Exploit Collector
Linux Kernel Slab Out-Of-Bounds Write

https://4.bp.blogspot.com/-mbNmyGHywr4/WWlve-suujI/AAAAAAAAIP4/9elXOC6IHOcW_3VzQDLCix2bjP9zh38ZgCLcBGAs/s1600/h83.png
This archive contains demo exploits for CVE-2022-0185. There are two versions here. The non-kctf version (fuse version) specifically targets Ubuntu with kernel version 5.11.0-44. It does not directly return a root shell, but makes /bin/bash suid, which will lead to trivial privilege escalation. Adjusting the single_start and modprobe_path offsets should allow it to work on most other Ubuntu versions that have kernel version 5.7 or higher; for versions between 5.1 and 5.7, the spray will need to be improved as in the kctf version. The exploitation strategy relies on FUSE and SYSVIPC elastic objects to achieve arbitrary write. The kctf version achieves code execution as the root user in the root namespace, but has at most 50% reliability - it is targeted towards Kubernetes 1.22 (1.22.3-gke.700). This exploitation strategy relies on pipes and SYSVIPC elastic objects to trigger a stack pivot and execute a ROP chain in kernelspace.

MD5 | bb5c8ef222c6b344deefbde1bb368f2d

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Linux Kernel Slab Out-Of-Bounds Write

https://4.bp.blogspot.com/-rlkVZrkp7Nk/WWlvMMd1AsI/AAAAAAAAIMM/kgTZoxpDP8Ypbt5o2Ma3tAKenLk3_TLPQCLcBGAs/s1600/h18.png
Local privilege escalation exploit for a Linux kernel slab out-of-bounds write vulnerability. This exploit has been tested in an Ubuntu 21.04 Hirsute with kernel 5.11.0.

MD5 | 18ece74e78d74e50f3895375a0888e89

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

웁살라시큐리티, Nakji Network와 총 20만 달러 버그 바운티 진행
https://sentinel-protocol.medium.com/%EC%9B%81%EC%82%B4%EB%9D%BC%EC%8B%9C-%ED%81%90%EB%A6%AC%ED%8B%B0-nakji-network%EC%99%80-%EC%B4%9D-20%EB%A7%8C-%EB%8B%AC%EB%9F%AC-%EB%B2%84%EA%B7%B8-%EB%B0%94%EC%9A%B4%ED%8B%B0-%EC%A7%84%ED%96%89-762b1feefd54?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Uppsala Security(웁살라시큐리티)는 블록체인 온체인 데이터 인덱싱 프로젝트인 Nakji Network(Nakji Network)와 버그 바운티 프로그램을 함께 합니다.Continue reading on Medium » (https://sentinel-protocol.medium.com/%EC%9B%81%EC%82%B4%EB%9D%BC%EC%8B%9C-%ED%81%90%EB%A6%AC%ED%8B%B0-nakji-network%EC%99%80-%EC%B4%9D-20%EB%A7%8C-%EB%8B%AC%EB%9F%AC-%EB%B2%84%EA%B7%B8-%EB%B0%94%EC%9A%B4%ED%8B%B0-%EC%A7%84%ED%96%89-762b1feefd54?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
A brief overview of JWT and its exploits

https://cdn-images-1.medium.com/max/1626/1*MVa-u9kb5jozCKBMIkBBUg.png
Introduction

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Reverse Engineering Wordle

https://cdn-images-1.medium.com/max/2600/1*oh8ajDprN3j9L4nyuw4Gxg.png
It was another day at work when a co-worker of ours dropped a link to a game called Wordle. At this point I had never heard of the game…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

웁살라시큐리티, Nakji Network와 총 20만 달러 버그 바운티 진행

Uppsala Security(웁살라시큐리티)는 블록체인 온체인 데이터 인덱싱 프로젝트인 Nakji Network(Nakji Network)와 버그 바운티 프로그램을 함께 합니다.Continue reading on Medium »
Read more...

hacking: security in practice
Anxiety kicked in, how long is the recommended minimum character length for your primary email?

Evening all, got big anxiety that my current password for my primary email account isn't strong enough, it's 19 characters long with lower, upper, number & symbol characters. Years ago I read 14 characters was the magic number but assume it's higher now.

submitted by /u/DCzy7
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
A good book to learn about privacy and anonimity?

I'm quite a beginner in Cybersecurity (currently studying for the Sec+ certificate) and I just realised that privacy and anonimity is a topic that interests me so much and I would like to know more about it.

submitted by /u/Rola7013
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Millions of Routers, IoT Devices at Risk as Malware Source Code Surfaces on GitHub

"BotenaGo" contains exploits for more than 30 vulnerabilities in multiple vendor products and is being used to spread Mirai botnet malware, security vendor says.

Dark Reading: Attacks/Breaches
OMB Issues Zero-Trust Strategy for Federal Agencies

Federal officials tout the strategy as a more proactive approach to securing government networks.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
ArmorCode Closes $11 Million Seed Funding Round

Company will use new funds to extend its AppSecOps platform capabilities.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
JFrog's New Tools Flag Malicious JavaScript Packages

The three open source tools flag malicious JavaScript packages before they are downloaded and installed from the npm package manager.

Hacking on Medium
Hands on XSS: Cross site scripting

https://cdn-images-1.medium.com/max/1200/0*rRT_KnLSj154uTUi.jpg
If you are a web developer and want to avoid XSS attack or interested in cyber security then you want to read this article.

Continue reading on System Weakness »

___________________________
@hacking_Attack
@Hacking_Video