𝙃4𝙓-𝙏𝙤𝙤𝙡𝙨 🐲
Open source toolkit for scraping, OSINT and more
Link 🔗:-
https://github.com/V1li/H4X-Tools
Open source toolkit for scraping, OSINT and more
Link 🔗:-
https://github.com/V1li/H4X-Tools
GitHub
GitHub - vil/H4X-Tools: A modular, terminal-based toolkit for OSINT, reconnaissance, and scraping - built in Python, runs on Linux…
A modular, terminal-based toolkit for OSINT, reconnaissance, and scraping - built in Python, runs on Linux and Windows. - vil/H4X-Tools
👍2
Discord is spyware because it collects all information that passes through its communication platform. As Discord is a centralized communication platform, all communications have to go through Discord's official servers, where all of that information can potentially be recorded. The vast majority of said information has been confirmed to be recorded, such as all communications between users. Discord has also been confirmed to use other spyware features such as various forms of telemetry. Discord's main source of income is from investment, from which it has received over $279.3 million dollars. Discord cannot be built from source and the source code for Discord is unavailable.
https://spyware.neocities.org/articles/discord
https://spyware.neocities.org/articles/discord
❤2
Исследователь продемонстрировал деанонимизацию Tor-серверов через ETag
https://xakep.ru/2023/06/19/tor-etag/
https://xakep.ru/2023/06/19/tor-etag/
👍1
CVE-2023-35086 POC - ASUS routers format string vulnerability
July 25 2023, Altin (tin-z), github.com/tin-zBrief descriptionASUS RT-AX56U V2 & RT-AC86U router firmwares below or equal to version 3.0.0.4.386_50460 and 3.0.0.4_386_51529 respectively have a format string vulnerability in the detwan.cgi function of the httpd service that can cause code execution when an attacker constructs malicious data.
The vulnerability affects also other ASUS devices using httpd service.
Read here for more details.
references:PocThe vulnerability permits achieving RCE, meanwhile the PoC only achieves DoS, mainly because the firmware was emulated with QEMU and so the stack is different from the real case device.
Prerequisites:The value of 'Referer' header should contain the target's addresspoc_crash.pyvirtualenv --python=python3 .venv source .venv/bin/activate pip install hexdump python poc_crash.py --HOST ...
Continue reading at github.com (from /r/netsec)
July 25 2023, Altin (tin-z), github.com/tin-zBrief descriptionASUS RT-AX56U V2 & RT-AC86U router firmwares below or equal to version 3.0.0.4.386_50460 and 3.0.0.4_386_51529 respectively have a format string vulnerability in the detwan.cgi function of the httpd service that can cause code execution when an attacker constructs malicious data.
The vulnerability affects also other ASUS devices using httpd service.
Read here for more details.
references:PocThe vulnerability permits achieving RCE, meanwhile the PoC only achieves DoS, mainly because the firmware was emulated with QEMU and so the stack is different from the real case device.
Prerequisites:The value of 'Referer' header should contain the target's addresspoc_crash.pyvirtualenv --python=python3 .venv source .venv/bin/activate pip install hexdump python poc_crash.py --HOST ...
Continue reading at github.com (from /r/netsec)
👍1
Deep_Dive_Exploring_the_Real_world_Value_of_Open_Source_Intelligence.pdf
53.1 MB
Deep Dive: Exploring the Real-world Value of Open Source Intelligence
Rae Baker explains how to use publicly available data to advance your investigative OSINT skills and how your adversaries are most likely to use publicly accessible data against you.
Rae Baker explains how to use publicly available data to advance your investigative OSINT skills and how your adversaries are most likely to use publicly accessible data against you.
💥Hard-coded credentials in Technicolor TG670 DSL gateway router(CVE-2023-31808)
The Technicolor TG670 Router DSL Gateway Router includes a hard-coded service account that allows for authentication over services on the WAN interface, using HTTP, SSH, or TELNET. The authenticated user can use it to gain full administrative control of the router.
⚠️A remote attacker can use the default username and password to login as the administrator to the router device. This allows the attacker to modify any of the administrative settings of the router and use it in unexpected ways. This requires Remote Administration is enabled on the router, which is the default setting.
The Technicolor TG670 Router DSL Gateway Router includes a hard-coded service account that allows for authentication over services on the WAN interface, using HTTP, SSH, or TELNET. The authenticated user can use it to gain full administrative control of the router.
⚠️A remote attacker can use the default username and password to login as the administrator to the router device. This allows the attacker to modify any of the administrative settings of the router and use it in unexpected ways. This requires Remote Administration is enabled on the router, which is the default setting.
👍1
💥GeoServer SQL Injection Vulnerability Analysis (CVE-2023-25157)
SQL Injection Vulnerabilities have been found with:
💾
💾
💾
💾
💾
💾
🔖CVE-2023-25157 - GeoServer SQL Injection - PoC
Usage:
SQL Injection Vulnerabilities have been found with:
💾
PropertyIsLike filter, when used with a String field and any database DataStore, or with a PostGIS DataStore with encode functions enabled💾
strEndsWith function, when used with a PostGIS DataStore with encode functions enabled💾
strStartsWith function, when used with a PostGIS DataStore with encode functions enabled💾
FeatureId filter, when used with any database table having a String primary key column and when prepared statements are disabled💾
jsonArrayContains function, when used with a String or JSON field and with a PostGIS or Oracle DataStore (GeoServer 2.22.0+ only)💾
DWithin filter, when used with an Oracle DataStore🔖CVE-2023-25157 - GeoServer SQL Injection - PoC
Usage:
python3 CVE-2023-25157.py <URL>👍1
DFIR Toolkit
20 command line tools for forensic investigation of Windows artifacts.
https://github.com/dfir-dd/dfir-toolkit
#dfir #rust
20 command line tools for forensic investigation of Windows artifacts.
https://github.com/dfir-dd/dfir-toolkit
#dfir #rust
👍1
Embedded device firmware (Yaesu FT-70D radio) reverse engineering
https://landaire.net/reversing-yaesu-firmware-encryption
https://landaire.net/reversing-yaesu-firmware-encryption
👍3🔥2❤1