73 matches found
RED_HAWK
Versione 2.0.0 Di R3D@0R2H1N A.K.A Tuhinshubhra Strumento tutto in uno per Information Gathering e Vulnerability Scanning Scansioni che puoi eseguire con RED HAWK : Scansione di base Titolo del sito NUOVO Indirizzo IP Rilevamento del server web MIGLIORATO Rilevamento CMS Rilevamento Cloudflare...
ChaosKobra
ChaosKobra 🐍 Un altro strumento per l'enumerazione dei sottodomini per i normali, scritto in Python3. 🔧 Tecnologie e Strumenti 📚 Requisiti Python 3.9+ pip3 Installazione Usa il gestore di pacchetti pip per installare i requisiti. Se non è installato, installalo con il seguente comando...
Dnsplit
Dnsplit - Strumento di Enumerazione dei Sottodomini 🕵️♂️ Dnsplit è uno strumento basato su Python progettato per scoprire in modo efficiente i sottodomini. 🚀 È un progetto a cui sono molto legato, dato che sono ancora relativamente nuovo sia nella programmazione che nel campo dell'hacking etico...
EUVD-2019-5876
Malware in sbrugna...
EUVD-2005-0586
Malware in sbrugna...
CVE-2019-14729
In CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a sub-domain from a victim's account via an attacker account...
TotalCloud Insights: Crafting Effective Indicators of Compromise (IoCs) for Sub-domain Takeover Risk Detection
Subdomain takeover poses a significant security threat in cloud environments. It occurs when a subdomain of a domain e.g., subdomain.example.com inadvertently resolves to an external service no longer under the organizations control. These orphaned subdomains provide attackers with a foothold for...
Building an AppSec Program with Qualys WAS – Configuring a Web Application or API: Crawl Settings
Qualys Web Application Scanning WAS stands out as the industrys leading Dynamic Application Security Testing DAST solution. Delving deeper into these settings is crucial for effectively harnessing its potential to uncover vulnerabilities. Scan coverage is greatly influenced by the crawl settings,...
When setSubnodeOwner transfers ownership of sub-domain the new owner can perform actions before fuses are burned
Lines of code Vulnerability details Impact Function NameWrapper.setSubnodeOwner can be used to transfer ownership of a sub-domain to a new owner and, at the same time, burn fuses. A possible use-case could be that a domain owner wants to transfer ownership of the sub-domain but burn fuses in orde...
[PNM-002] The expiry of the parent node can be smaller than the one of a child node, violating the guarantee policy
Lines of code Vulnerability details Description By design, the child node's expiry can only be extended up to the parent's current one. Adding these restrictions means that the ENS users only have to look at the name itself's fuses and expiry without traversing the hierarchy to understand what...
8x8 Bounty: Dangling DNS Record docs.jitsi.net (unsuccessful GSuite takeover)
A dangling DNS record was found for the subdomain docs.jitsi.net, which was abandoned and belonged to GSuite. An attacker could have claimed the subdomain and taken it over, causing potential damage to the website and company. It was recommended to remove the Cname and DNS connecting to it...
CVE-2020-29031
An Insecure Direct Object Reference vulnerability exists in the web UI of the GateManager which allows an authenticated attacker to reset the password of any user in its domain or any sub-domain, via escalation of privileges. This issue affects all GateManager versions prior to 9.2c...
Garud - An Automation Tool That Scans Sub-Domains, Sub-Domain Takeover And Then Filters Out XSS, SSTI, SSRF And More Injection Point Parameters
An automation tool that scans sub-domains, sub-domain takeover and then filters out xss, ssti, ssrf and more injection point parameters. Requirements: Go Language, Python 2.7 or Python 3. System requirements: Recommended to run on vps with 1VCPU and 2GB ram. Tools used - You must need to install...
GHSA-PXMP-FWJC-4X7Q HTML Injection in marky-markdown
All versions of marky-markdown are vulnerable to HTML Injection due to a validation bypass. The package only allows iframes where the source is youtube.com but it is possible to bypass the validation with sources where youtube.com is the sub-domain, such as youtube.com.evil.co. This Recommendatio...
HTML Injection in marky-markdown
All versions of marky-markdown are vulnerable to HTML Injection due to a validation bypass. The package only allows iframes where the source is youtube.com but it is possible to bypass the validation with sources where youtube.com is the sub-domain, such as youtube.com.evil.co. This Recommendatio...
Solana BBP: Heap memory can be accessible through metrics.solana.com
Summary: Heap memory can be accessable due to misconfiguration in one of the sub-domains. While doing recon i ended up downloading heap memory file. Steps To Reproduce: 1.Open https://metrics.solana.com:8086/debug/pprof/heap 2. now you can see heap memory accessible through it Supporting...
Acronis: Subdomain Takeover – jet.acronis.com pointing to unclaimed Webflow services
Hi Team, Greetings! I've come across jet.acronis.com of acronis.com pointing to an unclaimed Webflow service. Visiting the jet.acronis.com returned the default 404 page for Webflow service, thereby making it potential for subdomain takeover. F937948 jet.acronis.com CNAME pointed to...
Zoom Addresses Vanity URL Zero-Day
A previously undisclosed bug in Zoom’s customizable URL feature has been addressed that could have offered a hacker a perfect social-engineering avenue for stealing credentials or sensitive information. Disclosed by Zoom and Check Point on Thursday, the security flaw existed in the “Vanity URL”...
BlackDir-Framework - Web Application Vulnerability Scanner
Web Application Vulnerability Scanner. 1. Spider Directories 2. Find Sub Domain 3. Advanced Dorks Search 4. Scan list of Dorks 5. Scan WebSites Xss,Sql 6. Reverse Ip Lookup 7. Port Scan Installation: git clone https://github.com/RedVirus0/BlackDir-Framework.git cd BlackDir pip3 install -r...