PoC of how someone can grab db settings from config files, if they are edited in Vim on a server (for example, if an admin user edits WordPress' wp-config.php file, an attacker can just download the .swp file and get the credentials)
https://ift.tt/2CeG8pd
Submitted September 04, 2018 at 12:59AM by web_dev_etc
via reddit https://ift.tt/2LTIERw
https://ift.tt/2CeG8pd
Submitted September 04, 2018 at 12:59AM by web_dev_etc
via reddit https://ift.tt/2LTIERw
How I did not get a shell
https://ift.tt/2wjChRv
Submitted September 03, 2018 at 10:13PM by eqarmada2
via reddit https://ift.tt/2MHBjtk
https://ift.tt/2wjChRv
Submitted September 03, 2018 at 10:13PM by eqarmada2
via reddit https://ift.tt/2MHBjtk
Protection: Defending Assets, Information & Yourself in the Modern Age
https://ift.tt/2NLcMQP
Submitted September 04, 2018 at 09:27AM by darksim905
via reddit https://ift.tt/2LQN5MQ
https://ift.tt/2NLcMQP
Submitted September 04, 2018 at 09:27AM by darksim905
via reddit https://ift.tt/2LQN5MQ
reddit
r/netsec - Protection: Defending Assets, Information & Yourself in the Modern Age
3 votes and 1 comment so far on Reddit
Multiple Vulnerabilities on Kerui Endoscope Camera
https://ift.tt/2NRfZOs
Submitted September 04, 2018 at 02:49PM by utku1337
via reddit https://ift.tt/2Crhm5B
https://ift.tt/2NRfZOs
Submitted September 04, 2018 at 02:49PM by utku1337
via reddit https://ift.tt/2Crhm5B
Utkusen
Multiple Vulnerabilities on Kerui Endoscope Camera
Recently, I bought a device named Kerui Endoscope Camera (Model:YPC99) from Aliexpress. It’s a very popular device which is sold more than 5000 via different stores.
The package contains: Endoscope camera, Wifi device and a small user manual
Problem 1…
The package contains: Endoscope camera, Wifi device and a small user manual
Problem 1…
XIP - IP addresses mutation
https://ift.tt/2wGPcNF
Submitted September 04, 2018 at 04:54PM by Nitr4x
via reddit https://ift.tt/2Q4NAWG
https://ift.tt/2wGPcNF
Submitted September 04, 2018 at 04:54PM by Nitr4x
via reddit https://ift.tt/2Q4NAWG
Using AWS Account ID’s for IAM User Enumeration
https://ift.tt/2CfX4vF
Submitted September 04, 2018 at 06:53PM by hackers_and_builders
via reddit https://ift.tt/2oBFzfo
https://ift.tt/2CfX4vF
Submitted September 04, 2018 at 06:53PM by hackers_and_builders
via reddit https://ift.tt/2oBFzfo
Fuzzing Counter-Strike: Global Offensive maps files with AFL
https://ift.tt/2PBxMcX
Submitted September 04, 2018 at 08:01PM by 0x4a616e
via reddit https://ift.tt/2LVhSrZ
https://ift.tt/2PBxMcX
Submitted September 04, 2018 at 08:01PM by 0x4a616e
via reddit https://ift.tt/2LVhSrZ
reddit
r/netsec - Fuzzing Counter-Strike: Global Offensive maps files with AFL
20 votes and 1 comment so far on Reddit
Discovering misconfigured Tor sites exposing themselves via public IPs (Spanish)
https://ift.tt/2wIhs2f
Submitted September 04, 2018 at 10:19PM by le-quack
via reddit https://ift.tt/2LWMKbp
https://ift.tt/2wIhs2f
Submitted September 04, 2018 at 10:19PM by le-quack
via reddit https://ift.tt/2LWMKbp
TekCrispy
IP's públicas de Tor son expuestas mediante certificados SSL
Por medio de una mala configuración del servidor es posible encontrar la IP pública de cualquier sitio web oculto con Tor.
0wned - Code execution via Python package installation
https://ift.tt/2Q2fJxJ
Submitted September 04, 2018 at 09:58PM by Schwag
via reddit https://ift.tt/2LWypLW
https://ift.tt/2Q2fJxJ
Submitted September 04, 2018 at 09:58PM by Schwag
via reddit https://ift.tt/2LWypLW
GitHub
mschwager/0wned
Code execution via Python package installation. Contribute to mschwager/0wned development by creating an account on GitHub.
JSON Deserialization Memory Corruption Vulnerabilities on Android
https://ift.tt/2NyDonN
Submitted September 05, 2018 at 12:47AM by marketingversprite
via reddit https://ift.tt/2ChiZCu
https://ift.tt/2NyDonN
Submitted September 05, 2018 at 12:47AM by marketingversprite
via reddit https://ift.tt/2ChiZCu
VerSprite | Integrated Security Services and Consulting
JSON Deserialization Memory Corruption Vulnerabilities on Android
VerSprite's cybersecurity research team analyzes JSON Deserialization Memory Corruption Vulnerabilities on Android. Stay tuned for the rest of the series.
Credential Stealer - MEGA Chrome Extension version 3.39.4
https://ift.tt/2oEKs7J
Submitted September 05, 2018 at 01:34AM by Roflnor
via reddit https://ift.tt/2MQ3OW5
https://ift.tt/2oEKs7J
Submitted September 05, 2018 at 01:34AM by Roflnor
via reddit https://ift.tt/2MQ3OW5
reddit
r/Monero - Don't use MEGA Chrome Extension version 3.39.4
94 votes and 29 comments so far on Reddit
Create a Hypervisor From Scratch (Parts 1 &2)
https://ift.tt/2NOJD70
Submitted September 05, 2018 at 03:12AM by PeterG45
via reddit https://ift.tt/2MKBGTX
https://ift.tt/2NOJD70
Submitted September 05, 2018 at 03:12AM by PeterG45
via reddit https://ift.tt/2MKBGTX
Sina & Shahriar's Blog
Hypervisor From Scratch – Part 2: Entering VMX Operation - Sina & Shahriar's Blog
In this section, we will learn about Detect Hypervisor Support for our processor, then we simply config the basic stuff to Enable VMX and Loading our VMCS in the last of this, we look at Interacting with our VMM from User-Mode.
x64 Inline Assembly in Windows Driver Kit
https://ift.tt/2NOTQ3z
Submitted September 05, 2018 at 03:10AM by PeterG45
via reddit https://ift.tt/2NndBlX
https://ift.tt/2NOTQ3z
Submitted September 05, 2018 at 03:10AM by PeterG45
via reddit https://ift.tt/2NndBlX
Sina & Shahriar's Blog
x64 Inline Assembly in Windows Driver Kit - Sina & Shahriar's Blog
In this post, you will learn how to create an x64 inline assembly project in Windows Driver Kit. As you know Microsoft remove _asm from its compilers.
Hacking the RPi Cam Web Interface
https://ift.tt/2LWQyJK
Submitted September 05, 2018 at 07:55AM by Inter4567
via reddit https://ift.tt/2M096bU
https://ift.tt/2LWQyJK
Submitted September 05, 2018 at 07:55AM by Inter4567
via reddit https://ift.tt/2M096bU
Reigningshells
Hacking The RPi Cam Web Interface
In my spare time, I like to poke around on different open and closed source projects and look for vulnerabilities. Recently, I turned m...
Which Vulnerabilities Are Being Exploited by Attackers
https://ift.tt/2LIbm7C
Submitted September 05, 2018 at 12:41PM by CyberBullets
via reddit https://ift.tt/2wJTh3F
https://ift.tt/2LIbm7C
Submitted September 05, 2018 at 12:41PM by CyberBullets
via reddit https://ift.tt/2wJTh3F
Rapid7 Blog
Common Vulnerabilities Exploited in Attacks and Penetration Tests
Software vulnerabilities are at the core of pen testing—and our "Under the Hoodie" report provides insights and advice one can only get in the trenches.
Company claim "New" way to access home routers and home networks
https://ift.tt/2NiGmzR
Submitted September 05, 2018 at 01:39PM by le-quack
via reddit https://ift.tt/2oEWDBc
https://ift.tt/2NiGmzR
Submitted September 05, 2018 at 01:39PM by le-quack
via reddit https://ift.tt/2oEWDBc
SureCloud
Wi-Jacking: Accessing your neighbour’s WiFi without cracking
During a recent engagement we found an interesting interaction of browser behaviour and an accepted weakness in almost every home router that could be Abusing ‘by design’ behaviour to gain the ability to hijack millions of WiFi networks through saved credentials…
Passwordless Authentication Wallet (PAW)
https://ift.tt/2M5zDVC
Submitted September 05, 2018 at 09:36PM by jrjr17
via reddit https://ift.tt/2NiUw4g
https://ift.tt/2M5zDVC
Submitted September 05, 2018 at 09:36PM by jrjr17
via reddit https://ift.tt/2NiUw4g
GitHub
jrjr/paw.js
Passwordless Authentication Wallet (PAW) is key-based authentication for the web. The library helps manage identities, their associated public/private keypairs, and signing operations in the browse...
MEGA Chrome Extension Hacked - Detailed Timeline of Events - SerHack security engineer
https://ift.tt/2NkWlgV
Submitted September 05, 2018 at 10:40PM by serhack
via reddit https://ift.tt/2wKfHlg
https://ift.tt/2NkWlgV
Submitted September 05, 2018 at 10:40PM by serhack
via reddit https://ift.tt/2wKfHlg
serhack.me
MEGA Chrome Extension Hacked - Detailed Timeline of Events - SerHack security engineer
On 4 September at 14:30 UTC, an unknown attacker managed to hack into MEGA's Google Chrome web store account and upload a malicious version 3.39.4 of an extension to the web store, according to a blog post published by the company.
Hack the Struts 2 RCE Vulnerability (CVE-2018-11776) in a live sandbox
https://ift.tt/2LLN2Sj
Submitted September 06, 2018 at 12:57AM by jrkjared3
via reddit https://ift.tt/2Q58dSJ
https://ift.tt/2LLN2Sj
Submitted September 06, 2018 at 12:57AM by jrkjared3
via reddit https://ift.tt/2Q58dSJ
HackEDU
Interactive Cybersecurity Training | HackEDU
Interactive Cybersecurity Training. HackEDU offers comprehensive online Secure Development Training for your developers, engineers, and IT personnel to assist your organization in laying a foundation of security and application vulnerability prevention, assessment…
Cisco has addressed vulnerabilities in its products
https://ift.tt/2LXgUeJ
Submitted September 06, 2018 at 02:37PM by sirpedrotavares
via reddit https://ift.tt/2NjdI1E
https://ift.tt/2LXgUeJ
Submitted September 06, 2018 at 02:37PM by sirpedrotavares
via reddit https://ift.tt/2NjdI1E
Segurança Informática
Cisco has addressed vulnerabilities in its products
Cisco addressed a dozen and high severity vulnerabilities affecting the company's RV series, SD-WAN, Umbrella, and other products.
Fallout Exploit Kit Used in Malvertising Campaign to Deliver GandCrab Ransomware
https://ift.tt/2NUoAzY
Submitted September 07, 2018 at 01:26AM by EvanConover
via reddit https://ift.tt/2CmPcZc
https://ift.tt/2NUoAzY
Submitted September 07, 2018 at 01:26AM by EvanConover
via reddit https://ift.tt/2CmPcZc
FireEye
Fallout Exploit Kit Used in Malvertising Campaign to Deliver GandCrab Ransomware « Fallout Exploit Kit Used in Malvertising Campaign…
FireEye identified a new exploit kit that was being served up as part of a malvertising campaign affecting users in Japan, Korea, the Middle East, Southern Europe, and other countries in the Asia Pacific region.