Penetration Testing Frequently Asked Questions

You may have noticed this recent article about Googles contest that rewarded a hacker for discovering a vulnerability in Chrome. Once Google verified the vulnerability, they were able to fix the bug and issue the cash prize to the hacker. This is a very public example similar to what Coalfire Lab...

'The Hacker News' Celebrating 2nd Birthday

One of the most awaited occasions in a year is your birthday, same way we are today celebrating 'The Hacker News' 2nd Birthday week from on 28th October-3rd November 2012. Originally founded on 1st November 2010 by Mohit Kumar, 'The Hacker News' was the very First dedicated Hacking and Security...

NASA Jet Propulsion Laboratory Vulnerable to Cross Site Scripting (XSS)

Yesterday, we report about the security breach in US Government computers belongs to NASA restricted area website and Hacker dump out the complete source code and files from server of the website. Today another hacker claim a quick XSS Cross site scripting Vulnerability in NASA's Jet Propulsion...

3.6 Million South Carolina Taxpayers at Risk of ID Theft

State officials are warning South Carolina taxpayers that 3.6 million Social Security numbers and other personal data was exposed in a recent attack on Department of Revenue servers. Anyone who filed a state return since 1998 are asked to call 866 578-5422 or visit protectmyid.com/scdor. The stat...

Remotely controlled Malware as Browser extensions

"Browser extensions extend the functionality of the web browser. These extensions improve the appearance, functionality, security or other parts of the browser. Extensions were also developed with malicious intent, in order to generate revenue or just spread the code between more and more browser...

Hacker leaks source code of NASA website belongs to US Government computer

A Hacker going by name - "LegitHacker97" claiming that he successfully access a NASA subdomain website , that actually belongs to a US Government computer, as mentioned on homepage. WARNING This is a US Government computer Hacker also dump a 82.51 MB compressed or 337 MB uncompressed Archive five...

Patriot Hacker 'The Jester' list his all time favorite Open Source Intelligence toolset

Most of the readers have question in mind that, How hackers know everything about their target ? How to DOX finding personal information someone ? So answer is -- Open Source Intelligence OSINT. A Patriot Hacker 'The Jester' or "th3j35t3r" who made his name after harassing Anonymous activist grou...

vBGarage Pro vBulletin Mod - SQL Injection

vBGarage Pro search parameter "modelyear" is unsanitzed, which can lead to an SQL Injection. !/bin/bash MegaManSec InterNot echo "MegaManSec @ www.internot.info" echo "White-Hat Hacker :" if -z "$1" ; then echo "Usage: $0 http://link.to/forum/" echo "Example: $0 http://f800riders.org/forum/" exit...

Sony PlayStation 3 hacked with custom firmware

The PlayStation 3 has been hacked before, originally with the PSJailbreak dongle and fail0verflow, but Sony managed to fight back with Firmware 3.60 which managed to ingeniously re-secure the console. But Hackers have released a custom firmware which allows compromised consoles to log into PSN,...

F5 FirePass SSL VPN 4xxx Series | Arbitrary URL Redirection

OVERVIEW F5 FirePass SSL VPN is vulnerable to Open URL Redirection. 2. BACKGROUND F5 FirePass SSL VPN provides secure remote access to enterprise applications and data for users over any device or network while protecting your corporate. See http://www.f5.com/pdf/products/firepass-overview.pdf...

Schoolhos CMS Beta 2.29 - id SQL Injection

Schoolhos CMS Beta 2.29 - id SQL Injection Exploit Title: Schoolhos CMS SQL Injetions Google Dork: intext:Schoolhos Free Open Source CMS Date: 22 Oktober 2012 Exploit Author: Cumi++ Vendor Homepage: http://schoolhos.com/ Version: Beta 2.29 Tested on: Ubuntu 12.04...

Anonymous Hacker claims to have 20,000 debit card details from HSBC Cyberattack

One of Anonymous hacker groups "FawkesSecurity" who claim responsibility for a DDOS cyber attack on HSBC Bank says that they also manage to get 20,000 debit card details. When HSBC said, "This denial-of-service attack did not affect any customer data, but did prevent customers using HSBC online...

Peru Domains Registrar hacked and 207116 Domain panel credentials leaked

A huge hack carried out today ! One of the biggest Peru Domain registrar company punto.pe hacked by Lulzsecperu declared by a tweet and Complete database of 207116 websites has been leaked on internet. Leaked database include Domain panel username, encrypted password, Company descriptions. Hacked...

French Android Malware writer Arrested for stealing $653700

A French hacker has been arrested for spreading a virus through fake smartphone applications. Prosecutors say he stole tiny sums from 17,000 people, amassing about 500,000 euros £405,000 since 2011. Working from the basement of his parents' home in Amiens, France, he created malicious software th...

45000 Wordpress blogs hacked on 2nd day of Spam campaign

Yesterday I have reported about a huge mysterious hack in wordpress servers, that cause compromise of 15000 wordpress account and hacker managed to post same spam article of "Money making sites" with title - "Im getting paid!" on each blog. We explained how hacker was earning in thousands of...

Struts2 remote code execution vulnerability detection principle and code level implementation-vulnerability warning-the black bar safety net

Laboratory evan-css analysis of the recent very fire of Struct2 vulnerability hole. Recently very fire the Struts2 vulnerability everyone should have heard of it, if you haven't heard it doesn't matter about this vulnerability can be described with a one-sentence summary: vulnerability is...

Sensitive server info leaked from weather.gov Vulnerability

Kosova Hacker's Security group today release very sensitive server info of "The National Weather Service", which was gathered due to a "Local file inclusion" Vulnerability in weather.gov . By definition, Local File Inclusion also known as LFI is the process of including files on a server through...

Exclusive : Gary McKinnon wins 10-year fight against US extradition

Gary McKinnon has had his extradition blocked by the UK government. He has finally won his 10-year fight against extradition after Home Secretary Theresa May today halted proceedings on human rights grounds. The Home Secretary said medical reports warning the computer hacker would kill himself if...

New Internet Explorer zero-day, Can trigger malware automatically

The new zero day exploit has been discovered and being exploited in the wild. This can be used to load malicious application on victim machines running fully patched Windows XP SP3 along with the latest editions of the IE 7 and IE 8 browser and Adobe's Flash software. Eric Romang was examining on...

Think Like a Hacker for Better Security

Computer hacking is truly an epidemic. It's not enough to apply the latest patches to your servers and workstations or otherwise defend yourself reactively. If you're in charge of your network's security, you must understand how hackers minds work and what tools they're using for their attacks...