tag:blogger.com,1999:blog-7061815432850058967Sun, 25 Oct 2026 12:35:43 +0000All hacking based info for educational purpose onlyhttp://globalhackers.blogspot.com/noreply@blogger.com (Akram)Blogger1104125tag:blogger.com,1999:blog-7061815432850058967.post-1538431450454705286Tue, 27 Sep 2022 14:11:00 +00002022-09-27T19:41:54.039+05:30  Description A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.12). The affected application does not properly handle the import of large configuration files. A local attacker could import a specially crafted file which could lead to a denial-of-service condition of the application service. References https://nvd.nist.gov/vuln/http://globalhackers.blogspot.com/2022/09/a-vulnerability-has-been-identified-in_27.htmlnoreply@blogger.com (Akram)0tag:blogger.com,1999:blog-7061815432850058967.post-1398825780403761489Tue, 27 Sep 2022 14:08:00 +00002022-09-27T19:38:45.333+05:30  Description A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions), APOGEE PXC Compact (P2 Ethernet) (All versions), APOGEE PXC Modular (BACnet) (All versions), APOGEEhttp://globalhackers.blogspot.com/2022/09/a-vulnerability-has-been-identified-in.htmlnoreply@blogger.com (Akram)0tag:blogger.com,1999:blog-7061815432850058967.post-996639882065252449Fri, 09 Sep 2022 10:07:00 +00002022-09-09T15:37:46.163+05:30 We often face situations where many countries just keep on getting more and more free internet tricks using VPN apps. The you wonder how that is possible. Well the only truth is that they got so many free internet researchers in that area. Don’t you want to become a free internet creator and make yourself and skills known by many? I guess you really want that. Well there is no http://globalhackers.blogspot.com/2022/09/the-ultimate-guide-to-find-bug-host.htmlnoreply@blogger.com (Akram)0tag:blogger.com,1999:blog-7061815432850058967.post-2681691433241487223Fri, 09 Sep 2022 10:06:00 +00002022-09-09T15:36:00.440+05:30What Is the Microsoft Office CVE-2022-30190 Follina Vulnerability? nao_sec cyber security research team discovered a malicious Word document that downloads an HTML file and abuses Microsoft Support Diagnostic Tool (ms-msdt) to execute PowerShell commands on May 27th, 2022. An example attack follows these steps: Adversaries craft a malicious Word http://globalhackers.blogspot.com/2022/09/microsoft-office-cve-2022-30190.htmlnoreply@blogger.com (Akram)0tag:blogger.com,1999:blog-7061815432850058967.post-478197246774753017Fri, 09 Sep 2022 10:03:00 +00002022-09-09T15:33:38.786+05:30Know About WDM? Windows Driver Model (WDM) is the oldest and still the most-used driver framework. Every driver is essentially a WDM driver; the newer framework Windows Driver Framework (WDF) encapsulates WDM, simplifies the development process and deals with WDM’s multiple technical difficulties. The primary thing we care about while inspecting WDM drivers is how we can communicate with http://globalhackers.blogspot.com/2022/09/finding-bugs-in-windows-drivers-part-1.htmlnoreply@blogger.com (Akram)0tag:blogger.com,1999:blog-7061815432850058967.post-6595943000462602291Fri, 09 Sep 2022 09:54:00 +00002022-09-09T15:24:25.610+05:30 CVE-2022-1388 is a critical vulnerability (CVSS 9.8) in the management interface of F5 Networks’ BIG-IP solution that enables an unauthenticated attacker to gain remote code execution on the system through bypassing F5’s iControl REST authentication. The vulnerability was first discovered by F5’s internal product security team and disclosed publicly on May 4, 2022.  What http://globalhackers.blogspot.com/2022/09/f5-big-ip-rce-cve-2022-1388.htmlnoreply@blogger.com (Akram)0tag:blogger.com,1999:blog-7061815432850058967.post-5688935512192148437Fri, 09 Sep 2022 09:52:00 +00002022-09-09T15:22:36.831+05:30What is Ghidra ? Ghidra is an open-source software reverse engineering (SRE) framework developed by National Security Agency (NSA) Research Directorate of United States, for NSA’s Cyberseurity mission. The binaries were released at RSA Conference in March 2019; the sources were published one month later on GitHub. Ghidra is seen by many security http://globalhackers.blogspot.com/2022/09/ghidra-reverse-engineering-tool-used-by.htmlnoreply@blogger.com (Akram)0tag:blogger.com,1999:blog-7061815432850058967.post-8483039842229099581Fri, 09 Sep 2022 09:50:00 +00002022-09-09T15:20:17.424+05:30Vulnerability Details and Investigation As one of the world’s most popular Java lightweight open-source framework, Spring allows developers to focus on business logic and simplifies the development cycle of Java enterprise applications. Exploitation requires an endpoint with DataBinder enabled (e.g. a POST request that decodes data from the request body automatically) and depends http://globalhackers.blogspot.com/2022/09/spring4shell-spring-core-rce-0-day.htmlnoreply@blogger.com (Akram)0tag:blogger.com,1999:blog-7061815432850058967.post-6387870268479023051Fri, 09 Sep 2022 09:47:00 +00002022-09-09T15:17:52.471+05:30Domain takeover If you discover some domain (domain.tld) that is being used by some service inside the scope but the company has lost the ownership of it, you can try to register it (if cheap enough) and let know the company. If this domain is receiving some sensitive information like a sessions cookie via GET parameter or in the Referer header, this is for sure a vulnerability. Subdomain http://globalhackers.blogspot.com/2022/09/subdomain-takeover-hackerone-owasp.htmlnoreply@blogger.com (Akram)0tag:blogger.com,1999:blog-7061815432850058967.post-1278366060820111702Fri, 09 Sep 2022 09:45:00 +00002022-09-09T15:15:56.144+05:30How to Hack Email Accounts Have you ever wondered how cybercriminals hack email passwords? At some point, you may have wondered how to hack email accounts just for the sake of preventing your account from getting hacked. There are several techniques that you can explore to hack the password of an email account. No email account is immune to hacking. Here are some practical ways of hackinghttp://globalhackers.blogspot.com/2022/09/email-hacking-email-hijacking-emails.htmlnoreply@blogger.com (Akram)0tag:blogger.com,1999:blog-7061815432850058967.post-1730671781950720549Fri, 09 Sep 2022 09:44:00 +00002022-09-09T15:14:16.996+05:30About Cyber Physical Attacks In a physical attack, an attacker gains physical access to a physical asset in the infrastructure system in order to damage it, disable it, steal it, or use it in an undesirable way. … The goal is to produce a security system that has balanced physical protection for all potential adversary scenarios.Here are some common examples of how physical threat http://globalhackers.blogspot.com/2022/09/must-know-these-cyber-physical-attacks.htmlnoreply@blogger.com (Akram)0tag:blogger.com,1999:blog-7061815432850058967.post-6936104034174604835Fri, 09 Sep 2022 09:43:00 +00002022-09-09T15:13:13.862+05:30What Is Post Message()? The window.postMessage() method safely enables cross-origin communication between Window objects; e.g., between a page and a pop-up that it spawned, or between a page and an iframe embedded within it. PostMessage uses the following function to send a message 1targetWindow.postMessage(message, targetOrigin, [transfer]);2​3# postMessagehttp://globalhackers.blogspot.com/2022/09/what-is-postmessage-vulnerability.htmlnoreply@blogger.com (Akram)0tag:blogger.com,1999:blog-7061815432850058967.post-7523309597215545954Fri, 09 Sep 2022 09:41:00 +00002022-09-09T15:11:28.125+05:30What Is 2FA And Otp? 2FA ( Two Factor Authentication) is an authentication protocol where access is only granted after providing two pieces of evidence to an authentication mechanism typically a Password and an OTP (One Time Token). To access an account protected with 2FA you need both the password and a secret token, this serves as an extra layer of security. To successfully bypass 2FA http://globalhackers.blogspot.com/2022/09/hackers-top-methods-to-bypass-2fa-and.htmlnoreply@blogger.com (Akram)0tag:blogger.com,1999:blog-7061815432850058967.post-8382781857273513845Fri, 09 Sep 2022 09:40:00 +00002022-09-09T15:10:04.711+05:30 What is CRLF? When a browser sends a request to a web server, the web server answers back with a response containing both the HTTP response headers and the actual website content, i.e. the response body. The HTTP headers and the HTML response (the website content) are separated by a specific combination of special characters, namely a carriage return and a line feed. For short they http://globalhackers.blogspot.com/2022/09/carriage-return-line-feed-crlf-crlf.htmlnoreply@blogger.com (Akram)0tag:blogger.com,1999:blog-7061815432850058967.post-6529578491182018794Fri, 09 Sep 2022 09:38:00 +00002022-09-09T15:08:30.343+05:30 What is WebSocket? WebSocket is, like HTTP, a communications protocol that enables interaction between a browser and a web server.The WebSocket protocol allows both servers and browsers to send messages to each other using a single TCP connection. This is very useful when trying to create real-time applications such as online games and live chat. For example, Slack’s web app uses http://globalhackers.blogspot.com/2022/09/cross-site-websocket-hijacking-cswsh.htmlnoreply@blogger.com (Akram)0tag:blogger.com,1999:blog-7061815432850058967.post-7714791292142309140Fri, 09 Sep 2022 09:37:00 +00002022-09-09T15:07:29.016+05:30 What is Clickjacking? Clickjacking is an attack that tricks a user into clicking a webpage element which is invisible or disguised as another element. This can cause users to unwittingly download malware, visit malicious web pages, provide credentials or sensitive information, transfer money, or purchase products online. Typically, clickjacking is performed by displaying an http://globalhackers.blogspot.com/2022/09/clickjacking-clickjacking-attacks.htmlnoreply@blogger.com (Akram)0tag:blogger.com,1999:blog-7061815432850058967.post-8364985795246160045Fri, 09 Sep 2022 09:36:00 +00002022-09-09T15:06:14.931+05:30 What things do hackers need in mobiles? Ram:- 4 to 8 GBRom:- 64 GB to UnlimitedBattery:- 3050mAh to 6000mAhKernel:- Hacking Framework Supported KernelsOs:- Android Or LinuxSoC:- Media Tek G35 or Up And SD 635 or Up Linux Phones Made For Hackers:- Pro 1X Pro 1X An interesting smartphone that supports Ubuntu Touch, Lineage OS, and Android as well. It is not just a Linux http://globalhackers.blogspot.com/2022/09/best-hacking-android-phones-for-hacker.htmlnoreply@blogger.com (Akram)0tag:blogger.com,1999:blog-7061815432850058967.post-4972019219536142810Fri, 09 Sep 2022 09:34:00 +00002022-09-09T15:04:43.723+05:30 Cross-Site Script Incusion (XSSI) XSSI designates a kind of vulnerability which exploits the fact that, when a resource is included using the script tag, the SOP doesn’t apply, because scripts have to be able to be included cross-domain. An attacker can thus read everything that was included using the script tag. This is especially interesting when it comes to dynamic JavaScript http://globalhackers.blogspot.com/2022/09/cross-site-script-incusionxssi.htmlnoreply@blogger.com (Akram)0tag:blogger.com,1999:blog-7061815432850058967.post-624256804969834753Fri, 09 Sep 2022 09:29:00 +00002022-09-09T14:59:40.676+05:30 What is server-side template injection(SSTI Vulnerability)? A server-side template injection occurs when an attacker is able to use native template syntax to inject a malicious payload into a template, which is then executed server-side. Template engines are designed to generate web pages by combining fixed templates with volatile data. Server-side template injection attacks can http://globalhackers.blogspot.com/2022/09/ssti-server-side-template-injection.htmlnoreply@blogger.com (Akram)0tag:blogger.com,1999:blog-7061815432850058967.post-6819245252152743254Fri, 09 Sep 2022 09:28:00 +00002022-09-09T14:58:48.060+05:30 Understanding IDOR Vulnerability There can be many variables in the application such as “id”, “pid”, “uid”. Although these values are often seen as HTTP parameters, they can be found in headers and cookies. The attacker can access, edit or delete any of other users’ objects by changing the values. This vulnerability is called IDOR. First, it needs to understand the application http://globalhackers.blogspot.com/2022/09/understanding-idor-vulnerability-there.htmlnoreply@blogger.com (Akram)0tag:blogger.com,1999:blog-7061815432850058967.post-3270448752020386877Fri, 09 Sep 2022 09:27:00 +00002022-09-09T14:57:49.266+05:30 What is XML external entity injection? XML external entity(XXE) injection is a web security vulnerability that allows an attacker to interfere with an application’s processing of XML data. Using XXE, an attacker is able to cause Denial of Service (DoS) as well as access local and remote content and services and to interact with any back-end or external systems that the application http://globalhackers.blogspot.com/2022/09/what-is-xxe-injection-how-hackers-do-it.htmlnoreply@blogger.com (Akram)0tag:blogger.com,1999:blog-7061815432850058967.post-1623109606419779236Fri, 09 Sep 2022 09:27:00 +00002022-09-09T14:57:13.714+05:30 What is OS command injection? OS command injection is a web vulnerability that allows an attacker to execute arbitrary operating system (OS) commands on the server that is running an application, and typically fully compromise th application and all its data. This is very dangerous hack because the hacker can get full control. The attacker change everything ,I mean everything likehttp://globalhackers.blogspot.com/2022/09/how-hackers-access-server-using-command.htmlnoreply@blogger.com (Akram)0tag:blogger.com,1999:blog-7061815432850058967.post-387845848431738726Fri, 09 Sep 2022 09:26:00 +00002022-09-09T14:56:11.610+05:30 What is Local File Inclusion (LFI)? This is a vulnerability commonly found to affect web application that rely on a scripting run time. Local File Inclusion (LFI) or simply File Inclusion, refers to an inclusion attack through which an attacker can trick the web application into including files on the web server by exploiting a functionally that dynamically includes local files or http://globalhackers.blogspot.com/2022/09/how-do-hackers-upload-shellcodes-using.htmlnoreply@blogger.com (Akram)0tag:blogger.com,1999:blog-7061815432850058967.post-5820665545464545102Fri, 09 Sep 2022 09:25:00 +00002022-09-09T14:55:16.823+05:30 What is Cross Site Scripting(XSS)? Cross site scripting (XSS) is an attack in which an attacker injects malicious executable scripts into the code of a trusted application or website. This is a combination of HTML and XSS provided by the attacker, but XSS can also be used to deliver malicious downloads, plugins, or media content. In this case hacker execute some malicious links into http://globalhackers.blogspot.com/2022/09/how-do-hackers-hijack-websites-and.htmlnoreply@blogger.com (Akram)0tag:blogger.com,1999:blog-7061815432850058967.post-7910482047379966938Fri, 09 Sep 2022 09:24:00 +00002022-09-09T14:54:33.919+05:30 What is SQL injection? The Wikipedia article on SQL injection reads: SQL injection is a code injection technique, used to attack data driven applications, in which malicious SQL statements are inserted into an entry field for execution. SQL Injection is a web-based attack used by hackers to steal sensitive information from organizations through web applications. It is one of the http://globalhackers.blogspot.com/2022/09/how-hackers-leak-databases-sql.htmlnoreply@blogger.com (Akram)0