Hacking on Medium
Will banning the shame game on hacking victims improve cybersecurity?

https://cdn-images-1.medium.com/max/2600/1*USMXzh-fdAsvQb_bv_LPsA.jpeg
In cybersecurity, you’re never bulletproof. But you don’t have to be defenseless against hackers either — unless you don’t care.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Beyaz şapkalı hacker kiralama gerçekleştirmek

Beyaz şapkalı veya siyah şapkalı olmak üzere temelde ikiye ayrılan hacker platformları sizlere seçenekler sunmaktadır.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
El FBI advierte sobre el ransomware BlackCat que afectó a más de 60 organizaciones en todo el mundo

https://cdn-images-1.medium.com/max/1493/0*I249zpN1xmhT311I
PUBLICADO EN 25 ABRIL, 2022POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Lapsus$: Who, What, Where, Why, How

https://cdn-images-1.medium.com/max/2600/0*pv4i7bUHaBnXFK3K
Lapsus$ (often stylized LAPSUS$, aka DEV-0537) is an extortionist threat group that has made headlines in 2022 due to its large-scale…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
DDexec - A Technique To Run Binaries Filelessly And Stealthily On Linux Using Dd To Replace The Shell With Another Process

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjUkLeCPT7H8zthlXjObbjV5_bDbLbPwe0kvbp-n9TC8INKb4nl3g5qcZy-CQoTGNsgTwVgTqC-LIbsw3Dozoe-bo6yKtOwhCE72d0X3k17WoyIz0wmqX_UqiUuBUBvm54VyYdKLPD-dY6Y_b7qzalFd4A887Ny7fPr2lpwV5xqDKrCKqPsOZKJs-_x/w640-h420/h99.png In Linux in order to run a program it must exist as a file, it must be accessible in some way through the file system hierarchy (this is just how execve()works). This file may reside on disk or in ram (tmpfs, memfd) but you need a filepath. This has made very easy to control what is run on a Linux system, it makes easy to detect threats and attacker's tools or to prevent them from trying to execute anything of theirs at all (e. g. not allowing unprivileged users to place executable files anywhere).

But this technique is here to change all of this. If you can not start the process you want... then you hijack one already existing. UsagePipe into the ddexec.shscript the base64 of the binary you want to run (without newlines). The arguments for the script are the arguments for the program (starting with argv[0]).

Here, try this: base64 -w0 /bin/ls | bash ddexec.sh /bin/ls -lA There is also the ddsc.shscript that allows you to run binary code directly. The following is a "Hello world" shellcode. bash ddsc.sh -x <<or bash ddsc.sh < <(xxd<<And yes. It works with meterpreter.

Tested Linux distributions are Debian, Alpine and Arch. Supported shells are bash, zsh and ash over x86_64 and aarch64 (arm64) architectures. DependenciesThis script depends on the following tools to work. dd bash | zsh | ash (busybox) head tail cut grep od readlink wc tr base64 The techniqueIf you are able to modify arbitrarily the memory of a process then you can take over it. This can be used to hijack an already existing process and replace it with another program. We can achieve this either by using the ptrace()syscall (which requires you to have the ability to execute syscalls or to have gdb available on the system) or, more interestingly, writing to /proc/$pid/mem.

The file /proc/$pid/memis a one-to-one mapping of the entire address space of a process (e. g. from 0x0000000000000000to 0x7ffffffffffff000in x86-64). This means that reading from or writing to this file at an offset xis the same as reading from or modifying the contents at the virtual address x.

Now, we have four basic problems to face:

* In general, only root and the program owner of the file may modify it.
* ASLR.
* If we try to read or write to an address not mapped in the address space of the program we will get an I/O error.

This problems have solutions that, although they are not perfect, are good:

* Most shell interpreters allow the creation of file descriptors that will then be inherited by child processes. We can create a fd pointing to the memfile of the sell with write permissions... so child processes that use that fd will be able to modify the shell's memory.
* ASLR isn't even a problem, we can check the shell's mapsfile or any other from the procfs in order to gain information about the address space of the process.
* So we need to lseek()over the file. From the shell this cannot be done unless using the infamous dd. In more detailThe steps are relatively easy and do not require any kind of expertise to understand them:

* Parse the binary we want to run and the loader to find out what mappings they need. Then craft a "shell"code that will perform, broadly speaking, the same steps that the kernel does up[...]

___________________________
@hacking_Attack
@Hacking_Video

on each call to execve():
* Create said mappings.
* Read the binaries into them.
* Set up permissions.
* Finally initialize the stack with the arguments for the program and place the auxiliary vector (needed by the loader).
* Jump into the loader and let it do the rest (load libraries needed by the program).

* Obtain from the syscallfile the address to which the process will return after the syscall it is executing.
* Overwrite that place, which will be executable, with our shellcode (through memwe can modify unwritable pages).
* Pass the program we want to run to the stdin of the process (will be read()by said "shell"code).
* At this point it is up to the loader to load the necessary libraries for our program and jump into it.

Oh, and all of this must be done in shell scripting, or what would be the point? ContributeWell, there are a couple of TODOs. Besides this, you may have noticed that I do not know much about shell scripting (I am more of a C programmer) and I am sure I must have won a decade worth of "useless use of an echo" awards and the rest of variants just with a fraction of this project.

* Improve code style and performance.
* Port to other shells.
* Allow run the program with a non-empty environment.

Anyway, all contribution is welcome. Feel free to fork and PR. CreditRecently I have come to know that Sektor7 had already published this almost-exact same technique on their blog a few years ago.

Despite this, I thought this technique independently in, now almost, its entirety. Probably the smarter piece of this technique is the use of the inherited file descriptor, idea provided by David Buchanan (inspired, I think, by Sektor7's blog) almost a year before I even started thinking about this topic. This alone not only makes the technique much simpler and neat, it also makes it far deadlier by eliminating the need to disable ASLR. His tweet also made me realize how stupid I was for not noticing that memallowed to write to non-writable pages, hence making the ROP unnecessary... This ultimately also has the desired effect of making this significantly easier to port to other ISAs.

Either way, I hope I will be able to spread this technique much further, which is what matters.

I would like to thank Carlos Polop, a great pentester and better friend, for making me think about this subject, and for his helpful feedback and interest, oh and the name of the project. I am sure that if you are reading this you have already used his awesome tool PEASS and found helpful some article in his book HackTricks. I also thank him for helping me with the talk at the RootedCon 2022. Now what?This technique can be prevented in several ways.

* Not installing dd(maybe even go distroless?).
* Placing ddwhere only root can run it.
* Using a kernel compiled without support for the memfile. Questions? Death threats?Feel free to send me an email to arget@protonmail.ch. Download DDexec

___________________________
@hacking_Attack
@Hacking_Video

Improper cookie not expiring after logged out!
https://medium.com/@mujios101/improper-cookie-not-expiring-after-logged-out-ba43e9033459?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

hey folks! Im Mujibur Rahman from chennai and I’m a security researcherContinue reading on Medium » (https://medium.com/@mujios101/improper-cookie-not-expiring-after-logged-out-ba43e9033459?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

The time I hacked a Fortune 500 company, but it was out of scope.
https://hustlebunny.medium.com/the-time-i-hacked-a-fortune-500-company-but-it-was-out-of-scope-3837069354bc?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hi :) thanks for taking some time to read my blog post. This is a short post about a bug I found during my testing of a Fortune 500…Continue reading on Medium » (https://hustlebunny.medium.com/the-time-i-hacked-a-fortune-500-company-but-it-was-out-of-scope-3837069354bc?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress ScrollReveal.js Effects 1.1.1 Cross Site Scripting

https://2.bp.blogspot.com/-x_QP5QrO-tY/WWlvkxoh72I/AAAAAAAAIQ4/t-2dHNJyeE0-qZNxsCg7sgdho_ipgPgbgCLcBGAs/s1600/h98.png
WordPress ScrollReveal.js Effects plugin version 1.1.1 suffers from a persistent cross site scripting vulnerability.

SHA-256 | f800608c7b194924e95a7c7384d8c6cfc72b83e0e53783ec418dd1ccd53766ac

Download
# Exploit Title: WordPress Plugin ScrollReveal.js Effects - Stored Cross Site Scripting
# Date: 25-04-2022
# Exploit Author: Mariam Tariq - Hunt3rsherlock_
# Vendor Homepage: https://wordpress.org/plugins/scrollrevealjs-effects/
# Version: 1.1.1
# Tested on: Firefox
# Contact me: mariamtariq404@gmail.com
# Vulnerable Code:
```

```
# POC
1. Install ScrollReveal.js Effects WordPress plugin and activate.
2. Go to configuration and on vFactor field inject XSS payload “>
onerror=alert(‘’XSS>
3. XSS will trigger.

## PoC Image
https://imgur.com/a/uQRT2mD
https://imgur.com/1BB80ep

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Delier Tim isimli Hacker grubu İlker Zorlu isimli bahis baronunu hedef aldı, Tüm bilgileri ele geçti

submitted by /u/sansizadam
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video