brut3k1t - Server-side Brute-force Module (ssh, ftp, smtp, facebook, and more)

Server-side brute-force module. Brute-force dictionary attack, jk attack that supports multiple protocols and services. 1. Introduction brut3k1t is a server-side bruteforce module that supports dictionary attacks for several protocols. The current protocols that are complete and in support are:...

WordPress Instagram Feed 1.4.6.2 Cross Site Scripting / Cross Site Request Forgery

------------------------------------------------------------------------ Persistent Cross-Site Scripting in Instagram Feed plugin via CSRF ------------------------------------------------------------------------ Sipke Mellema, July 2016...

Instagram Feed <= 1.4.6.2 - Authenticated Cross-Site Scripting (XSS) & CSRF

The Smash Balloon Social Photo Feed WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS & CSRF security vulnerability...

WhatsApp Android text Crash 0day Exploit

This code work on all Android versions. Don't work on all android emulators as nexus. It is a short code that acts on android. When Android PROCESS the code, the app gets a crash. Don't work if android don't process directly the code. tested and work 100% on: - whatsapp message. - whatsapp...

Drupal Instagram Block Module Information Disclosure Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. An information disclosure vulnerability exists in the Drupal Instagram Block module, which allows attackers to exploit the vulnerability to obtain sensitive information...

Likes for Instagram - Customized SSL, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Likes for Instagram published at the 'play' market has multiple vulnerabilities...

l.instagram.com Open Redirect vulnerability

Vulnerable URL: http://l.instagram.com/?e=ATOPqvJF4MOhjGLwZVc5pxI4lKXUFJhqh2PgNmfVtkXyEQMsFy0U8cX=http://openbugbounty.org/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 16.08.2017 Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank|...

That's A Clever Hack! How anyone could make Money from Google and Microsoft

Smart hackers could exploit a loophole that could allow them to steal a significant amount of cash from Google, Microsoft and Instagram using a Premium rate phone number. Security researcher Arne Swinnen from Belgium has discovered an ingenious way to steal money from big tech companies like...

Instagram Block - Moderately Critical - Information Disclosure - SA-CONTRIB-2016-037

This module enables you to authenticate with Instagram's API via an intermediary service instagram.yanniboi.com. The module doesn't sufficiently advise that your authentication tokens could be intercepted. CVE identifiers issued ACVE identifier will be requested, and added upon issuance, in...

Bug Hunter Found Ways to Hack Any Instagram Accounts

How to hack an Instagram account? The answer to this question is difficult to find, but a bug bounty hunter just did it without too many difficulties. Belgian bug bounty hunter Arne Swinnen discovered two vulnerabilities in image-sharing social network Instagram that allowed him to brute-force...

Instagram Patches Brute-Force Authentication Flaws

Facebook on Thursday patched a pair of vulnerabilities that enabled brute-force attacks against Instagram passwords, and also hardened its password policy. Researcher Arne Swinnen privately disclosed the flaws in December and in February respectively. One bug was patched in February, while the...

Zomato: Instagram OAuth2 Implementation Leaks Access Token; Allows for Cross-Site Script Inclusion (XSSI)

Once a user connects his Zomato account to Instagram via OAuth2, the page https://www.zomato.com/php/instagramtagrelay leaks the Instagram OAuth2 Access Token issued to Zomato: PoC: https://www.zomato.com/php/instagramtagrelay?callback=aaabc Result personal data x'ed: HTTP/1.1 200 OK...

Zomato: Reflected Cross-Site Scripting in www.zomato.com/php/instagram_tag_relay

https://www.zomato.com/php/instagramtagrelay is vulnerable to XSS via the callback parameter both POST and GET. PoC: https://www.zomato.com/php/instagramtagrelay?callback=%3Cscript%3Ealertdocument.domain%3C/script%3E In addition, when a Zomato user accesses the page after having connected his...

This 10-year-old Boy becomes the youngest Bug Bounty Hacker

"Talent has no Age Limit" That’s what I said for a 10-year-old Finnish boy on our official Facebook page while sharing his recent achievement with our readers i.e. Winning $10,000 bug bounty from Instagram. Last Tuesday when we at The Hacker News first acknowledged this talented boy and the flaw ...

10-Year-Old Instagram Bug Hunter Earns $10,000

A 10-year-old boy from Finland earned $10,000 after discovering an API bug that allowed him to erase Instagram comments from any account. Facebook confirmed to Threatpost the boy, who goes by the name “Jani”, discovered the bug in late February and received the payout in early March from Facebook...

WordPress Instagram Plugin Cross-Site Scripting

A cross-site scripting vulnerability exists in WordPress Instagram Plugin. Successful exploitation of this vulnerability would allow remote attackers to inject an arbitrary web script into the affected system...

From the deserialization vulnerability to take control of the Empire: millions of dollars of Instagram vulnerability-vulnerability warning-the black bar safety net

2 0 1 2 years, Blloberg in the Facebook white hat reward program's website published a famous article, mentioned in the article:“if Facebook shows the value of millions of dollars of vulnerability,we also wishes to do a single full pay”in. In this article before you start, I want to cheat click...

Grab for Instagram - Customized SSL, Dangerous filesystem permissions, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application Grab for Instagram published at the 'play' market has multiple vulnerabilities...

Instatistics-Instagram tracker - Customized SSL, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Instatistics-Instagram tracker published at the 'play' market has multiple vulnerabilities...

Free instagram followers - Customized SSL, MIT license, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application Free instagram followers published at the 'play' market has multiple vulnerabilities...