Blind XSS is a relatively easy bug to find with the availability of tools like XSS-Hunter and Burp collaborator.Continue reading on Medium » (https://adamwize.medium.com/blind-xss-disappointment-f122d48cbb0a?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

($$$) IDOR via GET Request which can SOLD all User Products
https://aidilarf.medium.com/idor-via-get-request-which-can-sold-all-user-products-2f5bc3ea1650?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hi everyone,Continue reading on Medium » (https://aidilarf.medium.com/idor-via-get-request-which-can-sold-all-user-products-2f5bc3ea1650?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

($$$) IDOR via GET Request which can SOLD all User Products

Hi everyone,Continue reading on Medium »
Read more...

Kali Linux Tutorials
Registry-Spy : Cross-platform Registry Browser For Raw Windows Registry Files

Registry-Spy is a free, open-source cross-platform Windows Registry viewer. It is a fast, modern, and versatile explorer for raw registry files.

Features include:

* Fast, on-the-fly parsing means no upfront overhead
* Open multiple hives at a time
* Searching
* Hex viewer
* Modification timestamps

Requirements

* Python 3.8+

Installation

Download the latest version from the releases page. Alternatively, use one of the following methods.

pip (recommended)

* pip install registryspy
* registryspy

Manual

* pip install -r requirements.txt
* python setup.py install
* registryspy

Standalone

* pip install -r requirements.txt
* python registryspy.py

Screenshots

Main Window
https://blogger.googleusercontent.com/img/a/AVvXsEjPzPE3NIv7DJIrZd_7YHEvT9ZKqiu-yes82AyF5iwQStvdX3WEuUsebzx2X-Hx2WSMvqnNcjp66a4roK-IR4tRqwriwHUksbD9kX94HysY9cmc9_10v6zx3Ex_sO_0bp8WRGHmVqy7zD75fVoaH4kz8czuWuQ62F1v2Vn1kfw7tX0oAsvwqj0Mrh_L=s791
Find Dialog
https://blogger.googleusercontent.com/img/a/AVvXsEj73-tSNeitt7bjIVKW7U5ZpIhzzqleQywF8-XCXmq5Pc4kqZ9MFI4KfWC7QVSHrNfx9ZT2uoJ3w4zM5KrWj8mTo4cN2EYEL8w_uO5AyunrD6kGGCFiY3w2qv1OhoblNNic3fTrKIv-SE9zlotL-5E-Lbxj8pBerhDJn8PwJg9xCZxZxXKTbDrzX5B4=s402
Building

Dependencies:

* PyInstaller 4.5+

Regular building: pyinstaller registryspy_install.spec

Creating a single file: pyinstaller registryspy_onefile.spec
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Inject-Assembly : Inject .NET Assemblies Into An Existing Process

Inject-Assembly is an alternative to traditional fork and run execution for Cobalt Strike. The loader can be injected into any process, including the current Beacon. Long-running assemblies will continue to run and send output back to the Beacon, similar to the behavior of execute-assembly.

There are two components of inject-assembly:

* BOF initializer: A small program responsible for injecting the assembly loader into a remote process with any arguments passed. It uses Beacon Inject Process to perform the injection, meaning this behavior can be customized in a Malleable C2 profile or with process injection BOFs (as of version 4.5).
* PIC assembly loader: The bulk of the project. The loader will initialize the .NET runtime, load the provided assembly, and execute the assembly. The loader will create a new App Domain in the target process so that the loaded assembly can be totally unloaded when execution is complete.

Communication between the remote process and Beacon occurs through a named pipe. The Aggressor script generates a pipe name and then passes it to the BOF initializer.

Notable Features

* Patches Environment.Exit() to prevent the remote process from exiting.
* .NET assembly header stomping (MZ bytes, e_lfanew, DOS Header, Rich Text, PE Header).
* Random pipe name generation based on SourcePoint.
* No blocking of the Beacon, even if the assembly is loaded into the current process.

Usage

Download and load the inject-assembly.cna Aggressor script into Cobalt Strike. You can then execute assemblies using the following command:

inject-assembly pid assembly [args…]

Specify 0 as the PID to execute in the current Beacon process.

It is recommended to use another tool, like FindObjects-BOF, to locate a process that already loads the .NET runtime, but this is not a requirement for inject-assembly to function.
Download

___________________________
@hacking_Attack
@Hacking_Video

($$$) IDOR via GET Request which can SOLD all User Products

Hi everyone,Continue reading on Medium »
Read more...

hacking: security in practice
aircrack in VM

so i am trying to use aircrack on VM but it says something like wireless card undetected . so how can i use my laptop wireless in VM?
are there is any other way for wifi hacking?

submitted by /u/UnkownWithUnkownprsn
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
The Dirty Pipe Vulnerability

submitted by /u/donutloop
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
POST requests can accept URL Query parameters.

Was doing a pentest and i encountered a situation whereby there was a POST request API which takes a sensitive secret as a parameter. The interesting thing was that this API would also accept and parse the parameter even if it was sent as a query parameter.

For example the original request was to be

POST abc.com
Content-type: application/json /u/sg_pepehands69
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hash identification

I'm not sure if this is the right place. So this hash is meant to be "admin" 84e8e3c1c19a6a2cba961c4a58d2699b but I can't figure out the hash. It looks MD4/5 but can't make a copy. This was off of a device running VxWorks 6.9 from a file called auth.txt. I'm not sure if it's actually vxworks using this file.

I don't need to crack it, since I set the passwords on my own device. Just would like to figure out the hashes it's using.

Thanks!

submitted by /u/tommykw
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Learn SQL interactively!

https://cdn-images-1.medium.com/max/1916/1*w0nfDbNA9mwE-_-Kp3VFvQ.png
Intro

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

GraphQL Cop - Security Auditor Utility For GraphQL APIs
http://www.kitploit.com/2022/03/graphql-cop-security-auditor-utility.html

___________________________
@hacking_Attack
@Hacking_Video

GraphQL Cop is a small Python utility to run common security tests against GraphQL (https://www.kitploit.com/search/label/GraphQL) APIs.
Requirements Python3 Requests Library Detections Alias Overloading (DoS) Batch Queries (DoS) GET based Queries (CSRF) GraphQL Tracing (https://www.kitploit.com/search/label/Tracing) / Debug Modes (Info Leak) Field Duplication (DoS) Field Suggestions (Info Leak) GraphiQL (Info Leak) Introspection (Info Leak) Directives Overloading (DoS) Usage Starting... [HIGH] Introspection Query Enabled (Information Leakage) [LOW] GraphQL Playground UI (Information Leakage) [HIGH] Alias Overloading with 100+ aliases is allowed (Denial of Service) [HIGH] Queries are allowed with 1000+ of the same repeated field (Denial of Service) python3 main.py -t https://mywebsite.com/graphql -o json {'Field Suggestions': {'severity': 'LOW', 'impact': 'Information Leakage', 'description': 'Field Suggestions are Enabled'}, 'Introspection': {'severity': 'HIGH', 'impact': 'Information Leakage', 'description': 'Introspection Query Enabled'}, 'Possible CSRF (GET)': {'severity': 'LOW', 'impact': 'Possible CSRF', 'description': 'HTTP GET method supported (maybe CSRF)'}, 'Alias Overloading': {'severity': 'HIGH', 'impact': 'Denial of Service', 'description': 'Alias Overloading with 100+ aliases is allowed'}, 'Field Duplication': {'severity': 'HIGH', 'impact': 'Denial of Service', 'description': 'Queries are allowed with 1000+ of the same repeated field'}, 'Directive Overloading': {'severity': 'HIGH', 'impact': 'Denial of Service', 'description': 'Multiple duplicated directives allowed in a query'}}">python3 main.py -t https://mywebsite.com/graphql

GraphQL Cop 1.0
Security Auditor for GraphQL
Dolev Farhi

Starting...
[HIGH] Introspection Query Enabled (Information Leakage)
[LOW] GraphQL Playground UI (Information Leakage)
[HIGH] Alias Overloading with 100+ aliases is allowed (Denial of Service)
[HIGH] Queries are allowed with 1000+ of the same repeated field (Denial of Service)

python3 main.py -t https://mywebsite.com/graphql -o json

{'Field Suggestions': {'severity': 'LOW', 'impact': 'Information Leakage', 'description': 'Field Suggestions are Enabled'}, 'Introspection': {'severity': 'HIGH', 'impact': 'Information Leakage', 'description': 'Introspection Query Enabled'}, 'Possible CSRF (GET)': {'severity': 'LOW', 'impact': 'Possible CSRF', 'description': 'HTTP GET method supported (maybe CSRF)'}, 'Alias Overloading': {'severity': 'HIGH', 'impact': 'Denial of Service', 'description': 'Alias Overloading with 100+ aliases is allowed'}, 'Field Duplication': {'severity': ' HIGH', 'impact': 'Denial of Service', 'description': 'Queries are allowed with 1000+ of the same repeated field'}, 'Directive Overloading': {'severity': 'HIGH', 'impact': 'Denial of Service', 'description': 'Multiple duplicated directives allowed in a query'}}


Download Graphql-Cop (https://github.com/dolevf/graphql-cop)

___________________________
@hacking_Attack
@Hacking_Video

Full Account Takeover due to improper validation of old password

Hello Hackers and Security community. I’m going to share how I’m able find the bug.Continue reading on Medium »
Read more...

Black Hat Ethical Hacking
New Linux bug gives root on all major distros, exploit released

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png New Linux bug gives root on all major distros, exploit releasedPost Views: 2
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png
Reading Time: 2 Minutes
A new Linux vulnerability known as ‘Dirty Pipe’ allows local users to gain root privileges through publicly available exploits.
Today, security researcher Max Kellermann responsibly disclosed the ‘Dirty Pipe’ vulnerability and stated that it affects Linux Kernel 5.8 and later versions, even on Android devices.

The vulnerability is tracked as CVE-2022-0847 and allows a non-privileged user to inject and overwrite data in read-only files, including SUID processes that run as root.

Kellerman discovered the bug after tracking down a bug that was corrupting web server access logs for one of his customers.

Kellerman states that the vulnerability is similar to the Dirty COW vulnerability (CVE-2016-5195) fixed in 2016.
See Also: Complete Offensive Security and Ethical Hacking Course Public exploits give root privileges As part of the Dirty Pipe disclosure, Kellerman released a proof-of-concept (PoC) exploit that allows local users to inject their own data into sensitive read-only files, removing restrictions or modifying configurations to provide greater access than they usually would have.

For example, security researcher Phith0n illustrated how they could use the exploit to modify the /etc/passwd file so that the root user does not have a password. Once this change is made, the non-privileged user could simply execute the ‘su root‘ command to gain access to the root account.
Why did I overwrite the /etc/passwd?
Because this file saves all the user information on Linux.
I remove the "x" flag behind the "root" user, it means that I set an empty password for this user. So I can use "su root" to escalate privilege without credentials.

— Phith0n (@phithon_xg) March 7, 2022
However, an updated exploit by security researcher BLASTY was also publicly released today that makes it even easier to gain root privileges by patching the /usr/bin/su command to drop a root shell at /tmp/sh and then executing the script.

Once executed, the user gains root privileges, as demonstrated by BleepingComputer below in Ubuntu 20.04.3 LTS running the 5.13.0-27-generic kernel.
https://www.bleepstatic.com/images/news/security/attacks/l/linux/dirtypipe/dirtypipe-poc.jpg
___________________________
@hacking_Attack
@Hacking_Video