hacking: security in practice
Dragos discovered a Florida water utility contractor hosting malicious code on their website

submitted by /u/mBGP
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Features or tools required in portable device.

Hi, I am designing a portable device for hackers(like a smartphone). Please suggest the features that are required.

It will be open sourcee.

submitted by /u/Winter_Youth_1740
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
$500 as My First Bounty

https://cdn-images-1.medium.com/max/794/1*kBpQNeMsay9X4wqPb-qoGA.png
Hello Hackers!

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Finding and Exploiting Unintended Functionality in Main Web App APIs

https://cdn-images-1.medium.com/max/631/1*prKbMk2bhZbCM-9RwY-ABQ.png
While hunting for bugs on Main Web Apps, I encounter tons of interesting APIs.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to hack your ex-girlfriend’s Instagram account

Don’t

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Life’s a Peach (Fuzzer): How to Build and Use GitLab’s Open-Source Protocol Fuzzer

https://cdn-images-1.medium.com/max/2600/1*AyMBV8PMe_1mv0d3Cei9Hw.png
This article aims to demonstrate an end-to-end application of Peach Fuzzer, from build, to deployment, to vulnerability discovery.

Continue reading on CSG @ GovTech »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Who’s in your Facebook and Instagram accounts?

https://cdn-images-1.medium.com/max/2600/0*PNSVxX7rJ4GB3_rP
What to do if you receive a notification about a suspicious login to your Facebook or Instagram account.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Windows PoC Exploit Released for Wormable RCE

https://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Windows PoC Exploit Released for Wormable RCEPost Views: 127
Reading Time: 1 Minute
A researcher has released a proof-of-concept (PoC) exploit for CVE-2021-31166, a use-after-free, highly critical vulnerability in the HTTP protocol stack (http.sys) that could lead to wormable remote code execution (RCE).
Microsoft discovered the flaw internally, releasing a patch in its May 11 Patch Tuesday update. This was the most severe bug in that batch: an http.sysissue that requires neither user authentication nor user interaction to exploit. An exploit would allow RCE with kernel privileges or a denial-of-service (DoS) attack.

According to a tweet from Microsoft’s Justin Campbell, the vulnerability was found by @_mxms and @fzzyhd1.
Fortunately this http.sys bug was an internal find by our team. This one thanks to @_mxms, @fzzyhd1 and everyone who contributes to our tooling and automation. https://t.co/0ru9BQMaJ9

— Justin Campbell (@metr0) May 13, 2021
See Also: Microsoft, Google Clouds Hijacked for Gobs of Phishing http.sysenables Windows and applications to communicate with other devices; it can be run standalone or in conjunction with Internet Information Services (IIS). Microsoft Advises Priority Patching“In most situations, an unauthenticated attacker could send a specially crafted packet to a targeted server utilizing the HTTP Protocol Stack (http.sys) to process packets,” Microsoft explained in its advisory. Given that the vulnerability is wormable, Microsoft recommends prioritizing the patching of affected servers.

“With a CVSS score of 9.8, the vulnerability announced has the potential to be both directly impactful and is also exceptionally simple to exploit, leading to a remote and unauthenticated denial-of-service (Blue Screen of Death) for affected products,” McAfee’s Steve Povolny said in an analysis of the flaw at the time.

Povolny explained that the problem lies in how Windows improperly tracks pointers while processing objects in network packets containing HTTP requests. The vulnerability only affects the latest versions of Windows 10 and Windows Server, meaning that the exposure for internet-facing enterprise servers is “fairly limited,” he said. That’s because many of these systems run Long Term Servicing Channel (LTSC) versions, such as Windows Server 2016 and 2019, which aren’t susceptible to this flaw. Public Exploit for Wormable Security BugResearcher Axel Souchet, who used to work for Microsoft, published the PoC to GitHub, noting that the bug happens in http!UlpParseContentCoding, where the function has a local LIST_ENTRYand appends an item to it. “When it’s done, it moves it into the Request structure; but it doesn’t NULLout the local list,” he explained. “The issue with that is that an attacker can trigger a code path that frees every [entry] of the local list, leaving them dangling in the Request object.”
See Also: Offensive Security Tool: EyeWitness This isn’t the first PoC exploit for CVE-2021-31166 that Souchet has released, but this is the first wormable one. Over the weekend, he released a PoC that only locked the impacted Windows system as long as it’s running an IIS server. That initial exploit shows how an attacker can leverage the flaw to cause DoS on a targeted system by sending it specially crafted packets.
I've built a PoC for CVE-2021-31166 the "HTTP Protocol Stack Remote Code Execution Vulnerability": https://t.co/8mqLCByvCp https://s.w.org/images/core/emoji/13.0.1/72x72/1[...]

___________________________
@hacking_Attack
@Hacking_Video

f525.png https://s.w.org/images/core/emoji/13.0.1/72x72/1f525.png pic.twitter.com/yzgUs2CQO5

— Axel Souchet (@0vercl0k) May 16, 2021 And Thus Does the Exploit Lifecycle Crank Up AgainThe publishing of a PoC code like this is typically the first step in the lifecycle of an exploit. As explained by Trend Micro’s Mayra Rosario Fuentes at the RSA Conference 2021 on Monday, the next step in that lifecycle is for crooks to sell it.

After it’s in the wild, a vulnerability moves into the stage of public disclosure. Next, the vendor patches the vulnerability. Finally, that vulnerability goes down two paths: If it’s patched, that’s it, end of life. If not, the exploit’s still there, waiting to be purchased on underground forums and set free on whichever unlucky victims haven’t yet patched.

One example is the eight-month lifecycle of CVE-2020-9054: an exploit sold on the XSS cybercriminal forum for $20,000 in February 2020 that got written up by cybersecurity journalist Brian Krebs, was publicly disclosed and patched by Microsoft in March 2020, and wound up being exploited by a botnet a month later. That botnet, a variant of the Mirai botnet named Mukashi that targeted Zyxel network-attached storage (NAS) devices, allowed threat actors to remotely compromise and control devices. See Also: Hacking Stories: Xbox UndergroundFive months after it was patched, in August 2020, another forum post requested an exploit, offering a bargain basement payment of $2,000. It’s a tenth of the original exploit, but a solid indication that some vulnerabilities have a long shelf life – most particularly if they’re used to crack open Microsoft products. Microsoft exploits, after all, are by far the most-requested and the most-sold exploit flavors on the underground market: All the more reason to heed Microsoft’s advice to prioritize patching for this one.
Source: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Untitled-design-3-1-90x90.png Microsoft, Google Clouds Hijacked for Gobs of Phishing1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Untitled-design-2-2-90x90.png Microsoft, Adobe Exploits Top List of Crooks’ Wish List2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Untitled-design-3-90x90.png Bizarro Banking Trojan Sports Sophisticated Backdoor3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Safari_Browser-90x90.jpg ‘Scheme Flooding’ Allows Websites to Track Users Across Browsers4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Mac-Malware-90x90.jpg Apple’s ‘Find My’ Network Exploited via Bluetooth7 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Untitled-design-2-1-90x90.png GitHub Prepares to Move Beyond Passwords1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Untitled-design-2-90x90.png Wormable Windows Bug Opens Door to DoS, RCE1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Yellow-Duck-Malware-90x90.jpg Lemon Duck Cryptojacking Botnet Changes Up Tactics1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/iPhone-Jailbreak-90x90.jpg iPhone Hack Allegedly Used to Spy on China’s Uyghurs2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/cisco-jabber-90x90.jpg Critical Cisco SD-WAN, HyperFlex Bugs Threaten Corporate Networks2 weeks ago
The post Windows PoC Exploit Released for Wormable RCE first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

403 Forbidden Bypass

Hey hunters! This writeup is related with my previous writeup. I’ll share with you how I was able to bypass 403 Forbidden. So, Let’s get…Continue reading on Medium »
Read more...

403 Forbidden Bypass
https://dewangpanchal98.medium.com/403-forbidden-bypass-fc8b5df109b7?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hey hunters! This writeup is related with my previous writeup. I’ll share with you how I was able to bypass 403 Forbidden. So, Let’s get…Continue reading on Medium » (https://dewangpanchal98.medium.com/403-forbidden-bypass-fc8b5df109b7?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
Any input?

I want to learn about how horrible the deep web is. Every nitty gritty detail of how it’s set up, how people use it, it fascinates me. I could never use it myself but I love learning about current tech. I’d never order drugs off the deep web. Couldn’t be me

submitted by /u/terpfiend227
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video