XSS using a username
https://sagarsajeev.medium.com/xss-using-a-username-8a8ab1b79a77?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

XSS triggered by exploiting a vulnerable input field of a signup page.Continue reading on Medium » (https://sagarsajeev.medium.com/xss-using-a-username-8a8ab1b79a77?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Attack Simulator for SolarWinds, Codecov, and ua-parser-js breaches
https://www.reddit.com/r/redteamsec/comments/yv140a/attack_simulator_for_solarwinds_codecov_and/

The SUNSPOT (http://crowdstrike.com/blog/sunspot-malware-technical-analysis/) malware, Codecov breach (https://about.codecov.io/security-update/), and lot of compromised open-source packages (like was the case with ua-parser-js (https://github.com/advisories/GHSA-pjwm-rvh2-c87w)) target the CI/ CD pipeline to modify release build or exfiltrate credentials. As part of writing tests for Harden Runner GitHub Action (https://github.com/step-security/harden-runner), which prevents such attacks, there was a need to write attack simulator for these attacks. You can check out the attack simulator here: https://github.com/step-security/attack-simulator It has information and relevant links about these attacks at one place. There are a set of GitHub Actions workflows that simulate the steps from these attacks. There is also a malware simulator npm package which simulates behavior of typical compromised npm packages using preinstall step. Wanted to share in case one is looking for similar attack simulator for attacks on CI/ CD pipelines. submitted by /u/varunsh-coder (https://www.reddit.com/user/varunsh-coder)
[link] (https://www.reddit.com/r/redteamsec/comments/yv140a/attack_simulator_for_solarwinds_codecov_and/) [comments] (https://www.reddit.com/r/redteamsec/comments/yv140a/attack_simulator_for_solarwinds_codecov_and/)

___________________________
@hacking_Attack
@Hacking_Video

P1 Bounties: Cross-Site Scripting (XSS) Tips And Tricks
https://medium.com/the-gray-area/p1-bounties-cross-site-scripting-xss-tips-and-tricks-10bf84daff38?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

TL;DR- A guide on what XSS is, how to find it, how to exploit it, and then how to make the most money off of it.Continue reading on The Gray Area » (https://medium.com/the-gray-area/p1-bounties-cross-site-scripting-xss-tips-and-tricks-10bf84daff38?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Appshark : Static Taint Analysis Platform To Scan Vulnerabilities In An Android App

Appshark is a static taint analysis platform to scan vulnerabilities in an Android app. PrerequisitesAppshark requires a specific version of JDK — JDK 11. After testing, it does not work on other LTS versions, JDK 8 and JDK 16, due to the dependency compatibility issue. Building/Compiling AppSharkWe assume that you are working in the root directory of the project repo. You can build the whole project with the gradle tool.
$ ./gradlew build -x test
After executing the above command, you will see an artifact file AppShark-0.1.1-all.jarin the directory build/libs. Running AppSharkLike the previous step, we assume that you are still in the root folder of the project. You can run the tool with
$ java -jar build/libs/AppShark-0.1.1-all.jar config/config.json5
The config.json5has the following configuration contents.
{
"apkPath": "/Users/apks/app1.apk",
"out": "out",
"rules": "unZipSlip.json",
"maxPointerAnalyzeTime": 600
}
Each JSON field is explained below.

* apkPath: the path of the apk file to analyze
* out: the path of the output directory
* rules: the path(s) of the rule file(s), can be more than 1 rules
* maxPointerAnalyzeTime: the timeout duration in seconds set for the analysis started from an entry point
* debugRule: specify the rule name that enables logging for debugging

If you provide a configuration JSON file which sets the output path as outin the project root directory, you will find the result file out/results.jsonafter running the analysis. Interpreting the ResultsBelow is an example of the results.json.
{
"AppInfo": {
"AppName": "test",
"PackageName": "net.bytedance.security.app",
"min_sdk": 17,
"target_sdk": 28,
"versionCode": 1000,
"versionName": "1.0.0"
},
"SecurityInfo": {
"FileRisk": {
"unZipSlip": {
"category": "FileRisk",
"detail": "",
"model": "2",
"name": "unZipSlip",
"possibility": "4",
"vulners": [
{
"details": {
"position": "$r31",
"entryMethod": "$r3",
"url": "/Volumes/dev/zijie/appshark-opensource/out/vuln/1-unZipSlip.html",
"target": [
"$r3",
"pf{obj{java.lang.StringBuilder}(unknown)->@data}",
"$r11",
"$r31"
]
},
"hash": "ec57a2a3190677ffe78a0c8aaf58ba5aee4d2247",
"possibility": "4"
},
{
"details": {
"position": "$r34",
"entryMethod": "$r3",
"url": "/Volumes/dev/zijie/appshark-opensource/out/vuln/2-unZipSlip.html",
"target": [
"$r3",
"pf{obj{java.lang.StringBuilder}(unknown)->@data}",
"___________________________
@hacking_Attack
@Hacking_Video

ance.security.app.pathfinder.testdata.zipslip:->$r14",
"$r34"
]
},
"hash": "26c6d6ee704c59949cfef78350a1d9aef04c29ad",
"possibility": "4"
}
],
"wiki": "",
"deobfApk": "/Volumes/dev/zijie/appshark-opensource/app.apk"
}
}
},
"DeepLinkInfo": {
},
"HTTP_API": [
],
"JsBridgeInfo": [
],
"BasicInfo": {
"ComponentsInfo": {
},
"JSNativeInterface": [
]
},
"UsePermissions": [
],
"DefinePermissions": {
},
"Profile": "/Volumes/dev/zijie/appshark-opensource/out/vuln/3-profiler.json"
} Click Here To Download

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Are hackers outside the US really that good?

I have a longing suspicion that hackers outside the US are not as good as they are here. I’m specifically referring to the cybersecurity researcher role. using an academic approach to find vulnerabilities in hardware and software. I have yet to see anything at the level of stuxnet.

It’s amazing how much a technical feat it is to create computers, and software that runs on them.

Every nation uses American operating systems to run on their devices.

If they can’t even create there own OS there’s no way they have the technical expertise to create sophisticated cyber weapons.

But that’s just my opinion, what are your thoughts

submitted by /u/trollingguru
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

P1 Bounties: Cross-Site Scripting (XSS) Tips And Tricks

TL;DR- A guide on what XSS is, how to find it, how to exploit it, and then how to make the most money off of it.Continue reading on The Gray Area »
Read more...

Dicas de Bug Bounty — Parte 1

Aqui estão dicas e anotações que fiz baseadas em artigos e writeups que liContinue reading on Medium »
Read more...

Bug Bounty Tips — Part 1

Here are some tips and annotations that i’ve made based on articles and writeups that i’ve readContinue reading on Medium »
Read more...

Need help NMAP Shows all ports are open
https://www.reddit.com/r/Pentesting/comments/yv2x4r/need_help_nmap_shows_all_ports_are_open/

Hello, ​ I am currently using NMAP to scan my sonicwalls just for fun and noticed that all sonicwalls show a few ports open (standard ports that makes sense to me). But one location show all ports are open. The only thing different is that at that location we have the famous "999" vlan where the internet goes into my Dell switch and then into two different routers (or buildings). This is because they are two different companeis running off the same internet. Is it the Dell switch that is giving me all these ports open? Has anyone ever encountered this? I showed this to my boss and I am not sure why it is happening or a way to proove it isn't the sonicwall... ​ Thanks! submitted by /u/Alternative-Phone946 (https://www.reddit.com/user/Alternative-Phone946)
[link] (https://www.reddit.com/r/Pentesting/comments/yv2x4r/need_help_nmap_shows_all_ports_are_open/) [comments] (https://www.reddit.com/r/Pentesting/comments/yv2x4r/need_help_nmap_shows_all_ports_are_open/)

___________________________
@hacking_Attack
@Hacking_Video

Strange discovery
https://www.reddit.com/r/Pentesting/comments/yv4118/strange_discovery/

I'm sorry if this isn't the right sub or if this isn't relevant, I just don't know where to post this. Alright so I'm new into pentesting and I basically don't know much, recently I started focusing a bit more on learning by doing simple CTFs on various websites. One day I was looking for a real life example of LFI or RFI vulnerabilities (without any malicious intentions, it was just for education purposes), I found some random Google dorks and I started looking, like I said I'm a newbie so I really don't know much about how it works. I just wanted to see how it worked, so I kept looking, the results weren't really relevant but I just kept stumbling upon what seemed to be randomly generated blogs with very weird URLs, they seem randomly generated and suggest that they are vulnerable, some of them can load google pages (nothing else seems to work), but they generally are just abusing indexation. These blogs are all very similar: a login form, a randomly generated text which seems to be taken from the book Pride and Prejudice mixed with some random cybersecurity jargon (it's the same type of text for all of them), and a functional comment section with random comments on them. The page updates it's content every time you refresh it. They seem to have no purpose, no ads, no external links (except in the comments, probably just automated bots external to the site), no invitations and no information about the owners. I only listed a few (54) and got tired that day, but there's thousands of them, I tried to look it up and search about it but I found nothing. Here's the few ones I listed. (https://github.com/angelichours/splogs/blob/main/list.txt) But like I said there's thousands of them. Does anyone know what this is? submitted by /u/civilflower7164 (https://www.reddit.com/user/civilflower7164)
[link] (https://www.reddit.com/r/Pentesting/comments/yv4118/strange_discovery/) [comments] (https://www.reddit.com/r/Pentesting/comments/yv4118/strange_discovery/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Malware Techniques

https://cdn-images-1.medium.com/max/1024/1*oulE49BJjG_-nB3XM8LxMQ.jpeg
This is a repository of resource about Malware techniques. A curated list of resources to analyse and study malware techniques.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Faculty writeup hack the box

https://cdn-images-1.medium.com/max/1031/1*IsLdtDRWB9VkDACV2bEj_A.png
Target IP : 10.10.11.169

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to Exploit 6 Common Network Services (TryHackMe Network Services 1&2 — No Spoilers!)

https://cdn-images-1.medium.com/max/800/1*Z0YMHbVV9WqSEmec8ZE1PQ.png
Prefer to watch this article instead? No Problem!

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video