hacking: security in practice
Russia arrests 14 alleged members of REvil ransomware gang, including hacker U.S. says conducted Colonial Pipeline attack

https://external-preview.redd.it/iCNOPUW1Q7QzKEcXbHrheFUw6WRjV46hklVO-vEU2-0.jpg?width=640&crop=smart&auto=webp&s=b9d07d209e1d498c785ccb30ed6fbbbef20947fe submitted by /u/cowpiejoy
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Express TestNet Bug Bounty Program

The Express Protocol Testnet is LIVE! With this launch, we have got one step closer to achieving our grand vision of building a…Continue reading on Pandora Finance »
Read more...

Hacking on Medium
How To Download KRNL in 2022 || Download The Best Cheat For Roblox

Hello, i’m $ixRaze and i wanna show my video. The title makes it clear what it is video.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Samsung suffers security breach, hackers release 190GB of data: report

https://cdn-images-1.medium.com/max/620/0*bgagM9wx1Hs6wjMB
Samsung Electronics appears to have had a severe security vulnerability. The hackers responsible for this incident claim to have exposed…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
HackOwasp 4.0- A wonderful opportunity! Register quick!!

https://cdn-images-1.medium.com/max/600/1*iycrk-7TJWKMBnUU1OJoqQ.jpeg
Hey there reader and it would be a great if you are a coder too ( or aspiring to be one). As a current Campus Ambassador for HackOwasp4.0…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
ReDoS — Denial of Service by RegEx

https://cdn-images-1.medium.com/max/1516/1*hJd2AbuVfucAp-gd6k5NSA.png
Regular expressions (RegEx) are a formal language to define simple patterns. It is commonly used to find interesting parts within a larger…

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
PwnKit-Exploit - Proof Of Concept (PoC) CVE-2021-4034

https://blogger.googleusercontent.com/img/a/AVvXsEhqNMnJx-NhcmnKUWBmyvQw9M1B_gCgM9UigjRhwqQBqyfluJaic1E0HT09Ccvngjr_ZBqZfMDRz20gR3QJnYvqmoZmuws7U7fWT5o3_ixiRZns-f95og1FP57F0SlY7HDOMaCkHIZk8wVh-YGFQ2YOAWgjck6xrU4F4GrOXe4BRu349gHNanQkaWW1=w273-h400 https://blogger.googleusercontent.com/img/a/AVvXsEj2ywNzLgoT_wP9Dkc2AwHxBzcnWzbPVaejvjZCfApZJn7dRkwx3e1V67bGwd7PSxOOHg4eswo2qguiSU2NY1Ecbc-zeTv_lfKh8Eds20RoMNr_BNe3bXWwCJ_-zv0QLSy1P3Mkmg7TJZ33s9DEvFPEyVQsaHc4VhGfRw4tSfCqg3BvMxBsCSbyCfA2=w400-h200 Proof Of Concept (PoC) CVE-2021-4034
@c0br40x help to make this section in README!! Proof of Concepthttps://blogger.googleusercontent.com/img/a/AVvXsEgNX-HnmAk-61Qs5ZEX_MNxpsjz_fLKqQypNLjr_47YNbNpAcMWXudZohMJlaa4Kxxuz_Baeh7qGLg_AALEP6Xcc3vibaMj9JkCr6ga0qYU0agEXM5WiMqxBklZ3DVEJb7-DR-3NgW9M--UQ5sCYQKQfxgX-Bkkt1nyV3litenJfjDq9SM2VuTfev0T=w640-h522 debian@debian:~/PwnKit-Exploit$ make
cc -Wall exploit.c -o exploit
debian@debian:~/PwnKit-Exploit$ whoami
debian
debian@debian:~/PwnKit-Exploit$ ./exploit
Current User before execute exploit
hacker@victim$whoami: debian
Exploit written by @luijait (0x6c75696a616974)
[+] Enjoy your root if exploit was completed succesfully
root@debian:/home/debian/PwnKit-Exploit# whoami
root
root@debian:/home/debian/PwnKit-Exploit# FixCommand Use sudo chmod 0755 pkexecFix CVE 2021-4034 Installation & Usegit clone https://github.com/luijait/PwnKit-Exploitcd PwnKit-Exploitmake./exploitwhoamiCommand Utility make cleanClean build to test code modified ExplanationBased blog.qualys.com

The beginning of pkexec’s main() function processes the command-line arguments (lines 534-568), and searches for the program to be executed, if its path is not absolute, in the directories of the PATH environment variable (lines 610-640): 435 main (int argc, char *argv[])
436 {
...
534 for (n = 1; n < (guint) argc; n++)
535 {
...
568 }
...
610 path = g_strdup (argv[n]);
...
629 if (path[0] != '/')
630 {
...
632 s = g_find_program_in_path (path);
...
639 argv[n] = path = s;
640 }unfortunately, if the number of command-line arguments argc is 0 – which means if the argument list argv that we pass to execve() is empty, i.e. {NULL} – then argv[0] is NULL. This is the argument list’s terminator. Therefore:

at line 534, the integer n is permanently set to 1; at line 610, the pointer path is read out-of-bounds from argv[1]; at line 639, the pointer s is written out-of-bounds to argv[1]. But what exactly is read from and written to this out-of-bounds argv[1]?

To answer this question, we must digress briefly. When we execve() a new program, the kernel copies our argument, environment strings, and pointers (argv and envp) to the end of the new program’s stack; for example: |---------+---------+-----+------------|---------+---------+-----+------------|
| argv[0] | argv[1] | ... | argv[argc] | envp[0] | envp[1] | ... | envp[envc] |
|----|----+----|----+-----+-----|------|----|----+----|----+-----+-----|------|
V V V V V V

"program" "-option" NULL "value" "PATH=name" NULL Clearly, because the argv and envp pointers are contiguous in memory, if argc is 0, then the out-of-bounds argv[1] is actually envp[0], the pointer to our first environment variable, “value”. Consequently:

At line 610, the path of the program to be executed is read out-of-bounds from argv[1] (i.e. envp[0]), and points to “value”; At line 632, this path “value” is passed to g_find_program_in_path() (because “value” does not start with a slash, at line 629); Then, g_find_pr[...]

___________________________
@hacking_Attack
@Hacking_Video

ogram_in_path() searches for an executable file named “value” in the directories of our PATH environment variable; If such an executable file is found, its full path is returned to pkexec’s main() function (at line 632); Finally, at line 639, this full path is written out-of-bounds to argv[1] (i.e. envp[0]), thus overwriting our first environment variable. So, stated more precisely:

If our PATH environment variable is “PATH=name”, and if the directory “name” exists (in the current working directory) and contains an executable file named “value”, then a pointer to the string “name/value” is written out-of-bounds to envp[0]; OR

If our PATH is “PATH=name=.”, and if the directory “name=.” exists and contains an executable file named “value”, then a pointer to the string “name=./value” is written out-of-bounds to envp[0]. In other words, this out-of-bounds write allows us to re-introduce an “unsecure” environment variable (for example, LD_PRELOAD) into pkexec’s environment. These “unsecure” variables are normally removed (by ld.so) from the environment of SUID programs before the main() function is called. We will exploit this powerful primitive in the following section.

Last-minute note: polkit also supports non-Linux operating systems such as Solaris and *BSD, but we have not investigated their exploitability. However, we note that OpenBSD is not exploitable, because its kernel refuses to execve() a program if argc is 0. Download PwnKit-Exploit

___________________________
@hacking_Attack
@Hacking_Video

Website to generate tagged files to notify when opened after placed in network?
https://www.reddit.com/r/Pentesting/comments/t8q2vg/website_to_generate_tagged_files_to_notify_when/

Hey guys, A while ago a colleague of mine mentioned a website where you can generate files like Excels, Word documents, PDFs and more. Nothing malicious at all, but these files or exsiting files will get a tag and that tag sends a notification towards the creator to see who opens that file, or when it is opened. I can't find this website anymore and was hoping someone here knows what I'm talking about and can help me towards teh name? :) submitted by /u/ThirstyThursten (https://www.reddit.com/user/ThirstyThursten)
[link] (https://www.reddit.com/r/Pentesting/comments/t8q2vg/website_to_generate_tagged_files_to_notify_when/) [comments] (https://www.reddit.com/r/Pentesting/comments/t8q2vg/website_to_generate_tagged_files_to_notify_when/)

___________________________
@hacking_Attack
@Hacking_Video

TS Wallet Beta-Testing Launched
https://medium.com/@contact.tokenspace/ts-wallet-beta-testing-launched-de0088647927?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Woo, the time is finally here! After continuously developing and testing, the long-awaited TokenSpace (public beta version V1.0.2) is…Continue reading on Medium » (https://medium.com/@contact.tokenspace/ts-wallet-beta-testing-launched-de0088647927?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Express TestNet Bug Bounty Program
https://medium.com/pandoraprotocol/express-testnet-bug-bounty-program-d09c27931054?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

The Express Protocol Testnet is LIVE! With this launch, we have got one step closer to achieving our grand vision of building a…Continue reading on Pandora Finance » (https://medium.com/pandoraprotocol/express-testnet-bug-bounty-program-d09c27931054?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
After a Busy December, Attacks on Log4j Vulnerability Dropped

While attackers and researchers shift their attention to the next new vulnerability, security teams make sure they finish patching vulnerable Log4j versions in their applications and services.

Dark Reading: Attacks/Breaches
Why the World Needs a Global Collective Cyber Defense

This sort of approach would enable cross-company and cross-sector threat information sharing, an effort that would allow companies to easily turn data into actionable insights.

Real-world examples of cryptographic failures
https://www.reddit.com/r/Pentesting/comments/t8s1kp/realworld_examples_of_cryptographic_failures/

Hi all. I have been doing CTF challenges and I'm aware of famous cryptographic schemes. Although there are weaknesses intentionally injected in the CTF challenges, I was wondering how common cryptographic failures are as against XSS or SQLi. Since algorithms like RSA are strong enough to brute force and there are a lot of warnings on the web around using weak crypto methods, I think that crypto vulnerabilities are not that common. Could you experts who see real-world applications of this vulnerability elaborate on this? submitted by /u/pyDeb (https://www.reddit.com/user/pyDeb)
[link] (https://www.reddit.com/r/Pentesting/comments/t8s1kp/realworld_examples_of_cryptographic_failures/) [comments] (https://www.reddit.com/r/Pentesting/comments/t8s1kp/realworld_examples_of_cryptographic_failures/)

___________________________
@hacking_Attack
@Hacking_Video

All about Account Takeover

Account Takeover Methods
Read more...