Hacking on Medium
BurpSuite Add all subdomains to scope

https://cdn-images-1.medium.com/max/1098/1*iYTHBv9-l4bvdc4fi40KZA.png
If the target is TARGET.COM then do the following to update all subdomains to scope:

Continue reading on Medium »

Hacking on Medium
~~ Zoom bombers’ manifesto ~~

Oh my goodness oh my goodness

Continue reading on Medium »

Hacking on Medium
The Problem with Network Visibility

https://cdn-images-1.medium.com/max/2600/0*GGHGMhhv_6zYd_Fu
If you do not know what is happening, you are toothless

Continue reading on TechLife »

Privilege Escalation Lead to Data Breach

Assalamualaikum, Bug Hunter! Bagaimana Kabarnya ? Semoga Baik-baik saja ya, kali ini saya mau membuat Write Up yang menurut saya Bug ini…Continue reading on Medium »
Read more...

Don’t Give Up On XSS! | Fun Firefox XSS

There’s always a way to exploit xss in different contextsContinue reading on InfoSec Write-ups »
Read more...

What is Ethereum? Mastering Ethereum Chapter 1 Summary

What is Ethereum Everything you need to know?Continue reading on Medium »
Read more...

달빗(Dalbit,m00nlight): 중국 해커 그룹의 APT 공격 캠페인 - ASEC BLOG
https://www.reddit.com/r/redteamsec/comments/10qnpjk/%EB%8B%AC%EB%B9%97dalbitm00nlight_%EC%A4%91%EA%B5%AD_%ED%95%B4%EC%BB%A4_%EA%B7%B8%EB%A3%B9%EC%9D%98_apt_%EA%B3%B5%EA%B2%A9_%EC%BA%A0%ED%8E%98%EC%9D%B8_asec_blog/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://asec.ahnlab.com/ko/46431/) [comments] (https://www.reddit.com/r/redteamsec/comments/10qnpjk/%EB%8B%AC%EB%B9%97dalbitm00nlight_%EC%A4%91%EA%B5%AD_%ED%95%B4%EC%BB%A4_%EA%B7%B8%EB%A3%B9%EC%9D%98_apt_%EA%B3%B5%EA%B2%A9_%EC%BA%A0%ED%8E%98%EC%9D%B8_asec_blog/)

Black Hat Ethical Hacking
Sh1mmer: A New Exploit Enables Unenrollment of Enterprise-Managed Chromebooks

Sh1mmer: A New Exploit Enables Unenrollment of Enterprise-Managed ChromebooksPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes ‘Sh1mmer’ exploitA new exploit called ‘Sh1mmer’ allows users to unenroll enterprise-managed Chromebooks and bypass device restrictions. The exploit was developed by security researchers from the Mercury Workshop Team and requires a publicly leaked RMA shim that the Sh1mmer exploit will modify.

When Chromebooks are enrolled with a school or enterprise, they are managed by policies established by the organization’s administrators.
This allows administrators to force-install browser extensions, apps, and to restrict how a device can be used. However, the Sh1mmer exploit lets users unenroll their Chromebooks from enterprise management.
See Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses Exploit specificsThe exploit requires a publicly leaked RMA shim, which is a disk image stored on USB devices containing a combination of the Chrome OS factory bundle components used to reinstall the operating system and manufacturer tools for repair and diagnostics.

The researcher’s online builder is used to inject the RMA shim with the Sh1mmer exploit, and then the Chrome Recovery utility is run. The Sh1mmer menu is then launched, where the user can unenroll and re-enroll the device, enable USB boot, allow root-level access to the operating system, and more.

https://www.bleepstatic.com/images/news/security/exploits/sh1mmer/sh1mmer-menu.jpg Sh1mmer exploit menu – source bleepingcomputer.com
Trending: How to Exploit “improper error handling” in Web Applications Trending: Offensive Security Tool: XSSRocket Google is aware, but no prevention or detection is provided for the exploitGoogle has stated that they are aware of the issue and are working with hardware partners to address it, although they have not provided information on how administrators can prevent the exploit or detect exploited devices.

When the Sh1mmer exploit is used, the device will show up as inactive in the administration console, which administrators can enable inactive device notifications for to receive emails when a device becomes inactive, allowing them to look into it further and determine if the exploit was used. Some members of the k12sysadmin Reddit group have warned that the use of the Sh1mmer exploit likely breaks student code of conduct and could lead to serious consequences, such as having the school confiscate the Chromebook and removing the student’s district use of technology for a year.
Trending: Cisco VPN Routers: 19,000 Devices Left Exposed to Remote Command Execution Exploit Chain
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-11-300x150.png QNAP NAS Devices at Risk of Remote Malicious Code InjectionJanuary 31, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-10-1-300x150.png PlugX Variant Uncovered: Document-Stealing Malware Targets USB DrivesJanuary 30[...]

Black Hat Ethical Hacking
QNAP NAS Devices at Risk of Remote Malicious Code Injection

QNAP NAS Devices at Risk of Remote Malicious Code InjectionPost Views: 237 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes QNAP, a provider of Network-Attached Storage (NAS) devices, has issued a warning to its customers to install firmware updates that resolve a critical security vulnerability on its devices. The flaw, tracked as CVE-2022-27596, is rated as “Critical” by QNAP, with a CVSS v3 score of 9.8, and is described as a SQL injection flaw.
The vulnerability impacts the QTS 5.0.1 and QuTS hero h5.0.1 versions of the operating system and could allow remote attackers to inject malicious code.
See Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses QNAP advise for device protectionQNAP has advised users running the affected versions of the operating system to upgrade to QTS 5.0.1.2234 build 20221201 or later, and QuTS hero h5.0.1.2248 build 20221215 or later, to ensure the protection of their devices.

The update can be performed by logging in as the admin user and navigating to the firmware update section in the Control Panel, or by downloading the update from QNAP’s Download Center.

It is important for users to apply these security updates as soon as possible, as threat actors are known to target vulnerabilities in QNAP devices.
The company’s devices are already the target of ongoing ransomware campaigns, such as DeadBolt and eCh0raix, which abuse vulnerabilities to encrypt data on exposed NAS devices.
Trending: How to Exploit “improper error handling” in Web Applications Trending: Offensive Security Tool: XSSRocket Always check for updatesIn conclusion, the critical security vulnerability reported by QNAP highlights the importance of keeping device firmware updated to ensure the protection of sensitive data.
Trending: Cisco VPN Routers: 19,000 Devices Left Exposed to Remote Command Execution Exploit Chain
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/02/Images-for-the-News-posts-4-300x150.png Sh1mmer: A New Exploit Enables Unenrollment of Enterprise-Managed ChromebooksFebruary 1, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-10-1-300x150.png PlugX Variant Uncovered: Document-Stealing Malware Targets USB DrivesJanuary 30, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-8-1-300x150.png Ransack Library’s Search and Sort Feature Puts Ruby on Rails Applications at Risk of Information TheftJanuary 27, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-7-2-300x150.png Windows CryptoAPI Flaw Allows Attackers to Spoof Identity, PoC Exploit ReleasedJanuary 26, 2023
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post QNAP NAS Devices at Risk of Remote Malicious Code Injection first appeared on Black Hat Ethical Hacking.

, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-8-1-300x150.png Ransack Library’s Search and Sort Feature Puts Ruby on Rails Applications at Risk of Information TheftJanuary 27, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-7-2-300x150.png Windows CryptoAPI Flaw Allows Attackers to Spoof Identity, PoC Exploit ReleasedJanuary 26, 2023
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Sh1mmer: A New Exploit Enables Unenrollment of Enterprise-Managed Chromebooks first appeared on Black Hat Ethical Hacking.

Monomorph - MD5-Monomorphic Shellcode Packer - All Payloads Have The Same MD5 Hash
http://www.kitploit.com/2023/02/monomorph-md5-monomorphic-shellcode.html

════════════════════════════════════╦═══
╔═╦═╗ ╔═╗ ╔═╗ ╔═╗ ╔═╦═╗ ╔═╗ ╔══╔═╗ ╠═╗
═╩ ╩ ╩═╚═╝═╩ ╩═╚═╝═╩ ╩ ╩═╚═╝═╩ ╠═╝═╩ ╩═
════════════════════════════════╩═══════
By Retr0id

═══ MD5-Monomorphic Shellcode Packer (https://www.kitploit.com/search/label/Packer) ═ ══


USAGE: python3 monomorph.py input_file output_file [payload_file]
What does it do? It packs up to 4KB of compressed shellcode into an executable binary, near-instantly. The output file will always have the same MD5 hash: 3cebbe60d91ce760409bbe513593e401 Currently, only Linux x86-64 is supported. It would be trivial to port this technique to other platforms, although each version would end up with a different MD5. It would also be possible to use a multi-platform polyglot (https://www.kitploit.com/search/label/Polyglot) file like APE (https://justine.lol/ape.html). Example usage: $ python3 monomorph.py bin/monomorph.linux.x86-64.benign bin/monomorph.linux.x86-64.meterpreter sample_payloads/bin/linux.x64.meterpreter.bind_tcp.bin
Why? People have previously (https://www.mscs.dal.ca/~selinger/md5collision/) used single collisions to toggle a binary (https://www.kitploit.com/search/label/Binary) between "good" and "evil" modes. Monomorph takes this concept to the next level. Some people still insist on using MD5 to reference file samples, for various reasons that don't make sense to me. If any of these people end up investigating code packed using Monomorph, they're going to get very confused. How does it work? For every bit we want to encode, a colliding MD5 block has been pre-calculated using FastColl (https://github.com/cr-marcstevens/hashclash/tree/master/src/md5fastcoll). As summarised here (https://github.com/corkami/collisions/tree/master/hashquines#read-an-encoded-value), each collision gives us a pair of blocks that we can swap out without changing the overall MD5 hash. The loader checks which block was chosen at runtime, to decode (https://www.kitploit.com/search/label/Decode) the bit. To encode 4KB of data, we need to generate 4*1024*8 collisions (which takes a few hours), taking up 4MB of space in the final file. To speed this up, I made some small tweaks to FastColl to make it even faster in practice, enabling it to be run in parallel. I'm sure there are smarter ways to parallelise it, but my naive approach is to start N instances simultaneously and wait for the first one to complete, then kill all the others. Since I've already done the pre-computation, reconfiguring the payload (https://www.kitploit.com/search/label/Payload) can be done near-instantly. Swapping the state of the pre-computed blocks is done using a technique (https://github.com/corkami/collisions/blob/master/hashquines/scripts/collisions.py) implemented by Ange Albertini. Is it detectable? Yes. It's not very stealthy at all, nor does it try to be. You can detect the collision blocks using detectcoll (https://github.com/cr-marcstevens/hashclash/tree/collisiondetection/src/collisiondetection).

Download Monomorph (https://github.com/DavidBuchanan314/monomorph)

Privilege Escalation Lead to Data Breach
https://medium.com/@ibnu1337/privilege-escalation-lead-to-data-breach-1e4975c3edaa?source=rss------bug_bounty-5

Assalamualaikum, Bug Hunter!
Bagaimana Kabarnya ? Semoga Baik-baik saja ya, kali ini saya mau membuat Write Up yang menurut saya Bug ini…Continue reading on Medium » (https://medium.com/@ibnu1337/privilege-escalation-lead-to-data-breach-1e4975c3edaa?source=rss------bug_bounty-5)

Don’t Give Up On XSS! | Fun Firefox XSS
https://infosecwriteups.com/dont-give-up-on-xss-fun-firefox-xss-3fce0ee297a?source=rss------bug_bounty-5

There’s always a way to exploit xss in different contextsContinue reading on InfoSec Write-ups » (https://infosecwriteups.com/dont-give-up-on-xss-fun-firefox-xss-3fce0ee297a?source=rss------bug_bounty-5)