Cre : https://medium.com/@fcwdbrqmr/400-bounty-again-using-google-dorks-6dc8e438f017Continue reading on Medium » (https://rei-hunt.medium.com/find-bugs-by-google-dork-method-69f79aa93221?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Find bugs by Google dork method

Cre : https://medium.com/@fcwdbrqmr/400-bounty-again-using-google-dorks-6dc8e438f017Continue reading on Medium »
Read more...

Business Logic Bug| Email Existing Bypass | Running 2 accounts with a single email

Vulnerability Category: Business Logic ErrorContinue reading on Medium »
Read more...

Business Logic Bug| Email Existing Bypass | Running 2 accounts with a single email

Vulnerability Category: Business Logic ErrorContinue reading on Medium »
Read more...

hacking: security in practice
‘Sophisticated’ new Chinese hacking tool found, spurring US warning to allies.

https://external-preview.redd.it/gQTTzPaAuYtK7m11rNlnyAzEfe8lnfkbLiFsQmXKKro.jpg?width=640&crop=smart&auto=webp&s=f023f00b2d529a7a5e7e93b87212109f48e05095 submitted by /u/SnooPeppers6719
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Business Logic Bug| Email Existing Bypass | Running 2 accounts with a single email
https://medium.com/@awezkagdi.ak/business-logic-bug-email-existing-bypass-running-2-accounts-with-a-single-email-b6f5f59947d2?source=rss------bug_bounty-5

Vulnerability Category: Business Logic ErrorContinue reading on Medium » (https://medium.com/@awezkagdi.ak/business-logic-bug-email-existing-bypass-running-2-accounts-with-a-single-email-b6f5f59947d2?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Introduction to the blog

Welcome, everyone, to my blog, which I have named Byte Lab. As you may have seen on the About page, this blog is going to be systems…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
RCE Bugs in WhatsApp, Other Hugely Popular VoIP Apps: Patch Now!

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png RCE Bugs in WhatsApp, Other Hugely Popular VoIP Apps: Patch Now!7 total views,  7 views today
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png
Reading Time: 1 Minute
WhatsApp and BlueJeans are just two of the world’s most popular communication apps that are using an open-source library riddled with newfound security holes.
The flaws are in the ubiquitous open-source PJSIP multimedia communication library, used by the Asterisk PBX toolkit that’s found in a massive number of VoIP implementations.
One thing this open-source, flawed library shares with the Apache Log4J logging library fiasco that started in December: It’s ubiquitous.

The library, PJSIP – an open-source multimedia communication library – is also used by Asterisk. Asterisk is an enterprise-class, open-source PBX (private branch exchange) toolkit that’s used in voice-over-IP (VoIP) services in a massive number of implementations.

According to the Asterisk site, the software is downloaded 2M times annually and runs on 1M servers in 170 countries. Asterisk powers IP PBX systems, VoIP gateways and conference servers, and it’s used by SMBs, enterprises, call centers, carriers and governments.
See Also: Complete Offensive Security and Ethical Hacking Course
On Monday, devops platform provider JFrog Security disclosed five memory-corruption vulnerabilities in PJSIP, which supplies an API that can be used by IP telephony applications such as voice-over-IP (VoIP) phones and conference apps.

An attacker who successfully triggers the vulnerabilities can flip the switch on remote code execution (RCE) in an application that uses the PJSIP library, JFrog researchers explained.

Following JFrog’s disclosure, PJSIP’s maintainers have fixed the five CVEs, depicted below. https://media.threatpost.com/wp-content/uploads/sites/103/2022/03/01155749/PJSIP-security-vulnerabilities-e1646168517426.png The disclosed PJSIP security vulnerabilities. Source: JFrog Security. What Went WrongIn its technical breakdown, JFrog researchers explained that the PJSIP framework offers a library named PJSUA that supplies an API for SIP applications.

“The basic PJSUA APIs are also wrapped by object-oriented APIs. PJSUA offers a rich Media Manipulation API, where we have spotted the [five] vulnerabilities,” they said.
See Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH Three of the flaws are stack overflow vulnerabilities that can lead to RCE and which are rated 8.1 on the CVSS severity-rating scale.

The remaining two include a read out-of-bounds vulnerability and a buffer overflow weakness in the PJSUA API, both of which can lead to denial-of-service (DoS) and both of which are rated at CVSS 5.9. Vulnerable ProjectsJFrog said that projects that use the PJSIP library before version 2.12 and which pass attacker-controlled arguments to any of the following APIs are vulnerable:

* pjsua_player_create – filename argument must be attacker-controlled
* pjsua_recorder_create – filename argument must be attacker-controlled
* pjsua_playlist_create – file_names argument must be (partially) attacker-controlled
* pjsua_call_dump – buffer argument capacity must be smaller than 128 bytes

JFrog recommended upgrading PJSIP to version 2.12 to address the vulnerabilities. See Also: Recon Tool: Metagoofil Not the First TimePockmarks in PJSIP and other common videoconferencing architecture implementations are nothing new. In August 2018, Google Project Zer[...]

___________________________
@hacking_Attack
@Hacking_Video

o researcher Natalie Silvanovich disclosed critical vulnerabilities in most of the common ones, including WebRTC (used by Chrome, Safari, Firefox, Facebook Messenger, Signal and others), PJSIP (which, again, is used by WhatsApp, BlueJeans and millions of implementations of Asterisk) and Apple’s proprietary library for FaceTime.

“If exploited, such vulnerabilities would have let attackers crash apps using the implementation, by merely placing a video call,” noted Ronen Slavin, then head of research at Reason Cybersecurity and currently the co-founder and CTO at the source code control, detection, and response platform Cycode, back in 2019. “This would have then triggered a memory heap overflow which could allow the attacker to take over the victim’s video calling account.”

Apps such as Skype, Google Hangouts and WhatsApp “have made it easy to have meaningful face-to-face interactions across between two points anywhere on the globe,” he wrote.

It was true then. But since, the pandemic has been gas on the fire when it comes to virtual connections: all the more reason to heed JFrog’s advice and patch ASAP. Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
See Also: Hacking stories: MafiaBoy, the hacker who took down the Internet
Source: threatpost.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/download-90x90.jpg Cyber-attack on Nvidia linked to Lapsus$ ransomware gang1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/GettyImages-802535150-1-90x90.jpg Conti ransomware’s internal chats leaked after siding with Russia2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/6469-article-220223-ukraine-body-text-90x90.jpg Data wiper deployed in cyber-attacks targeting Ukrainian systems5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/T8F9rL5Ub6TRWHtQwsVCK6-1200-80-90x90.jpg Samsung Shattered Encryption on 100M Phones6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/4346-article-220222-airtags-body-text-90x90.jpg AirTag clone bypassed Apple’s tracking-protection features, claims researcher1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Banner-Img-AWS-90x90.jpg Introducing Ghostbuster – AWS security tool protects against dangling elastic IP takeovers1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/zabbix_blog_java-apps-90x90.png Critical vulnerabilities in Zabbix Web Frontend allow authentication bypass, code execution on servers1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/ezgif.com-gif-maker-4-1-90x90.jpg GitHub code scanning now finds more security vulnerabilities2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/012qzWe52HXVPxkc8nUrPyv-1.fit_lim.size_1200x630.v1617817629-90x90.jpg Massive LinkedIn Phishing, Bot Attacks Feed on the Job-Hungry2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Unredacter-Pixelize-90x90.gif New tool can uncover redacted, pixelated text to reveal sensitive data2 weeks ago
The post RCE Bugs in WhatsApp, Other Hugely Popular VoIP Apps: Patch Now! first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Last week the United Kingdom’s National Cyber Security Centre urged UK organizations “to strengthen their cyber resilience in response to the situation in Ukraine”. They followed that warning by adopting a set of actions to take when the cyber threat is heightened.

https://external-preview.redd.it/fl8KxYVZMid-QC2e5GlyXxKEFNGfilv0JfZJVD6QrMU.jpg?width=640&crop=smart&auto=webp&s=ebb74bc033a94a069347ff99540ad6d3a1b73cdd submitted by /u/mobfig316
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Has anyone signed up all of those leaked defense ministry emails for Mailbait? It would be a shame if their inboxes got flooded with thousands of emails with every new entry

https://external-preview.redd.it/YxEXpxmxDxDp1IpKnGsy-0SQXyxoI1FXx08mCNvbTIo.jpg?width=320&crop=smart&auto=webp&s=cf1207173b44c0429fbdf7122b454d50a0ee92d9 submitted by /u/Ok-Abbreviations2486
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Demonstration of how use Counter-Strike 1.6 as Malware C2

If you're a malware operator who likes to Rush B and want to manage your victims while playing games, this is for you.

https://www.youtube.com/watch?v=b2L1lWtwBiI&t=1s

https://twitter.com/kaganisildak/status/1498585440680656896

submitted by /u/kaganisildak
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What I should do?

Long story in short - I’ve had beef w someone who somehow was using my social accounts for months without me knowing it, until now - I know who that is and I know his IP

What I can do with it?

submitted by /u/OkCryptographer9015
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Ukrainian startup is offering hackers $100,000 to bring down Russian websites

submitted by /u/theinternetstapler
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video