Dark Reading: Attacks/Breaches
Zero-Day Vulnerability Discovered in Java Spring Framework

A proof-of-concept exploit allows remote compromises of Spring Web applications.

SpringShell: Spring Core RCE 0-day Vulnerability
https://www.reddit.com/r/redteamsec/comments/tsnmkh/springshell_spring_core_rce_0day_vulnerability/

submitted by /u/Gorkha56 (https://www.reddit.com/user/Gorkha56)
[link] (https://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html) [comments] (https://www.reddit.com/r/redteamsec/comments/tsnmkh/springshell_spring_core_rce_0day_vulnerability/)

___________________________
@hacking_Attack
@Hacking_Video

just scanning my network traffic and this just looked kinda odd i need a second opinion?
https://www.reddit.com/r/Pentesting/comments/tsoo41/just_scanning_my_network_traffic_and_this_just/

___________________________
@hacking_Attack
@Hacking_Video

submitted by /u/Bashnanotechp (https://www.reddit.com/user/Bashnanotechp)
[link] (https://i.redd.it/pzh3vsa4imq81.jpg) [comments] (https://www.reddit.com/r/Pentesting/comments/tsoo41/just_scanning_my_network_traffic_and_this_just/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The Biggest Crypto Heist In History Just Went Down (Also, Is Wells Fargo Racist?)

https://cdn-images-1.medium.com/max/2600/0*hndVtCTnDeNuZ0Ji
This is crazy. About $600 million was stolen in crypto assets and it’s apparently one of the biggest crypto heists ever. Of course, with…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackme — VulnNet: Roasted

https://cdn-images-1.medium.com/max/600/1*vr1iNNSEdxteuODeHzdT4w.png
Hai pada tulisan kali ini saya akan membagikan beberapa tulisan yang akan terbagi menjadi bagian antara lain Active directory attack and…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
using Bettercap/or similar monitor tools, breaks wifi until reboot!

I'm on Mac but had similar issues in the past on Linux. Basically tools like bettercap, which seems to have trouble working to be honest at first. It only seems my single network. Then it starts working and I can see my wifi is in monitoring mode thanks to the "eye" icon on my status bar on macos.

So I gather the info I need in monitoring mode, like using wifi.recon, and then type wifi.recon off. What I assume should happen is the interface goes back to normal.

I exit bettercap.

Unfortunately although I can see the networks around me, I cannot connect to any at all, no matter what.

Here's what I've tried:

ifconfig en0(/1) down/up

I've removed the interface from system pref -> network and readded it.

Nothing works, the only thing that allows me to connect back to wifi is rebooting.

I hope my explanation was okay, what do you guys think?

In ifconfig, the status is pretty much always inactive, sometimes after multiple commands, it may switch to active for seconds, then it goes back to inactive. It's rather annoying, I can't be rebooting after every single attempt st using Bettercap

Edit 2

Okay so I disconnected from my network as bettercap says and used en0 as said as well. The issue is when I do wifi.recon on, no networks pop up no matter how long I wait.

But if I switch to en1, it finds tons. But then of course I won't be able to connect anymore until I reboot 🤦‍♂️

submitted by /u/HealingWithNature
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
CVE-2022-22963 : A new zero-day vulnerability in the Spring Core Java framework called 'Spring4Shell' has been publicly disclosed, allowing unauthenticated remote code execution on applications.

https://external-preview.redd.it/tMpoNbrUqRwWKHl11pAa3T334dcoGbOcnDoYSvKhFxI.jpg?width=640&crop=smart&auto=webp&s=46e8a9d0a209ab84fde7ac58a460fc0f6ff27d09 submitted by /u/Late_Ice_9288
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

CloudSek EWYL 2022 CTF

Solving a Harry Potter Themed CTFContinue reading on InfoSec Write-ups »
Read more...

CloudSek EWYL 2022 CTF
https://infosecwriteups.com/cloudsek-ewyl-2022-ctf-eae4229b561c?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Solving a Harry Potter Themed CTFContinue reading on InfoSec Write-ups » (https://infosecwriteups.com/cloudsek-ewyl-2022-ctf-eae4229b561c?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Ronin Exploit, Largest Crypto Hack to Date

https://cdn-images-1.medium.com/max/820/1*TYOYRdhyWJBELQwpIntpvQ.png
Losses in excess of $610 million.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Insecure Deserialisation(JAVA)

https://cdn-images-1.medium.com/max/2600/1*d0NHhTUihbNfZ8bz6YXQTg.png
In this blog post we will learn what is Deserialisation .Why we need it .How it works and how can we abuse it.All in the context of java.

Continue reading on System Weakness »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Cross-Contract Reentrancy Attack

https://cdn-images-1.medium.com/max/1200/1*vdXpQwo7YavhbQSbLoDT0w.png
Reentrancy attack is one of the most common attacks on EVM-based smart contracts. It is an attack with devastating damages, which can be…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
CloudSek EWYL 2022 CTF

https://cdn-images-1.medium.com/max/2600/1*lEqj94rcqFK9llK9vY75xg.png
Solving a Harry Potter Themed CTF

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
is there a way to hack this?

I found a fake apple watch that acts like a fitness watch is there any way to hack it to make it work like a normal smartwatch

submitted by /u/metalhatcat
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
POS System Emulating or Modding

Hello Everyone, there's these old cash registers that a restaurant I work at threw out because they were old outdated technology. These registers were the Sam4s SPS2000 touch screen register, which had a lot of cool features like customizable buttons and items. Being the IT guy of the store, I've had to take home some of these registers from time to time as sometimes the software on them would get corrupt, and I'd have to manually update it from a USB with new firmware files and such. I've even restored a bricked system via tftp with files provided by the retailer.

Now that these registers are retired, I'm looking for a way to either emulate these systems and get them on a different chip (for example, getting this on a raspberry pi would be cool) or to mod it with custom code, maybe even getting it to run doom or something funny I don't know lol.

There are multiple files I have:

zImage

xlib.yaffs

sps2000

ramdisk.gz

NANDBOOT.BIN

MICOM.BIN

BOOTROM.BIN

app.yaffs

*Note that some of these files don't have extensions for some reason.

All of these files are available for download via CCR, completely legally here

All I know is that the software on the system is an ARM Based Linux distro, made to run only the sps2000 main software (which I believe is contained in the sps2000 file because I've used that file alone to update and restore the software from time to time)

Would anyone be able to help me get this either emulated or decompiled? Or have your own fun with it lol. Thank you!

submitted by /u/maxwell321
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Which do you prefer?

Feel free to explain your preference in the comments

View Poll

submitted by /u/STATERA_DIGITAL
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video