#Beacon

How Wiz Research found a common misconfiguration in Azure Active Directory that compromised multiple Microsoft applications, including a Bing management portal

644 viewsedited 09:06

#Beacon

Looking to secure your Bitrix-based website from potential threats? Look no further than the BITRIX VULNERABILITY SCANNER, based on the expert insights and techniques found in the Attacking Bitrix guide.

#bitrix

1.7K views14:05

#Beacon

Path Buster - path normalization utility is a tool that can be used to detect vulnerabilities in web applications related to file and directory path handling.

It allows you to automatically normalize and compare different variants of file and directory paths on a server to identify potential vulnerabilities related to normalization.

GitHub

GitHub - ethicalhackingplayground/pathbuster: A path-normalization pentesting tool.

A path-normalization pentesting tool. Contribute to ethicalhackingplayground/pathbuster development by creating an account on GitHub.

839 views22:16

#Beacon

https://blog.securitybreached.org/2023/04/19/how-i-manipulated-my-rank-on-the-bugcrowd-platform/

Security Breached Blog

How I Manipulated My Rank on the Bugcrowd Platform - Security Breached Blog

This vulnerability on the Bugcrowd platform allowed manipulating rank on the platform using the API.

821 views15:04

#Beacon

https://www.synack.com/blog/exploits-explained-5-unusual-authentication-bypass-techniques/?utm_content=222702763&utm_medium=social&utm_source=twitter&hss_channel=tw-2485761421

Synack

Exploits Explained: 5 Unusual Authentication Bypass Techniques

% %

787 views18:32

#Beacon

🔥🔥🔫 Волшебная папка про багбаунти

❗️Теперь все каналы и чаты на тему багбаунти можно добавить себе прямо сейчас в один клик в виде отдельной папки (Павел Дуров запилил нам крутой функционал) - вот эта папка.

В этой папке 26 активных чатов и телеграмм каналов на эту тему, всё что нужно багхантеру. Саму папку буду допиливать в процессе и мы соберем в ней всё, что вообще можно собрать про багбаунти.

🐹 Багхантер

937 viewsedited 23:45

#Beacon

https://github.com/mindedsecurity/semgrep-rules-android-security

GitHub

GitHub - mindedsecurity/semgrep-rules-android-security: A collection of Semgrep rules derived from the OWASP MASTG specifically…

A collection of Semgrep rules derived from the OWASP MASTG specifically for Android applications. - mindedsecurity/semgrep-rules-android-security

874 views12:48

#Beacon

https://checkmarx.com/blog/hijacking-s3-buckets-new-attack-technique-exploited-in-the-wild-by-supply-chain-attackers/

Checkmarx

Hijacking S3 Buckets: New Attack Technique

Without altering a single line of code, attackers poisoned the NPM package bignum by hijacking the S3 bucket serving binaries necessary for its function and replacing them with malicious ones

664 views18:59

#Beacon

Chrome Browser Extension Security Testing

https://www.cobalt.io/blog/introduction-to-chrome-browser-extension-security-testing

* Nuclei templates to audit Chrome extensions

www.cobalt.io

Introduction to Chrome Browser Extension Security Testing | Cobalt

Browser extensions, plugins, and add-ons are software components that enhance the functionality of existing programs, specifically web browsers.

860 views22:04

#Beacon

https://www.nullpt.rs/hacking-gta-servers-using-web-exploitation

www.nullpt.rs

Hacking GTA V RP Servers Using Web Exploitation Techniques

FiveM provides a powerful framework to create game experiences not otherwise possible in Grand Theft Auto. However, this power can be abused by attackers through the use of XSS in vulnerable NUI resources.

673 views10:01

#Beacon

https://trufflesecurity.com/blog/how-secrets-leak-out-of-docker-images/

#trufflehog

Trufflesecurity

How Secrets Leak out of Docker Images ◆ Truffle Security Co.

Complexities in Docker’s layered architecture and caching has created an environment where developers can easily unintentionally leak secrets. Most Docker secret leaks fall into 3 categories: overly permissive file operations, hardcoded secrets in Dockerfiles…

617 viewsedited 07:08

#Beacon

https://labs.hakaioffsec.com/nginx-alias-traversal/

Hakai

Vulnerability Research

517 views20:25

#Beacon

https://medium.com/@bazzounbassem/bypass-two-factor-authentication-of-facebook-accounts-25-300-7ae152d7836a

Medium

Bypass Two-Factor Authentication of Facebook Accounts ($25,300)

In this writeup, I will explain how I discovered a Two-Factor Authentication bypass in Facebook during Meta bug bounty Researchers…

568 views20:30

#Beacon

https://youtu.be/1w_t6mOaOq4

YouTube

Сергей Канибор . Kubernetes Pentest All‑in‑One: The Ultimate Toolkit

Kubernetes Pentest All‑in‑One: The Ultimate Toolkit

Сергей Канибор
R&D / Container Security, Luntry

Чтобы автоматизировать и ускорить работу при проведении пентеста Kubernetes‑кластера, обычно используют различные инструменты. Но что делать, если ты находишься…

531 views15:29

#Beacon

https://medium.com/@evan.connelly/post-account-takeover-account-takeover-of-internal-tesla-accounts-bc720603e67d

Medium

Post Account Takeover? Account Takeover of Internal Tesla Accounts

In testing various Tesla web applications as part of the Tesla Bug Bounty Program, I’ve created many Tesla user accounts. At some point…

610 views20:10

#Beacon

https://samcurry.net/hacking-starbucks/

samcurry.net

Hacking Starbucks and Accessing Nearly 100 Million Customer Records

After a long day of trying and failing to find vulnerabilities on the Verizon Media bug bounty program I decided to call it quits and do some chores. I needed to buy gifts for a friends birthday and went online to order a Starbucks gift card.

529 views18:33

#Beacon

https://blog.projectdiscovery.io/understanding-automating-credential-stuffing-a-comprehensive-guide/

projectdiscovery.io

Understanding & Automating Credential Stuffing Testing with Nuclei — ProjectDiscovery Blog

It's not breaking news that protecting sensitive user data and ensuring the security of online accounts has become more critical than ever. With an increasing number of data breaches and cyberattacks, understanding various attack methodologies and implementing…

609 views18:34

#Beacon

https://medium.com/@mrhavit/breaking-tiktok-our-journey-to-finding-an-account-takeover-vulnerability-b0646aba1c4b

Medium

Breaking TikTok: Our Journey to Finding an Account Takeover Vulnerability

Hello, fellow security researchers and bug bounty hunters!

620 views20:20

#Beacon

https://medium.com/@snoopy101/weird-lfi-and-escalating-the-impact-from-high-to-critical-3e804f5366e9

Medium

Weird LFI and escalating the impact from High to Critical

Hey wonderful hackers. I was hacking on a VDP program and after a light recon I picked one subdomain to hunt.

700 views20:22

#Beacon

Forwarded from sdnv's funk-hole

Пентестеры в СНГ часто сталкиваются с 1С-серверами внутри инфраструктур, один из векторов атак - Консоль Администрирования Кластеров 1С (RAS).
Чтобы попытаться подключиться к нему - подбирают версию клиента коноли аналогичную серверу, скачивают нужный серверный дистрибутив под винду и только тогда смогут зайти под имеющимися/пустыми кредами получая кучу полезной информации.

Я автоматизировал этот процесс благодаря консольной утилите rac от 1С для Linux. Более того, больше не нужно подбирать версию клиента и сервера - утилита rac работает с разными версиями серверов.

Этапы: Скан nmap с поиском открытых портов RAS, Сбор информации при успешном подключении к серверу, Выгрузка полученной информации в .csv под каждый сервер. Более подробно в README

https://github.com/sdnv0x4d/rasoff

GitHub

GitHub - sdnv0x4d/rasoff: 1C RAS Offensive Security Tool

1C RAS Offensive Security Tool. Contribute to sdnv0x4d/rasoff development by creating an account on GitHub.

671 views08:56

About

Blog

Apps

Platform