AllAboutBugBounty

This repository is an offensive tool for bug bounty hunting, specifically for bypassing various security measures and exploiting vulnerabilities in web applications. The primary focus is on identifying and exploiting weaknesses in business logic, authentication, and authorization. The repository...

Cyberattackers Embrace CAPTCHAs to Hide Phishing

Cyberattackers are using Google’s reCAPTCHA aka the “I am not a robot” function and fake CAPTCHA-like services to obscure various phishing and other campaigns, according to researchers. There are signs however that those evasion efforts may be losing their efficacy. CAPTCHAs are familiar to most...

We COVID-Clicked on Garbage, Report Finds: Podcast

Squawking pets, stir-crazy kids, Tiger King: Is it any wonder that work-from-home humans clicked on malicious CAPTCHAs at the astonishing rate of 50 times more than the non-pandemic year before? In the company’s annual Human Factor 2021 report assessing how the threat landscape morphed over the...

Contact Form 7 Captcha < 0.0.9 - CSRF to Stored XSS

The plugin does not have any CSRF check in place when saving its settings, allowing attacker to make a logged in user with the manageoptions change them. Furthermore, the settings are not escaped when output in attributes, leading to a Stored Cross-Site Scripting issue. All cf7sr parameters are...

Contact Form 7 Captcha < 0.0.9 - CSRF to Stored XSS

The plugin does not have any CSRF check in place when saving its settings, allowing attacker to make a logged in user with the manageoptions change them. Furthermore, the settings are not escaped when output in attributes, leading to a Stored Cross-Site Scripting issue. PoC All cf7sr parameters a...

in emoncms/emoncms

✍️ Description weak password requirements can lead to account takeover vulnerability as attacker easily can perform Bruteforce attacks. 🕵️‍♂️ Proof of Concept if a attacker knows the username and email of the your users then attacker easily can reset the victim password and no privileges required...

Do CAPTCHAs work and what’s the alternative?

We know youre busy, so the answer is “No”. Users want less friction, and a good bot detection and mitigation solution will do the job MUCH better. The first lesson on the first day of UI school is that users want the path of least resistance. While the gamification of cybersecurity does have a...

CVE-2020-25414

A local file inclusion vulnerability was discovered in the captcha function in Monstra 3.0.4 which allows remote attackers to execute arbitrary PHP code...

Remote file inclusion

A local file inclusion vulnerability was discovered in the captcha function in Monstra 3.0.4 which allows remote attackers to execute arbitrary PHP code...

Dictionary-Of-Pentesting

This repository is an offensive tool for Bug Bounty and penetration testing, specifically targeting WordPress and other web applications. It contains a collection of exploits and techniques for bypassing security measures, including account takeover, cross-site scripting XSS, denial of service Do...

How to produce a secure landing page that is safe and get results?

By Owais Sultan One way to improve the security of these landing pages is to add a captcha to the submission process... This is a post from HackRead.com Read the original post: How to produce a secure landing page that is safe and get results?...

Brute Force Attack

phanan/koel is vulnerable to brute-force attack. Lack of CAPTCHA and throttling controls on the login page allows an attacker to repeatedly submit the login form with different values in an attempt to discover usernames and passwords...

I’m Not a Robot! So Why Won’t Captchas Believe Me?

If clicking crosswalks makes your blood boil, you’re not alone. Fortunately, there are some tips that make solving those challenges way less frustrating...

CVE-2021-29047

The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not invalidate CAPTCHA answers after it is used, which allows remote attackers to repeatedly perform actions protected by a CAPTCHA challenge by reusing the same CAPTCHA answer...

CVE-2021-29047

The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not invalidate CAPTCHA answers after it is used, which allows remote attackers to repeatedly perform actions protected by a CAPTCHA challenge by reusing the same CAPTCHA answer...

CVE-2021-29047

The CVE-2021-29047 issue affects Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.3 before fix pack 1, where SimpleCaptcha does not invalidate CAPTCHA answers after use. This allows remote attackers to reuse a previously solved CAPTCHA to perform actions protected by CAPTCHA, effectively bypassing t...

CVE-2021-29047

The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not invalidate CAPTCHA answers after it is used, which allows remote attackers to repeatedly perform actions protected by a CAPTCHA challenge by reusing the same CAPTCHA answer...

iPhone calendar spam attacks on the rise

Recently, we have seen an increasing number of reports from iPhone users about their calendars filling up with junk events. These events are most often either pornographic in nature, or claim that the device has been infected or hacked, and in all cases they contain malicious links. This phenomen...

UPchieve: No Rate Limit On Reset Password

welcome all : i found that no rate limit in reset password in ::: ==https://app.upchieve.org/resetpassword== Summary: No rate limit check on forgot password which can lead to mass mailing and spamming of users and possible employees A little bit about Rate Limit: A rate limiting algorithm is used...

MTN Group: Missing captcha and rate limit protection in help form

Hello One of your form that you are using to receive help message from users, lack captcha and its backend/server does not block massive request. The page is https://mtn.cm/fr/help/ Steps To Reproduce: 1. Visit https://mtn.cm/fr/help/ and fill all the field and submit. 2. Intercept the request wi...