hicalhacking.com/wp-content/uploads/2022/03/685f-article-211221-chrome-site-isolation-body-text-90x90.jpg HTML parser bug triggers Chromium XSS security flaw2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Polygon-hacker-90x90.jpg Hackers getting faster at latching onto unpatched vulnerabilities3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/mitmproxy-90x90.png HTTP request smuggling bug patched in mitmproxy4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ee3dc49c79d14f20970cc8b20063f52e-90x90.jpg Flash loan attack on One Ring protocol nets crypto-thief $1.4 million1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-3-1-90x90.jpg DeadBolt Ransomware Resurfaces to Hit QNAP Again1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/hackers-90x90.jpg Lapsus$ Data Kidnappers Claim Snatches From Microsoft, Okta1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Invisible-man-scaled-e1647906959971-90x90.jpg Browser-in-the-Browser Attack Makes Phishing Nearly Invisible1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/pdf-export-90x90.png Workaround offered for unpatched HTML-to-PDF rendering vulnerability2 weeks ago
The post News-Draft-Patreon image removed, Patreon link instead first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Slyther - AWS Security Tool
http://www.kitploit.com/2022/04/slyther-aws-security-tool.html

Slyther is AWS (https://www.kitploit.com/search/label/AWS) Security tool to check read/write/delete access (https://www.kitploit.com/search/label/Access) for S3 buckets  Requirements aws-cli Installation pip3 install -r requirements.txt Usage example python3 slyther.py -b flaws.cloud Release History 0.0.3 Added option to check if aws-cli is installed or not 0.0.2 Added option to check list of buckets 0.0.1 Initial release Created by – @iamavu (https://twitter.com/iamavu)

Download Slyther (https://github.com/iamavu/Slyther)

Hunting for Malicious Binaries and Backdoors in the Running Containers
https://www.reddit.com/r/redteamsec/comments/ttq82i/hunting_for_malicious_binaries_and_backdoors_in/

submitted by /u/tbhaxor (https://www.reddit.com/user/tbhaxor)
[link] (https://tbhaxor.com/hunting-malicious-binaries-in-containers/) [comments] (https://www.reddit.com/r/redteamsec/comments/ttq82i/hunting_for_malicious_binaries_and_backdoors_in/)

auto export burp suite http logs
https://www.reddit.com/r/Pentesting/comments/tts2xp/auto_export_burp_suite_http_logs/

<!-- SC_OFF -->Thank you for reading this post! ​ Does anyone have an idea how I can auto export specific burp suite http logs to a file? I know you can do it for all types of HTTP requests and responses that come in, but I want it only for specific packets. I've tried doing it with Loger++, but it seemingly doesn't support an auto function. ​ Really just whenever I get a certain packet in my http history I want to export it to a file from the moment it appears in the HTTP history and this way create one big file with all the http packets ​ So to summarize: Everytime I get a certain HTTP packet in my HTTP history (only scopes ones), I want the request to be written to a file automatically, not clicking export somewhere. ​ I'd appreciate any answer! <!-- SC_ON --> submitted by /u/Kenshievaaa (https://www.reddit.com/user/Kenshievaaa)
[link] (https://www.reddit.com/r/Pentesting/comments/tts2xp/auto_export_burp_suite_http_logs/) [comments] (https://www.reddit.com/r/Pentesting/comments/tts2xp/auto_export_burp_suite_http_logs/)

Small bugs are more dangerous than you think

Chaining bugs for the winContinue reading on Medium »
Read more...

Hacking on Medium
Top 7 Hacking labs to practice ethical hacking. Complete Guide.

To become proficient in any skill, you need to practice a lot.

Continue reading on Medium »

Hacking on Medium
My Experience About I4G Hackathon

Thank you i4G for this opportunity. The time and resources you have channelled towards developing the youth are laudable. I can’t imagine…

Continue reading on Medium »

KitPloit - PenTest Tools!
Slyther - AWS Security Tool

https://blogger.googleusercontent.com/img/a/AVvXsEg0uvyflfi0Yz3jHoS1KQiwhYnY9s_Ki08PtPo6GhRiqu9Kb3Emsm-W1aqkJapoypIxFHI6pwSr-08bZgqPEnnKweFPuX-kIf3reYu5WMpi51278IYvUxrYkP_48qAz8lJTFh-iwPjS3Jciwo05CrWhooNahmICPItaotxz9mzlb0DwgDpy9Z6roJyQ=w640-h308
Slyther is AWS Security tool to check read/write/delete access for S3 buckets
Requirements

aws-cli

Installation

pip3 install -r requirements.txt

Usage example

python3 slyther.py -b flaws.cloud

Release History

*
0.0.3

* Added option to check if aws-cli is installed or not

*
0.0.2

* Added option to check list of buckets

*
0.0.1

* Initial release

*
Created by – @iamavu
Download Slyther

Small bugs are more dangerous than you think
https://medium.com/@terminatorLM/small-bugs-are-more-dangerous-than-you-think-9411618191ab?source=rss------bug_bounty-5

Chaining bugs for the winContinue reading on Medium » (https://medium.com/@terminatorLM/small-bugs-are-more-dangerous-than-you-think-9411618191ab?source=rss------bug_bounty-5)

Exploit Collector
WordPress Uleak Security Dashboard 1.2.3 Cross Site Scripting

https://3.bp.blogspot.com/-_lYy5AwzHPI/WWlvAVk_lrI/AAAAAAAAIKU/HsTDdKCabVkkHkFsXQw08U72hOmjap5rACLcBGAs/s1600/h121.png
WordPress Uleak Security Dashboard plugin version 1.2.3 suffers from a cross site scripting vulnerability.

MD5 | a6144e85c938898117f92da552acffa1

Download
# Exploit Title: WordPress Plugin uleak-security-dashboard 1.2.3 - Stored Cross-Site Scripting (Authenticated)
# Date: 31-03-2022
# Exploit Author: Hassan Khan Yusufzai - Splint3r7
# Vendor Homepage: https://wordpress.org/plugins/uleak-security-dashboard/ <https:
# Version: 1.2.3
# Tested on: Firefox
# Contact me: h [at] spidersilk.com

# Vulnerable Code:

```
ULeak API Key*:

value="'.$user['apikey'].'">(Insert your ULeak
API Key. Find your Credentials in your profil settings
href="https://uleak.de/profil">here)
```

# POC

1) Install uleak-security-dashboard WordPress Plugin
2) Naviagete to http://localhost/wp-admin/tools.php?page=uleak
3) Inject payload ```">```
in *ULeak API Key*: *filed.
4) XSS will trigger.

# POC Image

https://prnt.sc/D7sq6IlNtNaf

Source:packetstormsecurity.com

Black Hat Ethical Hacking
Offensive Security Tool: Boomerang

Offensive Security Tool: BoomerangPost Views: 7 https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png Reading Time: 2 Minutes

Offensive Security Tool: Boomerang GitHub Link BoomerangWho said cloud servers are secure? A cloud server is only as secure as the company using it. It’s all about how they are set up, like regular servers. When performing assessments such as Bug Bounty or Penetration testing and you have in your scope cloud servers, there are various techniques to perform strong recon and attacks. Exposing the internal servers using tunneling, proxychains which uses the Tor Network, and once done you can perform Pivoting, which is a technique that from one machine you get to expand and take over all the machines on that network.
Boomerang by paranoidninja is a tool to expose multiple internal servers to web/cloud using HTTP+TCP Tunneling. The Server will expose 2 ports on the Cloud. One will be where tools like proxychains can connect over socks, another will be for the agent to connect. The agent can be executed on any internal host. The agent will connect to the server and listen for any connection that can be forwarded to internal machine like a socks server. A more detailed information can be found in the image below. Features like authentication are in pipeline and will be added soon. Agent and Server are pretty stable and can be used in Red Team for Multiple levels of Pivoting and exposing services to external/other networks.
See Also: Recon Tool: PSRecon
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Boomerang_v0.1-1024x415.png
Boomerang Agent and Server support Windows, Linux and Arm architecture
Features in Progress: Proxy Authentication (Use IP Whitelisting for C2s till then)
See Also: Lizard Squad – the infamous hacking group that brought Xbox and PlayStation networks to their knees. https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/unknown-90x90.png Recon Tool: PSRecon18 hours ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/SysWhispers3-90x90.png Offensive Security Tool: SysWhispers31 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/SwaggerHole-90x90.png Recon Tool: SwaggerHole1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/uncover-90x90.png Recon Tool: Uncover2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Fibratus_-90x90.png Offensive Security Tool: Fibratus3 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/animation-scapy-themes-demo-90x90.gif Offensive Security Tool: Scapy4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Red-Teaming-Tactics-and-Techniques-90x90.png Offensive Security Tools Collection: Red Teaming Tactics and Techniques1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/metagoofil-90x90.png Recon Tool: Metagoofil1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/swaks-1-90x90.png Offensive Security Tool: Swaks – Swiss Army Knife for SMTP1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Odin-90x90.png OSINT & Recon Tool: Odin1 month ago
The post Offensive Security Tool: Boomerang first appeared on Black Hat Ethical Hacking.

Dark Reading: Attacks/Breaches
More Than Ever, Security Matters

Public policy proposals must consider technical, practical, and real-world security effects, and make sure we avoid unintended consequences.

Hacking on Medium
DC-4 — VulnHub

https://cdn-images-1.medium.com/max/700/0*2Vgjh3U_25aLxA5j.jpg
Introduction:

Continue reading on System Weakness »

Hacking on Medium
Hacker: você saber definir o que é?

https://cdn-images-1.medium.com/max/960/0*EewX-6xqp9u01bk_.jpg
Muito se fala em hacker, esta é uma daquelas palavras que ficam borbulhando na nossa mente, temos uma noção, mas na hora de explicar para…

Continue reading on Medium »