip install -r requirements.txt If you plan to leverage headless browser verification using selenium, please install Chrome and Firefox web driver by refering selenium document. Usage Configuration FUSE uses a user-provided configuration file that specifies parameters for a target PHP application. The script must be filled out before testing a target Web application. You can check out README file and example configuration files. Configuration for File Monitor (Optional) $ vim filemonitor.py... 10 MONITOR_PATH='/var/www/html/' <- Web root of the target application 11 MONITOR_PORT=20174 <- Default port of File Monitor 12 EVENT_LIST_LIMITATION=8000 <- Maxium number of elements in EVENT_LIST... Execution FUSE $ python framework.py Path of configuration file File Monitor $ python filemonitor.py Result When FUSE completes the penetration testing, a HOST directory and a HOST\_report.txt file are created. A HOST folder stores files that have been attempted to upload. A HOST\_report.txt file contains test results and information related to files that trigger U(E)FU. CVEs If you find UFU and UEFU bugs and get CVEs by running FUSE, please send a PR for README.md Application CVEs Elgg CVE-2018-19172 ECCube3 CVE-2018-18637 CMSMadeSimple CVE-2018-19419, CVE-2018-18574 CMSimple CVE-2018-19062 Concrete5 CVE-2018-19146 GetSimpleCMS CVE-2018-19420, CVE-2018-19421 Subrion CVE-2018-19422 OsCommerce2 CVE-2018-18572, CVE-2018-18964, CVE-2018-18965, CVE-2018-18966 Monstra CVE-2018-6383, CVE-2018-18694 XE XEVE-2019-001 Author This research project has been conducted by WSP Lab at KAIST. Taekjin Lee Seongil Wi Suyoung Lee Sooel Son Citing FUSE To cite our paper: Distributed System Security Symposium}, year = 2020 } ">@INPROCEEDINGS{lee:ndss:2020, author = {Taekjin Lee and Seongil Wi and Suyoung Lee and Sooel Son}, title = {{FUSE}: Finding File Upload Bugs via Penetration Testing}, booktitle = {Proceedings of the Network and Distributed System Security Symposium}, year = 2020} Download FUSE
Read more...

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
14 and want some tips

Hi, I’m a male, 14 and in the UK and, want to start learning CTF, cyber security, hacking etc, I need some tips, guides, books maybe? Also going to say, I have very limited knowledge on code, and, what to become advanced at this ‘trade’. It’s something I’ve always kinda wanted to do, but never actually done. I also need tips on how to keep the up with new tools and, worst comes to worst, counter attack/ defend against someone

submitted by /u/WelcomeMarrow37
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Path Traversal Zero-Day Apache/2.4.50 (Debian) Server | CVE-2021–41773|CVE-2021–42013
https://medium.com/@andreabocchetti88/path-traversal-zero-day-apache-2-4-50-debian-server-cve-2021-41773-cve-2021-42013-ba64d183a566?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Path Traversal Zero-Day en Apache HTTP Server | CVE-2021–41773|CVE-2021–42013Continue reading on Medium » (https://medium.com/@andreabocchetti88/path-traversal-zero-day-apache-2-4-50-debian-server-cve-2021-41773-cve-2021-42013-ba64d183a566?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Path Traversal Zero-Day Apache/2.4.50 (Debian) Server | CVE-2021–41773|CVE-2021–42013

Path Traversal Zero-Day en Apache HTTP Server | CVE-2021–41773|CVE-2021–42013Continue reading on Medium »
Read more...

Hacking on Medium
Attacking the ‘3 Random Words’ password format: A practical example of its flaws

https://cdn-images-1.medium.com/max/743/1*RBeJGWspY8IADX4Z0Eqstg.png
Preamble

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video