[2/3] XSS Through The Front-Door @ Gitlab
https://medium.com/@_ip_/2-3-xss-through-the-front-door-gitlab-fc4b6799e743?source=rss------bug_bounty-5

Sometimes XSS flaws are met with shrugs. They’re an incredibly common vulnerability in web applications even today with so many…Continue reading on Medium » (https://medium.com/@_ip_/2-3-xss-through-the-front-door-gitlab-fc4b6799e743?source=rss------bug_bounty-5)

Hacking on Medium
[2/3] XSS Through The Front-Door @ GitLab

https://cdn-images-1.medium.com/max/800/1*de5guCEw-0tGSIkn33E2NA.jpeg
Sometimes XSS flaws are met with shrugs. They’re an incredibly common vulnerability in web applications even today with so many…

Continue reading on Medium »

Hacking on Medium
Control other PC by Sending a Single Link

https://cdn-images-1.medium.com/max/600/1*ofT7J895cyLjoDEl7ixMVA.jpeg
July 29, 2021

Continue reading on Medium »

Hacking on Medium
Earning $$$ without any hacking, Most interesting OTP Bypass

https://cdn-images-1.medium.com/max/2436/1*8PHY875ml1O7m_54f0nlcA.png
Want to see how i managed to get OTP Bypass without any hacking ? Give it a shot and read my story!

Continue reading on InfoSec Write-ups »

[2/3] XSS Through The Front-Door @ GitLab

Sometimes XSS flaws are met with shrugs. They’re an incredibly common vulnerability in web applications even today with so many…Continue reading on Medium »
Read more...

https://b.thumbs.redditmedia.com/251fHwAyAp-_saC0ZujVKWymy4x2Z2UfM6d-M5QvkRA.jpg submitted by /u/rjandali
[link] [comments]

hacking: security in practice
How we hacked the kicksharing

https://external-preview.redd.it/dBjycHv9bFFFUMpG3VXtCPrIJO9Fups_EQnHhB8mco8.jpg?width=640&crop=smart&auto=webp&s=3e1ae398760a61c180e91a89fb78b2e3b29b929e submitted by /u/pimterry
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Internal AWS credentials swiped by researcher via SQL payload

Internal AWS credentials swiped by researcher via SQL payloadPost Views: 24
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/patreon-300x61.png Advanced Enumeration techniques with NMAP, Zenmap and Hydra

Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes
A security researcher said they seized credentials for an internal AWS service by exploiting a local file read vulnerability on a Relational Database Service (RDS) EC2 instance.
Credit for the discovery goes to Gafnit Amiga, director of security research at Israeli cloud security firm Lightspin, who told The Daily Swig that the research was noteworthy “because the final payload is all SQL commands”.

The impact was obscured by the fact AWS declined to divulge the purpose or implementation of the vulnerable internal service, but it did tell Amiga that any abuse would not have imperilled customer data.

While recognizing the appeal of AWS services, the finding showed that “wrapping third-party services such as PostgreSQL and trying to provide users with advanced features is sometimes a double-edged sword”, said Amiga.

AWS has comprehensively addressed the vulnerability and said it had found no evidence of hostile exploitation, according to the researcher. Path to the breakthroughAmiga began the research by spinning up an RDS instance using the Amazon Aurora PostgreSQL engine and connecting to the database using psql, according to a blog post documenting the process.

She set out to access the underlying machine running PostgreSQL, “so I searched for something that will allow me to run OS commands, send network requests or read local files,” the researcher explained.
See Also: Complete Offensive Security and Ethical Hacking Course
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png
“After trying all simple known techniques, I decided to go over the extensions.”

RDS supports many extensions for PostgreSQL, “but I felt that the chances they will miss something there are higher because it is not that simple to do a secure integration to a third-party code”, she continued.

The researcher examined the functionality of 8-10 such extensions and the objects they created within Postgres before alighting on one that yielded a potential breakthrough: log_fdw. Bypassing validationUsing the log_fdw extension, Amiga attempted a path traversal when creating a foreign table, but this prompted an exception saying “the log file path specified was invalid”.

After testing another relative path, she identified the source of the error as a validation function.

AWS created a custom foreign data wrapper – which can obtain data from external files – for log_fdw with handler and validator functions.

A potential breakthrough arose when it transpired that the validator function is optional for foreign data.
See Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH Amiga potentially had permission to update the validator function using the rds_superuser role. “I just hoped that they validate the path only in the validation function,” she said.

This hope was fulfilled when the researcher dropped the validator function and the path traversal succeeded.

She then found temporary identity and access management (IAM) credentials at csd-grover-credentials.json, comprising a publicKey and privateKey, that turned out to be connected to an internal role by the name of csd-grover-role.

Amiga was then able to discover and access a corresponding internal, ‘Grover’ service. See Also: Offensive Security Tool: Scapy
The vulnerability was reported to AWS on December 9. AWS applied an initial patch [...]

___________________________
@hacking_Attack
@Hacking_Video

for recent versions of RDS and Aurora PostgreSQL engines on December 14, then confirmed on March 22 that all current supported versions were fixed and that potentially affected customers had been given mitigation instructions. Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
See Also: Hacking stories: MafiaBoy, the hacker who took down the Internet
Source: portswigger.net Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/spring4shell-90x90.jpg Attackers are abusing Spring4Shell vulnerability to spread Mirai botnet malware1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/ezgif.com-gif-maker-2-1-90x90.jpg Attackers Spoof WhatsApp Voice-Message Alerts to Steal Info2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/f956-article-211015-apple-body-text-90x90.jpg Apple paid out $36,000 bug bounty for HTTP request smuggling flaws5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/3e41-article-210226-vmware-body-text-90x90.jpg VMware warns of critical vulnerabilities in multiple products6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/A-New-Borat-RAT-Capable-Of-Conducting-Ransomware-DDOS-Activities-90x90.png No-Joke Borat RAT Propagates Ransomware, DDoS1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/php-pear-hacked-packages-malware-90x90.png Supply chain flaws in PHP package manager PEAR lay undiscovered for 15 years1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/php-hack-90x90.jpg PHP bug allows attackers to bypass domain filters, stage DoS attacks against servers1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/apple-iphone-hacking-90x90.jpg Apple emergency update fixes zero-days used to hack iPhones, Macs2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Google-Campus-90x90.jpg Google Chrome Bug Actively Exploited as Zero-Day2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/685f-article-211221-chrome-site-isolation-body-text-90x90.jpg HTML parser bug triggers Chromium XSS security flaw2 weeks ago
The post Internal AWS credentials swiped by researcher via SQL payload first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
BEST WAY TO HACK YOUR HUSBAND CELLPHONE WITHOUT HIM KNOWING

As a wife, you will be curious who your husband is always texting and chatting with online. If he is prone to do this, you will need hard…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Start learn pentesting/hacking. The Red Team

Useful materials for those who starting to learn pentesting/hacking. All materials checked by myself.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How hackers impersonate email-id’s : Email Spoofing and Phishing Attacks

https://cdn-images-1.medium.com/max/960/1*bNTMMFDZgG-McLeQx_qbwg.jpeg
Email Spoofing is a cyberattack where the attacker impersonates emails. It is a common tactic for carrying phishing attacks and spamming.

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Clickjacking: Think twice before you click!

https://cdn-images-1.medium.com/max/2600/0*6zDBT_8yOk6JChJD
You receive a link to a website that sells really cheap villas in Mexico. Who doesn’t want a cheap estate in Mehico? But what catches your…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Melody - A Transparent Internet Sensor Built For Threat Intelligence
http://www.kitploit.com/2022/04/melody-transparent-internet-sensor.html

___________________________
@hacking_Attack
@Hacking_Video

Melody Monitor the Internet's background noiseMelody is a transparent internet sensor built for threat intelligence (https://www.kitploit.com/search/label/Threat%20Intelligence) and supported by a detection rule framework which allows you to tag packets of interest for further analysis and threat monitoring.
Features Here are some key features of Melody : Transparent capture Write detection rules and tag specific packets to analyze them at scale Mock vulnerable (https://www.kitploit.com/search/label/Vulnerable) websites using the builtin HTTP/S server Supports the main internet protocols over IPv4 and IPv6 Handles log rotation for you : Melody is designed to run forever on the smallest VPS Minimal configuration required Standalone mode : configure Melody using only the CLI Easily scalable : Statically compiled binary Up-to-date Docker image Wishlist Since I have to focus on other projects right now, I can't put much time in Melody's development. There is a lot of rom for improvement though, so here are some features that I'd like to implement someday : Dedicated helper program to create, test and manage rules -> Check Meloctl in cmd/meloctl Centralized rules management Per port mock application Use cases Internet facing sensor Extract trends and patterns from Internet's noise Index malicious activity, exploitation (https://www.kitploit.com/search/label/Exploitation) attempts and targeted scanners Monitor emerging threats exploitation Keep an eye on specific threats Stream analysis Build a background noise profile to make targeted attacks stand out Replay captures to tag malicious packets in a suspicious stream Preview

___________________________
@hacking_Attack
@Hacking_Video