Holiday Season 2015 Email Campaign

The holiday season is a time when many people go on vacation or at least get much-needed downtime from work, but that is not always the case with attackers. To better understand the threats we face during “the most wonderful time of the year,” FireEye Labs has been collecting data on the most...

US Intelligence Chief Hacked by the Teen Who Hacked CIA Director

Nation's Top Spy Chief Got Hacked! The same teenage hacker who broke into the AOL email inbox of CIA Director John Brennan last October has now claimed to have broken into personal email and phone accounts of the US Director of National Intelligence James Clapper. Clapper was targeted by the...

Mozilla Firefox Bootstrapped Addon Social Engineering Code Execution

This protection will detect and block attempts to exploit this vulnerability...

Microsoft OneNote 2 0 1 3 null pointer read or cause RCE-vulnerability warning-the black bar safety net

The problem exists Software: One Note 2 0 1 3 Operating systemname: Microsoft Windows 7 Professional Operating systemversion: 6.1.7601 Service Pack 1 Build 7 6 0 1 Manufacturer: Microsoft Corporation According to WinDBG! exploitable extensions, Microsoft OneNote 2 0 1 3 There is at least one deni...

Shopify: HTTP-Response-Splitting on v.shopify.com

I discovered a HTTP-Response-Splitting issue on v.shopify.com Steps to reproduce: Call the following URL in any browser and catch the response e.g. with burp...

Cimon CmnView DLL Hijacking Vulnerability

OVERVIEW Ivan Sanchez of Wise Security has identified a DLL Hijacking vulnerability in the CIMON CmnView.exe application. CIMON, Inc. has produced a patch that mitigates this vulnerability. This vulnerability could be exploited remotely with social engineering and requires local user input...

Google Updates Chrome, Extends Safe Browsing to Chrome for Android

Google yesterday released an update for the Chrome browser that patches seven vulnerabilities and also updates Adobe Flash Player. It also announced that Google Safe Browsing has been extended to Chrome for Android. The Chrome browser update is the second in less than a week; on Dec 1, Chrome 47...

FBI Warns Public Officials of Doxing Threat

The FBI has put law enforcement and high-profile public officials on notice that they could be targeted by hacktivists following the recent doxing of CIA director John Brennan by the hacktivism collective called Crackas With Attitude. Brennan’s AOL email account was taken over by a teen associate...

Snapchat: Password Reset - query param overrides postdata

Suppose a user were to reset their password at the following url with the given query parameters: https://accounts.snapchat.com/accounts/changepassword? newpassword=someNewPass&newpassword2=someNewPass Then regardless of the new password entered into the form, someNewPass becomes the user's new...

X (Formerly Twitter): Following a User Actually Follows Another User

I can display a web intent page to a victim that appears to prompt them to follow one user, but actually ends up following a completely different user when they click "follow". The following is a proof of concept:...

Social Engineering — Free Online Training for Hackers

For most of us Hacking is Technological in Nature. But, we usually forget the most important element of hacking that makes a successful hack from 10% to over 90%... ...The Human Element. And here the Social Engineering comes in. Social Engineering deals with non-technical kind of intrusion and...

High school Student Hacked Into CIA Director's Personal Email Account

A self-described teenage hacker has claimed to have hacked into personal AOL email account of Central Intelligence Agency CIA Director John Brennan and swiped sensitive top-secret data. It's Really a major embarrassment for Brennan as well as the CIA. The hacker, who describes himself as an...

SpeedPhishing Framework: SPF

This presentation will start by quickly exploring some of the common phishing attack tools and techniques. During the presentation, audience participation will be encouraged in the form of providing examples and personal experience in what phishing techniques people have used and what would be...

Palo Alto Networks Panorama PAN-OS < 6.0.1 Firmware Signature Verification Bypass Arbitrary Code Execution

The remote Panorama appliance is running a version of Palo Alto Networks PAN-OS prior to 6.0.1. It is, therefore, affected by a firmware signature bypass vulnerability due to a flaw in signature verification process that allows an attacker to execute arbitrary Python code within an image file...

Aw, Snap! This 16-Character String Can Crash Your Google Chrome

Remember when it took only 13 characters to crash Chrome browser instantly? This time, it takes 16-character simple URL string of text to crash Google Chrome instantly. Yes, you can crash the latest version of Chrome browser with just a simple tiny URL. To do this, all you need to do is follow on...

Open Automation Software OPC Systems NET DLL Hijacking Vulnerability

OVERVIEW Ivan Sanchez from Nullcode Team has identified a DLL Hijacking vulnerability in Open Automation Software’s OPC Systems.NET application. Open Automation Software has reviewed the vulnerability and determined not to patch the issue at this time. This vulnerability could be exploited remote...

FBI Warns Businesses of Email Scams, Wire Fraud

U.S. businesses are losing millions in fraudulent wire transfers that have their root in email compromises of accounts belonging to top executives. An FBI advisory issued Thursday warns businesses that regularly conduct wire transfer payments to be vigilant about potential email account...

Geotweet - Social engineering tool for human hacking

Another way to use Twitter and instagram. Geotweet is an osint application that allows you to track tweets and instagram and trace geographical locations and then export to google maps. Allows you to search on tags, world zones and user info and timeline. Requirements Python 2.7 PyQt4, tweepy,...

SPF - SpeedPhish Framework

SPF SpeedPhish Framework is a python tool designed to allow for quick recon and deployment of simple social engineering phishing exercises. Requirements: dnspython twisted PhantomJS Usage: usage: spf.py -h -f -C --all --test -e -g -s --simulate -w -W -d -c --ip -v -y optional arguments: -h, --hel...

Change this Facebook Privacy Setting That Could Allow Hackers to Steal Your Identity

Facebook User: Who Can Find Me...? Hacker: Yes, I CAN!! A Security Researcher claimed “digi-crims could easily scan the population of an entire country to find targets”. Reza Moaiandin, technical director at Salt Agency, has figured out a way to exploit an important Facebook feature to gather...