Black Hat Ethical Hacking
Attackers are abusing Spring4Shell vulnerability to spread Mirai botnet malware

___________________________
@hacking_Attack
@Hacking_Video

Some insights into offensive security from ex Facebook red teamer
https://www.reddit.com/r/redteamsec/comments/u1usmc/some_insights_into_offensive_security_from_ex/

Recently recorded this podcast with a CTO in cybersecurity (my boss) and a former offensive security engineer at Facebook (currently enterprise architect at ReliaQuest) about red teaming and offensive security. There is some interesting insight into ethical red teaming, internal vs external teams and getting the business on board with the whole process. Give it a listen if you'd like. https://open.spotify.com/episode/1BuzVj8Md3K4O7OAkuHrdM submitted by /u/AgentLessBots (https://www.reddit.com/user/AgentLessBots)
[link] (https://www.reddit.com/r/redteamsec/comments/u1usmc/some_insights_into_offensive_security_from_ex/) [comments] (https://www.reddit.com/r/redteamsec/comments/u1usmc/some_insights_into_offensive_security_from_ex/)

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Scanmycode-Ce : Code Scanning/SAST/Static Analysis/Linting Using Many tools/Scanners

Scanmycode-Ce is a Code Scanning/SAST/Static Analysis/Linting solution using many tools/Scanners with One Report. You can also add any tool to it. Currently, it supports many languages and tech stacks. Similar to SonarQube, but it is different.
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEijvC5L7aWx6NtnZoBSu92JqTwyeHo6wy5ZD8Dj5NDKY6w_lo39RDaf1mqK3scw3a1QmCAcNbkYIhvKdavImGuYmuxxjScbSGrQu350DXG_5P2FfMMID7C-fj4vP3-SIMNmgxOUfR-LHAa3ipNqdO-9ALQXMYCT-9Pu3voJlpL6C84WPjucOVmafjxB/s441/155940853-04cb916d-658b-48e1-bae9-959af96fd2ba.png TLDRTo install it. Install dockerand docker-composeand then:

2 options

* Fastest (use DockerHub built images). If unsure, use this.

git clone https://github.com/marcinguy/scanmycode-ce.git
cd scanmycode-ce/dockerhub
./start.sh

* Slower (build everything)

git clone https://github.com/marcinguy/scanmycode-ce.git
cd scanmycode-ce/docker
./start.sh

Go in the Browser to: http://localhost:5000Sign up locally (and login in when needed) Under the hoodProgpilot, PMD, Bandit, Brakeman, Gosec, confused, semgrep, trufflehog3, jshint, log4shell via custom semgrep rule and other(s). Some were modified. Recorded DEMOCommunity Edition does not have GitHub support and other plugins. But rest is the same.
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEirYSqyHppvN1_NQclyaMGyGccgkc5qmd1OCgn0SCb_aotPHO0i64Q7qFpSN2pFpb_p9akAYmQa5ZxsAZObyl4--YN84yhu3ypJ3tlMbr9WOvrf2_zFQQq8Cofav0UbXmxaAt2p-V5OHXoySuJ3jW-72m01CTU7ckZzm-J8ImOcxXuBvKgr3SOPKsoD/s1814/152678316-04fdcd54-73e8-42f8-9bf2-fb9a69618ff9.gif How is Scanmycode different than SonarQube?Both use static analysis to find bugs and defects, but there are a few differences.

* Scanmycode can be extended with any tool producing JSON output (any binary, in any technology/language/product). That’s the biggest difference.
* Scanmycode is Open Source, SonarQube also offers an open-source version, but it is missing features (For example, 12 of the supported languages are not available in the open-source offering, and more powerful dataflow features are only available in the paid versions)
* Scanmycode supports scanning only changed files (differential analysis), SonarQube does not
* Scanmycode uses also semgrep as one of the tools (without semgrep community rules, only Scanmycode’s custom rules)

Below are semgrep’s (also Scanmycode advantages over SonarQube):

“Extending Semgrep with custom rules is simple, since Semgrep rules look like the source code you’re writing. Writing custom rules with SonarQube is restricted to a handful of languages and requires familiarity with Java and abstract syntax trees (ASTs).”

“Semgrep focuses on speed and ease-of-use, making analysis possible at up to 20K-100K loc/sec per rule. SonarQube authors report approximately 0.4K loc/sec for rulesets in production.”

Source: semgrep’s website Welcome to Scanmycode CE (Community Edition)!Scanmycode is based on QuantifedCode. QuantifiedCode is a code analysis & automation platform. It helps you to keep track of issues and metrics in your software projects, and can be easily extended to support new types of analyses. The application consists of several parts:

* A frontend, realized as a React.js app
* A backend, realized as a Flask app, that exposes a REST API consumed by the frontend
* A background worker, realized using Celery, that performs the code analysis

Currently supports: PHP, Java, Scala, Python, Ruby, Javascript, GO, Secret Scanning, Dependency Confusion, Trojan Source, Open Source and Proprietary Checks (total ca. 1000 checks)

Advantages:

* Many tools, one report (unification)
* Dismiss, collaborate on findings. Mark false-positives
* Enable/disable each individual check in Che[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Master_Librarian : A Tool To Audit Unix/*BSD/Linux System Libraries To Find Public Security Vulnerabilities

Master_Librarian is a simple tool to audit Unix/*BSD/Linux system libraries to find public security vulnerabilities.

To install requirements:

$ sudo python3 -m pip install -r requirements.txt

Overview:

$ python3 master_librarian.py -h
Master librarian v0.3
Tool to search public vulnerabilities on local libraries
by CoolerVoid
Example:
$ python3 master_librarian.py -t csv
$ python3 master_librarian.py -t txt -l 3
usage: master_librarian.py [-h] -t TYPES [-l LIMIT]
optional arguments:
-h, –help show this help message and exit
-t TYPES, –type TYPES
Name of output type for logs(txt or csv)
-l LIMIT, –limit LIMIT
Limit CVEs per pages in nvd NIST search(default is 3)

Example:

$ python3 master_librarian.py -t txt

output

Master librarian v0.3
Tool to search public vulnerabilities on local libraries
by CoolerVoid
Example:
$ python3 master_librarian.py -t csv
$ python3 master_librarian.py -t txt -l 3
Master librarian v0.3
Tool to search public vulnerabilities on local libraries
by CoolerVoid
Search pitfalls in operational system local packages
xres 1.2.0
cairo-ps 1.16.0
xf86vidmodeproto 2.3.1
libcrypto 1.1.1f
damageproto 1.2.1
libffi 3.3
xfixes 5.0.3
Integer overflow in X.org libXfixes before 5.0.3 on 32-bit platforms might allow remote X servers to gain privileges via a length value of INT_MAX, which triggers the client to stop reading data and get out of sync.
https://nvd.nist.gov/vuln/detail/CVE-2016-7944
7.5 HIGH
system.web.extensions.design_1.0 1.0.61025.0
kbproto 1.0.7
gio-unix-2.0 2.64.6
gdk-x11-2.0 2.24.32
sqlite3 3.31.1
cairo-png 1.16.0
libpcre2-posix 10.34
wcf 6.8.0.105
dmxproto 2.3.1
cairo-script 1.16.0
xext 1.3.4
x11 1.6.9
system.web.mvc 1.0.0.0
mono-cairo 6.8.0.105
cecil 6.8.0.105
udev 245
The default configuration of udev on Linux does not warn the user before enabling additional Human Interface Device (HID) functionality over USB, which allows user-assisted attackers to execute arbitrary programs via crafted USB data, as demonstrated by keyboard and mouse data sent by malware on a smartphone that the user connected to the computer.
https://nvd.nist.gov/vuln/detail/CVE-2011-0640
6.9 MEDIUM
plymouth-pretrigger.sh in dracut and udev, when running on Fedora 13 and 14, sets weak permissions for the /dev/systty device file, which allows remote authenticated users to read terminal data from tty0 for local users.
https://nvd.nist.gov/vuln/detail/CVE-2010-4176
4.0 MEDIUM
xkeyboard-config 2.29
bash-completion 2.10
yelp-xsl 3.36.0
xdamage 1.1.5
libgdiplus 6.0.4
icu-uc 66.1
xcomposite 0.4.5
harfbuzz 2.6.4
pixman-1 0.38.4
pthread-stubs 0.4
systemd 245
An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.
https://nvd.nist.gov/vuln/detail/CVE-2020-13529
2.9 LOW
systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.
https://nvd.nist.gov/vuln/detail/CVE-2020-13776
6.2 MEDIUM
A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.
https://nvd.nist.gov/vuln/detail/CVE-2020-1712
4.6 MEDIUM
expat 2.2.9
pangocairo 1.44.7
xdmcp 1.1.3
libpcreposix [...]

___________________________
@hacking_Attack
@Hacking_Video

ckers
* ca. 1000 checks now (Linters, Static Code Analysis/Code Scanning)
* any tool outputting JSON can be added
* fast (checks only new code on recheck)
* Git support (HTTPS/TLS and SSH). For private repositories only SSH.
* all REST API callable (CI/CD integrateable)
* Swiss army knife tool/SIEM for Code Scanning
* 100% Code transparency & full control of your code InstallationWe provide several options for installing Scanmycode. Which one is the right one for you depends on your use case.

* The manual installation is best if you want to modify or change Scanmycode
* The Docker-based installation is probably the easiest way to try Scanmycode without much work
* The Ansible-based installation is the most suitable way if you want to run Scanmycode in a professional infrastructure (possibly with multiple servers)

The following section will only discuss the manual installation process, for the other options please check their corresponding repositories. Manual InstallationThe installation consists of three parts:

* Install the dependencies required to run Scanmycode
* Download the required source code
* Set up the configuration Installing DependenciesScanmycode requires the following external dependencies:

* A message broker (required for the background tasks message queue). We recommend either RabbitMQ or Redis.
* A database (required for the core application). We recommend PostgreSQL, but SQLite is supported as well. Other database systems might work too (e.g. MySQL), but are currently not officially supported. If you need to run Scanmycode on a non-supported database, please get in touch with us and we’ll be happy to provide you some guidance. Download the Scanmycode CE source codeNow with the dependencies installed, we can go ahead and download Scanmycode: git clone https://github.com/marcinguy/scanmycode-ce.gitInstall the required Python packagesScanmycode CE manages dependencies via the Python package manager, pip. Edit SettingsScanmycode gets configured via YAML settings files. When starting up the application, it incrementally loads settings from several files, recursively updating the settings object. First, it will load default settings from quantifiedcode/settings/default.yml. Then, it will check if a QC_SETTINGSenvironment variable is defined and points to a valid file, and if so it will load settings from it (possibly overwriting default settings). If not, it will look for a settings.ymlfile in the current working directory and load settings from there. Additionally, it will check if a QC_SECRETSenvironment variable is defined and points to a valid file, and also load settings from there (this is useful for sensitive settings that should be kept separate from the rest [e.g. to not check them into version control]).

There is a sample settings.ymlfile in the root of the repository that you can start from. Running the SetupAfter editing your settings, run the setup command via

#run from the root directory of the repository
python manage.py setup

The setup assistant will iteratively walk you through the setup, and when finished you should have a working instance of Scanmycode! Running the web applicationTo run the web application, simply run python manage.py runserverRunning the background workerTo run the background worker, simply run python manage.py runworkerDownload

___________________________
@hacking_Attack
@Hacking_Video

8.39
ruby-2.7 2.7.0
glib-2.0 2.64.6
gnome-system-tools 3.0.0
xinerama 1.1.4
nunit 2.6.3
gmp 6.2.0
libevent 2.1.11-stable
xbuild12 12.0
xorg-sgml-doctools 1.11
presentproto 1.2
gdk-pixbuf-2.0 2.40.0
inputproto 2.3.2
libssl 1.1.1f
xcb-shm 1.14
gdk-2.0 2.24.32
libpng16 1.6.37
bigreqsproto 1.1.2
icu-io 66.1
xextproto 7.3.0
libthai 0.1.28
libbsd-overlay 0.10.0
mount 2.34.0
gio-2.0 2.64.6
adwaita-icon-theme 3.36.1
fontconfig 2.13.1
xrandr 1.5.2
monosgen-2 6.8.0.105
mono 6.8.0.105
xf86dgaproto 2.1
dri3proto 1.2
libpcre 8.39
pangoxft 1.44.7
blkid 2.34.0
libsepol 3.0
libevent_openssl 2.1.11-stable
uuid 2.34.0
gmodule-2.0 2.64.6
graphite2 3.0.1
libfl 2.6.4
zlib 1.2.11
cairo-pdf 1.16.0
ruby 2.7.0
Addressable is an alternative implementation to the URI implementation that is part of Ruby’s standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input, but nonetheless, no previous security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected. The vulnerability is patched in version 2.8.0. As a workaround, only create Template objects from trusted sources that have been validated not to produce catastrophic backtracking.
https://nvd.nist.gov/vuln/detail/CVE-2021-32740
5.0 MEDIUM
An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.
https://nvd.nist.gov/vuln/detail/CVE-2020-10933
5.0 MEDIUM
libevent_extra 2.1.11-stable
system.web.mvc3 3.0.0.0
libstartup-notification-1.0 0.12
mono-2 6.8.0.105
mono-nunit 2.6.3
gobject-2.0 2.64.6
glproto 1.4.17
cairo-ft 1.16.0
cairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free function incompatible with WebKit’s fastMalloc, leading to an application crash with a “free(): invalid pointer” error.
https://nvd.nist.gov/vuln/detail/CVE-2018-19876
4.3 MEDIUM
xcb 1.14
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application’s unrestricted use of the render method and providing a .. (dot dot) in a pathname.
https://nvd.nist.gov/vuln/detail/CVE-2016-0752
5.0 MEDIUM
fribidi 1.0.8
xtrans 1.4.0
cairo-xlib-xrender 1.16.0
mono-lineeditor 0.2.1
xcmiscproto 1.2.2
gmodule-no-export-2.0 2.64.6
dri2proto 2.8
python3-embed 3.8
libpcre32 8.39
system.web.mvc2 2.0.0.0
dotnet 6.8.0.105
iso-codes 4.4
fontutil 1.3.1
xbitmaps 1.1.1
system.web.extensions_1.0 1.0.61025.0
recordproto 1.14.2
resourceproto 1.2.0
mobile-broadband-provider-info 20190618
videoproto 2.3.3
libevent_core 2.1.11-stable
fontsproto 2.1.3
xsp-4 4.2
python3 3.8
In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The ._pth file (e.g., the python._pth file) is not affected.
https://nvd.nist.gov/vuln/detail/CVE-2020-15801
7.5 HIGH
In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases where CPython is embedded in a native application. This occurs because python3X.dll may use an invalid search path for python3.dll loading (after Py_SetPath has been used). NOTE: this issue C[...]

___________________________
@hacking_Attack
@Hacking_Video

ANNOT occur when using python.exe from a standard (non-embedded) Python installation on Windows.
https://nvd.nist.gov/vuln/detail/CVE-2020-15523
6.9 MEDIUM
xineramaproto 1.2.1
xcb-render 1.14
libpcre2-32 10.34
libbsd-ctor 0.10.0
libbsd 0.10.0
nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab).
https://nvd.nist.gov/vuln/detail/CVE-2019-20367
6.4 MEDIUM
xft 2.3.3

Tested in Ubuntu Linux, Fedora Linux and FreeBSD.

The purpose of this tool is to use in local pentest, take attention if you have a proper authorization before to use that. I do not have responsibility for your actions. You can use a hammer to construct a house or destroy it, choose the law path, don’t be a bad guy, remember. Download

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe: Kenobi

https://cdn-images-1.medium.com/max/600/1*_RwlH99OQZGZtCpRQsd0CA.jpeg
Task 1: Deploy the vulnerable machine

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
IDOR (Insecure Direct Object Reference) leads to listing all valid Users and edit their Profiles

https://cdn-images-1.medium.com/max/1335/1*txwAxko-DnEO37W3t8Z4FQ.png
Hello friends :) 
I am happy to write a blog again after finding an Insecure Direct Object Reference Vulnerability in Drexel University…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Resources & Learning Paths collections (Part-2)

https://cdn-images-1.medium.com/max/1280/0*W3Z5B9Xsg9QGaJuJ
This is Part 2 where we talk about Github Repositories which helps you to know about the Cybersecurity and other stuffs.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Build a SOC LAB
https://www.reddit.com/r/Pentesting/comments/u1x0bs/build_a_soc_lab/

Hey guys! I have a project where i need to build a LAB for a SOC (security operation center) with infra as code (vagrant) and then launch some attacks on it and investigate their behavior's with Splunk. So i would like from peoples that already worked or have expérience in this, if you Can recommand some good ressources that will help me see some examples of SOC architectures that i Can deploy and some interesting attacks to investigate. Cheers submitted by /u/Adel_Maestro (https://www.reddit.com/user/Adel_Maestro)
[link] (https://www.reddit.com/r/Pentesting/comments/u1x0bs/build_a_soc_lab/) [comments] (https://www.reddit.com/r/Pentesting/comments/u1x0bs/build_a_soc_lab/)

___________________________
@hacking_Attack
@Hacking_Video

XSS - The LocalStorage Robbery
https://shahjerry33.medium.com/xss-the-localstorage-robbery-d5fbf353c6b0?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Summary :Continue reading on Medium » (https://shahjerry33.medium.com/xss-the-localstorage-robbery-d5fbf353c6b0?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Immunefi Matching Bug Bounty Program: Renewal and Expansion
https://medium.com/nexus-mutual/immunefi-matching-bug-bounty-program-renewal-and-expansion-61f820a4275e?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Nexus Mutants recently approved the renewal and expansion of the Immunefi matching bug bounty program by a unanimous vote. Funding for the…Continue reading on Nexus Mutual » (https://medium.com/nexus-mutual/immunefi-matching-bug-bounty-program-renewal-and-expansion-61f820a4275e?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Nexus Mutual Community Renews Bounty Matching Program With $600k War Chest
https://medium.com/immunefi/nexus-mutual-community-renews-bounty-matching-program-with-600k-war-chest-1f4f4a5751d2?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video