Hunting for Malicious Binaries and Backdoors in the Running Containers
https://www.reddit.com/r/redteamsec/comments/ttq82i/hunting_for_malicious_binaries_and_backdoors_in/

submitted by /u/tbhaxor (https://www.reddit.com/user/tbhaxor)
[link] (https://tbhaxor.com/hunting-malicious-binaries-in-containers/) [comments] (https://www.reddit.com/r/redteamsec/comments/ttq82i/hunting_for_malicious_binaries_and_backdoors_in/)

auto export burp suite http logs
https://www.reddit.com/r/Pentesting/comments/tts2xp/auto_export_burp_suite_http_logs/

<!-- SC_OFF -->Thank you for reading this post! ​ Does anyone have an idea how I can auto export specific burp suite http logs to a file? I know you can do it for all types of HTTP requests and responses that come in, but I want it only for specific packets. I've tried doing it with Loger++, but it seemingly doesn't support an auto function. ​ Really just whenever I get a certain packet in my http history I want to export it to a file from the moment it appears in the HTTP history and this way create one big file with all the http packets ​ So to summarize: Everytime I get a certain HTTP packet in my HTTP history (only scopes ones), I want the request to be written to a file automatically, not clicking export somewhere. ​ I'd appreciate any answer! <!-- SC_ON --> submitted by /u/Kenshievaaa (https://www.reddit.com/user/Kenshievaaa)
[link] (https://www.reddit.com/r/Pentesting/comments/tts2xp/auto_export_burp_suite_http_logs/) [comments] (https://www.reddit.com/r/Pentesting/comments/tts2xp/auto_export_burp_suite_http_logs/)

Small bugs are more dangerous than you think

Chaining bugs for the winContinue reading on Medium »
Read more...

Hacking on Medium
Top 7 Hacking labs to practice ethical hacking. Complete Guide.

To become proficient in any skill, you need to practice a lot.

Continue reading on Medium »

Hacking on Medium
My Experience About I4G Hackathon

Thank you i4G for this opportunity. The time and resources you have channelled towards developing the youth are laudable. I can’t imagine…

Continue reading on Medium »

KitPloit - PenTest Tools!
Slyther - AWS Security Tool

https://blogger.googleusercontent.com/img/a/AVvXsEg0uvyflfi0Yz3jHoS1KQiwhYnY9s_Ki08PtPo6GhRiqu9Kb3Emsm-W1aqkJapoypIxFHI6pwSr-08bZgqPEnnKweFPuX-kIf3reYu5WMpi51278IYvUxrYkP_48qAz8lJTFh-iwPjS3Jciwo05CrWhooNahmICPItaotxz9mzlb0DwgDpy9Z6roJyQ=w640-h308
Slyther is AWS Security tool to check read/write/delete access for S3 buckets
Requirements

aws-cli

Installation

pip3 install -r requirements.txt

Usage example

python3 slyther.py -b flaws.cloud

Release History

*
0.0.3

* Added option to check if aws-cli is installed or not

*
0.0.2

* Added option to check list of buckets

*
0.0.1

* Initial release

*
Created by – @iamavu
Download Slyther

Small bugs are more dangerous than you think
https://medium.com/@terminatorLM/small-bugs-are-more-dangerous-than-you-think-9411618191ab?source=rss------bug_bounty-5

Chaining bugs for the winContinue reading on Medium » (https://medium.com/@terminatorLM/small-bugs-are-more-dangerous-than-you-think-9411618191ab?source=rss------bug_bounty-5)

Exploit Collector
WordPress Uleak Security Dashboard 1.2.3 Cross Site Scripting

https://3.bp.blogspot.com/-_lYy5AwzHPI/WWlvAVk_lrI/AAAAAAAAIKU/HsTDdKCabVkkHkFsXQw08U72hOmjap5rACLcBGAs/s1600/h121.png
WordPress Uleak Security Dashboard plugin version 1.2.3 suffers from a cross site scripting vulnerability.

MD5 | a6144e85c938898117f92da552acffa1

Download
# Exploit Title: WordPress Plugin uleak-security-dashboard 1.2.3 - Stored Cross-Site Scripting (Authenticated)
# Date: 31-03-2022
# Exploit Author: Hassan Khan Yusufzai - Splint3r7
# Vendor Homepage: https://wordpress.org/plugins/uleak-security-dashboard/ <https:
# Version: 1.2.3
# Tested on: Firefox
# Contact me: h [at] spidersilk.com

# Vulnerable Code:

```
ULeak API Key*:

value="'.$user['apikey'].'">(Insert your ULeak
API Key. Find your Credentials in your profil settings
href="https://uleak.de/profil">here)
```

# POC

1) Install uleak-security-dashboard WordPress Plugin
2) Naviagete to http://localhost/wp-admin/tools.php?page=uleak
3) Inject payload ```">```
in *ULeak API Key*: *filed.
4) XSS will trigger.

# POC Image

https://prnt.sc/D7sq6IlNtNaf

Source:packetstormsecurity.com

Black Hat Ethical Hacking
Offensive Security Tool: Boomerang

Offensive Security Tool: BoomerangPost Views: 7 https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png Reading Time: 2 Minutes

Offensive Security Tool: Boomerang GitHub Link BoomerangWho said cloud servers are secure? A cloud server is only as secure as the company using it. It’s all about how they are set up, like regular servers. When performing assessments such as Bug Bounty or Penetration testing and you have in your scope cloud servers, there are various techniques to perform strong recon and attacks. Exposing the internal servers using tunneling, proxychains which uses the Tor Network, and once done you can perform Pivoting, which is a technique that from one machine you get to expand and take over all the machines on that network.
Boomerang by paranoidninja is a tool to expose multiple internal servers to web/cloud using HTTP+TCP Tunneling. The Server will expose 2 ports on the Cloud. One will be where tools like proxychains can connect over socks, another will be for the agent to connect. The agent can be executed on any internal host. The agent will connect to the server and listen for any connection that can be forwarded to internal machine like a socks server. A more detailed information can be found in the image below. Features like authentication are in pipeline and will be added soon. Agent and Server are pretty stable and can be used in Red Team for Multiple levels of Pivoting and exposing services to external/other networks.
See Also: Recon Tool: PSRecon
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Boomerang_v0.1-1024x415.png
Boomerang Agent and Server support Windows, Linux and Arm architecture
Features in Progress: Proxy Authentication (Use IP Whitelisting for C2s till then)
See Also: Lizard Squad – the infamous hacking group that brought Xbox and PlayStation networks to their knees. https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/unknown-90x90.png Recon Tool: PSRecon18 hours ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/SysWhispers3-90x90.png Offensive Security Tool: SysWhispers31 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/SwaggerHole-90x90.png Recon Tool: SwaggerHole1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/uncover-90x90.png Recon Tool: Uncover2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Fibratus_-90x90.png Offensive Security Tool: Fibratus3 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/animation-scapy-themes-demo-90x90.gif Offensive Security Tool: Scapy4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Red-Teaming-Tactics-and-Techniques-90x90.png Offensive Security Tools Collection: Red Teaming Tactics and Techniques1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/metagoofil-90x90.png Recon Tool: Metagoofil1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/swaks-1-90x90.png Offensive Security Tool: Swaks – Swiss Army Knife for SMTP1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Odin-90x90.png OSINT & Recon Tool: Odin1 month ago
The post Offensive Security Tool: Boomerang first appeared on Black Hat Ethical Hacking.

Dark Reading: Attacks/Breaches
More Than Ever, Security Matters

Public policy proposals must consider technical, practical, and real-world security effects, and make sure we avoid unintended consequences.

Hacking on Medium
DC-4 — VulnHub

https://cdn-images-1.medium.com/max/700/0*2Vgjh3U_25aLxA5j.jpg
Introduction:

Continue reading on System Weakness »

Hacking on Medium
Hacker: você saber definir o que é?

https://cdn-images-1.medium.com/max/960/0*EewX-6xqp9u01bk_.jpg
Muito se fala em hacker, esta é uma daquelas palavras que ficam borbulhando na nossa mente, temos uma noção, mas na hora de explicar para…

Continue reading on Medium »

Hacking on Medium
BUIDLING OUR WEB3 FUTURE

https://cdn-images-1.medium.com/max/1000/1*QLDwFSc4Ge5nVL3_FdFIoQ.jpeg
An engineer turned VC’s perspective on the state of development in the Ethereum ecosystem

Continue reading on Medium »

Hacking on Medium
Jerry — HackTheBox

https://cdn-images-1.medium.com/max/600/1*SVHPCqulD0LgFM0xwa-CIA.png
Introduction:

Continue reading on System Weakness »

Hacking on Medium
How I cleared CEH Practical in my first attempt. How you can too!

https://cdn-images-1.medium.com/max/600/1*AACYGebMqJXYj3jyHaDP7g.png
All about CEH Practical

Continue reading on Medium »

Hacking on Medium
Lockbit, lo que necesitas saber del ransomware que imprime sus extorsiones

https://cdn-images-1.medium.com/max/1764/0*m4tpHL10oVEBhQTo
PUBLICADO EN 1 ABRIL, 2022POR EHACKING

Continue reading on Medium »