? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: portswigger.net Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-300x150.png VMware urges admins to patch critical auth bypass bug immediatelyAugust 3, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-4-300x150.png Thousand apps leak Twitter API keys, some allowing account hijacksAugust 2, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-3-300x150.png XSS vulnerabilities in Google Cloud, Google Play could lead to account hijacksAugust 1, 2022
Reading Time: 2 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Images-for-the-News-posts-2-1-300x150.png Microsoft SQL servers hacked to steal bandwidth with proxywareJuly 29, 2022
Reading Time: 4 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Jenkins security: Unpatched XSS, CSRF bugs included in latest plugin advisory first appeared on Black Hat Ethical Hacking.

hacking: security in practice
How do people spoof their number to a specific number?

I got calls from scammers pretending to be people in my contacts. How do they do that?

submitted by /u/Great_was_taken
[link] [comments]

hacking: security in practice
i think "Max Butler/Max Vision/Iceman" deserves a spot as one of the best hackers of all time

This man is Genghis Khan if he was a black hat hacker. He was a Cyber Security professional by day and evil hacker by night. His services were worth $110 an hour at the time (~2006).

He has did something I've never heard another hacker do ever... he went to black hat websites such as "DarkMarket" and "TalkCash" and stole email addresses, passwords, and login sessions, then deleted the databases. After that, he mass sent out emails to every (former) member of those sites and told them they were part of his new CardersMarket.com.

He then continued to run an underground empire that sold up to $2 billion dollars (!?) worth of stolen credit card info.

Like it or not Mr. Vision was an evil genius... he may not have hacked into 97 military databases but he's not your average "Dark Web" hacker/scammer or mid level pentester/cyber security researcher. Such a shame he's wastingll that time in jail when he could've been an Elon Musk or Jeff Bezos.

Now no one even talks about him. Remember guys, don't trade a chance at life long remembrance for one news headline...

Edit: hes not in prison anymore

submitted by /u/RubberDuckyOnAPi
[link] [comments]

This is how he could hijack Reddit accounts with just ONE click: a $10,000 bug bounty

Exploring Frans Rosén’s bypass of OAuth securityContinue reading on InfoSec Write-ups »
Read more...

This is how he could hijack Reddit accounts with just ONE click: a $10,000 bug bounty
https://infosecwriteups.com/this-is-how-he-could-hijack-reddit-accounts-with-just-one-click-a-10-000-bug-bounty-7fd8d54d5582?source=rss------bug_bounty-5

Exploring Frans Rosén’s bypass of OAuth securityContinue reading on InfoSec Write-ups » (https://infosecwriteups.com/this-is-how-he-could-hijack-reddit-accounts-with-just-one-click-a-10-000-bug-bounty-7fd8d54d5582?source=rss------bug_bounty-5)

This is how he could hijack Reddit accounts with just ONE click: a $10,000 bug bounty

Exploring Frans Rosén’s bypass of OAuth securityContinue reading on InfoSec Write-ups »
Read more...

Cirrusgo - A Fast Tool To Scan SAAS, PAAS App Written In Go
http://www.kitploit.com/2022/08/cirrusgo-fast-tool-to-scan-saas-paas.html

A fast tool to scan (https://www.kitploit.com/search/label/Scan) SAAS,PAAS App written in Go SAAS App Support : salesforce contentful (next version) Note flag -o output not working install : golang 1.18Ver go install -v github.com/Ph33rr/cirrusgo/cmd/cirrusgo@latest
or
go install -v github.com/Ph33rr/CirrusGo/cmd/cirrusgo@latest
Help: cirrusgo --help Define single URL to fuzz -l, --list Show App List -c, --check only check endpoint -V, --version Show current version -h, --help Display its help [cirrusgo [app] [options] ..] cirrusgo salesforce --help -u, --url Define single URL -c, --check only check endpoint -lobj, --listobj pull the object list. -gobj --getobj pull the object. -obj --objects set the object name. Default value is "User" object. Juicy Objects: Case,Account,User,Contact,Document,Cont entDocument,ContentVersion,ContentBody,CaseComment,Not e,Employee,Attachment,EmailMessage,CaseExternalDocumen t,Attachment,Lead,Name,EmailTemplate,EmailMessageRelation -gre --getrecord pull the Record id. -re --recordid set the recode id to dump the record -cw --chkWritable check all Writable objects -f, --full dump all pages of objects. --dump -H, --header Pass custom header (https://www.kitploit.com/search/label/Custom%20Header) to target -proxy, --proxy Use proxy to fuzz -o, --output File to save results [flags payload] [command: cirrusgo salesforce --payload options] -payload, --payload Generator (https://www.kitploit.com/search/label/Generator) payload (https://www.kitploit.com/search/label/Payload) for test manual Default "ObjectList" GetItems -obj set object -page set page -pages set pageSize GetRecord -re set recoder id WritableOBJ -obj set object SearchObj -obj set object -page set page -pages set pageSize AuraContext -fwuid set UID -App set AppName -markup set markup ObjectList no options Dump no options -h, --help Display its help '> ______ _ ______
/ ____/(_)_____ _____ __ __ _____ / ____/____
/ / / // ___// ___// / / // ___// / __ / __ \
/ /___ / // / / / / /_/ /(__ )/ /_/ // /_/ /
\____//_//_/ /_/ \__,_//____/ \____/ \____/ v0.0.1

cirrusgo --help

-u, --url Define single URL to fuzz
-l, --list Show App List
-c, --check only check endpoint
-V, --version Show current version
-h, --help Display its help

[cirrusgo [app] [options] ..]
cirrusgo salesforce --help

-u, --url Define single URL
-c, --check only check endpoint
-lobj, --listobj pull the object list.
-gobj --getobj pull the object.
-obj --objects set the object name. Default value is "User" object.
Juicy Objects: Case,Account,User,Contact,Document,Cont
entDocument,ContentVersion,ContentBody,CaseComment,Not
e,Employee,Attachment,EmailMessage,CaseExternalDocumen
t,Attachment,Lead,Name,EmailTemplate,EmailMessageRelation
-gre --getrecord pull the Record id.
-re --recordid set the recode id to dump the record
-cw --chkWritable check all Writable objects
-f, --full dump all pages of objects.
--dump
-H, --header Pass custom header to target
-proxy, --proxy Use proxy to fuzz

-o, --output File to save results

[flags payload]

[command: cirrusgo salesforce --payload options]
-payload, --payload Generator payload for test manual Default "ObjectList"

GetItems -obj set object
-page set page
-pages set pageSize
GetRecord -re set recoder id
WritableOBJ -obj set object
SearchObj -obj set object
-page set page
-pages set pageSize
AuraContext -fwuid set UID
-App set AppName
-markup set markup
ObjectList no options
Dump no options
-h, --help Display its help
Example : cirrusgo salesforce -u https://loclhost -gobj dump: cirrusgo salesforce -u https://localhost/ -f check Writable Objects: cirusgo salesforce -u https://localhost/ -cw

Download Cirrusgo (https://github.com/Ph33rr/cirrusgo)

KitPloit - PenTest Tools!
Cirrusgo - A Fast Tool To Scan SAAS, PAAS App Written In Go

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi86EhCFbOLT-YRbgxWvkf_H9XLy0Bzmk7RoA_a2c45PQ55r8qEXWB5fhnwxpNuxMG4hHDjwR_rTd4up9H-cmVsEI6RGKijUGnS-uV7bmXG0Ni2-jT5agL2vp8yXI1BLG0arI-ZWzbqsk6GcpdttpP3aXHWBJX9ENQuVFoyOcxLXJkdv3wRNQ2Yyh4T/w640-h482/cirrusgo.png A fast tool to scan SAAS,PAAS App written in Go

SAAS App Support :

* salesforce
* contentful (next version)

Note flag -o output not working

install : golang 1.18Ver go install -v github.com/Ph33rr/cirrusgo/cmd/cirrusgo@latest
or
go install -v github.com/Ph33rr/CirrusGo/cmd/cirrusgo@latestHelp: cirrusgo --helpPass custom header to target -proxy, --proxy <urlUse proxy to fuzz -o, --output <fileFile to save results [flags payload] [command: cirrusgo salesforce --payload options] -payload, --payload Generator payload for test manual Default "ObjectList" GetItems -obj set object -page set page -pages set pageSize GetRecord -re set recoder id WritableOBJ -obj set object SearchObj -obj set object -page set page -pages set pageSize AuraContext -fwuid set UID -App set AppName -markup set markup ObjectList no options Dump no options -h, --help Display its help ">______ _ ______
/ ____/(_)_____ _____ __ __ _____ / ____/____
/ / / // ___// ___// / / // ___// / __ / __ \
/ /___ / // / / / / /_/ /(__ )/ /_/ // /_/ /
\____//_//_/ /_/ \__,_//____/ \____/ \____/ v0.0.1

cirrusgo --help

-u, --url <urlDefine single URL to fuzz
-l, --list Show App List
-c, --check only check endpoint
-V, --version Show current version
-h, --help Display its help

[cirrusgo [app] [options] ..]
cirrusgo salesforce --help

-u, --url <urlDefine single URL
-c, --check only check endpoint
-lobj, --listobj pull the object list.
-gobj --getobj pull the object.
-obj --objects set the object name. Default value is "User" object.
Juicy Objects: Case,Account,User,Contact,Document,Cont
entDocument,ContentVersion,ContentBody,CaseComment,Not
e,Employee,Attachment,EmailMessage,CaseExternalDocumen
t,Attachment,Lead,Name,EmailTemplate,EmailMessageRelation
-gre --getrecord pull the Record id.
-re --recordid set the recode id to dump the record
-cw --chkWritable check all Writable objects
-f, --full dump all pages of objects.
--dump
-H, --header
Pass custom header to target
-proxy, --proxy <urlUse proxy to fuzz

-o, --output <fileFile to save results

[flags payload]
[command: cirrusgo salesforce --payload options]
-payload, --payload Generator payload for test manual Default "ObjectList"

GetItems -obj set object
-page set page
-pages set pageSize
GetRecord -re set recoder id
WritableOBJ -obj set object
SearchObj -obj set object
-page set page
-pages set pageSize
AuraContext -fwuid set UID
-App set AppName
-markup set markup
ObjectList no options
Dump no options
-h, --help Display its help
Example : cirrusgo salesforce -u https://loclhost -gobjdump: cirrusgo salesforce -u https://localhost/ -fcheck Writable Objects: cirusgo salesforce -u https://localhost/ -cwDownload Cirrusgo

Dark Reading: Attacks/Breaches
Ping Identity to Go Private After $2.8B Acquisition

The identity-services company is being acquired by Thoma Bravo software investment for cash, before being delisted.

What is the fastest way to get into bug bounty hunting with zero experience ?
https://medium.com/@satyampathania14/what-is-the-fastest-way-to-get-into-bug-bounty-hunting-with-zero-experience-ea6c748910b7?source=rss------bug_bounty-5

author :- Satyam pathaniaContinue reading on Medium » (https://medium.com/@satyampathania14/what-is-the-fastest-way-to-get-into-bug-bounty-hunting-with-zero-experience-ea6c748910b7?source=rss------bug_bounty-5)

Moonbeam Team släpper en brådskande säkerhetspatch för felet med trunkning av heltal
https://medium.com/@MoonbeamiSverige/moonbeam-team-sl%C3%A4pper-en-br%C3%A5dskande-s%C3%A4kerhetspatch-f%C3%B6r-felet-med-trunkning-av-heltal-63f97d7bc068?source=rss------bug_bounty-5

Aug 1, 2022Continue reading on Medium » (https://medium.com/@MoonbeamiSverige/moonbeam-team-sl%C3%A4pper-en-br%C3%A5dskande-s%C3%A4kerhetspatch-f%C3%B6r-felet-med-trunkning-av-heltal-63f97d7bc068?source=rss------bug_bounty-5)