Hacking on Medium
Executing Random Executables Can Get You In Trouble

https://cdn-images-1.medium.com/max/1440/1*LExXndJMFfPUePYI7sAU-w.png
What will happen to your OS when you execute random executables files?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
CVE-2022–42889: Text4Shell, Vulnerabilidad critica en Apache Commons Text

https://cdn-images-1.medium.com/max/1629/0*RCY2TtAixCwkATpV
Al igual que ocurrió en diciembre del año pasado con Log4Shell, aquella vulnerabilidad que afectaba a multitud de productos Java que…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Expertos advierten sobre una puerta trasera sigilosa de PowerShell disfrazada de actualización de…

https://cdn-images-1.medium.com/max/1698/0*k0kvDDiBcgkKtA9n
Han surgido detalles sobre una puerta trasera de PowerShell previamente no documentada y totalmente indetectable (FUD) que gana su sigilo…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

23000$ for Authentication Bypass & File Upload & Arbitrary File Overwrite
https://medium.com/@h4x0r_dz/23000-for-authentication-bypass-file-upload-arbitrary-file-overwrite-2578b730a5f8?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

How I found Authentication Bypass >> File upload vulnerability >> Arbitrary File Overwrite and how I managed I found the path of the file…Continue reading on Medium » (https://medium.com/@h4x0r_dz/23000-for-authentication-bypass-file-upload-arbitrary-file-overwrite-2578b730a5f8?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

What is 8680439..toString(30)?
https://www.reddit.com/r/Pentesting/comments/y896d3/what_is_8680439tostring30/

I am an experienced JS developer now learning web app pen testing and I have never seen this piece of code.
Every google search I make is a list of XSS cheat sheets. I can't find any website that explains what "8680439" is. Or why the double dots? I know "toString(30)" takes in a radix number. submitted by /u/green_anthem (https://www.reddit.com/user/green_anthem)
[link] (https://www.reddit.com/r/Pentesting/comments/y896d3/what_is_8680439tostring30/) [comments] (https://www.reddit.com/r/Pentesting/comments/y896d3/what_is_8680439tostring30/)

___________________________
@hacking_Attack
@Hacking_Video

Live subdomain enumeration using censys
https://medium.com/@kandar.souvik6/live-subdomain-enumeration-using-censys-43a8b6e9e775?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

I have found a way to find live subdomains(it is not guaranteed to work on all the websites) using simple keywords in censys.Continue reading on Medium » (https://medium.com/@kandar.souvik6/live-subdomain-enumeration-using-censys-43a8b6e9e775?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Live subdomain enumeration using censys

I have found a way to find live subdomains(it is not guaranteed to work on all the websites) using simple keywords in censys.Continue reading on Medium »
Read more...

Dark Reading: Attacks/Breaches
Security Awareness Urged to Grow Beyond Compliance

Increasingly vendors are looking for ways to take security awareness beyond checkbox compliance courses to more context-dependent interactions — a "shift left" to the average worker.

Dark Reading: Attacks/Breaches
Scammers Targeting Those Seeking Student Loan Forgiveness

FBI warns that cybercriminals are stealing personal information by posing as administrators of the Student Loan Debt Relief Plan.

Dark Reading: Attacks/Breaches
Apache Commons Vulnerability: Patch but Don't Panic

Experts say CVE-2022-42899 is a serious vulnerability, but widespread exploitation is unlikely because of the specific conditions that need to exist for it to happen.

Dark Reading: Attacks/Breaches
SBOMs: An Overhyped Concept That Won't Secure Your Software Supply Chain

We need more than the incomplete snapshot SBOMs provide to have real impact.

Found vulnaribility on subdomain of nasa.gov simply using censys
https://medium.com/@kandar.souvik6/found-vulnaribility-on-subdomain-of-nasa-gov-simply-using-censys-d93f253ff560?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hi, i have found low level vulnaribility on subdomain of nasa.gov simply using censys.At first i have used the process mentioned at my…Continue reading on Medium » (https://medium.com/@kandar.souvik6/found-vulnaribility-on-subdomain-of-nasa-gov-simply-using-censys-d93f253ff560?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Advise for elevating prompt with reverse tcp shell

Lab setup: Attempting to attack a Microsoft Win10 developer Vm with Kali Linux. Using the social engineering toolkit, I was able to get a reverse shell back to the Kali machine,which gave me a cmd.exe session

From what I read online, I should be able to drop from a cmd.exe prompt into a powershell prompt (no issue) then run as administrator (issue) The Win10 VM is being promoted for creds and not my Kali Machine. The user I’m impersonating is a local admin, but the shell that i access in Kali doesn’t have permission to make registry changes or create additional users. Any advice/commands I should try next are appreciated.

submitted by /u/HelpBeginning4777
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video