Web3 is a newfound technology and it’s claimed that it can greatly increase the security on the websites using it. In fact web3 is a new…Continue reading on Medium » (https://huntinex.medium.com/hacking-web3-introduction-and-how-to-start-88ae2c51f3ec?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Alternatives to bug bounties for blue teams/threat intel activities?

Hi everyone,

I was wondering if there are other platforms out there for blue team/threat intel/malware analysis activities (and that allow to make few bucks) like bug bounties programs do for "red team" activities. I am not referring to ctf/learning platforms as TryHackMe or HTB, I mean platforms in which you could be paid for your services.

submitted by /u/r3drush
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How recognised is EC-Council in the cyber security world ?

Is it a good certificate for getting a job in cyber security ?

submitted by /u/Bloodwolf6328
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Assistance hacking Skynet.

Title says it all, I’m worried Skynet might kill us all.

submitted by /u/theboarrior
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Fyasecurity

Just checking if anyone remembers the old-school 90s/early-00s fyasecurity.com hacking site/forum. Used to spend lots of time there. Purplehaze was the moderator/postmaster.

Internet archive was early beginning then so no index available.

Just a nostalgia question which you can ignore

submitted by /u/dcflatline
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Anyone want to start a CTF team?

Saw the popular post about joining a CTF team, but missed the boat on that group, so I figured there is probably enough interest to get another group going. I haven't done too many CTFs, but have been studying pentesting and cyber security for a couple years, and I think it would be a good opportunity to sharpen my skills. Will primarily be discord based, at least to start, could move to a more secure platform later on. Hopefully we can get a good mix of skill levels, DM me or post here if interested!

submitted by /u/SpartanJAH
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
best way i can stay secure??

i don’t know anything about hacking and stuff but there’s alot of doxxers around in groupchats on social medias and idk how could i protect myself

submitted by /u/Any_Blacksmith_7638
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
LiquidFiles 3.4.15 Cross Site Scripting

https://4.bp.blogspot.com/-4tZE0Y76jWM/WWlvMNv2FRI/AAAAAAAAIMQ/Di9LOyWyOssTbh7urhFnaBV0oE1qNf8CgCLcBGAs/s1600/h19.png
LiquidFiles version 3.4.15 suffers from a cross site scripting vulnerability.

SHA-256 | 64fb0fffa85d330dbc47f539a594fa8fcad4c9362b419983c93474d08ba4e151

Download
=====[ Tempest Security Intelligence - ADV-12/2021
]==========================

LiquidFiles - 3.4.15

Author: Rodolfo Tavares

Tempest Security Intelligence - Recife, Pernambuco - Brazil

=====[ Table of Contents]==================================================
* Overview
* Detailed description
* Timeline of disclosure
* Thanks & Acknowledgements
* References

=====[ Vulnerability
Information]=============================================
* Class: Improper Neutralization of Input During Web Page Generation
('Cross-site Scripting') [CWE-79]

* CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

=====[ Overview]========================================================
* System affected : LiquidFiles
* Software Version : Version - 3.4.15
* Impacts :
* XSS: LiquidFiles 3.4.15 has stored XSS through the "send email"
functionality when sending a file via email to an administrator. When a
file has no extension and contains malicious HTML / JavaScript content
(such as SVG with HTML content), the payload is executed upon a click. This
is fixed in 3.5.
=====[ Detailed
description]=================================================

* Stored XSS at [http://localhost:8080/message/new]:

* Steps to reproduce

1 - Create a file without extension, with the content below inside
```



```
2 - With an external user send an email with that file (without any
extension) to admin or someone.

3 - With the admin account go to the menu click on "Data", inside the
"Data" menu click at "Messages", and select the message that you sent at
step 2. At the table click on the filename row over your file, the
javascript code will be executed.

=====[ Timeline of
disclosure]===============================================

11/Jan/2021 - Responsible disclosure was initiated with the vendor.
12/Jan/2021 - LiquidFiles Support confirmed the issue;
18/Fev/2021 - The vendor fixed the vulnerability the second stored XSS's
06/Apr/2021 - CVEs was assigned and reserved as CVE-2021-30140

=====[ Thanks & Acknowledgements]========================================
* Tempest Security Intelligence [5]

=====[ References ]=====================================================

[1][ [
https://cwe.mitre.org/data/definitions/79.html]|https://cwe.mitre.org/data/definitions/79.html
]]
[2][ [https://gist.github.com/rodnt/9f7d368fac38cafa7334598ec94fb167]]
[3][ [https://www.tempest.com.br|
https://www.tempest.com.br/]|https://www.tempest.com.br/]

=====[ EOF ]===========================================================
--


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
PHPIPAM 1.4.4 Cross Site Request Forgery / Cross Site Scripting

https://3.bp.blogspot.com/-A9um4FlUYrw/WWlvH0fnNDI/AAAAAAAAILk/pA4dWsQKlcwBJHJ-2O0qL7e98i6zrXCWwCLcBGAs/s1600/h141.png
PHPIPAM version 1.4.4 suffers from cross site request forgery and cross site scripting vulnerabilities.

SHA-256 | 050c77ae0f13a5b4247218de44f8bf133ca516aae7da4d73aba802231bdde893

Download
=====[ Tempest Security Intelligence - ADV-03/2022
]==========================

PHPIPAM - Version 1.4.4

Author: Rodolfo Tavares

Tempest Security Intelligence - Recife, Pernambuco - Brazil

=====[ Table of Contents ]==================================================

* Overview
* Detailed description
* Timeline of disclosure
* Thanks & Acknowledgements
* References

=====[ Vulnerability Information
]=============================================

* Class: Improper Neutralization of Input During Web Page Generation
('Cross-Site Scripting') [CWE-79]
* CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

* Class: Cross-Site Request Forgery (CSRF) [CWE-352]
* CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
=====[ Overview ]========================================================

* System affected: PHPIPAM - Version 1.4.4
* Software Version: Version 1.4.4 (other versions may also be affected).
* Impact: PHPIPAM 1.4.4 is vulnerable to Cross-Site Request Forgery (CSRF)
and Cross-Site Scripting (XSS) via
app/admin/subnets/find_free_section_subnets.php. An attacker can exploit
this by injecting javascript code to coerce an admin user into performing
unintended actions.

=====[ Detailed description
]=================================================

The html codes below exploit vulnerabilities in the same way due to the
fact that both forms do not contain CSRF tokens and are vulnerable to XSS
attacks. Then an attacker can host the forms on their malicious host and
trick an administrator into visiting your page. If successful, the
javascript code will execute.

* [app/admin/subnets/find_free_section_subnets.php]
Exploit PHPIPAM
method="POST">
rodnt"
/>
=====[ Timeline of disclosure
]===============================================

13/Jan/2022 - Responsible disclosure was initiated with the vendor;

14/Jan/2022 - PHPIPAM confirmed the issues;

17/Jan/2022 - The vendor fixed the issues XSS and CSRF;

24/Mar/2022 - CVE reserved as CVE-2021-46426;

25/Mar/2022 - CVE assigned [5].

=====[ Thanks & Acknowledgements ]========================================

* Tempest Security Intelligence [4]

=====[ References ]=====================================================

[1] [
https://cwe.mitre.org/data/definitions/352.html|https://cwe.mitre.org/data/definitions/352.html
]

[2] [
https://cwe.mitre.org/data/definitions/79.html|https://cwe.mitre.org/data/definitions/79.html
]

[3] [
https://github.com/phpipam/phpipam/commit/6c1f72816d6ac634e9c174057e008717d959f351|https://github.com/phpipam/phpipam/commit/6c1f72816d6ac634e9c174057e008717d959f351
]

[4] [https://www.tempest.com.br|https://www.tempest.com.br/]

[5] [
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46426|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46426
]

[6][ Thanks to Celso (CGB) =)]

=====[ EOF ]===========================================================

--


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
SAP Application Server ABAP / ABAP Platform Code Injection / SQL Injection / Missing Authorization

___________________________
@hacking_Attack
@Hacking_Video

A Story of DOM XSS

Good day, everyone! This is my second article, this time on DOM XSS. An open redirection vulnerability was escalated to DOM XSS. If you…Continue reading on Medium »
Read more...

Bug Bounty Diaries #2

Hi guys! I’m back with a new blog and this is great because again… I learn a lot of things, specially about DNS, IP and things like that.Continue reading on Medium »
Read more...

Dark Reading: Attacks/Breaches
Majority of Kubernetes API Servers Exposed to the Public Internet

Shadowserver Foundation researchers find 380,000 open Kubernetes API servers.

Dark Reading: Attacks/Breaches
Dig Exits Stealth With $11M for Cloud Data Detection and Response Solution

CrowdStrike and CyberArk invest in Dig's seed round, which was led by Team8, alongside Merlin Ventures and chairs of MongoDB and Exabeam.

Dark Reading: Attacks/Breaches
Pro-Russian Information Operations Escalate in Ukraine War

In the three months since the war started, Russian operatives and those allied with the nation's interests have unleashed a deluge of disinformation and fake news to try and sow fear and confusion in Ukraine, security vendor says.