in network intrusions.

Tenable highlights the scenario of ransomware attacks where the threat actors could leverage CVE-2022-33675 to wipe backups and make free data restoration impossible. However, this is just one of the many examples.

Microsoft has also published an advisory to provide an overview of all the issues fixed in ASR this month, mentioning SQL injection and remote code execution in the impact section.

For these attacks, administrative credentials on the VMs are required; hence, CVE-2022-33675 can’t be used as a funnel to widen the scope of impact, but it could help lay the ground for acquiring those credentials on the target.

To address all security issues, make sure to apply this month’s updates. Those who can’t apply the patches could mitigate the risk by manually changing the write permission setting on the impacted directory. ​Trending: New RedAlert Ransomware targets Windows, Linux VMware ESXi servers
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/FTDZNGKMCJPIDKR5RE7MSLIMB4-scaled-300x150.jpg News – new template postJuly 13, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/remotelyunlock-honda-1-1-300x150.jpg Hackers Say They Can Unlock and Start Honda Cars RemotelyJuly 12, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/ezgif.com-gif-maker-3-300x150.jpg Hackers Used Fake LinkedIn Job Offer to Hack Off $625M from Axie InfinityJuly 11, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/ban6-Recovered-Recovered-Recovered-300x150.png New stealthy OrBit malware steals data from Linux devicesJuly 8, 2022
Reading Time: 4 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Microsoft fixes dozens of Azure Site Recovery privilege escalation bugs first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

COLIZEUM Bug-Bounty Program
https://medium.com/@colizeum/colizeum-bug-bounty-program-717dc437d3c0?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Report a bug and get Whitelisted for Colizeum ELITE NFT sale, this is an opportunity to get hands-on ELITE NFT before anybody else does.Continue reading on Medium » (https://medium.com/@colizeum/colizeum-bug-bounty-program-717dc437d3c0?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

COLIZEUM Bug-Bounty Program

Report a bug and get Whitelisted for Colizeum ELITE NFT sale, this is an opportunity to get hands-on ELITE NFT before anybody else does.Continue reading on Medium »
Read more...

Free4All Information Technology and Cyber Security Resources
https://www.reddit.com/r/redteamsec/comments/vxzdut/free4all_information_technology_and_cyber/

submitted by /u/cybersocdm (https://www.reddit.com/user/cybersocdm)
[link] (https://www.reddit.com/user/cybersocdm/comments/vxtkwt/free4all_information_technology_and_cyber/) [comments] (https://www.reddit.com/r/redteamsec/comments/vxzdut/free4all_information_technology_and_cyber/)

___________________________
@hacking_Attack
@Hacking_Video

How to find Origin IP

வணக்கம் மக்களே!!! I’m Boopathi. In this blog, I’m gonna discuss about Origin IPContinue reading on Medium »
Read more...

Dark Reading: Attacks/Breaches
QuickBooks Vishing Scam Targets Small Businesses

Businesses receive an invoice via email with a credit card charge and are asked to call a fake number and hand over personal information to receive a refund.

Hacking on Medium
How to hack IOS/ANDROID and any DAtabase

Even though you have said your marriage vows and promised to love and trust each other till eternity, the fact still remains that you and…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
‍IW Weekly #9: Web3 Hacking, Leveraging Google Dorks, Python Flaws, and more…

https://cdn-images-1.medium.com/max/2000/1*lOAxT5BZxjAjapoJG0na_Q.jpeg
Hey 👋

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The PUBG Mobile 2.1

https://cdn-images-1.medium.com/max/2208/1*Sg9YwDs-k9LmBL1-mGEouQ.jpeg
PUBG MOBILE 2.1 Update Announcement. PUBG MOBILE will begin pushing out the update on July 13 at 11:00 (UTC +0).

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Bypass-Url-Parser - Tool That Tests Many URL Bypasses To Reach A 40X Protected Page

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Reverse engineering a react native app.

In a RN app logics are stored in index,android,bundle (i heard correct me if i am wrong). So I came up with 2/3 apps made with RN. I reached to MYapp.apk -> assets which contained 'android.index.bundle' that was encrypted. I tried npm packages like react-native-decompiler but it threw error mentioning binary encrypted packages can't be decrypted. Am I going wrong somewhere? I checked smali files found nothing. Now how am I supposed to modify it.?

Thanks.

submitted by /u/TemporaryAbrocoma468
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Bypass-Url-Parser - Tool That Tests Many URL Bypasses To Reach A 40X Protected Page
http://www.kitploit.com/2022/07/bypass-url-parser-tool-that-tests-many.html

___________________________
@hacking_Attack
@Hacking_Video

Tool that tests MANY url bypasses to reach a 40X protected page. If you wonder why this code is nothing but a dirty curl wrapper, here's why: Most of the python requests do url/path/parameter encoding/decoding, and I hate this. If I submit raw chars, I want raw chars to be sent. If I send a weird path, I want it weird, not normalized. This is surprisingly hard to achieve in python without loosing all of the lib goodies like parsing, ssl/tls (https://www.kitploit.com/search/label/SSL/TLS) encapsulation and so on.
So, be like me, use curl as a backend, it's gonna be just fine.
Setup for bypass.py # Deps
sudo apt install -y bat curl virtualenv python3
# Tool
virtualenv -p python3 .py3
source .py3/bin/activate
pip install -r requirements.txt
./bypass-url-parser.py --url "http://127.0.0.1/juicy_403_endpoint/" Usage Expected result 2022-05-10 15:54:03 work bup[738125] INFO === Config ===
2022-05-10 15:54:03 work bup[738125] INFO debug: False
2022-05-10 15:54:03 work bup[738125] INFO url: http://thinkloveshare.com/api/jolokia/list
2022-05-10 15:54:03 work bup[738125] INFO outdir: /tmp/tmp48drf_ie-bypass-url-parser
2022-05-10 15:54:03 work bup[738125] INFO threads: 20
2022-05-10 15:54:03 work bup[738125] INFO timeout: 2
2022-05-10 15:54:03 work bup[738125] INFO headers: {}
2022-05-10 15:54:03 work bup[738125] WARNING Stage: generate_curls
2022-05-10 15:54:03 work bup[738125] INFO base_url: http://thinkloveshare.com
2022-05-10 15:54:03 work bup[738125] INFO base_path: /api/jolokia/list
2022-05-10 15:54:03 work bup[738125] WARNING Stage: run_curls
2022-05-10 15:54:03 work bup[738125] INFO Current: curl -sS -kgi --path-as-is -H 'User-Agent: Mozilla/5.0 (X11; Linux (https://www.kitploit.com/search/label/Linux) x86_64 ) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36' -w '\nStatus: %{http_code}, Length: %{size_download}' 'http://thinkloveshare.com/api/jolokia/list'
2022-05-10 15:54:03 work bup[738125] INFO Current: curl -sS -kgi --path-as-is -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36' -w '\nStatus: %{http_code}, Length: %{size_download}' -X 'CONNECT' 'http://thinkloveshare.com/api/jolokia/list'
2022-05-10 15:54:03 work bup[738125] INFO Current: curl -sS -kgi --path-as-is -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36' -w '\nStatus: %{http_code}, Length: %{size_download}' -X 'GET' 'http://thinkloveshare.com/api/jolokia/list'
2022-05-10 15:54:03 work bup[738125] INFO Current: curl -sS -kgi --path-as-is -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 S afari/537.36' -w '\nStatus: %{http_code}, Length: %{size_download}' -X 'LOCK' 'http://thinkloveshare.com/api/jolokia/list'
2022-05-10 15:54:03 work bup[738125] INFO Current: curl -sS -kgi --path-as-is -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36' -w '\nStatus: %{http_code}, Length: %{size_download}' -X 'OPTIONS' 'http://thinkloveshare.com/api/jolokia/list'
2022-05-10 15:54:03 work bup[738125] INFO Current: curl -sS -kgi --path-as-is -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36' -w '\nStatus: %{http_code}, Length: %{size_download}' -X 'PATCH' 'http://thinkloveshare.com/api/jolokia/list'
2022-05-10 15:54:03 work bup[738125] INFO Current: curl -sS -kgi --path-as-is -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36' -w '\nStatus: %{http_code}, Length: % {size_download}' -X 'POST' 'http://thinkloveshare.com/api/jolokia/list'

___________________________
@hacking_Attack
@Hacking_Video