Real Identity of Hacker Who Sold LinkedIn, Dropbox Databases Revealed

The real identity of Tessa88—the notorious hacker tied to several high-profile cyber attacks including the LinkedIn, DropBox and MySpace mega breaches—has been revealed as Maksim Vladimirovich Donakov Максим Владимирович Донаков, a resident of Penza, Russian Federation. In early 2016, a hacker wi...

Zenar Content Management System 8.3 Cross Site Request Forgery

Exploit Title: Zenar Content Management System 8.3 - Cross-Site Request Forgery CSRF Date: 2018-05-21 Exploit Author: Ismail Tasdelen Vendor Homepage: https://zenar.io/ Software Link : https://github.com/TribalSystems/Zenario/releases/tag/8.3.47997 Software : Zenar Content Management System 8.3...

The Offensive Web Application Penetration Testing Framework: TIDoS

TIDoS Framework is a comprehensive web-app audit framework. TIDoS is made to be comprehensive and versatile. It is a highly flexible framework where you just have to select and use modules. But before that, you need to set your own API KEYS for various OSINT purposes. To do so, open up APIKEYS.py...

Social Media Enumeration & Correlation Tool: Social Mapper

Social Mapper is a Open Source Intelligence Tool that uses facial recognition to correlate social media profiles across different sites on a large scale. It takes an automated approach to searching popular social media sites for targets names and pictures to accurately detect and group a person’s...

Social Mapper - A Social Media Enumeration & Correlation Tool

A Social Media Mapping Tool that correlates profiles via facial recognition by Jacob WilkinGreenwolf Social Mapper is a Open Source Intelligence Tool that uses facial recognition to correlate social media profiles across different sites on a large scale. It takes an automated approach to searchin...

Linkedin iOS 9.11.8592.4 CPU Resource Exhaustion

!/usr/bin/env python -- coding: utf-8 -- Linkedin Mobile iOS - v9.11 CPU Resource exhaustion Found this and more exploits at my open source security project: http://www.exploitpack.com Date and time of release: 2 August 2018 How to use: Run the script and copy the content of the file, send it as ...

LinkedIn account bypassed 2-Factor-Authentication Exploit

Exploit can reset any LinkedIn account while bypassing callphone authentication. This is private exploit. You can buy it at https://0day.today...

LinkedIn: Persistent XSS (unvalidated Open Graph embed) at LinkedIn.com

This report was previously published on Medium.com/@JonathanBouman. Follow me on Twitter or Medium for new reports. F361972 Proof of concept Background In my previous report we learned more about a special type of the persistent XSS attack; the unvalidated oEmbed attack. This attack allows us to...

Podcast: The Growing Social Media Threat Landscape

Facebook’s Cambridge Analytica scandal in March was just the tip of the social-media iceberg, as malware, hacks and basic privacy concerns continue to increase on social-media platforms. Threatpost’s Lindsey O’Donnell talks with Zack Allen, ZeroFOX’s manager of threat operations, about the threat...

'Zip Slip' Vulnerability Affects Thousands of Projects Across Many Ecosystems

Security researchers at British software firm Snyk have revealed details of a critical vulnerability that affects thousands of projects across many ecosystems and can be exploited by attackers to achieve code execution on the target systems. Dubbed "Zip Slip," the issue is an arbitrary file...

Microsoft Open Redirect

Exploit Title: Open Redirect at Microsoft Date: 28.05.2018 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.microsoft.com/ Software : Microsoft Service Website Software Version : 1.0.0 Vulnerability : Open Redirect CWE : CWE-601: URL Redirection to Untrusted Site 'Open Redirect'...

A week in security (April 23 – April 29)

Last week, we dug into behavioral biometrics, explored a new crossrider variant, and embraced the power of "no." We also launched another CrackMe challenge, took a deep dive into smart toys, and finished up with a look at digital privacy in the age of IoT. Other news LinkedIn does battle with...

Flaw in LinkedIn AutoFill Plugin Lets Third-Party Sites Steal Your Data

Not just Facebook, a new vulnerability discovered in Linkedin's popular AutoFill functionality found leaking its users' sensitive information to third party websites without the user even knowing about it. LinkedIn provides an AutoFill plugin for a long time that other websites can use to let...

Flaw in LinkedIn AutoFill Plugin Lets Third-Party Sites Steal Your Data

Not just Facebook, a new vulnerability discovered in Linkedin's popular AutoFill functionality found leaking its users' sensitive information to third party websites without the user even knowing about it. LinkedIn provides an AutoFill plugin for a long time that other websites can use to let...

Localblox exposes personal data of millions of Facebook & LinkedIn users

By Waqas Facebook has been at the receiving end of backlash and This is a post from HackRead.com Read the original post: Localblox exposes personal data of millions of Facebook & LinkedIn users...

Chris Vickery Discusses Data Leak of 48 Million Users by Private Intelligence Firm

SAN FRANCISCO – Profile data of 48 million users that was scraped from social networks and websites ranging from Facebook, LinkedIn, Zillow and Twitter was leaked by a private intelligence agency. The data was left on an Amazon S3 storage bucket accessible without a password by Localblox, the...

LinkedIn: Can delete other user's post and company page post

Vulnerability description not provided...

A week in security (April 02 – April 08)

Last week, we took a look at fake Whatsapp antics, dubious gaming extensions, and a huge Panera bread breach. There was also LockCrypt ransomware to contend with, we had a poke around Linkedin, and we published another Physician, protect thyself blog. Other news Compromised cash register systems...

Maybe you shouldn’t use LinkedIn

UPDATE: 4/6/2018 LinkedIn reached out for comment on the article, and we'd like to clarify our position based on their concerns. They wrote: Members control their connections, who can see them including keeping them private if they wish and only first degree connections can get access to your...

Russian Hacker Who Allegedly Hacked LinkedIn and Dropbox Extradited to US

A Russian man accused of hacking LinkedIn, Dropbox, and Formspring in 2012 and possibly compromising personal details of over 100 million users, has pleaded not guilty in a U.S. federal court after being extradited from the Czech Republic. Yevgeniy Aleksandrovich Nikulin, 30, of Moscow was arrest...