hacking: security in practice
Tracer | ESP32 + IMU + ToF (now on Tindie)

submitted by /u/Loud-Consideration-2
[link] [comments]

hacking: security in practice
Having issues with Winexe

Crossposted from /r/howtohack

Anyone ever run this program? I think it's included in Kali. While it's not something I have been familiar with in the past, it was mentioned in Grey Hat Hacking.

Anyway i'm using it against a domain host similar to how it's seen in this video. The command on my side just hangs after submission.

Now on the windows host looking at the logs I can see there was a logon, though it doesn't always seem to match up with the user I ran it with, it shows a SYSTEM login, though one time magically it did.

In any case I ran tcpdump on the kali side to see what is going on over the network. I can see the session being established, then a RST sent.

On the windows host i've confirmed that windows defender is not running nor the firewall, for troubleshooting and still nothing.

submitted by /u/sephstorm
[link] [comments]

Hacking on Medium
Bolstering cyber defenses to deal with evolving threats

https://cdn-images-1.medium.com/max/1027/1*A6x9sPZ_ZViVPP2t9e0bxQ.jpeg
Cyber criminals continue to get more sophisticated in their attacks. We have alluded to this before, but the cost of data breaches rises…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The most notorious Cyber Security & Ethical Hacking Job positions, salaries and degrees required |…

https://cdn-images-1.medium.com/max/1920/0*ob19F_8HOdn1O9nz.png
Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Los piratas informáticos Gold Ulrick siguen en acción a pesar de la fuga masiva de ransomware Conti

https://cdn-images-1.medium.com/max/1579/0*1WUC7TxkACx2f2W5
PUBLICADO EN 26 ABRIL, 2022POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The Dark side of Approve

https://cdn-images-1.medium.com/max/845/1*SnN_rLXIDp8_bA0p_5dD-Q.png
In this writing, I want to talk about the “approve” function in the EIP-20 Ethereum token standard,

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hackers Steal Bored Apes in Instagram Heist Worth Over £10 Million:

https://cdn-images-1.medium.com/max/2000/0*8nexYoxJ6sL2_-kQ.jpg
On April 25th, hackers gained control of the Bored Ape Yacht Club’s Instagram account, where they were able to create a post about the…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Bore - Simple CLI Tool For Making Tunnels To Localhost

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress WP-Invoice 4.3.1 Cross Site Scripting

https://1.bp.blogspot.com/-3PgjWVftdQ0/WWlvP-R2mXI/AAAAAAAAIM8/iBQyafDa-iYc-AHcRZlLffBv9_pWsP_-gCLcBGAs/s1600/h30.png
WordPress WP-Invoice plugin version 4.3.1 suffers from a persistent cross site scripting vulnerability.

SHA-256 | 1198ae90a0a19ceea8037a4ba1f3a90e0f447c7505ff7bf4fad7fd12b756e2b3

Download
# Exploit Title: WordPress Plugin WP-Invoice - Stored Cross Site Scripting
# Date: 25-04-2022
# Exploit Author: Mariam Tariq - HunterSherlock
# Vendor Homepage: https://wordpress.org/plugins/WP-Invoice/
# Version: 4.3.1
# Tested on: Firefox
# Contact me: mariamtariq404@gmail.com

# Vulnerable Code:
```
wpi.business_name = 'x
3. XSS will trigger and will be stored.

## POC Image

https://imgur.com/rsHIEO9

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Gitlab 14.9 Authentication Bypass

https://3.bp.blogspot.com/-p2bRUn4ag8U/WWlvPJDaCwI/AAAAAAAAIMw/gkQGiTtaXucRRVbpvBkwiWIbJMO4BFlLwCLcBGAs/s1600/h28.png
Gitlab versions 14.9 prior to 14.9.2, 14.8 prior to 14.8.5, and 14.7 prior to 14.7.7 suffer from a bypass vulnerability due to having set a hardcoded password for accounts registered using an OmniAuth provider.

SHA-256 | b9871a137c86a7af7a3f259af24481816299cde62d5eef695abcb78150bb320f

Download
# Exploit Title: Gitlab 14.9 - Authentication Bypass
# Date: 12/04/2022
# Exploit Authors: Greenwolf & stacksmashing
# Vendor Homepage: https://about.gitlab.com/
# Software Link: https://about.gitlab.com/install
# Version: GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2
# Tested on: Linux
# CVE : CVE-2022-1162
# References: https://github.com/Greenwolf/CVE-2022-1162

A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowing attackers to potentially take over accounts.

Exploit:

New Gitlab Accounts (created since the first affect version and if Gitlab is before the patched version) can be logged into with the following password:

123qweQWE!@#000000000


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video