# Latest Podcast
# Description
How to exploit the id parameter using Time-based Blind SQL Injection and Wayback Machine for vulnerabilities. Autorize is a Burp Suite extension for finding API vulnerabilities with user tokens. Hidden content can be found on 404 error pages using tools like dirsearch. Subdomain takeovers use tools like Subfinder, HTTPX, and Nuclei. A hacker used Dorki.io for an SSRF vulnerability to get AWS EC2 credentials. It discusses finding DOM-based XSS via client-side JavaScript, Bruno IDE for APIs, Reporting API for monitoring errors, and profiling subdomains with httpx and EyeWitness. Techniques for discovering APIs and methods for recon in bug bounties are detailed. Various vulnerabilities in GOG Galaxy and solutions for HTTP parser inconsistencies are explored, alongside insights into NetScout and Klarna’s Gram tools. Tools like unch, Scout Suite, SharpPersistSD, and EFuzz are also reviewed for security testing and auditing.
# Tradecraft
[#]
This article describes how to exploit the id parameter on web applications using Time-based Blind SQL Injection, focusing on utilizing historical URLs from the Wayback Machine to identify potential vulnerabilities.
[#]
Autorize is a Burp Suite extension that automates the detection of API vulnerabilities like broken object level authorization by injecting user tokens and analyzing response differences.
[#]
Subdomain takeovers involve exploiting inactive or misconfigured subdomains to gain control, typically using tools like Subfinder, HTTPX, and Nuclei to identify unclaimed subdomains, and then reclaiming them through S3 buckets, Azure services, or similar methods.
[#]
Using Dorki.io, a hacker exploited an SSRF vulnerability to extract AWS EC2 credentials from a metadata service, demonstrating the need for secure configurations and isolation of internal services.
[#]
This article explains how to identify and exploit DOM-based Cross-Site Scripting (XSS) vulnerabilities through client-side JavaScript source code analysis, using URL parameters to inject HTML or JavaScript.
[#]
Bruno is an open-source IDE for exploring and testing APIs, storing collections directly on your filesystem using a plain text markup language, Bru, and supports collaboration via Git without cloud-sync for enhanced data privacy.
[#]
The Reporting API helps web developers monitor client-side errors by sending violation reports from users' browsers to a specified endpoint, and Google offers open source solutions to filter and analyze these reports for better security.
[#]
This article explains how to identify and profile live subdomains of a target using tools like httpx and EyeWitness for DNS resolution in penetration testing.
[#]
The article outlines five methods for discovering APIs, including using API documentation, conducting OSINT research, analyzing HTML and JavaScript, active scanning and fuzzing, and examining mobile applications.
[#]
An ethical hacker discovered and reported multiple security vulnerabilities, including information disclosure, broken access control, and IDORs, in a voice communication solutions company by examining subdomains, API endpoints, and JS files.
[#]
The article describes a methodology for thorough reconnaissance in bug bounty programs, including finding internet assets through SSL certificates, subdomain enumeration, and using tools like Amass, Shodan, and httpx, as well as exploiting vulnerabilities found in Docker registries.
[#]
Rafael da Costa Santos' blog delves into HTTP parser inconsistencies across web technologies, showing how attackers can bypass security rules using pathname manipulation and offers solutions like reverse proxy validation to prevent these vulnerabilities.
[#]
Researchers found bugs in the GOG Galaxy 2.0 gaming platform, leading to a Denial-of-Service (CVE-2023-50915) and Local Privilege Escalation (CVE-2023-50914) vulnerabilities, and they suggest using filesystem and IPC abuse techniques to exploit these flaws.
[#]
The Web Penetration Testing Course repository contains materials on basic programming, information gathering, and web penetration testing techniques, last updated on May 13, 2024.
[#]
Researchers analyzed 3.1 million public AMIs across 27 AWS regions and found 500 GB of sensitive data, such as credentials and API keys, highlighting the importance of carefully inspecting AMIs before publishing.
[#]
NetScout is an OSINT tool that identifies domains, subdomains, directories, endpoints, and files for a given seed URL, using APIs like BinaryEdge and SERP API for data collection and offering various configurations for in-depth analysis.
[#]
Klarna's Gram is a collaborative web app for creating threat models using dataflow diagrams, offering features like automatic threat and control suggestions, system reviews, and integration with corporate tools like Jira and SSO.
[#]
"Attacking Rust" identifies and solves common security vulnerabilities in Rust code such as buffer overflows, unsafe code, and race conditions, using practical examples and best practices for secure coding.
[#]
This post covers techniques for attacking various programming languages and environments such as Java, PHP, NodeJS, APIs, Docker containers, and AWS, with detailed guides available on the provided blog links.
[#]
This article discusses the essentials of building a well-documented detection knowledge base for SOCs, including choosing a platform, structuring metadata, and outlining detailed detection documentation steps.
[#]
Scout Suite v5.14 is a tool for auditing multi-cloud security that now supports Digital Ocean and includes updates for AWS and Azure.
[#]
This post covers vulnerabilities in ChatGPT, specifically "Prompt Leaking" and "Prompt Injection," detailing how these were used to achieve remote code execution through Python code injection, and recommends strict input sanitization to mitigate such risks.
[#]
EFuzz is a versatile fuzzer that records interactions between a program and its environment, then replays these interactions with mutations to discover bugs or crashes in Linux user-mode software.
# News
[#]
Kaspersky's ICS CERT division found critical flaws in Telit Cinterion cellular modems, including a heap overflow vulnerability (CVE-2023-47610) that enables remote code execution via SMS, with mitigation strategies such as disabling SMS sending and verifying application signatures.
[#]
Helsinki's education division experienced a data breach due to an unpatched server vulnerability, impacting tens of thousands of students, guardians, and personnel, revealing sensitive information.
[#]
MITRE released EMB3D, a new threat-modeling framework for embedded devices to help manufacturers understand and mitigate vulnerabilities during the design phase, resulting in more secure infrastructure.
[#]
Russian hackers defaced multiple British local and regional newspaper websites, posting messages claiming responsibility and warning of the vulnerabilities in content management systems.
[#]
The Post Millennial hack exposed data for over 26 million people, including names, emails, passwords, and more, urging those affected to reset passwords and monitor account activity.
[#]
Firstmac Limited experienced a data breach by the Embargo cyber-extortion group, affecting personal and financial customer information, but have since enhanced security measures and offered identity theft protection services.
[#]
The Black Basta ransomware group has targeted over 500 entities since April 2022, exploiting vulnerabilities and using phishing, with recent attacks showing increased activity and ties to the FIN7 group.
[#]
Europol is investigating claims that IntelBroker stole confidential data from its Europol Platform for Experts, though no operational data was compromised.
[#]
Cybersecurity researchers have identified multiple critical vulnerabilities in Cinterion cellular modems that could allow threat actors to execute code remotely and gain unauthorized access, suggesting organizations disable non-essential SMS messaging and implement security controls.
[#]
Prompt injection attacks exploit how data and commands are mixed in Large Language Models (LLMs), causing vulnerabilities that are difficult to fully secure against, though efforts are being made to improve defenses through input cleaning and access-control mechanisms.
[#]
Romance scammers are targeting cryptocurrency investors using fake exchanges and social engineering, so be cautious and verify the legitimacy of any investment platform.
[#]
Cybersecurity researchers found a malicious Python package mimicking the popular requests library that hides a Golang-based Sliver C2 framework inside an image file, targeting macOS systems.
[#]
Australian lender Firstmac Limited disclosed a data breach caused by the Embargo extortion group, impacting sensitive customer information, and recommends vigilance for suspicious account activity.
[#]
A serious path traversal vulnerability in Apache OFBiz (CVE-2024-32113) allows remote code execution; users must update to version 18.12.13 to mitigate the risk.
[#]
NHS England Digital has issued an urgent alert about critical vulnerabilities (CVE-2024-0799, CVE-2024-0800, CVE-2024-0801) in Arcserve’s Unified Data Protection (UDP) platform, advising immediate application of security patches to avoid potential exploitation.
[#]
A security study revealed that FIDO2, a passwordless authentication standard, is vulnerable to session hijacking through MITM attacks due to inadequate validation by identity providers.
[#]
Encrypted email service Proton Mail has handed over user information to Swiss police, citing legal compliance, while Google patched a known Chrome security hole, and Wichita's government struggles with a ransomware attack from LockBit group.
[#]
PowerDNS has released a security update to fix a DoS vulnerability (CVE-2024-25581) in DNSdist versions 1.9.0 through 1.9.3 by releasing version 1.9.4 and providing workarounds for those unable to upgrade immediately.
[#]
Cacti has released an update to fix several critical vulnerabilities, including a severe remote code execution flaw (CVE-2024-25641), and users should upgrade to version 1.2.27 or later immediately.
[#]
Microsoft Edge users should immediately update to version 124.0.2478.97 to fix a zero-day 'Use After Free' vulnerability (CVE-2024-4671) and three other security flaws.
[#]
Scattered Spider, a cybercriminal group, is targeting finance and insurance industries with sophisticated phishing attacks using lookalike domains to steal credentials, emphasizing the need for proactive defense strategies including monitoring for fake domains, employee training, and multi-factor authentication.
