hacking: security in practice
How to further exploit this SQLi?

Hey, anyone know if/how I could further exploit this SQLi?

I found a blind SQLi on a project I was testing and I already confirmed I have a blind SQLi, but the problem is it's on the ORDER BY field. Query that's being executed (some names changed for anonymity sake):

SELECT table.* FROM db_table table WHERE 1 AND type = 'S' ORDER BY timestamp DESC LIMIT 100

My injection point is the "DESC", I can control that. I was trying to escalate it to RCE by writing to the server, but I'm not sure if it's possible within this point in the query.

What do you guys think, have any ideas?

submitted by /u/real900
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Can I get any sort of malware from simply opening an email?

Clarification: I don't mean clicking on any URLs once I'm inside the email. I am curious if the simple act of clicking on an email to read its contents can somehow install malware of any form.

submitted by /u/MeesterMoo74
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Google Emergency Update Fixes Chrome Zero-Day

Google patches a critical flaw in its Chrome browser, bringing its count of zero-day vulnerabilities fixed in 2022 to four.

Hacking on Medium
Revolax F

Accurate filler supply is the only online shop where you can buy quality dermal filler and botox at cheap prices online, with express…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Pickle Rick

https://cdn-images-1.medium.com/max/1920/1*COTutaq6FqKqr1HWpuSvcg.jpeg
“This Risk and Morty themed challenge requires you to exploit a Webserver to find 3 ingredients that will help Risk make his option to…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Kenobi

https://cdn-images-1.medium.com/max/936/1*JF-PE86ER_4dYfnM-yVKqw.png
“Walkthrough on exploiting a Linux machine. Enumerate Samba for shares, manipulate a vulnerable version of proftpd and escalate your…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What is the best way to research a digital picture from a potential scammer?

In brief, I believe my mother is being scammed by some dude that claims to be on an oil rig in the Gulf of Mexico. He has never met her or spoken to her, only chats via Google Hangouts. He is offering to pay for her to move in with him in Florida, and has sent a photo. Would love some advice on how to verify this person whether authentic or not.

submitted by /u/IGPANS
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Nmap scanning nearly all ports as open

I've downloaded a box from a random Twitter post. I got it running in virtualbox and when i Nmapped it, it's showing almost all ports as open. Thinking that it might be a joke, I assumed that I could connect to any service. So I tried ftp,telnet,ssh,etc. and on all of the services.

But everytime, no matter what service you try to connect to, it says "Connection reset". Even the goddamn http service.

I further considered this to be an error and I reset the machine and booted it again but still the same problem.

I looked it up and found that this was either Portspoofing or I'm hitting a well configured IDS/Firewall.

How do I get around this problem? More specifically, how do I automate the process of verification of the services and see if it's really up?

Thanks in advance.

submitted by /u/h4cks1n
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Upgrades for Spring Framework Have Stalled

Upgrading and fixing the vulnerability in the Spring Framework doesn't seem to have the same level of urgency or energy as patching the Log4j library did back in December

Creating Your Own Telegram Bot For Recon Bug Bounty

Hello Friends this is my fourth blog regarding bug huntingContinue reading on Medium »
Read more...

Creating Your Own Telegram Bot For Recon Bug Bounty
https://santoshdbobade.medium.com/creating-your-own-telegram-bot-for-recon-bug-bounty-8c3fd3dfcbcf?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello Friends this is my fourth blog regarding bug huntingContinue reading on Medium » (https://santoshdbobade.medium.com/creating-your-own-telegram-bot-for-recon-bug-bounty-8c3fd3dfcbcf?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Change Any User Profile Details on Disney
https://rashahacks.medium.com/change-any-user-profile-details-on-disney-837ab3a5d1bb?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

The Walt Disney Company started its program on Hackerone in March 2022.Continue reading on Medium » (https://rashahacks.medium.com/change-any-user-profile-details-on-disney-837ab3a5d1bb?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Change Any User Profile Details on Disney

The Walt Disney Company started its program on Hackerone in March 2022.Continue reading on Medium »
Read more...

Hacking on Medium
Introduction || Ethical Hacking — Part 1.1

https://cdn-images-1.medium.com/max/1282/1*DMH9Z9rTErtFBo2YID_CTQ.gif
If you have not read the first part check it here:
https://viruszzwarning.medium.com/the-basic-idea-ethical-hacking-series-1-6ea4c3799993

Continue reading on System Weakness »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe: [Day 14] Networking Dev(Insecure)Ops

https://cdn-images-1.medium.com/max/1920/1*psaTaSfd9sQyajFeYTLO-w.png
How many pages did the dirb scan find with its default wordlist?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Change Any User Profile Details on Disney

https://cdn-images-1.medium.com/max/600/0*PqZzaukAh4ZdOow9
The Walt Disney Company started its program on Hackerone in March 2022.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

OSWE Review 2022
https://www.reddit.com/r/Pentesting/comments/u4sp0i/oswe_review_2022/

___________________________
@hacking_Attack
@Hacking_Video