llion developers and 150,000 businesses to build customer engagement platforms.

Twilio also acquired Authy in February 2015, a popular two-factor authentication (2FA) provider for end users, developers, and enterprises with millions of users worldwide.
Trending: New Linux malware called RapperBot brute-forces Linux SSH servers to breach networks
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-5-300x150.png Researcher bypass email filter – XSS in Gmail’s AMP For EmailAugust 9, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-3-1-300x150.png Twitter confirms zero-day used to expose data of 5.4 million accountsAugust 8, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-2-300x150.png New Linux malware called RapperBot brute-forces Linux SSH servers to breach networksAugust 5, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-1-300x150.png Jenkins security: Unpatched XSS, CSRF bugs included in latest plugin advisoryAugust 4, 2022
Reading Time: 3 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Twilio discloses data breach after SMS phishing attack on employees first appeared on Black Hat Ethical Hacking.

MrKaplan - Tool Aimed To Help Red Teamers To Stay Hidden By Clearing Evidence Of Execution
http://www.kitploit.com/2022/08/mrkaplan-tool-aimed-to-help-red-teamers.html

MrKaplan is a tool aimed to help red teamers (https://www.kitploit.com/search/label/Red%20Teamers) to stay hidden (https://www.kitploit.com/search/label/Hidden) by clearing evidence of execution. It works by saving information such as the time it ran, snapshot of files and associate each evidence to the related user. This tool is inspired by MoonWalk (https://github.com/mufeedvh/moonwalk), a similar tool for Unix machines. You can read more about it in the wiki (https://github.com/idov31/MrKaplan/wiki) page.
Features Stopping event logging. Clearing files artifacts. Clearing registry (https://www.kitploit.com/search/label/Registry) artifacts. Can run for multiple users. Can run as user and as admin (Highly recommended to run as admin). Can save timestamps of files. Can exclude certian operations (https://www.kitploit.com/search/label/Operations) and leave artifacts to blue teams. Usage Before you start your operations on the computer, run MrKaplan with begin flag and whenever your finish run it again with end flag. DO NOT REMOVE MrKaplan registry key, otherwise MrKaplan will not be able to use the information. IOCs Powershell process that access (https://www.kitploit.com/search/label/Access) to the artifacts mentioned in the wiki page. Powershell importing weird base64 blob. Powershell process that performs Token Manipulation. MrKaplan's registry key: HKCU:\Software\MrKaplan. Acknowledgements PowerSploit (https://github.com/PowerShellMafia/PowerSploit) Phant0m (https://github.com/hlldz/Phant0m) ForensicArtifacts (https://github.com/ForensicArtifacts/artifacts/blob/main/data/windows.yaml) Disclaimer I'm not responsible in any way for any kind of damage that is done to your computer / program as cause of this project. I'm happily accept contribution, make a pull request and I will review it!

Download MrKaplan (https://github.com/Idov31/MrKaplan)

KitPloit - PenTest Tools!
MrKaplan - Tool Aimed To Help Red Teamers To Stay Hidden By Clearing Evidence Of Execution

https://blogger.googleusercontent.com/img/a/AVvXsEjVzZflpt_RNPgIMXcYGuCD4exXELaGPG9DIfm72NSrXe6kh2AjSQI_5g1GgFC6URJQha1wDQMx8NlaF1svT6J_V9u0jd2PIVRbZ1skA00HahwQcAWjAs9iBHdTbcAXaEB4i_F0Iy47gxMkypTPtK1UbSp4iTc1Toy5P1S3iVOQZwWItl-wzxo7M7s6=w640-h476
MrKaplan is a tool aimed to help red teamers to stay hidden by clearing evidence of execution. It works by saving information such as the time it ran, snapshot of files and associate each evidence to the related user.

This tool is inspired by MoonWalk, a similar tool for Unix machines.

You can read more about it in the wiki page.
Features

* Stopping event logging.
* Clearing files artifacts.
* Clearing registry artifacts.
* Can run for multiple users.
* Can run as user and as admin (Highly recommended to run as admin).
* Can save timestamps of files.
* Can exclude certian operations and leave artifacts to blue teams.

Usage

* Before you start your operations on the computer, run MrKaplan with begin flag and whenever your finish run it again with end flag.
* DO NOT REMOVE MrKaplan registry key, otherwise MrKaplan will not be able to use the information.

IOCs

*
Powershell process that access to the artifacts mentioned in the wiki page.

*
Powershell importing weird base64 blob.

*
Powershell process that performs Token Manipulation.

*
MrKaplan's registry key: HKCU:\Software\MrKaplan.
Acknowledgements

*
PowerSploit

*
Phant0m

*
ForensicArtifacts
Disclaimer

I'm not responsible in any way for any kind of damage that is done to your computer / program as cause of this project. I'm happily accept contribution, make a pull request and I will review it!
Download MrKaplan

Dark Reading: Attacks/Breaches
Human Threat Hunters Are Essential to Thwarting Zero-Day Attacks

Machine-learning algorithms alone may miss signs of a successful attack on your organization.

Dark Reading: Attacks/Breaches
Don't Take the Cyber Safety Review Board's Log4j Report at Face Value

Given the lack of reporting requirements, the findings are more like assumptions. Here's what organizations can do to minimize exposure.

Dark Reading: Attacks/Breaches
Lacework Updates Threat Detection To Uncover More Malicious Activity and Speed Investigation at Scale

New time series model and enhanced alerting experience make it easy for organizations to address more threats in the cloud while enabling faster investigations.

Hacking on Medium
RoadMap to Become a Ethical Hacker -Beginner Guide

https://cdn-images-1.medium.com/max/650/1*xs1GD0yCjDH6N6JBNwWSvg.png
Concern over security has grown as firms have shifted to internet platforms for data storage, management, and even sales. The hackers are…

Continue reading on Medium »

Hacking on Medium
Fuga de datos en Twilio y Slack

https://cdn-images-1.medium.com/max/1483/0*tnXXLq1TofQp_tMq
PUBLICADO EN 9 AGOSTO, 2022POR EHACKING

Continue reading on Medium »

Hacking on Medium
Welcome to Recurse

https://cdn-images-1.medium.com/max/2558/1*35S5dHksh7Axl3wARjGUbQ.png
So, yesterday was my first day in the Fall 22 batch of Recurse. It’s a programmers-retreat, pretty unstructured — based around learning…

Continue reading on Medium »

https://b.thumbs.redditmedia.com/TqQTgvNCubC3IMVWqnByD6abWXSYRgDkxI4sClZRmyc.jpg ​

https://preview.redd.it/mu0gg17btpg91.jpg?width=697&format=pjpg&auto=webp&s=02217fad21b4db77e65aa2347369740e048f8810

submitted by /u/fap_fap_fap_fapper
[link] [comments]

hacking: security in practice
Most Impressive internet related hack.

While not specifically a website hack, probably the most impressive Internet-related hack I can think of involved was "Internet Census 2012" This attack would be remembered by a few Regulars. I remember covering this topic for a few students

A simple yet sophisticated hack.

A security researcher/hacker seized control of a large number of embedded devices to produce what would have been the most thorough map of the Internet to that point. The impacted devices were distributed in over 100 countries.

The technique was straightforward yet magnificent. Many Internet-enabled devices, including routers, UPSs, printers, and other more obscure equipment, offer a remote command shell yet come with default passwords (or none at all) when they are finally deployed.

In contrast to typical botnets, which are frequently used for spamming or Distributed Denial of Service (DDoS) assaults, the individual behind this initiative linked them into a botnet, but they were used to transmit probes that were audible around the world, building maps of Internet topography. I later partnered with this company late 2018 in a bid to learn more about the technique.

All in all, the botnet involved spanned over 420,000 devices, and this wasn't even the upper limit to the number which could have been taken over.

When they were finished, the researcher silently removed their code from the impacted systems, left them alone, and left the passwords alone before publishing their findings and moving on.

They may have exploited this resource for a variety of malicious or self-enriching activities. Instead, they were content to conduct worthwhile research that may not have been feasible in any other manner. Since the research was unquestionably unlawful, I can understand why some people may find it unethical; yet, I have to admire someone who, given the option, chooses to act in their best interests rather than their own or others'.

You can read more about the methodology and findings which resulted via internet census 2012

submitted by /u/Simonvilla1
[link] [comments]

hacking: security in practice
Sorry about hacking your account

Sorry about this but i figured i should give this back and didnt know where else to put it, its a message to the guy that owns this account cos i accidentally pressed ignore on his chat and now i cant find him. doh.

please take your account back like this

https://www.reddit.com/account/magic_link/landing/MIT:/

put your email in there ( its the same ) click on the link in your email, reset the password. done.

once again, great fun messing around but sorry about that. ADHD FTW

submitted by /u/ocoio
[link] [comments]

Exploit Collector
Feehi CMS 2.1.1 Cross Site Scripting

https://3.bp.blogspot.com/-A9um4FlUYrw/WWlvH0fnNDI/AAAAAAAAILk/pA4dWsQKlcwBJHJ-2O0qL7e98i6zrXCWwCLcBGAs/s1600/h141.png
Feehi CMS version 2.1.1 suffers from a persistent cross site scripting vulnerability.

SHA-256 | d361efcdb1b82d5a2eb48510dede7b1357037345197851159d3a6375b4284b66

Download
# Exploit Title: Feehi CMS 2.1.1 - Stored Cross-Site Scripting (XSS)
# Date: 02-08-2022
# Exploit Author: Shivam Singh
# Vendor Homepage: https://feehi.com/
# Software Link: https://github.com/liufee/cms
#Profile Link: https://www.linkedin.com/in/shivam-singh-3906b0203/
# Version: 2.1.1 (REQUIRED)
# Tested on: Linux, Windows, Docker
# CVE : CVE-2022-34140
# Proof of Concept:
1-Sing-up https://localhost.cms.feehi/
2-Inject The XSS Payload in Username:
"> fill all required fields and
click the SignUp button
3-Login to Your Account, Go to any article page then XSS will trigger.

Source:packetstormsecurity.com