Hacking Articles Tips Tricks Videos Tutorials

KitPloit - PenTest Tools!
secureCodeBox (SCB) - Continuous Secure Delivery Out Of The Box

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjpwre11_amxA_1EmSRW3xYinkM1wcCWlqU3HEBRcZwfjXT0K0TM6za0iHQaAPEBBwzjxpLUrWpRfvR1LubDQ_ORtPZ_KzG7LbJe-oeVZMGLCo_nW6Q_oP0PYwdh5L3XrUfD7iDGv3yi9wMriX2gdeWUjuIZa3kz7EK9RNgv-0upITJ_b_pwF-jXNNf/w640-h192/secureCodeBox_01.png secureCodeBox is a kubernetes based, modularized toolchain for continuous security scans of your software project. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box.
For additional documentation aspects please have a look at our documentation website: Purpose of this ProjectThe typical way to ensure application security is to hire a security specialist (aka penetration tester) at some point in your project to check the application for security bugs and vulnerabilities. Usually, this check is done at a later stage of the project and has two major drawbacks:

1. Nowadays, a lot of projects do continuous delivery, which means the developers deploy new versions multiple times each day. The penetration tester is only able to check a single snapshot, but some further commits could introduce new security issues. To ensure ongoing application security, the penetration tester should also continuously test the application. Unfortunately, such an approach is rarely financially feasible.
2. Due to a typically time boxed analysis, the penetration tester has to focus on trivial security issues (low-hanging fruit) and therefore will probably not address the serious, non-obvious ones.

With the secureCodeBox we provide a toolchain for continuous scanning of applications to find the low-hanging fruit issues early in the development process and free the resources of the penetration tester to concentrate on the major security issues. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjr089tx55en0Yks-nV5OV7HLNVWrIS1anoSdUcmXEGUxp1B15e2bCei3MmnXejelHS6X5FMt_eia-NybDMRBps6rGEwRRRAQNnAkzuCwtfF2IitMMS7sVD1zl6jT2yg9VTKtW7dxOdW5cXeK6JgBV-QlaJhbtgc11hUTjKkkmVo1kqIuMOMBI7ck7h/w640-h352/secureCodeBox_02.jpg The purpose of secureCodeBox is not to replace the penetration testers or make them obsolete. We strongly recommend to run extensive tests by experienced penetration testers on all your applications.

Important note: The secureCodeBox is no simple one-button-click-solution! You must have a deep understanding of security and how to configure the scanners. Furthermore, an understanding of the scan results and how to interpret them is also necessary.

There is a German article about Security DevOps – Angreifern (immer) einen Schritt voraus in the software engineering journal OBJEKTSpektrum. QuickstartYou can find resources to help you get started on our documentation website including instruction on how to install the secureCodeBox and guides to help you run your first scans with it. Architecture Overviewhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhuVQ6ViPNeZX5rw321Q6LAyCZ4fMiKLKTPzqi49y0rhJ-gcuQl8CTgDIZrNJOpZXG82YGcC7d-Z-GWKfYRzKXFQdhFwPIC371EG8JXCTnx1agPYS2p49jOb2NfeLThGkKaHIqsS3Gau7pbsYb6J6bASxHxobY904Q9bNgw3qYTJG5Q7h7XT9VTCcUP/w640-h300/secureCodeBox_03.png UpgradingFor the steps required for upgrading your secureCodeBox installation, see Upgrading. LicenseCode of secureCodeBox is licensed under the Apache License 2.0. CommunityYou are welcome, please join us on...



* GitHub
* Slack
* Twitter

secureCodeBox is an official OWASP project. Author InformationSponsored and maintained by iteratec GmbH - secureCodeBox.io Download secureCodeBox

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

secureCodeBox (SCB) - Continuous Secure Delivery Out Of The Box

3 viewsedited 15:12

Step 11: Attacking Web Applications with Ffuf

As of starting this one, it’s Monday 27th June and my second to last day in work.Continue reading on Medium »
Read more...

3 views15:53

Hacking Articles Tips Tricks Videos Tutorials

Step 11: Attacking Web Applications with Ffuf
https://medium.com/@R4v3ncl4w/step-11-attacking-web-applications-with-ffuf-7136b9c015aa?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Medium

Step 11: Attacking Web Applications with Ffuf

As of starting this one, it’s Monday 27th June and my second to last day in work. Gotten quite a lot of academy stuff done as the last week…

4 viewsedited 16:13

Hacking Articles Tips Tricks Videos Tutorials

4 views16:13

Hacking Articles Tips Tricks Videos Tutorials

As of starting this one, it’s Monday 27th June and my second to last day in work.Continue reading on Medium » (https://medium.com/@R4v3ncl4w/step-11-attacking-web-applications-with-ffuf-7136b9c015aa?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Medium

Step 11: Attacking Web Applications with Ffuf

As of starting this one, it’s Monday 27th June and my second to last day in work. Gotten quite a lot of academy stuff done as the last week…

4 viewsedited 16:13

Hacking Articles Tips Tricks Videos Tutorials

4 views16:15

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Zoo Management System 1.0 Cross Site Scripting

https://1.bp.blogspot.com/-vtYXiq7PjFk/WWlvT3pSItI/AAAAAAAAIN4/S7SZq03xxCsAAYdYEaQwiY4Z64tRJ_WvQCLcBGAs/s1600/h43.png
Zoo Management System version suffers from a persistent cross site scripting vulnerability.

SHA-256 | 874927867e112ca658246011a5944207d41bca46257526c4396360f62c837087

Download

# Exploit Title: Zoo Management System 1.0 - Stored Cross-Site-Scripting (XSS)
# Date: 05/26/2022
# Exploit Author: Angelo Pio Amirante
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15344/zoo-management-system-phpoop-free-source-code.html
# Version: 1.0
# Tested on: Server: XAMPP

# Description:
Zoo Management System 1.0 is vulnerable to a stored cross site scripting in “Add Classification” functionality of the admin panel.

# Exploit:
1)Goto: http://localhost/admin/public_html/admin_login and login with the provided credentials
2)Goto: http://localhost/admin/public_html/save_classification
3)The “Classification Display Name” and “Classification Table Name” are both vulnerable so you can put in one of them
4)Goto: http://localhost/admin/public_html/view_classifications
5) Stored XSS payload is fired

# Image Poc:
https://ibb.co/FXc5zLt
https://ibb.co/CtFSQrQ

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Zoo Management System 1.0 Cross Site Scripting

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

5 viewsedited 16:15

Hacking Articles Tips Tricks Videos Tutorials

3 views16:16

About

Blog

Apps

Platform