CVE-2017-0906: Server-Side Request Forgery (SSRF)

The Recurly Client Python Library before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2 is vulnerable to a Server-Side Request Forgery vulnerability in the "Resource.get" method that could result in compromise of API keys or other critical resources...

PT-2017-10707

Name of the Vulnerable Software and Affected Versions Recurly Client .NET Library versions prior to 1.0.1 Recurly Client .NET Library versions prior to 1.1.10 Recurly Client .NET Library versions prior to 1.2.8 Recurly Client .NET Library versions prior to 1.3.2 Recurly Client .NET Library versio...

PT-2017-10706

Name of the Vulnerable Software and Affected Versions Recurly Client Python Library versions prior to 2.0.5 Recurly Client Python Library versions prior to 2.1.16 Recurly Client Python Library versions prior to 2.2.22 Recurly Client Python Library versions prior to 2.3.1 Recurly Client Python...

PT-2017-10705

Name of the Vulnerable Software and Affected Versions Recurly Client Ruby Library versions prior to 2.0.13 Recurly Client Ruby Library versions prior to 2.1.11 Recurly Client Ruby Library versions prior to 2.2.5 Recurly Client Ruby Library versions prior to 2.3.10 Recurly Client Ruby Library...

Yelp: Leaking sensitive information lead to compromise employer API keys

The configuration file of an internal IRC bot which included credentials to internal services and some external services used by Yelp developers was inadvertently included by an employee in a personal public GitHub repository. The repository was taken down and the affected credentials rotated...

CVE-2017-14797

Lack of Transport Encryption in the public API in Philips Hue Bridge BSB002 SW 1707040932 allows remote attackers to read API keys and consequently bypass the pushlink protection mechanism, and obtain complete control of the connected accessories by leveraging the ability to sniff HTTP traffic on...

Design/Logic Flaw

Lack of Transport Encryption in the public API in Philips Hue Bridge BSB002 SW 1707040932 allows remote attackers to read API keys and consequently bypass the pushlink protection mechanism, and obtain complete control of the connected accessories by leveraging the ability to sniff HTTP traffic on...

CVE-2017-14797

Lack of Transport Encryption in the public API in Philips Hue Bridge BSB002 SW 1707040932 allows remote attackers to read API keys and consequently bypass the pushlink protection mechanism, and obtain complete control of the connected accessories by leveraging the ability to sniff HTTP traffic on...

CVE-2017-14797: Inadequate Encryption Strength

Lack of Transport Encryption in the public API in Philips Hue Bridge BSB002 SW 1707040932 allows remote attackers to read API keys and consequently bypass the pushlink protection mechanism, and obtain complete control of the connected accessories by leveraging the ability to sniff HTTP traffic on...

CVE-2017-14797

Lack of Transport Encryption in the public API in Philips Hue Bridge BSB002 SW 1707040932 allows remote attackers to read API keys and consequently bypass the pushlink protection mechanism, and obtain complete control of the connected accessories by leveraging the ability to sniff HTTP traffic on...

CVE-2017-14797

The CVE-2017-14797 entry concerns Philips Hue Bridge BSB002 public API on firmware 1707040932, where a lack of transport encryption enables an attacker on the local intranet to sniff HTTP traffic and read API keys. This bypasses the pushlink protection and can, per cited sources, allow full contr...

PT-2017-13690

Name of the Vulnerable Software and Affected Versions Philips Hue Bridge BSB002 version 1707040932 Description The issue is related to a lack of transport encryption in the public API, allowing remote attackers to read API keys by sniffing HTTP traffic on the local intranet network. This can lead...

Automated Penetration Testing Toolkit UPDATE: APT2 v1.0-20170613!

PenTestIT RSS Feed Almost five months ago, I covered this automated penetration testing toolkit. I was updating my tools today and found that this toolkit was also updated some time ago. This is the APT2 v1.0-20170613 release, which was released almost 2 months ago. What is APT2? APT2 will perfor...

Subdomain Enumeration Using Censys & Crtsh!

PenTestIT RSS Feed If you read my last post about V1D0m and liked it, I'm sure you will LOVE this post. As you will remember, the older post was about subdomain enumeration using VirusTotal, this post is about enumerating subdomains and DNS information using the following services: CloudFlare,...

X (Formerly Twitter): XXE on sms-be-vip.twitter.com in SXMP Processor

Hi team, What type of issue are you reporting? Does it align to a CWE or OWASP issue? I've identified an XXE vulnerability in the cloudhopper sxmp servlet on sms-be-vip.twitter.com which discloses local files to an external attacker and allows web requests to be sent. This aligns to...

Chat With Hacker Assistant: hackerbot

Chat with your assistant and enjoy hacking This bot is a combination of chatbot and hacking tools Chatting Twitter account analysis Url scan File scan Ip scan Linux enumeration Linux priv escalation checker Shellshock Mimipenguin Installation git clone https://github.com/omergunal/hackerbot cd...

An All In One Information Gathering Tool: RED HAWK

RED HAWK is An All In One Tool For Information Gathering, SQL Vulnerability Scanning and Crawling.Coded In PHP Scans That You Can Perform Using RED HAWK : Basic Scan Site Title NEW IP Address Web Server Detection IMPROVED CMS Detection Cloudflare Detection robots.txt Scanner Whois Lookup IMPROVED...

Online Malware & URL Analysis: MalSub

Online Malware & URL Analysis malsub is a Python 3.6.x framework that wraps several web services of online malware and URL analysis sites through their RESTful Application Programming Interfaces APIs . It supports submitting files or URLs for analysis, retrieving reports by hash values, domains,...

Simple Twitter Metadata Scraper

Simple Twitter Metadata Scraper The goal of this simple python script is to analyze a Twitter profile through its tweets by detecting: Average tweet activity, by hour and by day of the week Timezone and language set for the Twitter interface Sources used mobile application, web browser, …...

PT-2018-5063

Name of the Vulnerable Software and Affected Versions Firefox for Android versions prior to 50 Description A previously installed malicious Android application with specific signature-level permissions can access API keys intended for Firefox. This issue is exclusive to Firefox for Android, with...