CredSniper - Phishing Framework which supports SSL and capture credentials with 2FA tokens

Easily launch a new phishing site fully presented with SSL and capture credentials along with 2FA tokens using CredSniper. The API provides secure access to the currently captured credentials which can be consumed by other applications using a randomly generated API token. Benefits Fully supporte...

On ROCA, KRACK, BoundHook, Google Advanced Protection

Threatpost editors Mike Mimoso and Tom Spring recap this week’s infosec news starting with the ROCA vulnerabilities affecting factorization of RSA private keys, the KRACK WPA2 Wi-Fi vulnerabilities, the BoundHook attacks, and Google’s introduction of Advanced Protection for Gmail. Download: Music...

safari10跨域漏洞

safari 10的XMLHttpRequest在null域下可以随意发起跨域请求和设置httpheader 我交到苹果的bugreport，并给apple发邮件后，他们自己悄悄把漏洞修了，连个邮件都没给我发，所以我决定公开poc 这是我在漏洞未修复前截的图： 这个漏洞可以造成同源策略绕过，随便跨域，这是我写的获取gmail数据的代码： html var serveraddress = 'http://127.0.0.1:8000/static/csrfWcn6h/' function deleteSelf let test = document.getElementById'test'...

How SS7 Flaw Can Be Used to Hack Gmail ID and Bitcoin Wallet

By Waqas An old vulnerability in the Signalling System No. 7 SS7 This is a post from HackRead.com Read the original post: How SS7 Flaw Can Be Used to Hack Gmail ID and Bitcoin Wallet...

LinkedIn Phishing Scam Steals Gmail Credentials Through Google Docs

By Waqas LinkedIn, a business and employment-oriented social networking website contain personal information This is a post from HackRead.com Read the original post: LinkedIn Phishing Scam Steals Gmail Credentials Through Google Docs...

Disguised as Citrix Utility, Kedi RAT Exploits Gmail to Transfer Data

By Uzair Amir A Remote Access Trojan RAT is one of the most used This is a post from HackRead.com Read the original post: Disguised as Citrix Utility, Kedi RAT Exploits Gmail to Transfer Data...

Compromised LinkedIn accounts used to send phishing links via private message and InMail

Phishing continues to be a criminals' favorite for harvesting user credentials with more or less sophisticated social engineering tricks. In this post, we take a look at a recent attack that uses existing LinkedIn user accounts to send phishing links to their contacts via private message but also...

Legal Robot: Email Length Verification

Hi Team, Hope you are good. I found your website app.legalrobot.com vulnerable to this vulnerability. Bug: Improper authentication - generic Description: Dont know much about the websites that how they stored email address.Email addresses are stored as VARCHAR128 But here your website legalrobot...

Gmail for iOS Adds Anti-Phishing Feature that Warns of Suspicious Links

Phishing — is an older style of cyber-attack but remains one of the most common and efficient attack vectors for attackers, as a majority of banking malware and various ransomware attacks begin with a user clicking on a malicious link or opening a dangerous attachment in an email. Phishing has...

Inbox by Gmail - BSD license, Base64 encoded String, Exported ContentProvider vulnerabilities

HackApp vulnerability scanner discovered that application Inbox by Gmail published at the 'play' market has multiple vulnerabilities...

Weblate: Running 2 accounts with a single email #3

Following the fixes: 241608 & 224072. there's still another way round this. Reproduction Steps 1. Register 2 accounts Preferably using Gmail not third party - Login both accounts on separate browsers - In Browser1, navigate to https://demo.weblate.org/accounts/profile/auth - Add a new association...

WordPress Ultimate Product Catalogue 4.2.2 SQL Injection

Exploit Title: Ultimate Product Catalogue 4.2.2 Sql Injection a Plugin WordPress a Sql Injection Exploit Author: Lenon Leite Vendor Homepage: https://wordpress.org/plugins/ultimate-product-catalogue/ Software Link: https://wordpress.org/plugins/ultimate-product-catalogue/ Contact:...

A week in security (June 19 – June 25)

Last week, we expanded on all the different technologies that Malwarebytes uses to break the attack chain and our Incident Response solution. We also warned you about a Roblox Robux generator scam and a phish targeting customers of Barclays Bank. Below are notable news stories and security-relate...

Google to stop scanning user emails for Gmail ads

By Jahanzaib Hassan Diane Greene, the founder of VMware Inc. and the board member at Google revealed that Google will now stop analyzing user’s personal emails for targeted advertising purposes. Gmail As you may know, Gmail users encounter a number of ads based on their emails content. That is, t...

Dedicated Machine Learning Behind Early Phishing Detection in Gmail

Cybercrime and state-sponsored advanced attacks continue to cling to email as a primary distribution vehicle for first-stage malware. Phishing campaigns thrive in targeted attacks, and criminals have even resuscitated old-school macro malware in attachments to gain that initial foothold on a...

Russian Hackers Made 'Tainted Leaks' a Thing — Phishing to Propaganda

We came across so many revelations of sensitive government and corporate data on the Internet these days, but what's the accuracy of that information leaked by unknown actors? Security researchers have discovered new evidence of one such sophisticated global espionage and disinformation campaign...

1 Million Gmail Users Impacted by Google Docs Phishing Attack

Google said that up to 1 million Gmail users were victimized by yesterday’s Google Docs phishing scam that spread quickly for a short period of time. In a statement, Google said that fewer than 0.1 percent of Gmail users were affected; as of last February, Google said it had one billion active...

Warning! Don't Click that Google Docs Link You Just Received in Your Email

Did someone just share a random Google Doc with you? First of all — Do not click on that Google Doc link you might have just received in your email and delete it immediately — even if it's from someone you know. I, my colleagues at The Hacker News, and even people all around the Internet,...

Weblate: Open redirect in Signing in via Social Sites

Weak Authentication Leads to the Open redirection to Malicios Sites : Signing in via Facebook : + https://hosted.weblate.org/accounts/login/facebook/?next=///evil.com Signing in via Gmail : + https://hosted.weblate.org/accounts/login/google-oauth2/?next=///evil.com Signing in via Github: +...

Hacker Selling Over 1 Million Decrypted Gmail and Yahoo Passwords On Dark Web

Hardly a day goes without headlines about any significant data breach. In past year, billions of accounts from popular sites and services, including LinkedIn, Tumblr, MySpace, Last.FM, Yahoo!, VK.com were exposed on the Internet. Now, according to the recent news, login credentials and other...