Kerentanan pada WordPress melalui Pengungkapan Informasi pengguna

Content: Broken Access Control (BAC) — Disclosure of User InformationContinue reading on Medium »
Read more...

KitPloit - PenTest Tools!
ShonyDanza - A Customizable, Easy-To-Navigate Tool For Researching, Pen Testing, And Defending With The Power Of Shodan

http://3.bp.blogspot.com/-HfvtRTCYnTM/YZ3QJbhSs3I/AAAAAAAA4AU/kC3BBy581dgTiAKCIDOlmGtohgCXuQhlgCK4BGAYYCw/w640-h524/ShonyDanza_1_shonydanza_demo-780791.gif A customizable, easy-to-navigate tool for researching, pen testing, and defending with the power of Shodan.
With ShonyDanza, you can:

* Obtain IPs based on search criteria
* Automatically exclude honeypots from the results based on your pre-configured thresholds
* Pre-configure all IP searches to filter on your specified net range(s)
* Pre-configure search limits
* Use build-a-search to craft searches with easy building blocks
* Use stock searches and pre-configure your own stock searches
* Check if IPs are known malware C2s
* Get host and domain profiles
* Scan on-demand
* Find exploits
* Get total counts for searches and exploits
* Automatically save exploit code, IP lists, host profiles, domain profiles, and scan results to directories within ShonyDanza Installationgit clone https://github.com/fierceoj/ShonyDanza.gitRequirements

* python3
* shodan library cd ShonyDanzapip3 install -r requirements.txtUsageEdit config.py to include your desired configurations cd configssudo nano config.py#config file for shonydanza searches

#REQUIRED
#maximum number of results that will be returned per search
#default is 100

SEARCH_LIMIT = 100
#REQUIRED
#IPs exceeding the honeyscore limit will not show up in IP results
#scale is 0.0 to 1.0
#adjust to desired probability to restrict results by threshold, or keep at 1.0 to include all results

HONEYSCORE_LIMIT = 1.0
#REQUIRED - at least one key: value pair
#add a shodan dork to the dictionary below to add it to your shonydanza stock searches menu
#see https://github.com/jakejarvis/awesome-shodan-queries for a great source of queries
#check into "vuln:" filter if you have Small Business Plan or higher (e.g., vuln:cve-2019-11510)

STOCK_SEARCHES = {
'ANONYMOUS_FTP':'ftp anonymous ok',
'RDP':'port:3389 has_screenshot:true',
'OPEN_TELNET':'port:23 console gateway -password',
'APACHE_DIR_LIST':'http.title:"Index of / "',
'SPRING_BOOT':'http.favicon.hash:116323821',
'HP_PRINTERS':'"Serial Number:" "Built:" "Server: HP HTTP"',
'DOCKER_API':'"Docker Containers:" port:2375',
'ANDROID_ROOT_BRIDGE':'"Android Debug Bridge" "Device" port:5555',
'MONGO_EXPRESS_GUI':'"Set-Cookie: mongo-express=" "200 OK"',
'CVE-2019-11510_PULSE_VPN':'http.html:/dana-na/',
'CVE-2019-19781_CITRIX_NETSCALER':'http.waf:"Citrix NetScaler"',
'CVE-2020-5902_F5_BIGIP':'http.favicon.hash:-335242539 "3992"',
'CVE-2020-3452_CISCO_ASA_FTD':'200 "Set-Cookie: webvpn;"'
}
#OPTIONAL
#IP or cidr range constraint for searches that return list of IP addresses
#use comma-separated list to designate multiple (e.g. 1.1.1.1,2.2.0.0/16,3.3.3.3,3.3.3.4)

#NET_RANGE = '0.0.0.0/0' Run cd ../python3 shonydanza.pySee this how-to article for additional usage instruction. Legal DisclaimerThis project is made for educational and ethical testing purposes only. Usage of ShonyDanza for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program. Download ShonyDanza

___________________________
@hacking_Attack
@Hacking_Video

Kerentanan pada WordPress melalui Pengungkapan Informasi pengguna
https://medium.com/@Nakaoseek/kerentanan-pada-wordpress-melalui-pengungkapan-informasi-pengguna-146ca29631cc?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Content: Broken Access Control (BAC) — Disclosure of User InformationContinue reading on Medium » (https://medium.com/@Nakaoseek/kerentanan-pada-wordpress-melalui-pengungkapan-informasi-pengguna-146ca29631cc?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

ShonyDanza - A Customizable, Easy-To-Navigate Tool For Researching, Pen Testing, And Defending With The Power Of Shodan

A customizable, easy-to-navigate tool for researching, pen testing, and defending with the power of Shodan. With ShonyDanza, you can: Obtain IPs based on search criteria Automatically exclude honeypots from the results based on your pre-configured thresholds Pre-configure all IP searches to filter on your specified net range(s) Pre-configure search limits Use build-a-search to craft searches with easy building blocks Use stock searches and pre-configure your own stock searches Check if IPs are known malware C2s Get host and domain profiles Scan on-demand Find exploits Get total counts for searches and exploits Automatically save exploit code, IP lists, host profiles, domain profiles, and scan results to directories within ShonyDanza Installation git clone https://github.com/fierceoj/ShonyDanza.git Requirements python3 shodan library cd ShonyDanza pip3 install -r requirements.txt Usage Edit config.py to include your desired configurations cd configs sudo nano config.py #config file for shonydanza searches#REQUIRED#maximum number of results that will be returned per search#default is 100SEARCH_LIMIT = 100#REQUIRED#IPs exceeding the honeyscore limit will not show up in IP results#scale is 0.0 to 1.0#adjust to desired probability to restrict results by threshold, or keep at 1.0 to include all resultsHONEYSCORE_LIMIT = 1.0#REQUIRED - at least one key: value pair#add a shodan dork to the dictionary below to add it to your shonydanza stock searches menu#see https://github.com/jakejarvis/awesome-shodan-queries for a great source of queries#check into "vuln:" filter if you have Small Business Plan or higher (e.g., vuln:cve-2019-11510)STOCK_SEARCHES = {'ANONYMOUS_FTP':'ftp anonymous ok','RDP':'port:3389 has_screenshot:true','OPEN_TELNET':'port:23 console gateway -password','APACHE_DIR_LIST':'http.title:"Index of / "','SPRING_BOOT':'http.favicon.hash:116323821','HP_PRINTERS':'"Serial Number:" "Built:" "Server: HP HTTP"','DOCKER_API':'"Docker Containers:" port:2375','ANDROID_ROOT_BRIDGE':'"Android Debug Bridge" "Device" port:5555','MONGO_EXPRESS_GUI':'"Set-Cookie: mongo-express=" "200 OK"','CVE-2019-11510_PULSE_VPN':'http.html:/dana-na/','CVE-2019-19781_CITRIX_NETSCALER':'http.waf:"Citrix NetScaler"','CVE-2020-5902_F5_BIGIP':'http.favicon.hash:-335242539 "3992"','CVE-2020-3452_CISCO_ASA_FTD':'200 "Set-Cookie: webvpn;"'}#OPTIONAL#IP or cidr range constraint for searches that return list of IP addresses#use comma-separated list to designate multiple (e.g. 1.1.1.1,2.2.0.0/16,3.3.3.3,3.3.3.4) #NET_RANGE = '0.0.0.0/0' Run cd ../ python3 shonydanza.py See this how-to article for additional usage instruction. Legal Disclaimer This project is made for educational and ethical testing purposes only. Usage of ShonyDanza for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program. Download ShonyDanza
Read more...

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
New Ransomware Variant Could Become Next Big Threat

"Yanluowang" strain appears to be establishing itself in the cybercrime marketplace, experts say.

Dark Reading: Attacks/Breaches
CISA Names 23 Members to New Cybersecurity Advisory Committee

Group will advise and provide recommendations to the director to enhance the nation’s cyber defense.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
ReliaQuest Valued At More Than $1 Billion Following Growth Round Led by KKR

The open XDR-as-a-service provider will use investment to expand business operations and further development of its GreyMatter platform.

___________________________
@hacking_Attack
@Hacking_Video

Injection is the New Black: Novel RTF Template Inject Technique Poised for Widespread Adoption Beyond APT Actors
https://www.reddit.com/r/redteamsec/comments/r6q086/injection_is_the_new_black_novel_rtf_template/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://www.proofpoint.com/us/blog/threat-insight/injection-new-black-novel-rtf-template-inject-technique-poised-widespread) [comments] (https://www.reddit.com/r/redteamsec/comments/r6q086/injection_is_the_new_black_novel_rtf_template/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Transporting malware in google links.

https://cdn-images-1.medium.com/max/891/1*wltF2cebWwNIg-YJRaMF1A.png
Hello guys! Today I will share my experience of how you can transport a encoded malware using accounts.google.com.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Utilizan plantillas y archivos RTF para Phishing y Malware

https://cdn-images-1.medium.com/max/1418/0*bmlM8C_HIs3NFF3G
PUBLICADO EN 1 DICIEMBRE, 2021POR DPAB

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Print nightmare still relevant in December?

Is it still a thing now? Or did windows finally patch it?

submitted by /u/jflaster
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Am I being realistic?

I posted this in cyber security sub but I figure it may be worth posting here too.

Hi everyone,

32 years old. I used to do a lot of website hacking and WiFi hacking back in highschool. The school still doesn’t know who got into their system via ftp and changed their website.

I had a neighbor who taught me a lot about computers after he heard I was very much interested in them. That’s where it all started really. Parents didn’t like that I was interested in cyber security given that at the time I was a bit of a trouble maker. Nothing serious just a typical angsty teenager. I got pushed into the biotech direction and did really well for myself. I’m a really curious person and very good at math. Engineering degree from an Ivy League school and a PhD in physics from another Ivy League school. Worked at 3 different biotech companies and my last job I was in charge of the R&D dept. I along with a few other people, I have been let go by the company. (My reason was for complaining to HR about a some toxic stuff that was going on. Don’t complain to HR I guess). Over the past 2 years my love for cyber security came back and I spent the last two years on try hack me and hack the box. I can fair pretty well with medium leve difficulties with out needing any hints or struggling for days on end. I can code in python, and build websites. I understand how many of the popular hacking tools work. I like to understand how the tools work before even using it.

My physics degree has given me so much math experience I can appreciate cryptography. Most importantly, thanks to all the online resources, I’ve been able to learn a lot and practice cyber security in a safe and legal way.

I’m at a point now where after a tough personal year (lost my father due to covid, house flooded due to a hurricane, and now getting laid off) I am looking to do the other things in life I’m passionate about because life is short and I may as well do things that make me happy.

Given my career experience my resume obviously does not show I have any field experience in cyber security outside of me mentioning that I do CTF’s. I plan on going for security+ since I am pretty comfortable with networks although I can see doing network+ or something similar help me get a foot in the door.

I guess my question is: How realistic is it for me to do a career change? Should I prove myself with certs first? The wiki on some of the sub Reddits are really helpful and I am just wondering if I’m being realistic or not. Should I just keep this as a hobby and chase the next biotech position?

Signed - a very burnt out 10 year biotech veteran who loves the problem solving cyber security requires.

submitted by /u/BodySmell
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Compromising the email supply chain of 190 Australian organisations through a single IT Managed Service Provider

submitted by /u/DrinkMoreCodeMore
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Brainstorming ideas for creating human like social media bots.

submitted by /u/estrojennnn
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video