Nextcloud: Share recipient can modify a share's expiration date

Vulnerable URL http://server/nextcloud/ocs/v2.php/apps/filessharing/api/v1/shares/share ID number Summary Nextcloud users can set expiration dates on documents they share with others. However, the function to update a share does not appear to properly validate the requester is the owner when...

Osmedeus - Automatic Reconnaisance And Scanning In Penetration Testing

Automatic Reconnaisance and Scanning in Penetration Testing What is Osmedeus? Osmedeus allow you to doing boring stuff in Pentesting automatically like reconnaissance and scanning the target by run the collection of awesome tools. Installation git clone https://github.com/j3ssie/Osmedeus cd...

Extending fuzzing with Burp by FAST

I love Burp Suite, like really. It’s the most convenient tool to visualize what’s happening with apps, what requests look like and to test simple things like XSS injection. At the same time, it’s really hard for me to do something more complicated, like implementing custom fuzzing with having to...

Extending fuzzing with Burp by FAST

I love Burp Suite, like really. It’s the most convenient tool to visualize what’s happening with apps, what requests look like and to test simple things like XSS injection. At the same time, it’s really hard for me to do something more complicated, like implementing custom fuzzing with having to...

Java deserialization vulnerability: in a restricted environment from vulnerability discovery to get a reverse Shell-vulnerability warning-the black bar safety net

Java deserialization vulnerability can be said that the Java security a piece of heart disease, in recent years more in the security sector“in the limelight”in. Actually say to the Java deserialization issues, as early as the beginning of 2015 in AppSecCali conference, two security researchers,...

AES-Killer v3.0 - Burp Plugin To Decrypt AES Encrypted Traffic Of Mobile Apps On The Fly

BurpsuitePlugin to decrypt AES Encrypted traffic on the fly. Requirements Burpsuite Java Tested on Burpsuite 1.7.36 Windows 10 xubuntu 18.04 Kali Linux 2018 What it does The IProxyListener decrypt requests and encrypt responses, and an IHttpListener than encrypt requests and decrypt responses. Bu...

Polycom VVX 500 / VVX 601 5.8.0.12848 Man-In-The-Middle

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Advisory ID: SYSS-2018-027 Product: VVX 500 / VVX 601 Manufacturer: Polycom Affected Versions: = 5.8.0.12848 Tested Versions: 5.4.0.10182, 5.8.0.12848 Vulnerability Type: X.509 validation - Man-in-the-Middle CWE-300 Risk Level: Medium Solution Statu...

AudioCodes 440HD / 450HD IP Phone 3.1.2.89 Man-In-The-Middle

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Advisory ID: SYSS-2018-026 Product: 440HD / 450HD IP Phone Manufacturer: AudioCodes Affected Versions: = 3.1.2.89 Tested Versions: VC3.1.1.43.1, VC3.1.2.89 Vulnerability Type: X.509 validation - Man-in-the-Middle CWE-300 Risk Level: Medium Solution...

Chaturbate: Update Chat Allowed By Option ( without age verification )

Summary Hi Team, I am here again with one interesting issue. This issue deals with the fact that according to the policies of chaturbate, a broadcaster cannot modify the option - Chat Allowed By - until and unless he/she has verified his/her age default choice is set to all. This thing could be...

Gurp - Golang command-line interface to Burp Suite's REST API

Requirements BurpSuite Professional v2.0.0beta or greater from PortSwigger Dependencies go get -u -v github.com/fatih/color go get -u -v github.com/integrii/flaggy go get -u -v github.com/tidwall/gjson go get -u -v github.com/grokify/html-strip-tags-go Binaries Latest version available here...

HackerOne: Revoking user session in https://hackerone.com/settings/sessions does not revoke the GraphQL query session

Hi Team, Summary: I have found an Insufficient Session Expiration on implementation of the new Revoke user session feature of HackerOne here: https://hackerone.com/settings/sessions Description: The new REVOKE session feature will destroy the session of the selected device, that means any request...

h1-5411-CTF: Remote Command Execution in a internal server to get the flag file

Summary: After source code disclosure using a LFI vulnerability and using PHP object injection with XXE I was able to find an internal service at port 1337. Using the SSRF through XXE I sent a HTTP request to this internal service and discovered a python object injection using status parameter,...

Upserve : Reflected xss on theacademy.upserve.com

Vulnerabilty Reflected xss in https://theacademy.upserve.com. STEPS TO REPRODUCE 1. Go to https://theacademy.upserve.com/playlists/all-videos/. 2. Click on any video to watch from the playlist and capture the request in burp. 3. you have to capture the request to...

hideNsneak - A CLI For Ephemeral Penetration Testing

This application assists in managing attack infrastructure for penetration testers by providing an interface to rapidly deploy, manage, and take down various cloud services. These include VMs, domain fronting, Cobalt Strike servers, API gateways, and firewalls. Black Hat Arsenal Video Demo Video ...

Vanilla: Abusing "Report as abuse" functionality to delete any user's post.

Hi Team, Greetings!! Description: I would like to report a vulnerability that can be used to delete any user’s post by abusing “Report an abuse” function within application. After specific number of reports submitted to server, it automatically deletes that post of user. Application has...

U.S. Dept Of Defense: Cross Site Scripting (XSS) – Reflected

Reflected Cross-site Scripting XSS occur when an attacker injects browser executable code within a single HTTP response.When a web application is vulnerable to this type of attack, it will pass unvalidated input sent through requests back to the client. The value of request parameter is copied in...

CLI for Ephemeral Penetration Testing: hideNsneak

This application assists in managing attack infrastructure for penetration testers by providing an interface to rapidly deploy, manage, and take down various cloud services. These include VMs, domain fronting, Cobalt Strike servers, API gateways, and firewalls. hideNsneak provides a simple...

Exploiting Blind Java Deserialization with Burp and Ysoserial

While performing a web application penetration test, I stumbled upon a parameter with some base64 encoded data within a POST parameter. Curious as to what it was, I sent it over to Burp decoder...

Xiaomi MIWiFi Xiaomi_55DD 2.8.50 Out-Of-Band Resource Load Vulnerability

An out-of-band resource load issue was discovered on Xiaomi MIWiFi Xiaomi55DD version 2.8.50 devices. It is possible to induce the application to retrieve the contents of an arbitrary external URL and return those contents in its own response. If a domain name containing a random string is used i...

MIWiFi Xiaomi_55DD 2.8.50 Out-Of-Band Resource Load

CVE: CVE-2018-16307 Issue: Out-of-band resource load Product affected: MIWiFi Xiaomi55DD Version 2.8.50 Summary: An "Out-of-band resource load" issue was discovered on Xiaomi MIWiFi Xiaomi55DD Version 2.8.50 devices. It is possible to induce the application to retrieve the contents of an arbitrar...