Black Hat Ethical Hacking
Jenkins security: Unpatched XSS, CSRF bugs included in latest plugin advisory

Jenkins security: Unpatched XSS, CSRF bugs included in latest plugin advisoryPost Views: 65 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes Open source DevOps platform Jenkins is warning users of unpatched security vulnerabilities impacting more than a dozen plugins.A leading open source automation server, Jenkins provides thousands of plugins to support building, deploying, and automating projects.

The organization’s latest security advisory lists a total of 27 plugin vulnerabilities, five of which were deemed to be ‘high’ impact and the majority of which remain unpatched.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course High fiveFirst on the list of high impact bugs – all of which were unfixed at the time of writing – is a cross-site request forgery (CSRF) vulnerability in the Coverity plugin (CVE-2022-36920).

It was found that the plugin fails to perform a permission check in an HTTP endpoint. In addition, this HTTP endpoint does not require POST requests, opening the door to CSRF attacks.

Meanwhile, an arbitrary file write vulnerability in the CLIF Performance Testing Plugin (CVE-2022-36894) allows attackers with ‘Overall/Read’ permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content.

Stored cross-site scripting (XSS) flaws were also discovered in the Dynamic Extended Choice Parameter plugin (CVE-2022-36902) and Maven Metadata plugin (CVE-2022-36905), along with a reflected XSS vulnerability in the Lucene-Search plugin (CVE-2022-36922).

​
Trending: The Difference between White-Box and Black-Box Pentesting Trending: Offensive Security Tool: DDoS-Layer7-bheh Getting the word outOf the 27 plugin vulnerabilities listed in the latest Jenkins security advisory, 18 remained unpatched and are effectively zero-days.

Discussing the team’s decision to disclose these issues to the community in lieu of any fixes, Jenkins security officer Wadeck Follonier told The Daily Swig: “The main objective of the Jenkins security team is to ensure the Jenkins plugin ecosystem is as secure as possible.

“With a plugin ecosystem as big as ours, it isn’t a surprise that not every plugin is maintained all the time, and maintainers sometimes cannot be contacted, do not respond, or tell us they’re no longer able to maintain the plugin.

“In those cases, we analyze the vulnerability in depth, write up a detailed description, and announce it in a security advisory with other, fixed vulnerabilities.”

Follonier added: “We believe that announcing vulnerabilities without a fix is the best solution for a difficult problem, as it allows administrators to carefully consider their continued use of the affected plugin.

“Besides the Jenkins Advisories mailing list and our social channels, we inform administrators about vulnerabilities affecting their Jenkins instance directly on the UI immediately after publishing an advisory, so every Jenkins administrator gets informed about this.

“Our recommendation to Jenkins administrators is to read our security advisories to understand whether they’re impacted,” Follonier said. “A lot of vulnerabilities are irrelevant to instances with only a single administrator user that are inaccessible to others, for example.

“Of course, if they are unsure whether they are affected, the safest thing to do is to uninstall the plugin.”
Trending: GitHub introduces 2FA and quality of life improvements for npm Are u a security researcher[...]

? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: portswigger.net Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-300x150.png VMware urges admins to patch critical auth bypass bug immediatelyAugust 3, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-4-300x150.png Thousand apps leak Twitter API keys, some allowing account hijacksAugust 2, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-3-300x150.png XSS vulnerabilities in Google Cloud, Google Play could lead to account hijacksAugust 1, 2022
Reading Time: 2 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Images-for-the-News-posts-2-1-300x150.png Microsoft SQL servers hacked to steal bandwidth with proxywareJuly 29, 2022
Reading Time: 4 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Jenkins security: Unpatched XSS, CSRF bugs included in latest plugin advisory first appeared on Black Hat Ethical Hacking.

hacking: security in practice
How do people spoof their number to a specific number?

I got calls from scammers pretending to be people in my contacts. How do they do that?

submitted by /u/Great_was_taken
[link] [comments]

hacking: security in practice
i think "Max Butler/Max Vision/Iceman" deserves a spot as one of the best hackers of all time

This man is Genghis Khan if he was a black hat hacker. He was a Cyber Security professional by day and evil hacker by night. His services were worth $110 an hour at the time (~2006).

He has did something I've never heard another hacker do ever... he went to black hat websites such as "DarkMarket" and "TalkCash" and stole email addresses, passwords, and login sessions, then deleted the databases. After that, he mass sent out emails to every (former) member of those sites and told them they were part of his new CardersMarket.com.

He then continued to run an underground empire that sold up to $2 billion dollars (!?) worth of stolen credit card info.

Like it or not Mr. Vision was an evil genius... he may not have hacked into 97 military databases but he's not your average "Dark Web" hacker/scammer or mid level pentester/cyber security researcher. Such a shame he's wastingll that time in jail when he could've been an Elon Musk or Jeff Bezos.

Now no one even talks about him. Remember guys, don't trade a chance at life long remembrance for one news headline...

Edit: hes not in prison anymore

submitted by /u/RubberDuckyOnAPi
[link] [comments]

This is how he could hijack Reddit accounts with just ONE click: a $10,000 bug bounty

Exploring Frans Rosén’s bypass of OAuth securityContinue reading on InfoSec Write-ups »
Read more...

This is how he could hijack Reddit accounts with just ONE click: a $10,000 bug bounty
https://infosecwriteups.com/this-is-how-he-could-hijack-reddit-accounts-with-just-one-click-a-10-000-bug-bounty-7fd8d54d5582?source=rss------bug_bounty-5

Exploring Frans Rosén’s bypass of OAuth securityContinue reading on InfoSec Write-ups » (https://infosecwriteups.com/this-is-how-he-could-hijack-reddit-accounts-with-just-one-click-a-10-000-bug-bounty-7fd8d54d5582?source=rss------bug_bounty-5)

This is how he could hijack Reddit accounts with just ONE click: a $10,000 bug bounty

Exploring Frans Rosén’s bypass of OAuth securityContinue reading on InfoSec Write-ups »
Read more...

Cirrusgo - A Fast Tool To Scan SAAS, PAAS App Written In Go
http://www.kitploit.com/2022/08/cirrusgo-fast-tool-to-scan-saas-paas.html

A fast tool to scan (https://www.kitploit.com/search/label/Scan) SAAS,PAAS App written in Go SAAS App Support : salesforce contentful (next version) Note flag -o output not working install : golang 1.18Ver go install -v github.com/Ph33rr/cirrusgo/cmd/cirrusgo@latest
or
go install -v github.com/Ph33rr/CirrusGo/cmd/cirrusgo@latest
Help: cirrusgo --help Define single URL to fuzz -l, --list Show App List -c, --check only check endpoint -V, --version Show current version -h, --help Display its help [cirrusgo [app] [options] ..] cirrusgo salesforce --help -u, --url Define single URL -c, --check only check endpoint -lobj, --listobj pull the object list. -gobj --getobj pull the object. -obj --objects set the object name. Default value is "User" object. Juicy Objects: Case,Account,User,Contact,Document,Cont entDocument,ContentVersion,ContentBody,CaseComment,Not e,Employee,Attachment,EmailMessage,CaseExternalDocumen t,Attachment,Lead,Name,EmailTemplate,EmailMessageRelation -gre --getrecord pull the Record id. -re --recordid set the recode id to dump the record -cw --chkWritable check all Writable objects -f, --full dump all pages of objects. --dump -H, --header Pass custom header (https://www.kitploit.com/search/label/Custom%20Header) to target -proxy, --proxy Use proxy to fuzz -o, --output File to save results [flags payload] [command: cirrusgo salesforce --payload options] -payload, --payload Generator (https://www.kitploit.com/search/label/Generator) payload (https://www.kitploit.com/search/label/Payload) for test manual Default "ObjectList" GetItems -obj set object -page set page -pages set pageSize GetRecord -re set recoder id WritableOBJ -obj set object SearchObj -obj set object -page set page -pages set pageSize AuraContext -fwuid set UID -App set AppName -markup set markup ObjectList no options Dump no options -h, --help Display its help '> ______ _ ______
/ ____/(_)_____ _____ __ __ _____ / ____/____
/ / / // ___// ___// / / // ___// / __ / __ \
/ /___ / // / / / / /_/ /(__ )/ /_/ // /_/ /
\____//_//_/ /_/ \__,_//____/ \____/ \____/ v0.0.1

cirrusgo --help

-u, --url Define single URL to fuzz
-l, --list Show App List
-c, --check only check endpoint
-V, --version Show current version
-h, --help Display its help

[cirrusgo [app] [options] ..]
cirrusgo salesforce --help

-u, --url Define single URL
-c, --check only check endpoint
-lobj, --listobj pull the object list.
-gobj --getobj pull the object.
-obj --objects set the object name. Default value is "User" object.
Juicy Objects: Case,Account,User,Contact,Document,Cont
entDocument,ContentVersion,ContentBody,CaseComment,Not
e,Employee,Attachment,EmailMessage,CaseExternalDocumen
t,Attachment,Lead,Name,EmailTemplate,EmailMessageRelation
-gre --getrecord pull the Record id.
-re --recordid set the recode id to dump the record
-cw --chkWritable check all Writable objects
-f, --full dump all pages of objects.
--dump
-H, --header Pass custom header to target
-proxy, --proxy Use proxy to fuzz

-o, --output File to save results

[flags payload]

[command: cirrusgo salesforce --payload options]
-payload, --payload Generator payload for test manual Default "ObjectList"

GetItems -obj set object
-page set page
-pages set pageSize
GetRecord -re set recoder id
WritableOBJ -obj set object
SearchObj -obj set object
-page set page
-pages set pageSize
AuraContext -fwuid set UID
-App set AppName
-markup set markup
ObjectList no options
Dump no options
-h, --help Display its help
Example : cirrusgo salesforce -u https://loclhost -gobj dump: cirrusgo salesforce -u https://localhost/ -f check Writable Objects: cirusgo salesforce -u https://localhost/ -cw

Download Cirrusgo (https://github.com/Ph33rr/cirrusgo)

KitPloit - PenTest Tools!
Cirrusgo - A Fast Tool To Scan SAAS, PAAS App Written In Go

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi86EhCFbOLT-YRbgxWvkf_H9XLy0Bzmk7RoA_a2c45PQ55r8qEXWB5fhnwxpNuxMG4hHDjwR_rTd4up9H-cmVsEI6RGKijUGnS-uV7bmXG0Ni2-jT5agL2vp8yXI1BLG0arI-ZWzbqsk6GcpdttpP3aXHWBJX9ENQuVFoyOcxLXJkdv3wRNQ2Yyh4T/w640-h482/cirrusgo.png A fast tool to scan SAAS,PAAS App written in Go

SAAS App Support :

* salesforce
* contentful (next version)

Note flag -o output not working

install : golang 1.18Ver go install -v github.com/Ph33rr/cirrusgo/cmd/cirrusgo@latest
or
go install -v github.com/Ph33rr/CirrusGo/cmd/cirrusgo@latestHelp: cirrusgo --helpPass custom header to target -proxy, --proxy <urlUse proxy to fuzz -o, --output <fileFile to save results [flags payload] [command: cirrusgo salesforce --payload options] -payload, --payload Generator payload for test manual Default "ObjectList" GetItems -obj set object -page set page -pages set pageSize GetRecord -re set recoder id WritableOBJ -obj set object SearchObj -obj set object -page set page -pages set pageSize AuraContext -fwuid set UID -App set AppName -markup set markup ObjectList no options Dump no options -h, --help Display its help ">______ _ ______
/ ____/(_)_____ _____ __ __ _____ / ____/____
/ / / // ___// ___// / / // ___// / __ / __ \
/ /___ / // / / / / /_/ /(__ )/ /_/ // /_/ /
\____//_//_/ /_/ \__,_//____/ \____/ \____/ v0.0.1

cirrusgo --help

-u, --url <urlDefine single URL to fuzz
-l, --list Show App List
-c, --check only check endpoint
-V, --version Show current version
-h, --help Display its help

[cirrusgo [app] [options] ..]
cirrusgo salesforce --help

-u, --url <urlDefine single URL
-c, --check only check endpoint
-lobj, --listobj pull the object list.
-gobj --getobj pull the object.
-obj --objects set the object name. Default value is "User" object.
Juicy Objects: Case,Account,User,Contact,Document,Cont
entDocument,ContentVersion,ContentBody,CaseComment,Not
e,Employee,Attachment,EmailMessage,CaseExternalDocumen
t,Attachment,Lead,Name,EmailTemplate,EmailMessageRelation
-gre --getrecord pull the Record id.
-re --recordid set the recode id to dump the record
-cw --chkWritable check all Writable objects
-f, --full dump all pages of objects.
--dump
-H, --header
Pass custom header to target
-proxy, --proxy <urlUse proxy to fuzz

-o, --output <fileFile to save results

[flags payload]
[command: cirrusgo salesforce --payload options]
-payload, --payload Generator payload for test manual Default "ObjectList"

GetItems -obj set object
-page set page
-pages set pageSize
GetRecord -re set recoder id
WritableOBJ -obj set object
SearchObj -obj set object
-page set page
-pages set pageSize
AuraContext -fwuid set UID
-App set AppName
-markup set markup
ObjectList no options
Dump no options
-h, --help Display its help
Example : cirrusgo salesforce -u https://loclhost -gobjdump: cirrusgo salesforce -u https://localhost/ -fcheck Writable Objects: cirusgo salesforce -u https://localhost/ -cwDownload Cirrusgo

Dark Reading: Attacks/Breaches
Ping Identity to Go Private After $2.8B Acquisition

The identity-services company is being acquired by Thoma Bravo software investment for cash, before being delisted.

What is the fastest way to get into bug bounty hunting with zero experience ?
https://medium.com/@satyampathania14/what-is-the-fastest-way-to-get-into-bug-bounty-hunting-with-zero-experience-ea6c748910b7?source=rss------bug_bounty-5

author :- Satyam pathaniaContinue reading on Medium » (https://medium.com/@satyampathania14/what-is-the-fastest-way-to-get-into-bug-bounty-hunting-with-zero-experience-ea6c748910b7?source=rss------bug_bounty-5)

Moonbeam Team släpper en brådskande säkerhetspatch för felet med trunkning av heltal
https://medium.com/@MoonbeamiSverige/moonbeam-team-sl%C3%A4pper-en-br%C3%A5dskande-s%C3%A4kerhetspatch-f%C3%B6r-felet-med-trunkning-av-heltal-63f97d7bc068?source=rss------bug_bounty-5