KitPloit - PenTest Tools!
Wpgarlic - A Proof-Of-Concept WordPress Plugin Fuzzer

https://blogger.googleusercontent.com/img/a/AVvXsEjkBAQ43H5hq3CSZznlrHqBCkxr8v2rfZBAkHVZ6QkRm4XdPoG6ullrz_GTyD6mUcATnbT4FcwB7uHJqLaXWbufV5A4Ep2934lsAAUbUMLE2UJUAnKj-qXs9OwToFmiLvkV3CRT5akAZQEgeher2Tco2fmK_xjrJOLwgo7UrcL-sfk9MvYVIcVN01cO=w640-h414 A proof-of-concept WordPress plugin fuzzer used in the research described in https://kazet.cc/2022/02/03/fuzzing-wordpress-plugins.html that helped to discover more than 140 vulnerablities in WordPress plugins installed on almost 15 million sites.

If you want to continue the research, start with less popular plugins - if a plugin achieved at least 10k active installs between October 2021 and January 2022, I have most probably looked at the fuzzer reports (and most focus has been put on plugins having at least 20k active installs). Because there is a lot of randomness in how fuzzer works, some vulnerabilities in these plugins remain undiscovered - but fewer ones.

Fuzzer reports contain a lot of false positives - most of them don't indicate a vulnerability. After seeing a report, first analyze whether the behavior you're observing is indeed a vulnerability or a false positive. Don't spam WPScan/vendors with raw fuzzer reports - provide a PoC exploit instead. ExamplesFor obvious reasons, the examples will contain only vulnerabilities that have already been fixed. Arbitrary file readLet's assume you are fuzzing responsive-vector-mapsin version 6.4.0: ./bin/fuzz_plugin responsive-vector-maps --version 6.4.0 (to fuzz the latest version, just skip --version).

After the fuzzing finishes (which would take 10-30 minutes for this plugin) you can call: ./bin/print_findings data/plugin_fuzz_results/ You will see, among others: https://blogger.googleusercontent.com/img/a/AVvXsEjkBAQ43H5hq3CSZznlrHqBCkxr8v2rfZBAkHVZ6QkRm4XdPoG6ullrz_GTyD6mUcATnbT4FcwB7uHJqLaXWbufV5A4Ep2934lsAAUbUMLE2UJUAnKj-qXs9OwToFmiLvkV3CRT5akAZQEgeher2Tco2fmK_xjrJOLwgo7UrcL-sfk9MvYVIcVN01cO=w640-h414 .

That means that the fuzzer detected executing fopen()on a known payload. Most of the payloads contain the word GARLICin them to facilitate automatic detection in output. You may see or configure them in docker_image/magic_payloads.php.

Then, you may browse the source code and see that indeed the wp_ajax_rvm_import_markersendpoint uses the file content to render output, thus allowing you to read arbitrary files on the server: CVE-2021-24947.

What you see in white is a crash considered interesting (you may modify them or add new ones in crash_detectors.py). Green is the context. In blue you see the report file name (with plugin name), plugin popularity and endpoint name (here: the ajax action name).

The data in yellow are what payloads were injected into what variables. Reflected XSSLet's assume you are fuzzing page-builder-addin version 1.4.9.4: ./bin/fuzz_plugin page-builder-add --version 1.4.9.4 After printing the results, you will see known payload echoed back: https://blogger.googleusercontent.com/img/a/AVvXsEhrUnJW0UZ1H8fvpix5si6P3UVilMDfzcALLOecAJ9uIL0tFQ3HtsoJTeptqSZ6iutBld00FevHnNdD9Kw_hKJJW4T4YmhQBnHvgmjVY11AblTzFj7ZcnjDAZP49cgYk-bmNUILi4SnNWDOn7NqE1qTUc_dwj49tdzxXcNhrCOqkUMTOVntw4LEJAqp=w640-h266 .

You can then manually test whether indeed this place (remember: in blue you have the endpoint name, here: the menu page name) is vulnerable to XSS. In this case, it is: CVE-2021-25067. Option update leading to stored XSS./bin/fuzz_plugin duplicate-page-or-post --version 1.4.6 After printing the results, you will see update_optionbeing called: https://blogger.googleusercontent.com/img/a/AVvXsEhA7I4LmJBYgic2K63V4P5zyyo8qgLvr6RtX0_Q3uXK3GMmc4djjy_CyicRuzRrmLdg9n1BpVZ-XRa1G[...]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Wpgarlic - A Proof-Of-Concept WordPress Plugin Fuzzer

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Iranian Hacking Group Among Those Exploiting Recently Disclosed VMWare RCE Flaw

Threat actor is using the flaw to deliver Core Impact backdoor on vulnerable systems, security vendor says.

Dark Reading: Attacks/Breaches
North Korean State Actors Deploying Novel Malware to Spy on Journalists

Spear-phishing campaign loaded with new "Goldbackdoor" malware targeted journalists with NK News, analysts found.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
What the ECDSA Flaw in Java Means for Enterprises

This Tech Tip reminds developers and security teams to check what version of Java they are running. Whether they are vulnerable to the ECDSA flaw boils down to the version number.

hacking: security in practice
Omg cable but in..

Is there a omg cable not from the exact brand/manufacture but is there a hacking cable but in in ear headphones version like the cable version one I know there’s the lighting cable and adapter but what about headphones that can do the same as hacking and etc etc

submitted by /u/theheadbanders
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
I received a message of someone claiming that infected me with njrat.

how should i proceed?

submitted by /u/JaponesBaiano
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Web Scraping a Google Contacts Directory

Not much "hacking" going on here, but I have a google organization directory for my school and it has about 20,000 contacts on it. I would like to get the email addresses that are on it to send a Rickroll email, but I am not able to select the emails all at once to copy them. So I would like to try web scraping and get the emails that way. However, I do not know much about how to web scrape. Another problem is that not all of the emails load at once. If the email is not currently on the screen, it will not load until I scroll down.Please tell me some services or methods that I can use to scrape the email addresses, or a way that I can get all of the email addresses to load at once.

submitted by /u/R4ndomP3rson69
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Atlassian has addressed a critical vulnerability in Jira software, tracked as CVE-2022-0540(CVSS score 9.9), that can be exploited by an unauthenticated attacker to bypass authentication. Threat actor could trigger the vulnerability by sending a specially crafted HTTP request to vulnerable software.

https://external-preview.redd.it/SwxCddYPLEy507Ufi7Zr4V5U_jUuK8sBVj0CrX6T268.jpg?width=216&crop=smart&auto=webp&s=27e65d503d5ff499a4e70b4f828d3c2e6d60c92e submitted by /u/Late_Ice_9288
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How to target a computer outside local network?

I have an exploitable test machine running windows 7 and I know how to target it inside the local network with the local IP address to run metasploit exploits against it.

My question is, how do I target this same windows 7 machine outside the local network. If I use the public IP Address, isn't that just the IP address of my router that all the local machines use? How would I specify which machine in the network to target?

submitted by /u/Practical_Bathroom53
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

help with crunch pelase!
https://www.reddit.com/r/Pentesting/comments/uc1w0n/help_with_crunch_pelase/

hello guys i hope you all good! i need help guys plz with crunch i have list for name and i want start with min 9 and max 15 and my list like this.. mohamed ahmed kareem sonia yassin samy abdulrahman badr abdelaziz ayman agnaden tedata vodafone etisalat orange zen ziad mahmoud elhadad awad rawan youssif mostafa ameen ali zico coco koki dido isso toto tata oraby islam hesham hussein hossam magdy mido becker salem ibrahim said ssadek habiba khattab ashour noga hegazy rima tito sadek hakem safwat fawry tomy anoosh pitbull hema abaas diab shaban nader tolba ammar lamia gego temo saso abdelhakim *@-_!0987654321 ​ ok the list is much long ...,so this is my list I didn't want the letters to change I just want the words to change EXMPLE: ahmedmohamed**1234 EXMPLE2: ahmedkoki@01085643 like this guys only words change not letters and (only numbers and symbols change with each other) I hope you can help me with your kindness and generosity thank you guys i wish you all the best. submitted by /u/matrix-n (https://www.reddit.com/user/matrix-n)
[link] (https://www.reddit.com/r/Pentesting/comments/uc1w0n/help_with_crunch_pelase/) [comments] (https://www.reddit.com/r/Pentesting/comments/uc1w0n/help_with_crunch_pelase/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How to Decrypt a file without knowing the Algorithm, but knowing the key?

So I am trying to decrypt a file here. It is a .XMDX file that seems to be encrypted. I have the encryption key, but I don't know the algorithm used. How would I go about finding the algorithm?

I am using python. Should I just shuffle through all the know algorithms and see if any of them yield a legible result? can this file even be decrypted? Usually, this file is read by a program that only shows the user the contents when the password is entered.

Thanks in advance!

submitted by /u/scrubswithnosleeves
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
The omg cable by hak5

Are there headphones or and airpod version of the omg lighting cable that has the same or similar features? would be surprised if there is considering no one is just picking up random headphones and using them. But! Would it be possible to make one and if so who’s the guy that can make it happen ?

submitted by /u/theheadbanders
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackme — Alfred(Exploit Jenkins Service Gain To Authority/System)

https://cdn-images-1.medium.com/max/600/1*LCrIBEvO-NKFN5IQWxjZYQ.png
Hi semua pada artikel ini saya akan membagikan write up mechine tryhackme yang bername alfred mechine ini berfokus pada teknologi jenkins…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
OWASP API Security (Offensive Prespective) : Excessive Data Exposure #3

https://cdn-images-1.medium.com/max/600/0*HpyszGZISX1YxXkD.png
Assalamualaikum Wr. Wb

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

My Pentest Log -16- (XS Size A Little Tip)
https://hcibo.medium.com/my-pentest-log-16-a-little-tip-ea55447443ae?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video