639 matches found
Easier URI Targeting With Metasploit Framework
Over the past year and a half, Metasploit Framework’s core engineering team in Belfast has made significant improvements to usability, discoverability, and the general quality of life for the global community of Framework users. A few of the enhancements we’ve worked on in MSF 6 include: A handy...
BlackMatter Ransomware Analysis; The Dark Side Returns
ARCHIVED STORY BlackMatter Ransomware Analysis; The Dark Side Returns By Alexandre Mundo and Marc Elias · September 22, 2021 BlackMatter is a new ransomware threat discovered at the end of July 2021. This malware started with a strong group of attacks and some advertising from its developers that...
New Capoae Malware Infiltrates WordPress Sites and Installs Backdoored Plugin
A recently discovered wave of malware attacks has been spotted using a variety of tactics to enslave susceptible machines with easy-to-guess administrative credentials to co-opt them into a network with the goal of illegally mining cryptocurrency. "The malware's primary tactic is to spread by...
How to protect your privacy on a smartphone: 12 tips & tricks
By Owais Sultan Nowadays, privacy on your smartphone plays an increasingly important role in our daily life. Let's talk about protecting privacy on your smartphone. This is a post from HackRead.com Read the original post: How to protect your privacy on a smartphone: 12 tips & tricks...
Dictionary-Of-Pentesting
This repository is an offensive tool for Bug Bounty and penetration testing, specifically targeting WordPress and other web applications. It contains a collection of exploits and techniques for bypassing security measures, including account takeover, cross-site scripting XSS, denial of service Do...
Shining a light on dark patterns with Carey Parker: Lock and Code S02E09
This week on Lock and Code, we speak to cybersecurity advocate and author Carey Parker about "dark patterns," which are subtle tricks online to get you to make choices that might actually harm you. Dark patterns have been around for years, and the tricks theyre based on are even older. Ever bough...
5 PDF Tricks You Should Know To Improve Document Productivity
By Owais Sultan Keeping your files as PDFs is a great idea, but you may need to do something more to achieve even more productivity. How? let's talk about it. This is a post from HackRead.com Read the original post: 5 PDF Tricks You Should Know To Improve Document Productivity...
Targeted Malware Reverse Engineering Workshop follow-up. Part 2
If you have read our previous blogpost "Targeted Malware Reverse Engineering Workshop follow-up. Part 1", you probably know about the webinar we conducted on April 8, 2021, with Kaspersky GReATs Ivan Kwiatkowski and Denis Legezo, to share best practices in reverse engineering and demonstrate...
谷歌 Google Chrome 资源管理错误漏洞
Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a resource management error vulnerability that could allow a remote attacker to create a specially crafted web page, trick a victim into visiting the page, trigger a release and then use the error and...
Bitso: Broken link hijack
Hello sir My name is Mohit kumar i found a bug known as broken link hijack on telegram Steps to view bug -- Navigate to -- https://bitso.com/ -- go down and click on language and then click on Espanol-Argentina you can now see the telgram link click on that I have attached a video poc too There's...
Cross site scripting
Cross-site scripting XSS vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One WP Security & Firewall all-in-one-wp-security-and-firewall plugin before 4.4.6 for WordPress...
CVE-2020-29171
Cross-site scripting XSS vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One WP Security & Firewall all-in-one-wp-security-and-firewall plugin before 4.4.6 for WordPress...
CVE-2020-29171
CVE-2020-29171 is a Cross-site Scripting (XSS) vulnerability in the WordPress plugin Tips and Tricks HQ All In One WP Security & Firewall (all-in-one-wp-security-and-firewall) up to version 4.4.6. The flaw resides in admin/wp-security-blacklist-menu.php and stems from insufficient input validatio...
CVE-2020-29171: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One WP Security & Firewall all-in-one-wp-security-and-firewall plugin before 4.4.6 for WordPress...
Windows Exploitation Tricks: Trapping Virtual Memory Access
Posted by James Forshaw, Project Zero This blog is a continuation of my series of Windows exploitation tricks. This one describes an exploitation trick I’ve been trying to develop for years, succeeding mostly, more on that later on the latest versions of Windows 10. It’s a trick to trap access to...
Happy HaXmas from the Rapid7 Team!
Happy HaXmas, everyone! This has been quite the year, but we’re thrilled that we’re able to keep up our favorite holiday tradition of our annual HaXmas blog series, which features holiday stories, hacking wins from the year, tips and tricks, and general festivity to keep you entertained during th...
Foxit Reader 资源管理错误漏洞
Foxit Reader is a Chinese Foxit Foxit company's a PDF document reader. A security vulnerability exists in Foxit PDF Reader 10.1.0.37527, which stems from a specially crafted PDF document that can trigger the reuse of previously free memory, which could lead to the execution of arbitrary code. The...
DNS Filtering: A Top Battle Front Against Malware and Phishing
Peter Lowe With the proliferation of malicious websites, domain name system DNS filtering has been adopted as an effective method for blacklisting content and blocking out suspicious webpages. Peter Lowe, security researcher with DNSFilter, talks to Cody Hackett on this week’s Threatpost Podcast...
PT-2021-1501
Name of the Vulnerable Software and Affected Versions: Flatpak versions prior to 1.10.4 and 1.12.0 Description: The issue is related to the lack of blocking in the seccomp filter for mount-related system calls, which can be exploited to gain access to confidential data, disrupt its integrity, and...
