Hi everyone! I hope you all are doing good. In this article, we are going to learn how we can crawl more links of a domain to increase our…Continue reading on Medium » (https://faiyazhacks.medium.com/how-to-crawl-links-like-a-pro-d0b58403be48?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Immunefi Launches Timebound Bug Bounty For Proof-of-Capital Vault System
https://medium.com/immunefi/immunefi-launches-timebound-bug-bounty-for-proof-of-capital-vault-system-344cbe886a3f?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Starting today for the next three weeks, Immunefi is launching a Timebound Bug Bounty Program for its new, proof-of-capital Vault System.Continue reading on Immunefi » (https://medium.com/immunefi/immunefi-launches-timebound-bug-bounty-for-proof-of-capital-vault-system-344cbe886a3f?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

The Story Of A Strange / Stored IDOR.
https://medium.com/@hf6452/a-story-of-a-strange-stored-idor-b6f2769bb6cb?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Story :Continue reading on Medium » (https://medium.com/@hf6452/a-story-of-a-strange-stored-idor-b6f2769bb6cb?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

How long does it take to get the certs to become a pen tester?
https://www.reddit.com/r/Pentesting/comments/ywucd6/how_long_does_it_take_to_get_the_certs_to_become/

Hi. I would like to become a pen tester after college, and I want to get my OSCP, OSWP, OSWE, and GPEN. I was wondering how long it would take me to get each cert? submitted by /u/ELIDAL99 (https://www.reddit.com/user/ELIDAL99)
[link] (https://www.reddit.com/r/Pentesting/comments/ywucd6/how_long_does_it_take_to_get_the_certs_to_become/) [comments] (https://www.reddit.com/r/Pentesting/comments/ywucd6/how_long_does_it_take_to_get_the_certs_to_become/)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Palo Alto Networks Announces PAN-OS 11.0 Nova to Help Keep Organizations One Step Ahead of Zero-Day Threats

Nova introduces innovations to help stop zero-day threats, simplify security architectures, and reduce the risk of costly misconfigurations.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Cybersecurity Best Practice Is Critical for Winning the New Space Race

The race is actually a relay — one that requires collaboration to win.

Dark Reading: Attacks/Breaches
What Is Top of Mind for CISOs Right Now?

Security executives are leaning into the powerful twinning of XDR and automated management to reduce the risk and impact of ransomware.

Dark Reading: Attacks/Breaches
Viakoo Announces Strategic Alliance With Nozomi Networks to Deliver Agentless, End-to-End IoT Security at Scale

Leaders in operational technology/Internet of Things (OT/IoT) discovery and remediation partner to deliver best-in-class IoT enterprise security management solution.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
More Than 1,000 New Cybersecurity Apprentices Joined Workforce in Past 12 Months

Safal Partners is helping to close the American cyber talent and diversity gap in cybersecurity.

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Revenue Collection System 1.0 Cross Site Scripting / Authentication Bypass

https://3.bp.blogspot.com/-m8d6k5PvpEU/WWlvYbY80xI/AAAAAAAAIOk/9YRDlN0af5krj_sxTfYJBUTX80Cs4dJKgCLcBGAs/s1600/h56.png
Revenue Collection System version 1.0 suffers from a persistent cross site scripting vulnerability allowing an authenticated client user to add an administrative user account to the application then log in as the newly created admin.

SHA-256 | c480b839cfd03e90fa43402bbfa8f8ab4dc9db4461d292dd292b3383bf3c5995

Download
# Exploit Title: Revenue Collection System v1.0 - Authentication Bypass via Stored XSS
# Exploit Author: Joe Pollock
# Date: November 16, 2022
# Vendor Homepage: https://www.sourcecodester.com/php/14904/rates-system.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/rates.zip
# Tested on: Kali Linux, Apache, Mysql
# CVE: T.B.C
# Vendor: Kapiya
# Version: 1.0
# Exploit Description:
# Revenue Collection System v1.0 suffers from a Stored Cross-Site Scripting vulnerability allowing an authenticated
# client user to add an administrative user account to the application then log in as the newly created admin.

To reproduce this exploit, log in as a client user then navigate to the 'Help' functionality (/index.php?page=help).
The help functionality is used to contact an administrator by sending a message. Paste the Javascript code below into the
'Your Message' textbox then click 'Send'. When an administrator views this message, an administrative user account will
be added to the application with username "admin_new" and password "Test123Test123". Using these credentials, it should
now be possible to log in to the application via the administrative login, here: /admin/login.php (Note: change the
'target', 'x_Username', and 'x_Passsword' as required).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Revenue Collection System 1.0 SQL Injection / Remote Code Execution

https://1.bp.blogspot.com/-5_4vnaEHtE4/WWlvOudg9oI/AAAAAAAAIMs/tPLG-GePmxgLMlPyiIuDfO-2MFfOtdhKQCLcBGAs/s1600/h26.png
Revenue Collection System version 1.0 suffers from an unauthenticated SQL injection vulnerability in step1.php that allows remote attackers to write a malicious PHP file to disk. The resulting file can then be accessed within the /rates/admin/DBbackup directory. This script will write the malicious PHP file to disk, issue a user-defined command, then retrieve the result of that command.

SHA-256 | b41c4f6c71ea1156cfd52b2bd3c354cdb2fc0372d5b22d463c64b50c55b777c0

Download
# Exploit Title: Revenue Collection System v1.0 - RCE via Unauthenticated SQL Injection
# Exploit Author: Joe Pollock
# Date: November 16, 2022
# Vendor Homepage: https://www.sourcecodester.com/php/14904/rates-system.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/rates.zip
# Tested on: Kali Linux, Apache, Mysql
# CVE: T.B.C
# Vendor: Kapiya
# Version: 1.0
# Exploit Description:
# Revenue Collection System v1.0 suffers from an unauthenticated SQL Injection Vulnerability, in step1.php, allowing remote attackers to
# write a malicious PHP file to disk. The resulting file can then be accessed within the /rates/admin/DBbackup directory.
# This script will write the malicious PHP file to disk, issue a user-defined command, then retrieve the result of that command.
# Ex: python3 rcsv1.py 10.10.14.2 "ls"

import sys, requests
def main():
if len(sys.argv) != 3:
print("(+) usage: %s
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Quux MVID-2022-0656 Hardcoded Credential

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Internet Download Manager 6.41 Build 3 Man-In-The-Middle

https://3.bp.blogspot.com/-8aNXwMYQICE/WWlvIs7ranI/AAAAAAAAILw/f2UnTjqyD14e3ZIoWuyFJjQ7Is9Nz7MtQCLcBGAs/s1600/h144.png
Internet Download Manager version 6.41 Build 3 suffers from a man-in-the-middle vulnerability that can enable an attacker to execute code on the victim's system.

SHA-256 | c91e3d887c068869ed07efa29c9e1304cc683d984cd8274cd1ef8940678521d0

Download
# Vulnerability Title: Internet Download Manager v6.41 Build 3 "Remote Code Execution via MITM" Vulnerability
# Date: 15.11.2022
# Author: M. Akil Gündoğan
# Contact: https://twitter.com/akilgundogan
# Vendor Homepage: https://www.internetdownloadmanager.com/
# Software Link: https://mirror2.internetdownloadmanager.com/idman641build3.exe?v=lt&filename=idman641build3.exe
# Version: v.6.41 Build 3
# Tested on: Windows 10 Professional x64
# PoC Video: https://youtu.be/0djlanUbfY4

Vulnerabiliy Description:
---------------------------------------
Some help files are missing in non-English versions of Internet Download Manager. Help files with the extension
".chm" prepared in the language used are downloaded from the internet and run, and displayed to users. This download is
done over HTTP, which is an insecure protocol. An attacker on the local network can spoof traffic with a MITM attack and
replaces ".chm" help files with malicious ".chm" files. IDM runs ".chm" files automatically after downloading.
This allows the attacker to execute code remotely.

It also uses HTTP for checking and downloading updates by IDM. The attacker can send fake updates as if the victim has a new update to the system.

Since we preferred to use Turkish IDM, our target address in the MITM attack was "http://www.internetdownloadmanager.com/languages/tut_tr.chm".

Requirements:
---------------------------------------
The attacker and the victim must be on the same local network.
The victim using the computer must have a user account with administrative privileges on the system. The attacker does not need to have administrator privileges!

Step by step produce:
---------------------------------------
1 - The attacker prepares a malicious CHM file. You can read the article at "https://sevenlayers.com/index.php/316-malicious-chm" for that.
2 - A MITM attack is made against the target using Ettercap or Bettercap.
3 - Let's redirect the domains "internetdownloadmanager.com" and "*.internetdownloadmanager.com" to our attacker machine with DNS spoofing.
4 - A web server is run on the attacking machine and the languages directory is created and the malicious ".chm" file with the
same name (tut_tr.chm / the file according to which language you are using.) is placed in it.
5 - When the victim opens Internet Download Manager and clicks on the "Tutorials" button, the download will start and our malicious ".chm" file will run automatically when it's finished.

Advisories:
---------------------------------------
Developers should stop using insecure HTTP in their update and download modules. In addition, every downloaded file
should not be run automatically, additional warning messages should be displayed for users.

Special thanks: p4rs, ratio, blackcode, zeyd.can and all friends.
---------------------------------------

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video