People Interactive: Origin IP found, Cloudflare bypassed

The vulnerability allowed non-Cloudflare IP addresses to access the origin servers, bypassing Cloudflare's protection and potentially exposing the servers to unfiltered attacks and data retrieval...

Cloudflare Launches Its Security-Focused Mobile VPN, Again

When the company first launched the Warp VPN, “all hell broke loose,” its CEO says. After a few months of tinkering, Cloudflare wants a do-over...

Astaroth Spy Trojan Uses Facebook, YouTube Profiles to Cover Tracks

Facebook and YouTube profiles are at the heart of an ongoing phishing campaign spreading the Astaroth trojan, bent on the eventual exfiltration of sensitive information. The attack is sophisticated in that it uses normally trusted sources as cover for malicious activities – thus evading usually...

Google to Experiment 'DNS over HTTPS' (DoH) Feature in Chrome 78

Immediately after Mozilla announced its plan to soon enable 'DNS over HTTPS ' DoH by default for Firefox users in the United States, Google today says it is planning an experiment with the privacy-focused technology in its upcoming Chrome 78. Under development since 2017, 'DNS over HTTPS' perform...

Mozilla Launches 'Firefox Private Network' VPN Service as a Browser Extension

Mozilla has officially launched a new privacy-focused VPN service, called Firefox Private Network, as a browser extension that aims to encrypt your online activity and limit what websites and advertisers know about you. Firefox Private Network service is currently in beta and available only to...

UPDATE: Kali Linux 2019.3 Release

PenTestIT RSS Feed Kali Linux 2019.3, the latest and the greatest Kali Linux release is now officially available! This is the third 2019 release, which comes after Kali Linux 2019.2. This release includes the normal bugs fixes, updates the kernel to version 5.2.9, and includes various new feature...

goDoH - A DNS-over-HTTPS C2

godoh is a proof of concept Command and Control framework, written in Golang, that uses DNS-over-HTTPS as a transport medium. Currently supported providers include Google, Cloudflare but also contains the ability to use traditional DNS. Installation All you would need are the godoh binaries...

HTTP Bugs Open Websites to DoS Attacks

Eight bugs in the implementation of HTTP/2, the most recent version of the HTTP protocol, can be exploited to launch denial of service attacks. The flaws were found in vendor server configurations ranging from Amazon, Google, Microsoft and Apache. Bugs are similar in nature and can be exploited b...

New HTTP/2 vulnerability exposure, allowing hackers to exploit an unpatched server to trigger a DoS attack-vulnerability warning-the black bar safety net

According to foreign media reports, recently, security researchers disclosed a HTTP/2 Protocol the eight vulnerabilities, allowing hackers to use to support HTTP/2 communication is not to patch the server to trigger a denial of Service DoS attack is. It is reported that these vulnerabilities allo...

8chan down after Cloudflare & hosting firms boots it off

By Uzair Amir Cloudflare's decision came hours after it was reported that 8chan has been linked to three recent mass shootings in the United States. This is a post from HackRead.com Read the original post: 8chan down after Cloudflare & hosting firms boots it off...

Cloudflare Ditches 8chan. What Happens Now?

In an interview with WIRED, Cloudflare CEO Matthew Prince explains his decision to stop protecting 8chan—and where the notorious forum goes from here...

Cloudcheck - Checks Using A Test String If A Cloudflare DNS Bypass Is Possible Using CloudFail

Cloudcheck is made to be used in the same folder as CloudFail. Make sure all files in this repo are in the same folder before using. Also create a empty text file called none.txt in the data folder, that way it doesn't do a subdomain brute when testing. Cloudcheck will automatically change your...

There are Upload file the file name at the time of discovery of the delay injection vulnerability-vulnerability warning-the black bar safety net

! The It is author in invited to test items found in the Upload File name the filename of a time delay blind injection vulnerabilities, this position is relatively rare, Share this in hopes of everyone starting to learn a role. The following is the author of the discovery process. Earlier this...

Cloudflare’s recent 502 Bad Gateway outage blamed on bad software

By Waqas If you are visiting a website and it is displaying “502 Bad Gateway” error it is not your fault but an issue with Cloudflare. Cloudflare, the world's largest "Content Delivery Network" CDN on the internet has suffered a service disruption causing “502 Bad Gateway” error on thousands of...

Google Announces DNS over HTTPS 'General Availability'

Google announced general availability of its Public DNS-over-HTTPS service Wednesday, based on the Internet Engineering Task Force’s RFC 8484 standard. The move is a culmination of three years of Google fine-tuning DNS over HTTPS, otherwise known as DoH. “Today we are announcing general...

Cloudflare’s Five-Year Project to Protect Nonprofits Online

The company's Project Galileo has helped organizations fend off DDoS and other attacks for the last five years...

Unikrn: multiple vulnerabilities on your mautic server

Hi @unikrn! I found some vulnerabilities in you crm server: 1. By pass Cloudflare access: You Use Cloudflare Access on https://crm.unikrn.com . BUt this link bypassed Cloudflare Access: ████████/login This vulnerability generates the disclosure of important data: PHP info page: ██████████phpinfo ...

Used to bypass the posture formed SSRF acquiring India's biggest stock broker company AWS password credentials-vulnerability warning-the black bar safety net

Hello everyone, today share of it is the author in response to India's biggest stock broker company for security testing, by different levels of the bypassing techniques Bypass, and eventually acquired the company AWS password credentials in the process. Where to WAF bypassing, as well as further...

WAFW00F v1.0.0 - Detect All The Web Application Firewall!

WAFW00F identifies and fingerprints Web Application Firewall WAF products. How does it work? To do its magic, WAFW00F does the following: Sends a normal HTTP request and analyses the response; this identifies a number of WAF solutions. If that is not successful, it sends a number of potentially...

Travel Booking < 2.7.8.4 - Reflected & Stored XSS

Weak security measures like no input & textarea fields data filtering has been discovered in the 'Traveler - Travel Booking WordPress Theme'. Special Notes: 1 - 'Change Avatar' upload field works really strange. F.e., u can upload any .PHP file with extension .php.png and break profile page Serve...