Free Instagram Followers Tip - External URLs, WebView JavaScript enabled, WebView files access vulnerabilities

HackApp vulnerability scanner discovered that application Free Instagram Followers Tip published at the 'play' market has multiple vulnerabilities...

Layout from Instagram: Collage - Customized SSL, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application Layout from Instagram: Collage published at the 'play' market has multiple vulnerabilities...

WordPress Plugin Instagram Feed Cross-Site Request Forgery Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the Wordpress plugin Instagram Feed. An attacker exploiting the...

WordPress Instagram Feed 1.4.6.2 Plugin - Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications !-- Source: https://sumofpwn.nl/advisory/2016/persistentcrosssitescriptingininstagramfeedpluginviacsrf.html Persistent Cross-Site Scripting in Instagram Feed plugin via CSRF Abstract A persistent Cross-Site Scripting vulnerability was found in...

Server Side Bruteforce Module: brut3k1t

Server Side Bruteforce Module brut3k1t is a server-side bruteforce module that supports dictionary attacks for several protocols. The current protocols that are complete and in support are: ssh ftp smtp XMPP instagram facebook There will be future implementations of different protocols and servic...

WordPress Plugin Instagram Feed 1.4.6.2 - Cross-Site Request Forgery

WordPress Plugin Instagram Feed 1.4.6.2 - Cross-Site Request Forgery !-- Source: https://sumofpwn.nl/advisory/2016/persistentcrosssitescriptingininstagramfeedpluginviacsrf.html Persistent Cross-Site Scripting in Instagram Feed plugin via CSRF Abstract A persistent Cross-Site Scripting vulnerabili...

WordPress Instagram Feed Plugin <= 1.4.6.2 - Cross Site Request Forgery

Because of this vulnerability, attackers can perform a wide variety of actions, such as stealing Administrators' session tokens, or performing arbitrary actions on their behalf. Solution Update the plugin...

WordPress Plugin Instagram Feed 1.4.6.2 - Cross-Site Request Forgery

!-- Source: https://sumofpwn.nl/advisory/2016/persistentcrosssitescriptingininstagramfeedpluginviacsrf.html Persistent Cross-Site Scripting in Instagram Feed plugin via CSRF Abstract A persistent Cross-Site Scripting vulnerability was found in the Instagram Feed plugin. This issue allows an...

brut3k1t - Server-side Brute-force Module (ssh, ftp, smtp, facebook, and more)

Server-side brute-force module. Brute-force dictionary attack, jk attack that supports multiple protocols and services. 1. Introduction brut3k1t is a server-side bruteforce module that supports dictionary attacks for several protocols. The current protocols that are complete and in support are:...

WordPress Instagram Feed 1.4.6.2 Cross Site Scripting / Cross Site Request Forgery

------------------------------------------------------------------------ Persistent Cross-Site Scripting in Instagram Feed plugin via CSRF ------------------------------------------------------------------------ Sipke Mellema, July 2016...

Instagram Feed <= 1.4.6.2 - Authenticated Cross-Site Scripting (XSS) & CSRF

The Smash Balloon Social Photo Feed WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS & CSRF security vulnerability...

WhatsApp Android text Crash 0day Exploit

This code work on all Android versions. Don't work on all android emulators as nexus. It is a short code that acts on android. When Android PROCESS the code, the app gets a crash. Don't work if android don't process directly the code. tested and work 100% on: - whatsapp message. - whatsapp...

Drupal Instagram Block Module Information Disclosure Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. An information disclosure vulnerability exists in the Drupal Instagram Block module, which allows attackers to exploit the vulnerability to obtain sensitive information...

Likes for Instagram - Customized SSL, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Likes for Instagram published at the 'play' market has multiple vulnerabilities...

l.instagram.com Open Redirect vulnerability

Vulnerable URL: http://l.instagram.com/?e=ATOPqvJF4MOhjGLwZVc5pxI4lKXUFJhqh2PgNmfVtkXyEQMsFy0U8cX=http://openbugbounty.org/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 16.08.2017 Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank|...

That's A Clever Hack! How anyone could make Money from Google and Microsoft

Smart hackers could exploit a loophole that could allow them to steal a significant amount of cash from Google, Microsoft and Instagram using a Premium rate phone number. Security researcher Arne Swinnen from Belgium has discovered an ingenious way to steal money from big tech companies like...

Instagram Block - Moderately Critical - Information Disclosure - SA-CONTRIB-2016-037

This module enables you to authenticate with Instagram's API via an intermediary service instagram.yanniboi.com. The module doesn't sufficiently advise that your authentication tokens could be intercepted. CVE identifiers issued ACVE identifier will be requested, and added upon issuance, in...

Bug Hunter Found Ways to Hack Any Instagram Accounts

How to hack an Instagram account? The answer to this question is difficult to find, but a bug bounty hunter just did it without too many difficulties. Belgian bug bounty hunter Arne Swinnen discovered two vulnerabilities in image-sharing social network Instagram that allowed him to brute-force...

Instagram Patches Brute-Force Authentication Flaws

Facebook on Thursday patched a pair of vulnerabilities that enabled brute-force attacks against Instagram passwords, and also hardened its password policy. Researcher Arne Swinnen privately disclosed the flaws in December and in February respectively. One bug was patched in February, while the...

Zomato: Instagram OAuth2 Implementation Leaks Access Token; Allows for Cross-Site Script Inclusion (XSSI)

Once a user connects his Zomato account to Instagram via OAuth2, the page https://www.zomato.com/php/instagramtagrelay leaks the Instagram OAuth2 Access Token issued to Zomato: PoC: https://www.zomato.com/php/instagramtagrelay?callback=aaabc Result personal data x'ed: HTTP/1.1 200 OK...