Hacking Articles Tips Tricks Videos Tutorials

KitPloit - PenTest Tools!
Wpgarlic - A Proof-Of-Concept WordPress Plugin Fuzzer

https://blogger.googleusercontent.com/img/a/AVvXsEjkBAQ43H5hq3CSZznlrHqBCkxr8v2rfZBAkHVZ6QkRm4XdPoG6ullrz_GTyD6mUcATnbT4FcwB7uHJqLaXWbufV5A4Ep2934lsAAUbUMLE2UJUAnKj-qXs9OwToFmiLvkV3CRT5akAZQEgeher2Tco2fmK_xjrJOLwgo7UrcL-sfk9MvYVIcVN01cO=w640-h414 A proof-of-concept WordPress plugin fuzzer used in the research described in https://kazet.cc/2022/02/03/fuzzing-wordpress-plugins.html that helped to discover more than 140 vulnerablities in WordPress plugins installed on almost 15 million sites.

If you want to continue the research, start with less popular plugins - if a plugin achieved at least 10k active installs between October 2021 and January 2022, I have most probably looked at the fuzzer reports (and most focus has been put on plugins having at least 20k active installs). Because there is a lot of randomness in how fuzzer works, some vulnerabilities in these plugins remain undiscovered - but fewer ones.

Fuzzer reports contain a lot of false positives - most of them don't indicate a vulnerability. After seeing a report, first analyze whether the behavior you're observing is indeed a vulnerability or a false positive. Don't spam WPScan/vendors with raw fuzzer reports - provide a PoC exploit instead. ExamplesFor obvious reasons, the examples will contain only vulnerabilities that have already been fixed. Arbitrary file readLet's assume you are fuzzing responsive-vector-mapsin version 6.4.0: ./bin/fuzz_plugin responsive-vector-maps --version 6.4.0 (to fuzz the latest version, just skip --version).

After the fuzzing finishes (which would take 10-30 minutes for this plugin) you can call: ./bin/print_findings data/plugin_fuzz_results/ You will see, among others: https://blogger.googleusercontent.com/img/a/AVvXsEjkBAQ43H5hq3CSZznlrHqBCkxr8v2rfZBAkHVZ6QkRm4XdPoG6ullrz_GTyD6mUcATnbT4FcwB7uHJqLaXWbufV5A4Ep2934lsAAUbUMLE2UJUAnKj-qXs9OwToFmiLvkV3CRT5akAZQEgeher2Tco2fmK_xjrJOLwgo7UrcL-sfk9MvYVIcVN01cO=w640-h414 .

That means that the fuzzer detected executing fopen()on a known payload. Most of the payloads contain the word GARLICin them to facilitate automatic detection in output. You may see or configure them in docker_image/magic_payloads.php.

Then, you may browse the source code and see that indeed the wp_ajax_rvm_import_markersendpoint uses the file content to render output, thus allowing you to read arbitrary files on the server: CVE-2021-24947.

What you see in white is a crash considered interesting (you may modify them or add new ones in crash_detectors.py). Green is the context. In blue you see the report file name (with plugin name), plugin popularity and endpoint name (here: the ajax action name).

The data in yellow are what payloads were injected into what variables. Reflected XSSLet's assume you are fuzzing page-builder-addin version 1.4.9.4: ./bin/fuzz_plugin page-builder-add --version 1.4.9.4 After printing the results, you will see known payload echoed back: https://blogger.googleusercontent.com/img/a/AVvXsEhrUnJW0UZ1H8fvpix5si6P3UVilMDfzcALLOecAJ9uIL0tFQ3HtsoJTeptqSZ6iutBld00FevHnNdD9Kw_hKJJW4T4YmhQBnHvgmjVY11AblTzFj7ZcnjDAZP49cgYk-bmNUILi4SnNWDOn7NqE1qTUc_dwj49tdzxXcNhrCOqkUMTOVntw4LEJAqp=w640-h266 .

You can then manually test whether indeed this place (remember: in blue you have the endpoint name, here: the menu page name) is vulnerable to XSS. In this case, it is: CVE-2021-25067. Option update leading to stored XSS./bin/fuzz_plugin duplicate-page-or-post --version 1.4.6 After printing the results, you will see update_optionbeing called: https://blogger.googleusercontent.com/img/a/AVvXsEhA7I4LmJBYgic2K63V4P5zyyo8qgLvr6RtX0_Q3uXK3GMmc4djjy_CyicRuzRrmLdg9n1BpVZ-XRa1G[...]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

Wpgarlic - A Proof-Of-Concept WordPress Plugin Fuzzer

11 viewsedited 00:29

KitPloit - PenTest Tools!
Wpgarlic - A Proof-Of-Concept WordPress Plugin Fuzzer

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

Wpgarlic - A Proof-Of-Concept WordPress Plugin Fuzzer

10 viewsedited 00:29

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
Iranian Hacking Group Among Those Exploiting Recently Disclosed VMWare RCE Flaw

Threat actor is using the flaw to deliver Core Impact backdoor on vulnerable systems, security vendor says.

7 views02:29

Source

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
North Korean State Actors Deploying Novel Malware to Spy on Journalists

Spear-phishing campaign loaded with new "Goldbackdoor" malware targeted journalists with NK News, analysts found.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading

North Korean State Actors Deploying Novel Malware to Spy on Journalists

Spear-phishing campaign loaded with new "Goldbackdoor" malware targeted journalists with NK News, analysts found.

7 viewsedited 02:29

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
What the ECDSA Flaw in Java Means for Enterprises

This Tech Tip reminds developers and security teams to check what version of Java they are running. Whether they are vulnerable to the ECDSA flaw boils down to the version number.

7 views02:29

Source

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Omg cable but in..

Is there a omg cable not from the exact brand/manufacture but is there a hacking cable but in in ear headphones version like the cable version one I know there’s the lighting cable and adapter but what about headphones that can do the same as hacking and etc etc

submitted by /u/theheadbanders
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Omg cable but in..

Is there a omg cable not from the exact brand/manufacture but is there a hacking cable but in in ear headphones version like the cable version one...

8 viewsedited 02:32

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
I received a message of someone claiming that infected me with njrat.

how should i proceed?

submitted by /u/JaponesBaiano
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

I received a message of someone claiming that infected me with njrat.

how should i proceed?

6 viewsedited 02:32

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Web Scraping a Google Contacts Directory

Not much "hacking" going on here, but I have a google organization directory for my school and it has about 20,000 contacts on it. I would like to get the email addresses that are on it to send a Rickroll email, but I am not able to select the emails all at once to copy them. So I would like to try web scraping and get the emails that way. However, I do not know much about how to web scrape. Another problem is that not all of the emails load at once. If the email is not currently on the screen, it will not load until I scroll down.Please tell me some services or methods that I can use to scrape the email addresses, or a way that I can get all of the email addresses to load at once.

submitted by /u/R4ndomP3rson69
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Web Scraping a Google Contacts Directory

Not much "hacking" going on here, but I have a google organization directory for my school and it has about 20,000 contacts on it. I would like to...

8 viewsedited 02:32

Hacking Articles Tips Tricks Videos Tutorials

8 views02:32

Hacking Articles Tips Tricks Videos Tutorials

Photo

hacking: security in practice
Atlassian has addressed a critical vulnerability in Jira software, tracked as CVE-2022-0540(CVSS score 9.9), that can be exploited by an unauthenticated attacker to bypass authentication. Threat actor could trigger the vulnerability by sending a specially crafted HTTP request to vulnerable software.

https://external-preview.redd.it/SwxCddYPLEy507Ufi7Zr4V5U_jUuK8sBVj0CrX6T268.jpg?width=216&crop=smart&auto=webp&s=27e65d503d5ff499a4e70b4f828d3c2e6d60c92e submitted by /u/Late_Ice_9288
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Atlassian has addressed a critical vulnerability in Jira software,...

Posted in r/hacking by u/Late_Ice_9288 • 1 point and 0 comments

8 viewsedited 02:32