The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

Blogger.com vulnerability, Gaining Administrative Privileges on any Account ! In the last 2 months, Nir.Goldshlager  participated in Google reward program and found some High, Serious vulnerabilities. The vulnerability that  Nir.Goldshlager  want to share first, Is a critical vulnerability in Blogger (Google Service). That vulnerability could be used by an attacker to get administrator privilege over any blogger account (Permission Issue). Here are the details regarding the issue in Blogger service, Nir.Goldshlager found a HTTP Parameter Pollution vulnerability in Blogger that allow an attacker to add himself as an administrator on the victim's blogger account, Technical details: Here are the steps for getting admin control permissions over any blogger accounts. 1.) The attacker Use the invite author options in blogger (add authors): Vulnerability location: POST /add-authors.do HTTP/1.1 Request: security_token=attackertoken&blog...

A Thailand-based news website critical of Myanmar's military government says it has been hacked by unknown attackers who posted fake articles on it. The Irrawaddy website is run by exiled  Myanmar  journalists. It said on its home page Sunday that it was trying to fix the problem and prevent further attacks. The Irrawaddy's coverage of Myanmar has included exclusive photos of secret military missions to North Korea . It has been the target of several denial-of-service attacks that are meant to make the site unreachable. The fake articles concerned an alleged feud between Irrawaddy's editor and pro-democracy icon Aung San Suu Kyi , and the purported death of a popular singer.

10 Websites hacked by Xen0n (Bangladesh Cyber Army) Hacked Sites : https://lizzieshotel.com/BCA.html https://ziaresources.com/BCA.html https://www.gianairltd.com/BCA.html https://roydigital.com/BCA.html https://www.apollwnios.gr/BCA.html https://lefemmecafe.com/BCA.html https://uccoss.com/BCA.html https://www.jvp-gracac.hr/BCA.html https://www.newma.net/BCA.html https://mafiamediagroup.com/BCA.html News Source : Xen0n (Bangladesh Cyber Army)

Host-Extract - Host/IP Pattern Extractor Tool ! This little ruby script tries to extract all IP/Host patterns in page response of a given URL and JavaScript/CSS files of that URL. With it, you can quickly identify internal IPs/Hostnames, development IPs/ports, cdn, load balancers, additional attack entries related to your target that are revealed in inline js, css, html comment areas and js/css files. This is unlike web crawler which looks for new links only in anchor tags (<a) or the like. In some cases, host-extract may give you false positives when there are some words like - main-site_ver_10.2.1.3.swf. With -v option, you can ask the tool to output html view-source snippets for each IP/Domain extracted. This will shorten your manual analysis time. Please go to https://host-extract.googlecode.com/ for more info. Download/Update ============== svn co https://host-extract.googlecode.com/svn/trunk/ host-extract Tutorial Wiki ========== Sebastien Damaye from aldeid.com h...

Inbox.com Cross Site Scripting ( XSS ) vulnerability ! Reflected cross-site scripting vulnerabilities arise when data is copied from a request and echoed into the application's immediate response in an unsafe way. An attacker can use the vulnerability to construct a request which, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application. The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes. Users can be induced to issue the attacker's crafted request in various ways. For example, the attacker can send a victim a link containing a malicious URL in an email or instant message. They can submit the link to popular web sites that allow content authoring, for example in...