Dark Reading: Attacks/Breaches
Experts Urge Firms to Patch Trivial-to-Exploit Flaw in Linux PolicyKit

The memory corruption vulnerability in a policy component installed by default on most Linux distributions allows any user to become root. Researchers have already reproduced the exploit.

A brief overview of JWT and its exploits

IntroductionContinue reading on Medium »
Read more...

Beginner Bug Bounty Guide - Part 3
https://takshil-patil529.medium.com/beginner-bug-bounty-guide-part-3-8b979d0f6511?source=rss------bug_bounty-5

Previous : Beginner Bug Bounty Guide - Part 2Continue reading on Medium » (https://takshil-patil529.medium.com/beginner-bug-bounty-guide-part-3-8b979d0f6511?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Beginner Bug Bounty Guide - Part 4
https://takshil-patil529.medium.com/beginner-bug-bounty-guide-part-4-988e29f92643?source=rss------bug_bounty-5

Previous : Beginner Bug Bounty Guide - Part 3Continue reading on Medium » (https://takshil-patil529.medium.com/beginner-bug-bounty-guide-part-4-988e29f92643?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

A brief overview of JWT and its exploits
https://thexssrat.medium.com/a-brief-overview-of-jwt-and-its-exploits-97c53840378c?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

IntroductionContinue reading on Medium » (https://thexssrat.medium.com/a-brief-overview-of-jwt-and-its-exploits-97c53840378c?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Ninjasworkout - Vulnerable NodeJS Web Application

Damn Vulnerable NodeJS Application Quick Start Download the Repo => run npm i Afer Installing all dependency just run the application node app.js or nodemon app.js ADDED BUGS Prototype Pollution No SQL Injection Cross site Scripting Broken Access Control Broken Session Management Weak Regex Implementation Race Condition CSRF -Cross Site Request Forgery Weak Bruteforce Protection User Enumeration Reset Password token leaking in Referrer Reset Password bugs Sensitive Data Exposure Unicode Case Mapping Collision File Upload SSRF XXE Open Redirection Directory Traversal Insecure Deserilization => Remote Code Execution Server Side Template Injection Timing Attack Reset Password Module will not work !! You have to configure SMTP !! in utils=>sendmail.js TODO Improvement in User Interface Add New Vulnerabilities on weekly basis Add Documentation of all the Vulnerabilites Issues In case of bugs in the application, feel free to create an issues on github. Contribution Feel free to create a pull request for any contribution. Download Ninjasworkout
Read more...

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Linux Kernel Slab Out-Of-Bounds Write

https://4.bp.blogspot.com/-mbNmyGHywr4/WWlve-suujI/AAAAAAAAIP4/9elXOC6IHOcW_3VzQDLCix2bjP9zh38ZgCLcBGAs/s1600/h83.png
This archive contains demo exploits for CVE-2022-0185. There are two versions here. The non-kctf version (fuse version) specifically targets Ubuntu with kernel version 5.11.0-44. It does not directly return a root shell, but makes /bin/bash suid, which will lead to trivial privilege escalation. Adjusting the single_start and modprobe_path offsets should allow it to work on most other Ubuntu versions that have kernel version 5.7 or higher; for versions between 5.1 and 5.7, the spray will need to be improved as in the kctf version. The exploitation strategy relies on FUSE and SYSVIPC elastic objects to achieve arbitrary write. The kctf version achieves code execution as the root user in the root namespace, but has at most 50% reliability - it is targeted towards Kubernetes 1.22 (1.22.3-gke.700). This exploitation strategy relies on pipes and SYSVIPC elastic objects to trigger a stack pivot and execute a ROP chain in kernelspace.

MD5 | bb5c8ef222c6b344deefbde1bb368f2d

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Linux Kernel Slab Out-Of-Bounds Write

https://4.bp.blogspot.com/-rlkVZrkp7Nk/WWlvMMd1AsI/AAAAAAAAIMM/kgTZoxpDP8Ypbt5o2Ma3tAKenLk3_TLPQCLcBGAs/s1600/h18.png
Local privilege escalation exploit for a Linux kernel slab out-of-bounds write vulnerability. This exploit has been tested in an Ubuntu 21.04 Hirsute with kernel 5.11.0.

MD5 | 18ece74e78d74e50f3895375a0888e89

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

웁살라시큐리티, Nakji Network와 총 20만 달러 버그 바운티 진행
https://sentinel-protocol.medium.com/%EC%9B%81%EC%82%B4%EB%9D%BC%EC%8B%9C-%ED%81%90%EB%A6%AC%ED%8B%B0-nakji-network%EC%99%80-%EC%B4%9D-20%EB%A7%8C-%EB%8B%AC%EB%9F%AC-%EB%B2%84%EA%B7%B8-%EB%B0%94%EC%9A%B4%ED%8B%B0-%EC%A7%84%ED%96%89-762b1feefd54?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Uppsala Security(웁살라시큐리티)는 블록체인 온체인 데이터 인덱싱 프로젝트인 Nakji Network(Nakji Network)와 버그 바운티 프로그램을 함께 합니다.Continue reading on Medium » (https://sentinel-protocol.medium.com/%EC%9B%81%EC%82%B4%EB%9D%BC%EC%8B%9C-%ED%81%90%EB%A6%AC%ED%8B%B0-nakji-network%EC%99%80-%EC%B4%9D-20%EB%A7%8C-%EB%8B%AC%EB%9F%AC-%EB%B2%84%EA%B7%B8-%EB%B0%94%EC%9A%B4%ED%8B%B0-%EC%A7%84%ED%96%89-762b1feefd54?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
A brief overview of JWT and its exploits

https://cdn-images-1.medium.com/max/1626/1*MVa-u9kb5jozCKBMIkBBUg.png
Introduction

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Reverse Engineering Wordle

https://cdn-images-1.medium.com/max/2600/1*oh8ajDprN3j9L4nyuw4Gxg.png
It was another day at work when a co-worker of ours dropped a link to a game called Wordle. At this point I had never heard of the game…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

웁살라시큐리티, Nakji Network와 총 20만 달러 버그 바운티 진행

Uppsala Security(웁살라시큐리티)는 블록체인 온체인 데이터 인덱싱 프로젝트인 Nakji Network(Nakji Network)와 버그 바운티 프로그램을 함께 합니다.Continue reading on Medium »
Read more...

hacking: security in practice
Anxiety kicked in, how long is the recommended minimum character length for your primary email?

Evening all, got big anxiety that my current password for my primary email account isn't strong enough, it's 19 characters long with lower, upper, number & symbol characters. Years ago I read 14 characters was the magic number but assume it's higher now.

submitted by /u/DCzy7
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video