Dark Reading: Attacks/Breaches
Why the World Needs a Global Collective Cyber Defense

This sort of approach would enable cross-company and cross-sector threat information sharing, an effort that would allow companies to easily turn data into actionable insights.

Real-world examples of cryptographic failures
https://www.reddit.com/r/Pentesting/comments/t8s1kp/realworld_examples_of_cryptographic_failures/

Hi all. I have been doing CTF challenges and I'm aware of famous cryptographic schemes. Although there are weaknesses intentionally injected in the CTF challenges, I was wondering how common cryptographic failures are as against XSS or SQLi. Since algorithms like RSA are strong enough to brute force and there are a lot of warnings on the web around using weak crypto methods, I think that crypto vulnerabilities are not that common. Could you experts who see real-world applications of this vulnerability elaborate on this? submitted by /u/pyDeb (https://www.reddit.com/user/pyDeb)
[link] (https://www.reddit.com/r/Pentesting/comments/t8s1kp/realworld_examples_of_cryptographic_failures/) [comments] (https://www.reddit.com/r/Pentesting/comments/t8s1kp/realworld_examples_of_cryptographic_failures/)

___________________________
@hacking_Attack
@Hacking_Video

All about Account Takeover

Account Takeover Methods
Read more...

$$$ Bank Verification Bypass(Broken Object Level Authorisation)

Hey Readers, 👋, Hope you are doing great,
Read more...

hacking: security in practice
Things you can do to protect your business & organization from Russian hackers and cyberattacks

https://external-preview.redd.it/kqjRBu8BdivscN_DRZd_waqyOqHRFiqLxrMEVdGaH1s.jpg?width=640&crop=smart&auto=webp&s=7d92e1db169364c5de4188bc63395c852630c991 submitted by /u/loweggego
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Critical Cross-Account Vulnerability Found in Microsoft Azure Automation Service

https://external-preview.redd.it/k3W30jPDNfqcx3VnHwf61EpkphVKAa9LKOC8fTc_ptE.jpg?width=640&crop=smart&auto=webp&s=0e8af8f476208dd906e81c021699c548e42f136d submitted by /u/FoShizzleMyWeasle
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
CamPhish tool permission requirements

Heyo I was playing around with camphish and realised that in order to take pics, it requires the target to press accept to giving access to their camera . I know there are programs out there that can instantly gain access to a targets webcam without asking for permissions(i see most of them use a evil twin attack) . And mainly is there a way to detect such software if it was planted onto my pc(through clicking on links)

submitted by /u/Barlie2
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Reverse engineering

So I’m in a lot of Linux subreddits, a lot of people damn closed source software to hell meanwhile there is some closed source software that’s cool.

Can’t they make it open source via reverse engineering or decompiling?

If so: why don’t people do this more?

I’m pretty sure only the distribution of the software after the fact would be illegal, I mean you’d have to say goodbye to updates and patches, but???

submitted by /u/605yeeter
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
A new era of hacking?

With this recent declaration of cyber war by anonymous on the Russian federation, do you guys think this brings in a new era of hacking where gangs of hackers will be in active "gang wars" with other gangs? Just an interesting thought.

submitted by /u/seanie-123
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Making a Career Switch and Looking for Advice
https://www.reddit.com/r/Pentesting/comments/t8ubg6/making_a_career_switch_and_looking_for_advice/

Hello everyone. So I graduated form college a few years ago with a BFA in Acting and as you can probably guess, its a very hard industry to get into, let alone make a living in your years, thus I've been doing a lot of gig work and serving at restaurants. These jobs haven't been very consistent and moneywise and so I am making a career switch into IT, CyberSec. I was thinking with my acting background that I would be a good fit for Red Team as a social engineer. I should also point out that I am in a CyberSec Bootcamp and am going to come out with a cert in Sec+. I guess what I'm looking for is advice for getting onto Red Team without any real IT background. Any thoughts will be appreciated. THANK YOU submitted by /u/gosh_sammit (https://www.reddit.com/user/gosh_sammit)
[link] (https://www.reddit.com/r/Pentesting/comments/t8ubg6/making_a_career_switch_and_looking_for_advice/) [comments] (https://www.reddit.com/r/Pentesting/comments/t8ubg6/making_a_career_switch_and_looking_for_advice/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
PHOTON

https://cdn-images-1.medium.com/max/800/1*onFtwnrVjWk9cEThk-ciIg.png
(LET’S EXPLORE WEBSITE)

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Raising the Stakes: Cyrex & IGaming Security

https://cdn-images-1.medium.com/max/1920/0*1RneZ0aMd6NSLIPF.png
It’s no secret that the worldwide online gambling and IGaming sectors have expanded at a breakneck pace in recent years.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What is Forking?

https://cdn-images-1.medium.com/max/1080/1*0KHuzhrDrgQ9CT8gGdxmRw.jpeg
101, difference between hard and soft forks, prevalence

Continue reading on Shaping Web3 »

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Foxit PDF Reader 11.0 Unquoted Service Path

https://2.bp.blogspot.com/-y5QhCp_hFKM/WWlvahEOH0I/AAAAAAAAIPA/Q0VQ49Z0hVw4skegRDdSXm3Bk15Ptyg5wCLcBGAs/s1600/h70.png
Foxit PDF Reader version 11.0 suffers from an unquoted service path vulnerability.

MD5 | af6e2e5a7c7adaa894c56f18040549d4

Download
# Exploit Title: Foxit PDF Reader 11.0 - Unquoted Service Path
# Date: 05/03/2022
# Exploit Author: Hejap Zairy
# Vendor Homepage: https://www.foxit.com/pdf-reader/
# Software Link: https://www.foxit.com/downloads/#Foxit-Reader/
# Version: 11.0.1.49938
# Tested: Windows 10 Pro x64 es

C:\Users\Hejap>sc qc FoxitReaderUpdateService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: FoxitReaderUpdateService
TYPE : 110 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files (x86)\Foxit Software\Foxit PDF Reader\FoxitPDFReaderUpdateService.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Foxit PDF Reader Update Service
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Malwarebytes 4.5 Unquoted Service Path

https://2.bp.blogspot.com/-TEKdvnpzXEU/WWlu-1G01LI/AAAAAAAAIJ8/FsoklfFFqiwHwKy6Rf6U36sgF7K28-hPgCLcBGAs/s1600/h118.png
Malwarebytes version 4.5 suffers from an unquoted service path vulnerability.

MD5 | 0efbda2b49f64330eac963f78ac1927d

Download
# Exploit Title: Malwarebytes 4.5 - Unquoted Service Path
# Date: 05/03/2022
# Exploit Author: Hejap Zairy
# Vendor Homepage: https://www.malwarebytes.com/
# Software Link: https://www.malwarebytes.com/mwb-download/
# Version: 4.5.0
# Tested: Windows 10 Pro x64 es

C:\Users\Hejap>sc qc MBAMService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: MBAMService
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Malwarebytes Service
DEPENDENCIES : RPCSS
: WINMGMT
SERVICE_START_NAME : LocalSystem
#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Cloudflare WARP 1.4 Unquoted Service Path

https://3.bp.blogspot.com/-m8d6k5PvpEU/WWlvYbY80xI/AAAAAAAAIOk/9YRDlN0af5krj_sxTfYJBUTX80Cs4dJKgCLcBGAs/s1600/h56.png
Cloudflare WARP version 1.4 suffers from an unquoted service path vulnerability.

MD5 | 4edb0796b32e5f29aa038b4280241609

Download
# Exploit Title: Cloudflare WARP 1.4 - Unquoted Service Path
# Date: 05/03/2022
# Exploit Author: Hejap Zairy
# Vendor Homepage: https://www.cloudflare.com/
# Software Link: https://developers.cloudflare.com/warp-client/get-started/windows/
# Version: 1.4.107
# Tested: Windows 10 Pro x64 es

C:\Users\Hejap>sc qc CloudflareWARP
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: CloudflareWARP
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files\Cloudflare\Cloudflare WARP\\warp-svc.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Cloudflare WARP
DEPENDENCIES : wlansvc
SERVICE_START_NAME : LocalSystem

#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video