https://b.thumbs.redditmedia.com/3rG-htt5EHGb0IoHYwQ_Qt3Riuy5rPaNPMJTz-aP8Qs.jpg Don’t trust the WAF vendors – pentest them, before buy!
The data for the rating is collected by the community on Twitter, and we collect it on the website and filter it by vendors and vulnerabilities for you. Download the full infographic for all vendors!
https://waf-bypass.com/independent-rating-based-on-waf-community-bypasses/
https://preview.redd.it/mt21hvyqrex81.jpg?width=1080&format=pjpg&auto=webp&s=c69a66f936b7c418c00c35bc59dbf18f1c45e291
submitted by /u/Derrick_Wallarm
[link] [comments]
The data for the rating is collected by the community on Twitter, and we collect it on the website and filter it by vendors and vulnerabilities for you. Download the full infographic for all vendors!
https://waf-bypass.com/independent-rating-based-on-waf-community-bypasses/
https://preview.redd.it/mt21hvyqrex81.jpg?width=1080&format=pjpg&auto=webp&s=c69a66f936b7c418c00c35bc59dbf18f1c45e291
submitted by /u/Derrick_Wallarm
[link] [comments]
hacking: security in practice
Hacked for 2 months straight
Is it because I am a bitcoin whale? Real answers only. TYIA.
submitted by /u/Fuzzy_Detective_4178
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Hacked for 2 months straight
Is it because I am a bitcoin whale? Real answers only. TYIA.
submitted by /u/Fuzzy_Detective_4178
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Hacked for 2 months straight
Is it because I am a bitcoin whale? Real answers only. TYIA.
Update on cyber activity in Eastern Europe
https://www.reddit.com/r/redteamsec/comments/ui0q5e/update_on_cyber_activity_in_eastern_europe/
submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://blog.google/threat-analysis-group/update-on-cyber-activity-in-eastern-europe/) [comments] (https://www.reddit.com/r/redteamsec/comments/ui0q5e/update_on_cyber_activity_in_eastern_europe/)
___________________________
@hacking_Attack
@Hacking_Video
https://www.reddit.com/r/redteamsec/comments/ui0q5e/update_on_cyber_activity_in_eastern_europe/
submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://blog.google/threat-analysis-group/update-on-cyber-activity-in-eastern-europe/) [comments] (https://www.reddit.com/r/redteamsec/comments/ui0q5e/update_on_cyber_activity_in_eastern_europe/)
___________________________
@hacking_Attack
@Hacking_Video
reddit
Update on cyber activity in Eastern Europe
Posted in r/redteamsec by u/dmchell • 1 point and 0 comments
Hacking Power Plants and Industrial Control Systems
https://www.reddit.com/r/redteamsec/comments/ui0shb/hacking_power_plants_and_industrial_control/
submitted by /u/cybersocdm (https://www.reddit.com/user/cybersocdm)
[link] (https://youtube.com/watch?v=CZ6xMJu713I&feature=share) [comments] (https://www.reddit.com/r/redteamsec/comments/ui0shb/hacking_power_plants_and_industrial_control/)
___________________________
@hacking_Attack
@Hacking_Video
https://www.reddit.com/r/redteamsec/comments/ui0shb/hacking_power_plants_and_industrial_control/
submitted by /u/cybersocdm (https://www.reddit.com/user/cybersocdm)
[link] (https://youtube.com/watch?v=CZ6xMJu713I&feature=share) [comments] (https://www.reddit.com/r/redteamsec/comments/ui0shb/hacking_power_plants_and_industrial_control/)
___________________________
@hacking_Attack
@Hacking_Video
reddit
Hacking Power Plants and Industrial Control Systems
Posted in r/redteamsec by u/cybersocdm • 1 point and 0 comments
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
TryHackMe: [Day 21] Blue Teaming Needles In Computer Stacks
https://cdn-images-1.medium.com/max/1920/1*psaTaSfd9sQyajFeYTLO-w.png
We changed the text in the string $a as shown in the eicaryara rule we wrote, from X5O to X50, that is, we replaced the letter O with the…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
TryHackMe: [Day 21] Blue Teaming Needles In Computer Stacks
https://cdn-images-1.medium.com/max/1920/1*psaTaSfd9sQyajFeYTLO-w.png
We changed the text in the string $a as shown in the eicaryara rule we wrote, from X5O to X50, that is, we replaced the letter O with the…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
TryHackMe: [Day 21] Blue Teaming Needles In Computer Stacks
We changed the text in the string $a as shown in the eicaryara rule we wrote, from X5O to X50, that is, we replaced the letter O with the…
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Hack the HAckers
https://cdn-images-1.medium.com/max/2600/0*qmGBgZY7mgPu8s9i
While reading my feeds I came across “hacking the hackers” Heading , so I think lets try finding bugs on THM ( Try HacK Me ) .
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Hack the HAckers
https://cdn-images-1.medium.com/max/2600/0*qmGBgZY7mgPu8s9i
While reading my feeds I came across “hacking the hackers” Heading , so I think lets try finding bugs on THM ( Try HacK Me ) .
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Hack the HAckers
While reading my feeds I came across “hacking the hackers” Heading , so I think lets try finding bugs on THM ( Try HacK Me ) .
Information leakage in EXIF data of images(EXIF Data Exposure)
https://medium.com/@ranjanarajshree/information-leakage-in-exif-data-of-images-exif-data-exposure-fcd19eec9ce6?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://medium.com/@ranjanarajshree/information-leakage-in-exif-data-of-images-exif-data-exposure-fcd19eec9ce6?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
Information leakage in EXIF data of images(EXIF Data Exposure)
Summary :
Summary :Continue reading on Medium » (https://medium.com/@ranjanarajshree/information-leakage-in-exif-data-of-images-exif-data-exposure-fcd19eec9ce6?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
Information leakage in EXIF data of images(EXIF Data Exposure)
Summary :
Hacking Articles Tips Tricks Videos Tutorials
Photo
Black Hat Ethical Hacking
Security bug in VMWare Workspace ONE could allow access to internal, cloud networks
Security bug in VMWare Workspace ONE could allow access to internal, cloud networksPost Views: 32
Premium Content
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/patreon-300x61.png https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-2.png Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes
A security vulnerability in a mobile device management software could allow attackers access to organizations’ internal and cloud networks, researchers warn.
Discovered by Assetnote, the server-side request forgery (SSRF) bug was found in VMWare Workspace One UEM.
Tracked as CVE-2021-22054, the vulnerability could risk credentials and other sensitive data falling into the hands of malicious attackers.
“We discovered a pre-authentication vulnerability that allowed us to make arbitrary HTTP requests, including requests with any HTTP method and request body,” the researchers wrote in a blog post.
“In order to exploit this SSRF, we had to reverse engineer the encryption algorithm used by VMWare Workspace One UEM.”
The team were able to breach “a number of” organizations using the software, accessing both their internal network and cloud services.
Speaking to The Daily Swig, Assetnote’s Subham Shah said: “While I cannot share exact details about what companies were effected, there were a large number of enterprises that were vulnerable to this.
“In some cases, it was possible to use this vulnerability to breach the AWS accounts of the companies.”
See Also: Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png Shah added: “The impact of this vulnerability is rather on the organization running the software, instead of the individual users that are using the products.
“Using the SSRF vulnerability, it is possible to reach arbitrary hosts on the internal network. On cloud networks such as AWS, it is possible to reach the metadata IP address and potentially steal security credentials.
“Using these security credentials, it is possible to escalate the vulnerability to gain access to other infrastructure belonging to a company.”
See Also: New Nimbuspwn Linux vulnerability gives hackers root privileges RemediationsThe issue, which was first discovered in November 2021, has since been patched by the vendor.
Shah said that while VMware dealt with the issues “in a timely manner”, researchers agreed to the vendor’s request for more time to release more patches and allow customers to patch their instances before disclosure.
An advisory from VMWare contains details of fixes for the software.
Shah advised users of mobile management device software “if possible, do not expose the MDM solution to the external internet”. See Also: OSINT Tool: MOSINT Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?
If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
See Also: Darkside hacker group, the group that provides ransomware as a service
Source: portswigger.net Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/ezgif.com-gif-maker-2-90x90.jpg New PyScript project lets you run Python programs in the browser1 day ago
* https://www.blackhatethicalhacking.com/wp-conten[...]
___________________________
@hacking_Attack
@Hacking_Video
Security bug in VMWare Workspace ONE could allow access to internal, cloud networks
Security bug in VMWare Workspace ONE could allow access to internal, cloud networksPost Views: 32
Premium Content
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/patreon-300x61.png https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-2.png Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes
A security vulnerability in a mobile device management software could allow attackers access to organizations’ internal and cloud networks, researchers warn.
Discovered by Assetnote, the server-side request forgery (SSRF) bug was found in VMWare Workspace One UEM.
Tracked as CVE-2021-22054, the vulnerability could risk credentials and other sensitive data falling into the hands of malicious attackers.
“We discovered a pre-authentication vulnerability that allowed us to make arbitrary HTTP requests, including requests with any HTTP method and request body,” the researchers wrote in a blog post.
“In order to exploit this SSRF, we had to reverse engineer the encryption algorithm used by VMWare Workspace One UEM.”
The team were able to breach “a number of” organizations using the software, accessing both their internal network and cloud services.
Speaking to The Daily Swig, Assetnote’s Subham Shah said: “While I cannot share exact details about what companies were effected, there were a large number of enterprises that were vulnerable to this.
“In some cases, it was possible to use this vulnerability to breach the AWS accounts of the companies.”
See Also: Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png Shah added: “The impact of this vulnerability is rather on the organization running the software, instead of the individual users that are using the products.
“Using the SSRF vulnerability, it is possible to reach arbitrary hosts on the internal network. On cloud networks such as AWS, it is possible to reach the metadata IP address and potentially steal security credentials.
“Using these security credentials, it is possible to escalate the vulnerability to gain access to other infrastructure belonging to a company.”
See Also: New Nimbuspwn Linux vulnerability gives hackers root privileges RemediationsThe issue, which was first discovered in November 2021, has since been patched by the vendor.
Shah said that while VMware dealt with the issues “in a timely manner”, researchers agreed to the vendor’s request for more time to release more patches and allow customers to patch their instances before disclosure.
An advisory from VMWare contains details of fixes for the software.
Shah advised users of mobile management device software “if possible, do not expose the MDM solution to the external internet”. See Also: OSINT Tool: MOSINT Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?
If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
See Also: Darkside hacker group, the group that provides ransomware as a service
Source: portswigger.net Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/ezgif.com-gif-maker-2-90x90.jpg New PyScript project lets you run Python programs in the browser1 day ago
* https://www.blackhatethicalhacking.com/wp-conten[...]
___________________________
@hacking_Attack
@Hacking_Video
Black Hat Ethical Hacking
Security bug in VMWare Workspace ONE could allow access to internal, cloud networks | Black Hat Ethical Hacking
A security vulnerability in a mobile device management software could allow attackers access to organizations’ internal and cloud networks, researchers warn.
Hacking Articles Tips Tricks Videos Tutorials
Black Hat Ethical Hacking Security bug in VMWare Workspace ONE could allow access to internal, cloud networks Security bug in VMWare Workspace ONE could allow access to internal, cloud networksPost Views: 32 Premium Content https://www.blackhatethicalhacking.com/wp…
t/uploads/2022/05/1614322146_pexels-kevin-ku-577585-scaled-90x90.jpg Open source ‘Package Analysis’ tool finds malicious npm, PyPI packages2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/supply-chain-attack-90x90.jpg Socket: New tool uses a new, proactive defense against OSS supply chain attacks5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/github-90x90.jpg GitHub: How stolen OAuth tokens helped breach dozens of orgs6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Figure-6-Our-exploit-implemented-and-winning-the-TOCTOU-race-90x90.png New Nimbuspwn Linux vulnerability gives hackers root privileges1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/ezgif.com-gif-maker-6-90x90.jpg Lapsus$ Hackers Target T-Mobile1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/ezgif.com-gif-maker-5-90x90.jpg Log4Shell vulnerability in AWS allows full host takeover1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/New-Java-Framework-Vulnerability-and-Mitigations-90x90.jpg Java encryption implementation error made it trivial to forge credentials2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/ezgif.com-gif-maker-3-90x90.jpg CISA warns of attackers now exploiting Windows Print Spooler bug2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/ezgif.com-gif-maker-2-3-90x90.jpg Newly found zero-click iPhone exploit used in NSO spyware attacks2 weeks ago
The post Security bug in VMWare Workspace ONE could allow access to internal, cloud networks first appeared on Black Hat Ethical Hacking.
___________________________
@hacking_Attack
@Hacking_Video
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/supply-chain-attack-90x90.jpg Socket: New tool uses a new, proactive defense against OSS supply chain attacks5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/github-90x90.jpg GitHub: How stolen OAuth tokens helped breach dozens of orgs6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Figure-6-Our-exploit-implemented-and-winning-the-TOCTOU-race-90x90.png New Nimbuspwn Linux vulnerability gives hackers root privileges1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/ezgif.com-gif-maker-6-90x90.jpg Lapsus$ Hackers Target T-Mobile1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/ezgif.com-gif-maker-5-90x90.jpg Log4Shell vulnerability in AWS allows full host takeover1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/New-Java-Framework-Vulnerability-and-Mitigations-90x90.jpg Java encryption implementation error made it trivial to forge credentials2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/ezgif.com-gif-maker-3-90x90.jpg CISA warns of attackers now exploiting Windows Print Spooler bug2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/ezgif.com-gif-maker-2-3-90x90.jpg Newly found zero-click iPhone exploit used in NSO spyware attacks2 weeks ago
The post Security bug in VMWare Workspace ONE could allow access to internal, cloud networks first appeared on Black Hat Ethical Hacking.
___________________________
@hacking_Attack
@Hacking_Video
