Bringing Out of Scope, In Scope
https://meispi.medium.com/bringing-out-of-scope-in-scope-dc19ee17dd6?source=rss------bug_bounty-5

We are all aware of the CSRF on Login form being out of scope in almost all of the bug bounty programs. This post is about chaining this…Continue reading on Medium » (https://meispi.medium.com/bringing-out-of-scope-in-scope-dc19ee17dd6?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
PentestBro : Port Scanning, Banner Grabbing & Web Enumeration Into One Tool

Experimental tool for Windows. PentestBro combines subdomain scans, whois, port scanning, banner grabbing and web enumeration into one tool. Uses subdomain list of SecLists. Uses nmap service probes for banner grabbing. Uses list of paths for web enumeration. Example scan of “www.ccc.de“ Scanned subdomain, IPs and ports Grabbed banner for each IP and port whois […]

The post PentestBro : Port Scanning, Banner Grabbing & Web Enumeration Into One Tool appeared first on Kali Linux Tutorials.

___________________________
@hacking_Attack
@Hacking_Video

Bug Bounty on Medium
How I hacked into India’s top matrimonial website and earned amazon gift card worth 10K INR.

https://cdn-images-1.medium.com/max/1185/1*PRKIv9mGEbo5ickHdOW7YA.png
Hey friends,

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

How to find that BadAss IDOR

Hey there, my name is karan sharma. And i’m back with a story of IDOR and why i think you should know about it.Continue reading on Medium »
Read more...

Hacking on Medium
How I hacked into India’s top matrimonial website and earned amazon gift card worth 10K INR.

https://cdn-images-1.medium.com/max/1185/1*PRKIv9mGEbo5ickHdOW7YA.png
Hey friends,

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Internet पर आपकी इन गलतियों से आपको कोई भी कर सकता है । Hacked With these mistakes on the internet…

https://cdn-images-1.medium.com/max/1282/0*lQJOqtLIli4WaRem.jpg
आज के टाइम सभी internet use करते है और रोज़ तरह तरह की web sites को visite करते है लेकिन बोहोत लोगो को http ओर https के difference का पता…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Command execution: OWASP top vulnerability

https://cdn-images-1.medium.com/max/2600/1*JYgwaEFfqJre6bhC7u-Qiw.jpeg
what is command execution?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

5. SSH Socks5 Proxy Tunneling with Dynamic Ports.mp4

Watch Full Course :- https://t.me/joinchat/Sye7C3tuRFfA10yN

🔰 Todays findings 🔰

New QNAP NAS Flaws Exploited In Recent Ransomware Attacks - Patch It!
https://thehackernews.com/2021/04/new-qnap-nas-flaws-exploited-in-recent.html

Google Released Chrome 90 With The Fixes Of Zero-Day Flaw – Update Your Chrome Immediately
https://gbhackers.com/google-released-chrome-90-with-the-fixes-of-zero-day-flaw-update-your-chrome-immediately/

S3 Account Search
https://github.com/WeAreCloudar/s3-account-search

Designing sockfuzzer, a network syscall fuzzer for XNU
https://googleprojectzero.blogspot.com/2021/04/designing-sockfuzzer-network-syscall.html


Duo Two-factor Authentication Bypass
https://sensepost.com/blog/2021/duo-two-factor-authentication-bypass/

___________________________
@hacking_Attack
@Hacking_Video

🔰 Todays findings 🔰

Shopify Account Takeover $22500 Bug Bounty
https://youtu.be/YnKcRN6SBKI

CSRF Testing Guide For Bug Bounty Hunters
https://thexssrat.medium.com/csrf-tesguide-for-bug-bounty-hunters-d14db3462695

Passwordstate Password Manager Update Hijacked to Install Backdoor on Thousands of PCs
https://thehackernews.com/2021/04/passwordstate-password-manager-update.html

QR Codes Popularity May Abused to Deliver Malware and Banking Heists
https://gbhackers.com/qr-codes-popularity-may-abused-to-deliver-malware/

Detecting Jakarta Expression Language injections with CodeQL
https://infosecwriteups.com/detecting-jakarta-expression-language-injections-with-codeql-41c25d45cdb3

My Experience With BugBountyHunt3r — Hands on Bug Bounty Hunting Learning Platform
https://smhtahsin33.medium.com/my-experience-with-bugbountyhunt3r-hands-on-bug-bounty-hunting-learning-platform-9da52a50502d


CocoaPods RCE exploit exposed keys to repo used by three million mobile apps
https://portswigger.net/daily-swig/cocoapods-rce-exploit-exposed-keys-to-repo-used-by-three-million-mobile-apps

___________________________
@hacking_Attack
@Hacking_Video

🔰 Todays findings 🔰

RCE via Internal Access to Adminer Database Management (Critical)
https://ahmdhalabi.medium.com/rce-via-internal-access-to-adminer-database-management-critical-d3dc2a1d392a


Hacking GraphQL for Fun and Profit — Part 2— Methodology and Examples
https://busk3r.medium.com/hacking-graphql-for-fun-and-profit-part-2-methodology-and-examples-5992093bcc24

Critical RCE Bug Found in Homebrew Package Manager for macOS and Linux
https://thehackernews.com/2021/04/critical-rce-bug-found-in-homebrew.html

Ransomware Strain Qlocker Targeting QNAP NAS Flaws – Patch It!
https://cybersecuritynews.com/ransomware-strain-qlocker/

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Posta - Cross-document Messaging Security Research Tool

https://1.bp.blogspot.com/-u98Xm-VgmHI/YIJbmb2d8zI/AAAAAAAAV8Q/mG6ls42M0wAEJ2xylUocrhHU7Z_GS6e4QCNcBGAsYHQ/s16000/posta_1_benso-posta.png Posta is a tool for researching Cross-document Messaging communication. It allows you to track, explore and exploit postMessagevulnerabilities, and includes features such as replaying messages sent between windows within any attached browser. https://1.bp.blogspot.com/-lUICdel30kM/YIJbreJGzZI/AAAAAAAAV8U/5-kGRqeCqTgrY9iQZUp-06GVmSE0hz-cACNcBGAsYHQ/w640-h298/posta_2_main_page.png Prerequisites* Google Chrome / Chromium
* Node.js (optional) InstallationDevelopment EnvironmentRun Posta in a full development environment with a dedicated browser (Chromium):

1. Install Posta git clone https://github.com/benso-io/posta
cd posta
npm install2. Launch the dedicated Chromium session using the following command: node posta 3. Click on the Posta extension to navigate to the UI

Dev mode includes a local web server that serves a small testing site and the exploit page. When running in dev mode, you can access the exploit page at http://localhost:8080/exploit/ Chrome ExtensionRun Posta as a Chrome / Chromium Extension:

1. Clone the repo: git clone https://github.com/benso-io/posta.git2. Navigate to chrome://extensions3. Make sure Developer mode is enabled
4. Click on Load unpacked
5. Choose the chrome-extensiondirectory inside Posta and upload it to your browser
6. Load the extension
7. Pin the extension to your browser
8. Browse to the website you would like to examine
9. Click on the Posta extension to navigate to the UI TabsIn the Tabs section we can find our main Origin, with the iframes it hosts and communicates with through the session. We can choose the specific frame by clicking on it, and observe the postMessages related to that frame only. https://1.bp.blogspot.com/-pUHAIcol8_U/YIJbxrWSh4I/AAAAAAAAV8Y/s_kNz0MEZZwTy43rmj0sDZ_-e2Z8QzongCNcBGAsYHQ/w640-h427/posta_3_tabs.png MessagesIn the Messages section, we can inspect all postMessagetraffic being sent from the origin to its iframes, and vice versa. We can select specific communication for further examination by clicking on it. The Listeners area presents the code which is in charge of handling the communication, we can click and copy its contents for JS code observation. https://1.bp.blogspot.com/-ohzfRYjE2uY/YIJb4qn2XzI/AAAAAAAAV8c/4CZs1EArjwU7nP-BmeIUOlmPsOLNNlUFgCNcBGAsYHQ/w640-h138/posta_4_messages.png https://1.bp.blogspot.com/-hFae1u-uSdE/YIJb4-coMkI/AAAAAAAAV8g/Y_wOfdWmSd4PfIpPso5DS5ZG6wapPYwggCNcBGAsYHQ/w640-h86/posta_5_listeners.png ConsoleIn the console section, we can modify the original postMessagetraffic, and replay the messages with the tampered values which will be sent from the Origin to its iframe.

We should make tests and see if we can affect the behavior of the website by changing the postMessagecontent. If we manage to do so, it's time to try and exploit if from a different Origin, by clicking "Simulate exploit". https://1.bp.blogspot.com/-fqNRZLBNbpc/YIJcB1HkbWI/AAAAAAAAV8o/T4s53xS1s3Qke-jq6gQlWr7Lsxy8RVfsgCNcBGAsYHQ/w640-h186/posta_6_console.png https://1.bp.blogspot.com/-8pLHEY8GykE/YIJcB70-EEI/AAAAAAAAV8s/LLUuFWg3HroUi6P_hzvlGQP6lIg7EKVlwCNcBGAsYHQ/w640-h114/posta_7_buttons.png ExploitClick on the "host" button inorder to navigate to the exploitation window. https://1.bp.blogspot.com/-HmBuGmXw-II/YIJcIQ51SQI/AAAAAAAAV80/hlgFN9DyTf8kM-4vZbTzC7MYKeDS7-wrQCNcBGAsYHQ/w640-h94/posta_8_host.png In the Exploit section, Posta will try and host the specified origin as an iframe in order to initiate postMessagecommunication. Most[...]

___________________________
@hacking_Attack
@Hacking_Video

of the time we won't be able to do so, due to X-Frame-Options being enabled on the origin website.

Therefore, in order to continue with our exploitation, we'll need to gain communication reference with our Origin by initiating the window.openmethod, which can be achieved by clicking on "Open as tab".

We have the console to our right which will help us modify and craft our specified payloads and test them in Cross-Origin Communication, initiated by clicking on the Exploit button. https://1.bp.blogspot.com/-brfeCncpUHM/YIJcMT3nzII/AAAAAAAAV88/h-nVqlPlJxwBeKTHsZ6DTVXdvy2R2iuwwCNcBGAsYHQ/w640-h368/posta_9_exploit_area.png Authors* Chen Gour Arie
* Barak Tawily
* Gal Nagli
* Omer Yaron Download Posta

___________________________
@hacking_Attack
@Hacking_Video

How I got my first Blind XSS on Private Program

Hello everyone, I am Raghuveer Singh Chouhan and, this is my first blog on Blind XSS. Today I will explain how I found Blind XSS on a…Continue reading on Medium »
Read more...

Download Free Courses
Data Science Fundamentals with Python & SQL Specialization

https://s3.eu-central-1.wasabisys.com/courseupload/2021/04/Screen-Shot-2021-04-19-at-9.46.39-AM.png Data Science Fundamentals with Python and SQL Specialization — Coursera — Free download
Build the Foundation for your Data Science career. Develop hands-on experience with Jupyter, Python, SQL. Perform Statistical Analysis on real data sets.
WHAT YOU WILL LEARN
* Working knowledge of Data Science Tools such as Jupyter Notebooks, R Studio, GitHub, Watson Studio
* Python programming basics including data structures, logic, working with files, invoking APIs, and libraries such as Pandas and Numpy
* Statistical Analysis techniques including Descriptive Statistics, Data Visualization, Probability Distribution, Hypothesis Testing and Regression
* Relational Database fundamentals including SQL query language, Select statements, sorting & filtering, database functions, accessing multiple tables
Data science is one of the hottest professions of the decade, and the demand for data scientists who can analyze data and communicate results to inform data driven decisions has never been greater. This Specialization from IBM will help anyone interested in pursuing a career in data science by teaching them fundamental skills to get started in this in-demand field.

The specialization consists of 4 self-paced online courses that will provide you with the foundational skills required for Data Science, including open source tools and libraries, Python, Statistical Analysis, SQL, and relational databases. You’ll learn these data science pre-requisites through hands-on practice using real data science tools and real-world data sets.

Upon successfully completing these courses, you will have the practical knowledge and experience to delve deeper in Data Science and work on more advanced Data Science projects.
DOWNLOAD
Filename: Coursera – Data Science Fundamentals with Python and SQL.zip (download) Filesize: 670.95 MB
Course Content: https://www.coursera.org/specializations/data-science-fundamentals-python-sql