Cybersecurity researchers have disclosed a series of attacks by a threat actor of Chinese origin (Winnti or APT41) that has targeted organizations in Russia and Hong Kong with malware — including a previously undocumented backdoor.
https://thehackernews.com/2021/01/researchers-disclose-undocumented.html
https://thehackernews.com/2021/01/researchers-disclose-undocumented.html
5 Ways to Exploit a Domain Takeover Vulnerability
https://redhuntlabs.com/blog/5-ways-to-exploit-a-domain-takeover-vulnerability.html
https://redhuntlabs.com/blog/5-ways-to-exploit-a-domain-takeover-vulnerability.html
RedHunt Labs
5 Ways to Exploit a Domain Takeover Vulnerability - RedHunt Labs
Domain Takeover occurs when the organization did not renew its domain but still use it in their code and infrastructure. When the attacker registers the abandoned domain, they own the domain, including its subdomains and other types of DNS records.
👍1
AD Attack
1) Performing domain #recon using PS
https://stealthbits.com/blog/performing-domain-reconnaissance-using-powershell/
2) Attack mapping with #bloodhound
https://stealthbits.com/blog/local-admin-mapping-bloodhound/
3) Extracting passwd hashes
https://stealthbits.com/blog/extracting-password-hashes-from-the-ntds-dit-file/
4) Pass-the-hash attacks with #mimikatz
https://stealthbits.com/blog/passing-the-hash-with-mimikatz/
#Penetration_Testing
1) Performing domain #recon using PS
https://stealthbits.com/blog/performing-domain-reconnaissance-using-powershell/
2) Attack mapping with #bloodhound
https://stealthbits.com/blog/local-admin-mapping-bloodhound/
3) Extracting passwd hashes
https://stealthbits.com/blog/extracting-password-hashes-from-the-ntds-dit-file/
4) Pass-the-hash attacks with #mimikatz
https://stealthbits.com/blog/passing-the-hash-with-mimikatz/
#Penetration_Testing
Best writeup CTF hackthebox
https://github.com/Ignitetechnologies/HackTheBox-CTF-Writeups
https://github.com/Ignitetechnologies/HackTheBox-CTF-Writeups
GitHub
GitHub - Ignitetechnologies/HackTheBox-CTF-Writeups: This cheasheet is aimed at the CTF Players and Beginners to help them sort…
This cheasheet is aimed at the CTF Players and Beginners to help them sort Hack The Box Labs on the basis of Operating System and Difficulty. - Ignitetechnologies/HackTheBox-CTF-Writeups
'2022 Zero-Day In-the-Wild Exploitation…so far ', a blog post by Project-0 of Google.
https://googleprojectzero.blogspot.com/2022/06/2022-0-day-in-wild-exploitationso-far.html
https://googleprojectzero.blogspot.com/2022/06/2022-0-day-in-wild-exploitationso-far.html
Blogspot
2022 0-day In-the-Wild Exploitation…so far
Posted by Maddie Stone, Google Project Zero This blog post is an overview of a talk, “ 0-day In-the-Wild Exploitation in 2022…so far”,...
XSS in Gmail’s AMP For Email earns researcher $5,000.
https://portswigger.net/daily-swig/xss-in-gmails-amp-for-email-earns-researcher-5-000
https://portswigger.net/daily-swig/xss-in-gmails-amp-for-email-earns-researcher-5-000
The Daily Swig | Cybersecurity news and views
XSS in Gmail’s AMP For Email earns researcher $5,000
Researcher bypasses email filter with inspired style tag trickery
Zero-Day used to access 5.4M user data from Twitter (confirmed by company).
https://hackerone.com/reports/1439026
https://securityaffairs.co/wordpress/134087/data-breach/twitter-zero-day-data-leak.html
https://restoreprivacy.com/twitter-vulnerability-exposes-5-million-accounts/
https://hackerone.com/reports/1439026
https://securityaffairs.co/wordpress/134087/data-breach/twitter-zero-day-data-leak.html
https://restoreprivacy.com/twitter-vulnerability-exposes-5-million-accounts/
HackerOne
X / xAI disclosed on HackerOne: Discoverability by phone...
**Summary:** By using this vulnerability an attacker can find a twitter account by it's phone number/email even if the user has prohibited this in the privacy options.
**Description:** The...
**Description:** The...