Hacking on Medium
My First RCE from N/A to Triaged (CVE-2021–3064)

https://cdn-images-1.medium.com/max/623/1*QgHX7hXkkukt8W2ciO6urw.jpeg
hello hackers, my name is Vivek Kumar & I started my bug bounty journey 8 months ago lets get back to the RCE its gonna very shot blog…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Slyther - AWS Security Tool

Slyther is AWS Security tool to check read/write/delete access for S3 buckets  Requirements aws-cli Installation pip3 install -r requirements.txt Usage example python3 slyther.py -b flaws.cloud Release History 0.0.3 Added option to check if aws-cli is installed or not 0.0.2 Added option to check list of buckets 0.0.1 Initial release Created by – @iamavu Download Slyther
Read more...

hacking: security in practice
LAPSUS$: Who Is Behind The Group

https://external-preview.redd.it/Wrv7pYotsvYNMb3RwtYTWYg_7dRK_lVJnSkg6Us1_jI.jpg?width=640&crop=smart&auto=webp&s=11a003d559bc57cd10b5a4d3d22030d844d83c01 submitted by /u/Kortings_codes
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
beEF ilegal?

If you warn the user in the term of service that beef is penetrating testing them. is it still ilegal?

submitted by /u/Lucaspapper
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
News-Draft-Patreon image removed, Patreon link instead

News-Draft-Patreon image removed, Patreon link insteadPost Views: 7 Advanced Enumeration techniques with NMAP, Zenmap and Hydra https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Digital-Patreon-Logo_FieryCoral-150x150.png Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes
​Mozilla has released Firefox 97.0.2, Firefox ESR 91.6.1, Firefox for Android 97.3.0, and Focus 97.3.0 to fix two critical zero-day vulnerabilities actively exploited in attacks.
Both zero-day vulnerabilities are “Use-after-free” bugs, which is when a program tries to use memory that has been previously cleared. When threat actors exploit this type of bug, it can cause the program to crash while at the same time allowing commands to be executed on the device without permission.

These bugs are critical because they could allow a remote attacker to execute almost any command, including the downloading of malware to provide further access to the device.

The zero-day vulnerabilities fixed by Mozilla are:

* CVE-2022-26485: Use-after-free in XSLT parameter processing – Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw.
* CVE-2022-26486: Use-after-free in WebGPU IPC Framework – An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw.
See Also: Complete Offensive Security and Ethical Hacking Course
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png
As Mozilla’s security advisory explains, the Firefox developers are aware of “reports of attacks in the wild” actively exploiting these vulnerabilities.

While Mozilla has not shared how threat actors use these zero-day vulnerabilities in attacks, it was likely done by redirecting Firefox users to maliciously crafted web pages.

These vulnerabilities were discovered and disclosed to Mozilla by Chinese cybersecurity company Qihoo 360 ATA.

Due to the critical nature of these bugs, and they are being actively exploited, it is strongly recommended that all Firefox users update their browsers immediately.
See Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH You can also download the latest version of Mozilla Firefox for Windows, macOS, and Linux from the following links:

* Firefox 97.0.2 for Windows 64-bit
* Firefox 97.0.2 for Windows 32-bit
* Firefox 97.0.2 for macOS
* Firefox 97.0.2 for Linux 64-bit
* Firefox 97.0.2 for Linux 32-bit

Users can manually check for new updates by going to the Firefox menu > Help > About Firefox. Firefox will then automatically check for and install the latest update and prompt you to restart your browser. See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
See Also: Hacking stories: MafiaBoy, the hacker who took down the Internet
Source: bleepingcomputer.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/apple-iphone-hacking-90x90.jpg Apple emergency update fixes zero-days used to hack iPhones, Macs5 hours ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Google-Campus-90x90.jpg Google Chrome Bug Actively Exploited as Zero-Day1 day ago
* https://www.blackhatet[...]

___________________________
@hacking_Attack
@Hacking_Video

hicalhacking.com/wp-content/uploads/2022/03/685f-article-211221-chrome-site-isolation-body-text-90x90.jpg HTML parser bug triggers Chromium XSS security flaw2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Polygon-hacker-90x90.jpg Hackers getting faster at latching onto unpatched vulnerabilities3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/mitmproxy-90x90.png HTTP request smuggling bug patched in mitmproxy4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ee3dc49c79d14f20970cc8b20063f52e-90x90.jpg Flash loan attack on One Ring protocol nets crypto-thief $1.4 million1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-3-1-90x90.jpg DeadBolt Ransomware Resurfaces to Hit QNAP Again1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/hackers-90x90.jpg Lapsus$ Data Kidnappers Claim Snatches From Microsoft, Okta1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Invisible-man-scaled-e1647906959971-90x90.jpg Browser-in-the-Browser Attack Makes Phishing Nearly Invisible1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/pdf-export-90x90.png Workaround offered for unpatched HTML-to-PDF rendering vulnerability2 weeks ago
The post News-Draft-Patreon image removed, Patreon link instead first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Slyther - AWS Security Tool
http://www.kitploit.com/2022/04/slyther-aws-security-tool.html

Slyther is AWS (https://www.kitploit.com/search/label/AWS) Security tool to check read/write/delete access (https://www.kitploit.com/search/label/Access) for S3 buckets  Requirements aws-cli Installation pip3 install -r requirements.txt Usage example python3 slyther.py -b flaws.cloud Release History 0.0.3 Added option to check if aws-cli is installed or not 0.0.2 Added option to check list of buckets 0.0.1 Initial release Created by – @iamavu (https://twitter.com/iamavu)

Download Slyther (https://github.com/iamavu/Slyther)

Hunting for Malicious Binaries and Backdoors in the Running Containers
https://www.reddit.com/r/redteamsec/comments/ttq82i/hunting_for_malicious_binaries_and_backdoors_in/

submitted by /u/tbhaxor (https://www.reddit.com/user/tbhaxor)
[link] (https://tbhaxor.com/hunting-malicious-binaries-in-containers/) [comments] (https://www.reddit.com/r/redteamsec/comments/ttq82i/hunting_for_malicious_binaries_and_backdoors_in/)

auto export burp suite http logs
https://www.reddit.com/r/Pentesting/comments/tts2xp/auto_export_burp_suite_http_logs/

<!-- SC_OFF -->Thank you for reading this post! ​ Does anyone have an idea how I can auto export specific burp suite http logs to a file? I know you can do it for all types of HTTP requests and responses that come in, but I want it only for specific packets. I've tried doing it with Loger++, but it seemingly doesn't support an auto function. ​ Really just whenever I get a certain packet in my http history I want to export it to a file from the moment it appears in the HTTP history and this way create one big file with all the http packets ​ So to summarize: Everytime I get a certain HTTP packet in my HTTP history (only scopes ones), I want the request to be written to a file automatically, not clicking export somewhere. ​ I'd appreciate any answer! <!-- SC_ON --> submitted by /u/Kenshievaaa (https://www.reddit.com/user/Kenshievaaa)
[link] (https://www.reddit.com/r/Pentesting/comments/tts2xp/auto_export_burp_suite_http_logs/) [comments] (https://www.reddit.com/r/Pentesting/comments/tts2xp/auto_export_burp_suite_http_logs/)

Small bugs are more dangerous than you think

Chaining bugs for the winContinue reading on Medium »
Read more...

Hacking on Medium
Top 7 Hacking labs to practice ethical hacking. Complete Guide.

To become proficient in any skill, you need to practice a lot.

Continue reading on Medium »

Hacking on Medium
My Experience About I4G Hackathon

Thank you i4G for this opportunity. The time and resources you have channelled towards developing the youth are laudable. I can’t imagine…

Continue reading on Medium »

KitPloit - PenTest Tools!
Slyther - AWS Security Tool

https://blogger.googleusercontent.com/img/a/AVvXsEg0uvyflfi0Yz3jHoS1KQiwhYnY9s_Ki08PtPo6GhRiqu9Kb3Emsm-W1aqkJapoypIxFHI6pwSr-08bZgqPEnnKweFPuX-kIf3reYu5WMpi51278IYvUxrYkP_48qAz8lJTFh-iwPjS3Jciwo05CrWhooNahmICPItaotxz9mzlb0DwgDpy9Z6roJyQ=w640-h308
Slyther is AWS Security tool to check read/write/delete access for S3 buckets
Requirements

aws-cli

Installation

pip3 install -r requirements.txt

Usage example

python3 slyther.py -b flaws.cloud

Release History

*
0.0.3

* Added option to check if aws-cli is installed or not

*
0.0.2

* Added option to check list of buckets

*
0.0.1

* Initial release

*
Created by – @iamavu
Download Slyther

Small bugs are more dangerous than you think
https://medium.com/@terminatorLM/small-bugs-are-more-dangerous-than-you-think-9411618191ab?source=rss------bug_bounty-5

Chaining bugs for the winContinue reading on Medium » (https://medium.com/@terminatorLM/small-bugs-are-more-dangerous-than-you-think-9411618191ab?source=rss------bug_bounty-5)