23000$ for Authentication Bypass & File Upload & Arbitrary File Overwrite
https://medium.com/@h4x0r_dz/23000-for-authentication-bypass-file-upload-arbitrary-file-overwrite-2578b730a5f8?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

How I found Authentication Bypass >> File upload vulnerability >> Arbitrary File Overwrite and how I managed I found the path of the file…Continue reading on Medium » (https://medium.com/@h4x0r_dz/23000-for-authentication-bypass-file-upload-arbitrary-file-overwrite-2578b730a5f8?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

What is 8680439..toString(30)?
https://www.reddit.com/r/Pentesting/comments/y896d3/what_is_8680439tostring30/

I am an experienced JS developer now learning web app pen testing and I have never seen this piece of code.
Every google search I make is a list of XSS cheat sheets. I can't find any website that explains what "8680439" is. Or why the double dots? I know "toString(30)" takes in a radix number. submitted by /u/green_anthem (https://www.reddit.com/user/green_anthem)
[link] (https://www.reddit.com/r/Pentesting/comments/y896d3/what_is_8680439tostring30/) [comments] (https://www.reddit.com/r/Pentesting/comments/y896d3/what_is_8680439tostring30/)

___________________________
@hacking_Attack
@Hacking_Video

Live subdomain enumeration using censys
https://medium.com/@kandar.souvik6/live-subdomain-enumeration-using-censys-43a8b6e9e775?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

I have found a way to find live subdomains(it is not guaranteed to work on all the websites) using simple keywords in censys.Continue reading on Medium » (https://medium.com/@kandar.souvik6/live-subdomain-enumeration-using-censys-43a8b6e9e775?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Live subdomain enumeration using censys

I have found a way to find live subdomains(it is not guaranteed to work on all the websites) using simple keywords in censys.Continue reading on Medium »
Read more...

Dark Reading: Attacks/Breaches
Security Awareness Urged to Grow Beyond Compliance

Increasingly vendors are looking for ways to take security awareness beyond checkbox compliance courses to more context-dependent interactions — a "shift left" to the average worker.

Dark Reading: Attacks/Breaches
Scammers Targeting Those Seeking Student Loan Forgiveness

FBI warns that cybercriminals are stealing personal information by posing as administrators of the Student Loan Debt Relief Plan.

Dark Reading: Attacks/Breaches
Apache Commons Vulnerability: Patch but Don't Panic

Experts say CVE-2022-42899 is a serious vulnerability, but widespread exploitation is unlikely because of the specific conditions that need to exist for it to happen.

Dark Reading: Attacks/Breaches
SBOMs: An Overhyped Concept That Won't Secure Your Software Supply Chain

We need more than the incomplete snapshot SBOMs provide to have real impact.

Found vulnaribility on subdomain of nasa.gov simply using censys
https://medium.com/@kandar.souvik6/found-vulnaribility-on-subdomain-of-nasa-gov-simply-using-censys-d93f253ff560?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hi, i have found low level vulnaribility on subdomain of nasa.gov simply using censys.At first i have used the process mentioned at my…Continue reading on Medium » (https://medium.com/@kandar.souvik6/found-vulnaribility-on-subdomain-of-nasa-gov-simply-using-censys-d93f253ff560?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Advise for elevating prompt with reverse tcp shell

Lab setup: Attempting to attack a Microsoft Win10 developer Vm with Kali Linux. Using the social engineering toolkit, I was able to get a reverse shell back to the Kali machine,which gave me a cmd.exe session

From what I read online, I should be able to drop from a cmd.exe prompt into a powershell prompt (no issue) then run as administrator (issue) The Win10 VM is being promoted for creds and not my Kali Machine. The user I’m impersonating is a local admin, but the shell that i access in Kali doesn’t have permission to make registry changes or create additional users. Any advice/commands I should try next are appreciated.

submitted by /u/HelpBeginning4777
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
I seem to have found a lot of IP addresses with almost all of their ports open.

So i was basically just playing around with zmap and then ended up coming across a load of IPs with many open ports. I scanned these IPs on nmap and noticed they are practically using every service you could think of. I'm wondering if this is some sort of configuration of the servers side causing it to appear that these ports are open or is it something else?

submitted by /u/Ok-Chipmunk4539
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Strange Bedfellows — a modern western urban fantasy adventure

https://cdn-images-1.medium.com/max/600/1*tVI0SwOCWJrmNEfejt_MhA.jpeg
“Ben?”

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How I hacked a $10 Target Halloween toy to be interactive

https://cdn-images-1.medium.com/max/2450/1*nUcYLW7LxEOS6pvclsrvag.jpeg
Triggering the bat toy’s movement and sound with motion detection, by hacking it to connect to a Raspberry Pi and a webcam.

Continue reading on Code Like A Girl »

___________________________
@hacking_Attack
@Hacking_Video