Cross site scripting

Cross-site scripting XSS vulnerability in the newTwittersignbutton function in nextend-Twitter-connect.php in the Nextend Twitter Connect plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirectto parameter. NOTE: this may overlap...

CVE-2015-4557

CVE-2015-4557 is an XSS vulnerability in the Nextend Twitter Connect WordPress plugin, present before version 1.5.2. The issue is triggered via the redirect_to parameter in the function new_Twitter_sign_button in nextend-Twitter-connect.php, allowing injection of arbitrary script/HTML. The relate...

CVE-2015-4557

Cross-site scripting XSS vulnerability in the newTwittersignbutton function in nextend-Twitter-connect.php in the Nextend Twitter Connect plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirectto parameter. NOTE: this may overlap...

Mercury - A Hacking Tool Used To Collect Information And Use The Information To Further Hurt The Target

Mercury is a hacking tool used to collect information and use the information to further hurt the target. Installation Requires Python2 Linux apt-get install python2 git clone https://www.github.com/MetaChar/Mercury pip install -r requirements.txt Features BruteForce Mercury uses Selenium to...

GoldWave 5.70 Local Buffer Overflow

!/usr/bin/python Exploit Author: bzyo Twitter: @bzyo Exploit Title: GoldWave 5.70 - Local Buffer Overflow SEH Unicode Date: 04-05-2018 Vulnerable Software: GoldWave 5.70 Vendor Homepage: https://www.goldwave.com/ Version: 5.70 Software Link: http://goldwave.com//downloads/gwave570.exe Tested...

GoldWave 5.70 - Local Buffer Overflow (SEH Unicode) Exploit

Exploit for windows platform in category local exploits !/usr/bin/python Exploit Author: bzyo Twitter: @bzyo Exploit Title: GoldWave 5.70 - Local Buffer Overflow SEH Unicode Date: 04-05-2018 Vulnerable Software: GoldWave 5.70 Vendor Homepage: https://www.goldwave.com/ Version: 5.70 Software Link:...

Google Bans Cryptocurrency Mining Extensions From Chrome Web Store

In an effort to prevent cryptojacking by extensions that maliciously mine digital currencies without users' awareness, Google has implemented a new Web Store policy that bans any Chrome extension submitted to the Web Store that mines cryptocurrency. Over the past few months, we have seen a sudden...

WordPress Ajax Pagination (twitter Style) plugin path traversal vulnerability

WordPress is the WordPress Software Foundation of a set of blogging platform developed using the PHP language , the platform supports PHP and MySQL servers set up a personal blog site . Ajax Pagination twitter Style plugin is used in one of the paging plugin . A path traversal vulnerability exist...

CVE-2014-2674

Directory traversal vulnerability in the Ajax Pagination twitter Style plugin 1.1 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the loop parameter in an ajaxnavigation action to wp-admin/admin-ajax.php...

Powershell-RAT - Python Based Backdoor That Uses Gmail To Exfiltrate Data Through Attachment

Python based backdoor that uses Gmail to exfiltrate data as an e-mail attachment. This RAT will help someone during red team engagements to backdoor any Windows machines. It tracks the user activity using screen capture and sends the information to an attacker as an e-mail attachment. Note: This...

A View of Upcoming Threat Coverage from Pwn2Own 2018

This blog will be updated throughout the competition so keep tracking for the latest updates on upcoming threat coverage! St. Patrick’s Day is coming up later this week, but the contestants at Pwn2Own 2018 will need more than luck on their side. They will need to dive into their expert hacking...

TwLocation - Python Script That Gets Twitter Users' Tweets Location

Python script that gets Twitter users' tweets location Features Gets Twitter Usernames based on a latitude and longitude Profiles URLs Tweet Latitude and Longitude Google Maps link to Latitude and Longitude Usage TwLocation should work on all Linux distros running Python 2.7 First, clone it by...

Laravel: Persistent Cross-Site Scripting in default Laravel installation

Persistent XSS in default Laravel Installation I have been using the Laravel framework for quite a while now and discovered something odd. When following the installation instructions for the latest Laravel version 5.6.8 at the time of writing you will be up and running in a matter of minutes. Ev...

Dup Scout Enterprise 10.5.12 Share Username Buffer Overflow

!/usr/bin/python Exploit Author: bzyo Twitter: @bzyo Exploit Title: Dup Scout Enterprise 10.5.12 - Local Buffer Overflow Date: 02-22-2018 Vulnerable Software: Dup Scout Enterprise v10.5.12 Vendor Homepage: http://www.dupscout.com Version: 10.5.12 Software Link:...

Dup Scout Enterprise 10.5.12 - 'Share Username' Local Buffer Overflow

!/usr/bin/python Exploit Author: bzyo Twitter: @bzyo Exploit Title: Dup Scout Enterprise 10.5.12 - Local Buffer Overflow Date: 02-22-2018 Vulnerable Software: Dup Scout Enterprise v10.5.12 Vendor Homepage: http://www.dupscout.com Version: 10.5.12 Software Link:...

Dup Scout Enterprise 10.5.12 - Share Username Local Buffer Overflow Exploit

Exploit for windows platform in category local exploits !/usr/bin/python Exploit Author: bzyo Twitter: @bzyo Exploit Title: Dup Scout Enterprise 10.5.12 - Local Buffer Overflow Date: 02-22-2018 Vulnerable Software: Dup Scout Enterprise v10.5.12 Vendor Homepage: http://www.dupscout.com Version:...

Dup Scout Enterprise 10.5.12 - Share Username Local Buffer Overflow

Dup Scout Enterprise 10.5.12 - Share Username Local Buffer Overflow !/usr/bin/python Exploit Author: bzyo Twitter: @bzyo Exploit Title: Dup Scout Enterprise 10.5.12 - Local Buffer Overflow Date: 02-22-2018 Vulnerable Software: Dup Scout Enterprise v10.5.12 Vendor Homepage: http://www.dupscout.com...

X (Formerly Twitter): Takeover of Twitter-owned domain at mobileapplinking.com

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Summary: Not sure there is much of a...

IrfanView 4.44 Email Plugin - Buffer Overflow (SEH)

IrfanView 4.44 Email Plugin - Buffer Overflow SEH !/usr/bin/python Exploit Author: bzyo Twitter: @bzyo Exploit Title: IrfanView 4.44 Email PlugIn - Local Buffer Overflow SEH Date: 02-07-2018 Vulnerable Software: IrfanView 4.44 Email PlugIn Vendor Homepage: http://www.irfanview.com/ Version: 4.44...

PoT - Phishing On Twitter

Generate tweet automatically like him/her How it works? 1- Collect data from target's twitter account 2- Find target's friend and copy her/him account 3- Generate tweet automatically with markov chain algorithm and send it Installation git clone https://github.com/omergunal/PoT cd PoT pip3 instal...