on each call to execve():
* Create said mappings.
* Read the binaries into them.
* Set up permissions.
* Finally initialize the stack with the arguments for the program and place the auxiliary vector (needed by the loader).
* Jump into the loader and let it do the rest (load libraries needed by the program).

* Obtain from the syscallfile the address to which the process will return after the syscall it is executing.
* Overwrite that place, which will be executable, with our shellcode (through memwe can modify unwritable pages).
* Pass the program we want to run to the stdin of the process (will be read()by said "shell"code).
* At this point it is up to the loader to load the necessary libraries for our program and jump into it.

Oh, and all of this must be done in shell scripting, or what would be the point? ContributeWell, there are a couple of TODOs. Besides this, you may have noticed that I do not know much about shell scripting (I am more of a C programmer) and I am sure I must have won a decade worth of "useless use of an echo" awards and the rest of variants just with a fraction of this project.

* Improve code style and performance.
* Port to other shells.
* Allow run the program with a non-empty environment.

Anyway, all contribution is welcome. Feel free to fork and PR. CreditRecently I have come to know that Sektor7 had already published this almost-exact same technique on their blog a few years ago.

Despite this, I thought this technique independently in, now almost, its entirety. Probably the smarter piece of this technique is the use of the inherited file descriptor, idea provided by David Buchanan (inspired, I think, by Sektor7's blog) almost a year before I even started thinking about this topic. This alone not only makes the technique much simpler and neat, it also makes it far deadlier by eliminating the need to disable ASLR. His tweet also made me realize how stupid I was for not noticing that memallowed to write to non-writable pages, hence making the ROP unnecessary... This ultimately also has the desired effect of making this significantly easier to port to other ISAs.

Either way, I hope I will be able to spread this technique much further, which is what matters.

I would like to thank Carlos Polop, a great pentester and better friend, for making me think about this subject, and for his helpful feedback and interest, oh and the name of the project. I am sure that if you are reading this you have already used his awesome tool PEASS and found helpful some article in his book HackTricks. I also thank him for helping me with the talk at the RootedCon 2022. Now what?This technique can be prevented in several ways.

* Not installing dd(maybe even go distroless?).
* Placing ddwhere only root can run it.
* Using a kernel compiled without support for the memfile. Questions? Death threats?Feel free to send me an email to arget@protonmail.ch. Download DDexec

___________________________
@hacking_Attack
@Hacking_Video

Improper cookie not expiring after logged out!
https://medium.com/@mujios101/improper-cookie-not-expiring-after-logged-out-ba43e9033459?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

hey folks! Im Mujibur Rahman from chennai and I’m a security researcherContinue reading on Medium » (https://medium.com/@mujios101/improper-cookie-not-expiring-after-logged-out-ba43e9033459?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

The time I hacked a Fortune 500 company, but it was out of scope.
https://hustlebunny.medium.com/the-time-i-hacked-a-fortune-500-company-but-it-was-out-of-scope-3837069354bc?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hi :) thanks for taking some time to read my blog post. This is a short post about a bug I found during my testing of a Fortune 500…Continue reading on Medium » (https://hustlebunny.medium.com/the-time-i-hacked-a-fortune-500-company-but-it-was-out-of-scope-3837069354bc?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress ScrollReveal.js Effects 1.1.1 Cross Site Scripting

https://2.bp.blogspot.com/-x_QP5QrO-tY/WWlvkxoh72I/AAAAAAAAIQ4/t-2dHNJyeE0-qZNxsCg7sgdho_ipgPgbgCLcBGAs/s1600/h98.png
WordPress ScrollReveal.js Effects plugin version 1.1.1 suffers from a persistent cross site scripting vulnerability.

SHA-256 | f800608c7b194924e95a7c7384d8c6cfc72b83e0e53783ec418dd1ccd53766ac

Download
# Exploit Title: WordPress Plugin ScrollReveal.js Effects - Stored Cross Site Scripting
# Date: 25-04-2022
# Exploit Author: Mariam Tariq - Hunt3rsherlock_
# Vendor Homepage: https://wordpress.org/plugins/scrollrevealjs-effects/
# Version: 1.1.1
# Tested on: Firefox
# Contact me: mariamtariq404@gmail.com
# Vulnerable Code:
```

```
# POC
1. Install ScrollReveal.js Effects WordPress plugin and activate.
2. Go to configuration and on vFactor field inject XSS payload “>
onerror=alert(‘’XSS>
3. XSS will trigger.

## PoC Image
https://imgur.com/a/uQRT2mD
https://imgur.com/1BB80ep

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Delier Tim isimli Hacker grubu İlker Zorlu isimli bahis baronunu hedef aldı, Tüm bilgileri ele geçti

submitted by /u/sansizadam
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Explained: The Beanstalk Hack (April 2022)

https://external-preview.redd.it/xHQGaalpFuuhb4C0xrd7z6p_am5a00jUJY-eNyTNPYY.jpg?width=320&crop=smart&auto=webp&s=c222302af3fbe9f8dc8e685fa1133ab3f052fad3 submitted by /u/yintianshi
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Where to learn networking fundamentals as a complete beginner?

Absolutely new to computers.Having watched mr robot ,I am fascinated about these sort of things.but when searching youtube it always the same how to install kali linux....blah blah blah.I have started to learn C and linux.Before moving to kali or parrot,I want to learn about IP,TCp,UDP and other thing that everyones assumes u know when associating with linux

submitted by /u/i_hate_syntax
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What person or business can I hire to mitigate a personal hacking attack I’m experiencing?

Someone has acquired my SSN/DOB/full name. They have made multiple fake ID’s (or got real ID from the DMV) in my name.

They have applied to 10+ apartment buildings and got apartments rented to them on my name.

Yesterday I discovered a Trojan virus on my computer and on a flash drive I have, which allowed remote access to my computer.

When I logged on yesterday, all of my one note notes I had taken related to ID theft and my investigations were DELETED… luckily I recovered from recycle bin.

I have already contacted police and frozen credit.

I reset the laptop. But I’m still concerned. Who can I hire to make sure my accounts and machines are no longer compromised?

submitted by /u/itcamefromlab
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Ukraine Invasion Driving DDoS Attacks to All-Time Highs

Unprecedented numbers of DDoS attacks since February are the result of hacktivists' cyberwar against Russian state interests, researchers say.

Dark Reading: Attacks/Breaches
Trend Micro Launches New Security Platform

An ecosystem of native and third-party integrations provides visibility and control across the entire attack surface.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
This NFT Scam as a Service Is a Scam

https://external-preview.redd.it/oqFFDJMr9X90EGR5HUh425GnH_OIr1eZUBW1WeCbuCA.jpg?width=640&crop=smart&auto=webp&s=8457dfa502c4d8b54f41c8cf415fd61268033d5a submitted by /u/hackeronimacaroni
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Suspicious if I don't have an SD card?

If I dont have an sd card, is it suspicious that when I tried deleting pictures that somebody sent me through WhatsApp, Google photos said to give SD CARD ACCESS in order to delete those photos only? I had never gotten that notification whatsoever.

And is it suspicious from Google? Or the person who sent them?

Possible spyware/malware embedded in those pictures?

submitted by /u/parentingasking
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How do I know if my ex isn’t doing revenge porn on me, using my pictures or even fake accounts using my pictures?

For reference, I’m in Canada and this dude is a programmer so maybe he does know how to hack accounts. His dad, his siblings and his friends are all programmer so maybe they know how to hack an account. I’m saying this because these mfs hate me, if not hate, something in that direction.

I already have two step verifications everywhere and I use a VPN but maybe it is not enough. I know I shouldn’t had shared my pictures with my ex but I didn’t think of that at that moment. I can’t trust him, he is easily influenced, reckless and hates me so I wouldn’t surprised if he does that(praying that he doesn’t).

I’m also worried about all the pictures of me that might circulate on the internet. I used to have social media but I deleted/desactivated my accounts. I can’t call them haters nor frenemies but it is something in that area and I don’t know I just don’t feel safe.

The accounts I have right now are anon and I don’t follow anyone that might know me.

Please help

submitted by /u/Present-Painter3285
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video