Damn Vulnerable NodeJS Application
Quick Start run npm i ">Download the Repo =>

run npm i

Afer Installing all dependency just run the application node app.js or nodemon app.js

___________________________
@hacking_Attack
@Hacking_Video

ADDED BUGS Prototype Pollution No SQL Injection Cross site Scripting Broken Access Control Broken Session Management (https://www.kitploit.com/search/label/Management) Weak Regex Implementation Race Condition CSRF -Cross Site Request Forgery Weak Bruteforce (https://www.kitploit.com/search/label/Bruteforce) Protection User Enumeration (https://www.kitploit.com/search/label/Enumeration) Reset Password token leaking in Referrer Reset Password bugs Sensitive Data Exposure Unicode Case Mapping Collision File Upload SSRF XXE Open Redirection Directory Traversal
Insecure Deserilization => Remote Code Execution (https://www.kitploit.com/search/label/Remote%20Code%20Execution) Server Side Template Injection
Timing Attack
Reset Password Module will not work !! You have to configure SMTP !! in utils=>sendmail.js
TODO Improvement in User Interface Add New Vulnerabilities on weekly basis Add Documentation of all the Vulnerabilites Issues In case of bugs in the application, feel free to create an issues (https://github.com/effortlessdevsec/ninjasworkout/issues) on github. Contribution Feel free to create a pull request for any contribution.

Download Ninjasworkout (https://github.com/effortlessdevsec/ninjasworkout)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
‘Cyberpartisans’ hack Belarusian railway to disrupt Russian Ukraine invasion buildup

https://external-preview.redd.it/I1J_x-ogrOLulUyUwvphtOHTkQ3XlDXEGTh-VP3qxfo.jpg?width=640&crop=smart&auto=webp&s=e702cb8e032ef331b2502530c042b4a3569f1610 submitted by /u/jonfla
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What exploit is this? [Obd hacking]

Hi, I saw this video on YouTube and I was wondering what exploit is that, apparently he is able to start the car without the key something like a bypass to the ecu via obd port, it seems that he found a way to obtain the encryption key before hand. Does anyone know more about this? Does exist something like this on github? Here is the video on YouTube

submitted by /u/Sale_q_b
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Running command prompt from BIOS

I have been trying to run command prompt from the BIOS, but when I try to run command prompt from the BIOS it goes on aafe mode. How do I get out of safe mode?

submitted by /u/Shmifful
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Experts Urge Firms to Patch Trivial-to-Exploit Flaw in Linux PolicyKit

The memory corruption vulnerability in a policy component installed by default on most Linux distributions allows any user to become root. Researchers have already reproduced the exploit.

A brief overview of JWT and its exploits

IntroductionContinue reading on Medium »
Read more...

Beginner Bug Bounty Guide - Part 3
https://takshil-patil529.medium.com/beginner-bug-bounty-guide-part-3-8b979d0f6511?source=rss------bug_bounty-5

Previous : Beginner Bug Bounty Guide - Part 2Continue reading on Medium » (https://takshil-patil529.medium.com/beginner-bug-bounty-guide-part-3-8b979d0f6511?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Beginner Bug Bounty Guide - Part 4
https://takshil-patil529.medium.com/beginner-bug-bounty-guide-part-4-988e29f92643?source=rss------bug_bounty-5

Previous : Beginner Bug Bounty Guide - Part 3Continue reading on Medium » (https://takshil-patil529.medium.com/beginner-bug-bounty-guide-part-4-988e29f92643?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

A brief overview of JWT and its exploits
https://thexssrat.medium.com/a-brief-overview-of-jwt-and-its-exploits-97c53840378c?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

IntroductionContinue reading on Medium » (https://thexssrat.medium.com/a-brief-overview-of-jwt-and-its-exploits-97c53840378c?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Ninjasworkout - Vulnerable NodeJS Web Application

Damn Vulnerable NodeJS Application Quick Start Download the Repo => run npm i Afer Installing all dependency just run the application node app.js or nodemon app.js ADDED BUGS Prototype Pollution No SQL Injection Cross site Scripting Broken Access Control Broken Session Management Weak Regex Implementation Race Condition CSRF -Cross Site Request Forgery Weak Bruteforce Protection User Enumeration Reset Password token leaking in Referrer Reset Password bugs Sensitive Data Exposure Unicode Case Mapping Collision File Upload SSRF XXE Open Redirection Directory Traversal Insecure Deserilization => Remote Code Execution Server Side Template Injection Timing Attack Reset Password Module will not work !! You have to configure SMTP !! in utils=>sendmail.js TODO Improvement in User Interface Add New Vulnerabilities on weekly basis Add Documentation of all the Vulnerabilites Issues In case of bugs in the application, feel free to create an issues on github. Contribution Feel free to create a pull request for any contribution. Download Ninjasworkout
Read more...

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Linux Kernel Slab Out-Of-Bounds Write

https://4.bp.blogspot.com/-mbNmyGHywr4/WWlve-suujI/AAAAAAAAIP4/9elXOC6IHOcW_3VzQDLCix2bjP9zh38ZgCLcBGAs/s1600/h83.png
This archive contains demo exploits for CVE-2022-0185. There are two versions here. The non-kctf version (fuse version) specifically targets Ubuntu with kernel version 5.11.0-44. It does not directly return a root shell, but makes /bin/bash suid, which will lead to trivial privilege escalation. Adjusting the single_start and modprobe_path offsets should allow it to work on most other Ubuntu versions that have kernel version 5.7 or higher; for versions between 5.1 and 5.7, the spray will need to be improved as in the kctf version. The exploitation strategy relies on FUSE and SYSVIPC elastic objects to achieve arbitrary write. The kctf version achieves code execution as the root user in the root namespace, but has at most 50% reliability - it is targeted towards Kubernetes 1.22 (1.22.3-gke.700). This exploitation strategy relies on pipes and SYSVIPC elastic objects to trigger a stack pivot and execute a ROP chain in kernelspace.

MD5 | bb5c8ef222c6b344deefbde1bb368f2d

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Linux Kernel Slab Out-Of-Bounds Write

https://4.bp.blogspot.com/-rlkVZrkp7Nk/WWlvMMd1AsI/AAAAAAAAIMM/kgTZoxpDP8Ypbt5o2Ma3tAKenLk3_TLPQCLcBGAs/s1600/h18.png
Local privilege escalation exploit for a Linux kernel slab out-of-bounds write vulnerability. This exploit has been tested in an Ubuntu 21.04 Hirsute with kernel 5.11.0.

MD5 | 18ece74e78d74e50f3895375a0888e89

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

웁살라시큐리티, Nakji Network와 총 20만 달러 버그 바운티 진행
https://sentinel-protocol.medium.com/%EC%9B%81%EC%82%B4%EB%9D%BC%EC%8B%9C-%ED%81%90%EB%A6%AC%ED%8B%B0-nakji-network%EC%99%80-%EC%B4%9D-20%EB%A7%8C-%EB%8B%AC%EB%9F%AC-%EB%B2%84%EA%B7%B8-%EB%B0%94%EC%9A%B4%ED%8B%B0-%EC%A7%84%ED%96%89-762b1feefd54?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video