Black Hat Ethical Hacking
Critical command injection vulnerability discovered in Bitbucket Server and Data Center

Critical command injection vulnerability discovered in Bitbucket Server and Data CenterPost Views: 4 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Patreon-1.png Subscribe to Patreon to watch this episode.
Reading Time: 1 Minute A critical command injection vulnerability in a Bitbucket product could allow an attacker to execute arbitrary code, researchers warn.Bitbucket is a Git-based source code repository hosting service owned by Atlassian.

The flaw, tracked as CVE-2022-36804, is a command injection vulnerability in multiple API endpoints of Bitbucket Server and Data Center.

Read more of the latest news about security vulnerabilities

This vulnerability could allow remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request.

It was discovered by researcher ‘The Grand Pew’, who reported it through Bugcrowd’s bug bounty program.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course ​Update nowAll versions of the Server and Data Center released after 6.10.17 are affected, meaning that all instances running any versions between 7.0.0 and 8.3.0 inclusive are vulnerable.

Users are urged to update to the latest version. For those who cannot, Bitbucket has offered a workaround.
Trending: Common and Uncommon types of SQL Injection
Trending: Offensive Security Tool: WEF (WiFi Exploitation Framework) A blog post reads: “A temporary mitigation step is to turn off public repositories globally by setting feature.public.access=false as this will change this attack vector from an unauthorized attack to an authorized attack.”
Trending: WordPress sites hacked with fake Cloudflare DDoS alerts pushing malware
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: portswigger.net Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-1-4-300x150.png Twilio hackers hit over 130 orgs in massive Okta phishing attackAugust 26, 2022
Reading Time: 5 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-8-300x150.png Hackers use AiTM attack to monitor Microsoft 365 accounts for BEC scamsAugust 25, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-3-3-300x150.png GitLab patches critical remote code execution bugAugust 24, 2022
Reading Time: 2 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-1-3-300x150.png Over 80000 Hikvision vulnerable cameras exposed onlineAugust 23, 2022
Reading Time: 4 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Critical command injection vulnerability discovered in Bitbucket Server and Data Center first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Bypassing Amazon WAF to pop an alert()
https://infosecwriteups.com/bypassing-amazon-waf-to-pop-an-alert-4646ce35554e?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hey everyone, its been a while since I published anything. This time, I’ll be sharing how I bypassed Amazon WAF to get XSS on the target…Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/bypassing-amazon-waf-to-pop-an-alert-4646ce35554e?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

How I bypassed Reflected XSS in well-known platform

What is a XSS attackContinue reading on Medium »
Read more...

Bypassing Amazon WAF to pop an alert()

Hey everyone, its been a while since I published anything. This time, I’ll be sharing how I bypassed Amazon WAF to get XSS on the target…Continue reading on InfoSec Write-ups »
Read more...

hacking: security in practice
Cybersecurity & Data Science Bundle by Mercury Learning

https://external-preview.redd.it/jYYlaq9XbWQBauA53JvJGaDPdSBwx9l1_c1X9XGlpA8.jpg?width=320&crop=smart&auto=webp&s=f7af663d5438be8299f7b16e414fdbafe248df37 submitted by /u/8ing8ong
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Pool on the roof - August 29, 2022

Have a no0b question? New to hacking? Looking for a script? Need help with your github project? Something wrong with your payload? Stuck on a CTF or bug bounty?

This is a weekly recurring post to make friends with other hackers, ask questions, and get any type of help you may need.

Make sure to read our wiki as it's full of resources for you.

Keep all beginner questions in this weekly stickied post.

submitted by /u/AutoModerator
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Want to know the Legality as well as possibility of a hack

my college gave me a laptop, for which I paid in full, and put some restrictions on it.

1. I cannot use an account with admin privileges. only a guest account which they made for me can be used. the account with admin privileges is named admin but I do not know its password.
2. the internet has a web filter on it that bans social media as well as some other stuff (accessing reddit through a vpn).

what I want to do is find the password for the admin account.

Is it possible and is it legal?

submitted by /u/M9I99
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Anyone know where I could crack this

I’m doing some ethical hacking and having trouble cracking this hash

SHA256 ($pass.$salt) hash: a9751fb3d7a5af225468a9cfb3bbef0139576cfc2272120929ec231cadc88c30:1406a8c499a5f88e7edb925fd9106a03517b3032

submitted by /u/Cuddlyyyy
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Tryhackme b3dr0ck Makine Çözümü

https://cdn-images-1.medium.com/max/945/1*-1KlF6avp3EwMDhGydr4Lw.jpeg
Açıklama: Selam arkadaşlar, Tryhackme plartformunda bulunan ‘b3dr0ck’ isimli makinenin çözümünü sizinle paylaşıyor olacağım. Çocukluğumun…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
ความรู้เบื้องต้นเกี่ยวกับ Ethical Hacking & Penetration Testing(Pentest)

https://cdn-images-1.medium.com/max/800/1*4jbhI60oag7wPQu5yuTnrw.png
😆👍😘

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Bypassing Amazon WAF to pop an alert()

https://cdn-images-1.medium.com/max/1920/1*skG2p9oUdIrz1Bn7WkWzSw.jpeg
Hey everyone, its been a while since I published anything. This time, I’ll be sharing how I bypassed Amazon WAF to get XSS on the target…

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Ropr : A Blazing Fast Multithreaded ROP Gadget Finder. Ropper / Ropgadget Alternative

ROP (Return Oriented Programming) Gadgets are small snippets of a few assembly instructions typically ending in a retinstruction which already exist as executable code within each binary or library. These gadgets may be used for binary exploitation and to subvert vulnerable executables.

When the addresses of many ROP Gadgets are written into a buffer we have formed a ROP Chain. If an attacker can move the stack pointer into this ROP Chain then control can be completely transferred to the attacker.

Most executables contain enough gadgets to write a turing-complete ROP Chain. For those that don’t, one can always use dynamic libraries contained in the same address-space such as libc once we know their addresses.

The beauty of using ROP Gadgets is that no new executable code needs to be written anywhere – an attacker may achieve their objective using only the code that already exists in the program. How do I use a ROP Gadget?Typically the first requirement to use ROP Gadgets is to have a place to write your ROP Chain – this can be any readable buffer. Simply write the addresses of each gadget you would like to use into this buffer. If the buffer is too small there may not be enough room to write a long ROP Chain into and so an attacker should be careful to craft their ROP Chain to be efficient enough to fit into the space available.

The next requirement is to be able to control the stack – This can take the form of a stack overflow – which allows the ROP Chain to be written directly under the stack pointer, or a “stack pivot” – which is usually a single gadget which moves the stack pointer to the rest of the ROP Chain.

Once the stack pointer is at the start of your ROP Chain, the next retinstruction will trigger the gadgets to be excuted in sequence – each using the next as its return address on its own stack frame.

It is also possible to add function poitners into a ROP Chain – taking care that function arguments be supplied after the next element of the ROP Chain. This is typically combined with a “pop gadget”, which pops the arguments off the stack in order to smoothly transition to the next gadget after the function arguments. How do I install ropr?* Requires cargo (the rust build system)

Easy install:

cargo install ropr

the application will install to ~/.cargo/binFrom source

git clone https://github.com/Ben-Lichtman/ropr
cd ropr
cargo build –release

the resulting binary will be located in target/release/roprAlternatively:

git clone https://github.com/Ben-Lichtman/ropr
cd ropr
cargo install –path .

the application will install to ~/.cargo/binHow do I use ropr?USAGE:
ropr [OPTIONS]
ARGS:
The path of the file to inspect
OPTIONS:
-b, –base-pivot Filters for gadgets which alter the base pointer
-c, –colour Forces output to be in colour or plain text (true or false)
-h, –help Print help information
-j, –nojop Removes “JOP Gadgets” – these may have a controllable branch,
call, etc. instead of a simple retat the end
-m, –max-instr Maximum number of instructions in a gadget [default: 6]
-n, –noisy Includes potentially low-quality gadgets such as prefixes,
conditional branches, and near branches (will find significantly
more gadgets)
-p, –stack-pivot Filters for gadgets which alter the stack pointer
-r, –norop Removes normal “ROP Gadgets”
-R, –regex Perform a regex search on the returned gadgets for easy filtering
–range Search between address ranges (in hexadecial) eg. 0x1234-0x4567–raw Treats the input file as a blob of code (true or false)
-s, –nosys Removes syscalls and other interrupts
-V, –version Print version information

For example if I was looking for a way to fill raxwit[...]

___________________________
@hacking_Attack
@Hacking_Video