Exploit Collector
WordPress Catch Themes Demo Import Shell Upload

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
DCG 201 @ Super MAGFest — January 6–9th

https://cdn-images-1.medium.com/max/896/1*N889vmv0qKMbIF22SV2j8Q.jpeg
We at DCG 201 are excited to attend our first ever Super MAGFest this weekend from January 6th to January 9th at the Gaylord Hotel in…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to Spy on my partner WhatsApp.

https://cdn-images-1.medium.com/max/600/1*7hbLLRCdr4FkJPXVdHUdlg.jpeg
I will make this as brief as possible.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

What Is Red Teaming, How Does It Work and Why Is It Important?
https://www.reddit.com/r/redteamsec/comments/rxbq7i/what_is_red_teaming_how_does_it_work_and_why_is/

submitted by /u/stanley9528 (https://www.reddit.com/user/stanley9528)
[link] (https://halborn.com/what-is-red-teaming-how-does-it-work-and-why-is-it-important/) [comments] (https://www.reddit.com/r/redteamsec/comments/rxbq7i/what_is_red_teaming_how_does_it_work_and_why_is/)

___________________________
@hacking_Attack
@Hacking_Video

Log4J-Detect - Script To Detect The "Log4j" Java Library Vulnerability (CVE-2021-44228) For A List Of URLs With Multithreading
http://www.kitploit.com/2022/01/log4j-detect-script-to-detect-log4j.html

___________________________
@hacking_Attack
@Hacking_Video

Simple Python 3 (https://www.kitploit.com/search/label/Python%203) script to detect the "Log4j" Java library vulnerability (https://www.kitploit.com/search/label/Vulnerability) (CVE-2021-44228) for a list of URL with multithreading
The script "log4j-detect.py" developed in Python 3 is responsible for detecting whether a list of URLs are vulnerable (https://www.kitploit.com/search/label/Vulnerable) to CVE-2021-44228. To do so, it sends a GET request using threads (higher performance) to each of the URLs in the specified list. The GET request contains a payload that on success returns a DNS request to Burp Collaborator / interactsh. This payload is sent in a test parameter and in the "User-Agent" / "Referer" / "X-Forwarded-For" / "Authentication" headers. Finally, if a host is vulnerable, an identification number will appear in the subdomain (https://www.kitploit.com/search/label/Subdomain) prefix of the Burp Collaborator / interactsh (https://www.kitploit.com/search/label/Interactsh) payload and in the output of the script, allowing to know which host has responded via DNS. It should be noted that this script only handles DNS detection of the vulnerability and does not test remote command execution. Downloading log4j-detect.py wget https://github.com/takito1812/log4j-detect/raw/main/log4j-detect.py Running log4j-detect.py python3 log4j-detect.py

Download Log4J-Detect (https://github.com/takito1812/log4j-detect)

___________________________
@hacking_Attack
@Hacking_Video

Log4J-Detect - Script To Detect The "Log4j" Java Library Vulnerability (CVE-2021-44228) For A List Of URLs With Multithreading

Simple Python 3 script to detect the "Log4j" Java library vulnerability (CVE-2021-44228) for a list of URL with multithreadingThe script "log4j-detect.py" developed in Python 3 is responsible for detecting whether a list of URLs are vulnerable to CVE-2021-44228. To do so, it sends a GET request using threads (higher performance) to each of the URLs in the specified list. The GET request contains a payload that on success returns a DNS request to Burp Collaborator / interactsh. This payload is sent in a test parameter and in the "User-Agent" / "Referer" / "X-Forwarded-For" / "Authentication" headers. Finally, if a host is vulnerable, an identification number will appear in the subdomain prefix of the Burp Collaborator / interactsh payload and in the output of the script, allowing to know which host has responded via DNS. It should be noted that this script only handles DNS detection of the vulnerability and does not test remote command execution. Downloading log4j-detect.py wget https://github.com/takito1812/log4j-detect/raw/main/log4j-detect.py Running log4j-detect.py python3 log4j-detect.py Download Log4J-Detect
Read more...

___________________________
@hacking_Attack
@Hacking_Video

Authorization bypass — Gmail
https://infosecwriteups.com/authorization-bypass-gmail-2949af041fb?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

About the vulnerabilityContinue reading on InfoSec Write-ups » (https://infosecwriteups.com/authorization-bypass-gmail-2949af041fb?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
iOS malware can fake iPhone shut downs to snoop on camera, microphone

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png iOS malware can fake iPhone shut downs to snoop on camera, microphonePost Views: 257 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute
Researchers have developed a new technique that fakes a shutdown or reboot of iPhones, preventing malware from being removed and allowing hackers to secretly snoop on microphones and receive sensitive data via a live network connection.
Historically, when malware infects an iOS device, it can be removed simply by restarting the device, which clears the malware from memory.

However, this technique hooks the shutdown and reboot routines to prevent them from ever happening, allowing malware to achieve persistence as the device is never actually turned off.

Because this attack, which the researchers call “NoReboot,” does not exploit any flaws on the iOS and instead relies on human-level deception, it cannot be patched by Apple. Simulating a convincing rebootTo restart the iPhone, one has to press and hold the power button and either volume button until the slider with the reboot option appears, and then wait for roughly 30 seconds for the action to complete.

When an iPhone is shut off, its screen naturally goes dark, the camera is turned off, 3D touch feedback does not respond to long presses, sounds from calls and notifications are muted, and all vibrations are
See Also: Complete Offensive Security and Ethical Hacking Course
Security researchers from ZecOps have developed a trojan PoC (proof of concept) tool that can inject specially crafted code onto three iOS daemons to fake a shut down by disabling all the above indicators.
https://www.bleepstatic.com/images/news/u/1220909/Diagrams/hijack.jpg
___________________________
@hacking_Attack
@Hacking_Video

e backboardd lets SpringBoard take over the screen.

https://www.bleepstatic.com/images/news/u/1220909/Security/springboard-taking-over.png
Never trust that a device is fully turned offApple introduced a new feature in iOS 15, making it possible for users to locate their iPhones through ‘Find My’ even if they are powered off.
In iOS 15, the phone is findable even when “Powered off”. pic.twitter.com/gfi4WJfula

— Costin Raiu (@craiu) September 27, 2021
Apple didn’t bother to explain how exactly that works, but researchers found it is achieved by keeping the Bluetooth LPM chip active and running autonomously even when the iPhone is switched off.

While all user interaction with the device is turned off, the Bluetooth chip continues to advertise its presence to nearby devices by operating on low-power mode, albeit at intervals larger than the default 15 minutes.

This illustrates that you can never trust a device to be entirely powered off, even when you turn off your phone.

Likewise, the “NoReboot” technique makes it impossible to physically detect if an iPhone is off or not as to all outward appearances your device appears to be shut down.

Furthermore, malware developers and hackers can now gain persistence on iOS devices with this technique, where the usual recommendation of restarting an iPhone to clear infections no longer works.
Source: www.bleepingcomputer.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/0358ad020c37-article-cache-poisoning-article-90x90.png Researcher discovers 70 web cache poisoning vulnerabilities, nets $40k in bug bounty rewards1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/1200x0-90x90.jpg Apple iOS vulnerable to HomeKit ‘doorLock’ denial of service bug2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/exchange-90x90.png Microsoft releases emergency fix for Exchange – 2022 bug3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/maxresdefault-90x90.jpg Have I Been Pwned adds 441K accounts stolen by RedLine malware6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/1229111902.0-90x90.jpg T-Mobile says new data breach caused by SIM swap attacks1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/feature-log4j-blue-90x90.png Log4j 2.17.1 out now, fixes new remote code execution bug1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/qnap-logo-white-90x90.jpg QNAP NAS devices hit in surge of ech0raix ransomware attacks1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/shutterstock_495927541-90x90.jpg Wireless coexistence – New attack technique exploits Bluetooth, WiFi performance features1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/apple-store-tower-90x90.jpg Apple fixes macOS security flaw behind Gatekeeper bypass2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/5157-article-201208-ms-team_body_text-90x90.jpg Microsoft Teams bug allowing phishing unpatched since March2 weeks ago
The post iOS malware can fake iPhone shut downs to snoop on camera, micro[...]

___________________________
@hacking_Attack
@Hacking_Video

phone first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Cobalt Strike Sleep Mask IOC
https://www.reddit.com/r/redteamsec/comments/rxfkzo/cobalt_strike_sleep_mask_ioc/

https://codex-7.gitbook.io/codexs-terminal-window/blue-team/detecting-cobalt-strike/sleep-mask-kit-iocs ​ Recently noticed an IOC of the sleep mask kit while testing my own payloads, being the hook on the sleep() winapi. submitted by /u/CodeXTF2 (https://www.reddit.com/user/CodeXTF2)
[link] (https://www.reddit.com/r/redteamsec/comments/rxfkzo/cobalt_strike_sleep_mask_ioc/) [comments] (https://www.reddit.com/r/redteamsec/comments/rxfkzo/cobalt_strike_sleep_mask_ioc/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Digital Privacy: A Myth or Reality..?

https://cdn-images-1.medium.com/max/1920/1*8Nu0MICiKMCBrmrhuIbIxg.jpeg
Since the arrival of the new policy of Whatsapp on January 4, 2021, a new uproar has been initiated in the entire internet…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video