is not the first macOS bug fixed by Apple that would enable threat actors to completely circumvent OS security mechanisms such as Gatekeeper and File Quarantine on fully patched Macs.

In April, Apple patched a zero-day vulnerability exploited in the wild by Shlayer malware operators to bypass macOS automated security checks and deploy additional payloads on compromised Macs.

The Shlayer threat actors began targeting macOS users with unsigned and unnotarized malware that exploited the zero-day bug (tracked as CVE-2021-30657) starting with January 2021, as the Jamf Protect detection team discovered. Microsoft also discovered a macOS vulnerability in October, dubbed Shrootless and tracked as CVE-2021-30892), that could be used to bypass System Integrity Protection (SIP) and perform arbitrary operations, elevate privileges to root, and install rootkits on compromised devices.

“A malicious application may be able to modify protected parts of the file system,” Apple said in a security advisory issued after patching the Shrootless bug.
See Also: Hacking stories – Rafael Núñez (aka RaFa), hacking NASA with the hacking group: World of Hell
Source: www.bleepingcomputer.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/5157-article-201208-ms-team_body_text-90x90.jpg Microsoft Teams bug allowing phishing unpatched since March1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-6-90x90.jpg 800K WordPress sites still impacted by critical SEO plugin flaw2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-5-90x90.jpg Microsoft warns of easy Windows domain takeover via Active Directory bugs3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-4-90x90.jpg TellYouThePass ransomware revived in Linux, Windows Log4j attacks4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-3-1-90x90.jpg Log4j attackers switch to injecting Monero miners via RMI1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/Hackers-Using-Malicious-IIS-Server-Module-to-Steal-Microsoft-Exchange-560x380-1-90x90.jpg Hackers steal Microsoft Exchange credentials using IIS module1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/how-ransomware-works-1024x535-1-90x90.png New ransomware now being deployed in Log4Shell attacks1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/0d73-article-201111-ubuntu-90x90.jpg Attackers can get root by crashing Ubuntu’s AccountsService1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/frame_2_delay-0.5s-90x90.jpg Hackers start pushing malware in worldwide Log4Shell attacks2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-3-90x90.jpg Malicious Notepad++ installers push StrongPity malware2 weeks ago
The post Apple fixes macOS security flaw behind Gatekeeper bypass first appeared on Black Hat Ethical Hacking.

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/carbon-2048x1374-1-90x90.png OSINT Tool: Osintgram2 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/dalfox-90x90.png Offensive Security Tool: Dalfox2 months ago
The post Offensive Security Tool: log4j Honeypot Flask first appeared on Black Hat Ethical Hacking.

KitPloit - PenTest Tools!
SQLbit - Just Another Script For Automatize Boolean-Based Blind SQL Injections

https://blogger.googleusercontent.com/img/a/AVvXsEhal-rocrpyas0V-uVrYasq_POWPyhG1keoyCHuD6Ssn3B_eBi-eXoOcDAZwOfwvWhMkaDDfOgg_wRAE3EDksBJ459uyDPoSibweg8pyY8-fN74E7m6YplhS9ZzY1-YjFppU2I-mqyHoyrkGlDxW-9hweyDIZjIhcLYOOcwckFLIbxO7Fnq-j97mrn28A=w640-h384
A script for automatize boolean-based blind SQL injections.
Works with SQLite at least, supports using cookies.
It uses bitwise comparisons with multithreading to find cell values instead of binary search, which is more efficient.

It's able to:

* Search cell values by columns in a table
* Search characters count in a cells by columns in a table
* Search rows count in a table

The search algorithm is shown below.
Knowing the name of its column ('sqlite_master' by default in sqlite, for example) and the column name of it ('name' in sqlite) you can find values ​​of every cell in every row. And the fastest algorithm for this is checking the binary values of every character in every cell, which can be perform using multiple threads. Considering this, we can send only 7 requests to get the standard 7-bit letter, and using 1000 threads, we get ~142 letters per moment (it's also worth keeping in mind requests to get the length of a cell value).
https://blogger.googleusercontent.com/img/a/AVvXsEhQGE6EO93XcxBLLJZAVDVx47rJeF5djblHf5nu0aecFJGm8vkZAoxrEpg8ozK2E8QHyzk2Kf5iBnlhE7YOAgnTE2stbtrC7CUcOk-1iAVl6Ht2xU_bqkCd122ANMC_xSre2_KvQ5EViCaWGttSBqiIRfJvagGOUvHniSCGWNXeyVyVnB4a7QEEjJ-RIA=w640-h374
The number of bits need to compare (7 by default for ASCII) and the number of threads can be specified as input data.

Installing

git clone https://github.com/Sunlight-Rim/sqlbit.git
pip3 install -r requirements.txt


Usage

It does not accept command line arguments, so you can specify data in the config file or at runtime program.

python sqlbit.py

https://blogger.googleusercontent.com/img/a/AVvXsEhal-rocrpyas0V-uVrYasq_POWPyhG1keoyCHuD6Ssn3B_eBi-eXoOcDAZwOfwvWhMkaDDfOgg_wRAE3EDksBJ459uyDPoSibweg8pyY8-fN74E7m6YplhS9ZzY1-YjFppU2I-mqyHoyrkGlDxW-9hweyDIZjIhcLYOOcwckFLIbxO7Fnq-j97mrn28A=w640-h384
Note: please, use it only for your own servers or for the servers of those owners with whom you have agreed in advance.
Download SQLbit

Dark Reading: Attacks/Breaches
Log4j: A CISO's Practical Advice

Working together is going to make getting through this problem a lot easier.

Vibranium Debug Campaign

Vibranium is pleased to announce the debug bounty campaign!Continue reading on Medium »
Read more...

Hacking on Medium
Bypassing Character Restrictions

เว้นวรรค

Continue reading on Medium »

Hacking on Medium
Apple has fixed a major macOS issue

https://cdn-images-1.medium.com/max/1500/1*OKI86FHrv9h-pmNobF02HA.png
Apple has fixed a serious macOS problem that might have enabled malicious apps to bypass the operating system’s built-in security…

Continue reading on Medium »

Vibranium Debug Campaign
https://medium.com/@Vibranium_VBN/vibranium-debug-campaign-53b737961816?source=rss------bug_bounty-5

Vibranium is pleased to announce the debug bounty campaign!Continue reading on Medium » (https://medium.com/@Vibranium_VBN/vibranium-debug-campaign-53b737961816?source=rss------bug_bounty-5)

hacking: security in practice
Auxiliator, python telegram bot for analysing web-sites

Auxiliator is telegram bot for basic web-application analysis, I made it because sometimes there is no access to your main PC, where you can scan web-site and search for exploits, and you only have for e.g your phone. Some people would say, that you can just connect with ssh, but is is not really easy to type on small screen. That is why, i created this telegram bot, where it is simpler to analyse the website for further testing. I created it with python, and it can search for exploits on exploit-db, scan for open ports, search info about ip using Censys, detect WAF, and find real IP by domain using censys.I hope you enjoy this tool!)

Opened for critics and suggestions!

https://github.com/MajorRaccoon/Auxiliator

submitted by /u/Tough-Aide-1810
[link] [comments]

hacking: security in practice
does anyone know what i can do???

My entire instagram account got hacked, they changed my password, i asked instagram to send an email to my account but the email it’s being sent to is no longer active and i can’t log into it, so i cant do anything, i tried using the video face scan thing but it didn’t work for some reason, is there anything i can do to get it back or can someone else help me recover it some how? i just want to talk to my friends over insta again

submitted by /u/bblaineC
[link] [comments]

hacking: security in practice
Who wants to make a gc

Who wanta to make a group chat where we can learn coding and hacking together I have python and pycharm but idk what the next step is I watch beginner tutorials on youtube but its the same thif idk abt linux and all of that but who knows and can teach or who wants to make a gc to learn together over the break?

submitted by /u/Virtual_Stuff4719
[link] [comments]

Hacking on Medium
Madness TryHackMe — Writeup (Detailed)

https://cdn-images-1.medium.com/max/773/1*cwz77BVK1Mdgly7j8ED0vw.png
I get to learn many new ways, different methods and use the new tool by practicing this machine. It is fun and gives pain in the head at…

Continue reading on Medium »

Hacking on Medium
Chrome Extensions Used For Hacking

https://cdn-images-1.medium.com/max/800/1*Re8hZDHJpsC-9QXlI07pdg.jpeg
Mostly hackers can use the extensions for the purpose to locate the broken links and inform the client and these extensions are also helps…

Continue reading on Medium »