Marco hacks2learn

hi, i'm daniel. i'm a 15-year-old high school junior. in my free time, i hack billion dollar companies and build cool stuff.

3 months ago, I discovered a unique 0-click deanonymization attack that allows an attacker to grab the location of any target within a 250 mile radius. With a vulnerable app installed on a target's phone (or as a background application on their laptop), an attacker can send a malicious payload and deanonymize you within seconds--and you wouldn't even know.

I'm publishing this writeup and research as a warning, especially for journalists, activists, and hackers, about this type of undetectable attack. Hundreds of applications are vulnerable, including some of the most popular apps in the world: Signal, Discord, Twitter/X, and others. Here's how it works:

Cloudflare

By the numbers, Cloudflare is easily the most popular CDN on the market. It beats out competitors such as Sucuri, Amazon CloudFront, Akamai, and Fastly. In 2019, a major Cloudflare outage k

Original report

Affected Vendor: OpenPrinting
Affected Product: Several components of the CUPS printing system: cups-browsed, libppd, libcupsfilters and cups-filters.
Affected Version: All versions <= 2.0.1 (latest release) and master.
Significant ICS/OT impact? no
Reporter: Simone Margaritelli [[email protected]]
Vendor contacted? yes The vendor has been notified trough Github Advisories and all bugs have been confirmed:

https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8

PrinterLogic SaaS, multiple vulnerabilities

PrinterLogic's Enterprise Print Management software allows IT professionals to simplify printer driver management and empower end users. -- https://www.printerlogic.com/

Background

The following findings were identified by performing both dynamic testing of the PrinterLogic SaaS platform and code analysis of the source code contained in the virtual appliance available for download from the PrinterLogic website (Build 1.0.757: July 29th, 2022).

Description

This is a simple guide to perform javascript recon in the bugbounty

Steps

The first step is to collect possibly several javascript files (more files = more paths,parameters -> more vulns)

Proxmox with LVM-thin and why we should use Trim/Discard

Excerpts from the Proxmox VE Administration Guide]

LVM normally allocates blocks when you create a volume. LVM thin pools instead allocates blocks when they are written. This behaviour is called thin-provisioning, because volumes can be much larger than physically available space.

8.10.2. Trim/Discard It is good practice to run fstrim (discard) regularly on VMs and containers. This releases data blocks that the filesystem isn’t using anymore. It reduces data usage and resource load. Most modern operating systems issue such discard commands to their disks regularly. You only need to ensure that the Virtual Machines enable the disk discard option.

	// 1. Build a map of updated cookies from Set-Cookie headers
	var updatedCookies = new java.util.HashMap<String, String>();

	for (var header : requestResponse.response().headers()) {
	if (header.name().equalsIgnoreCase("Set-Cookie")) {
	var cookiePair = header.value().split(";", 2)[0]; // only take name=value
	var parts = cookiePair.split("=", 2);
	if (parts.length == 2) {
	updatedCookies.put(parts[0].trim(), parts[1].trim());
	}

	Import-Module Az
	Connect-AzAccount

	$ipre = "^((25[0-5]\|2[0-4][0-9]\|[01]?[0-9][0-9]?)\.){3}(25[0-5]\|2[0-4][0-9]\|[01]?[0-9][0-9]?)$"

	function Get-ClassicOrigins() {
	$profs = Get-AzCDNProfile
	$coll = @()

	foreach ($prof in $profs) {

	import argparse
	import ipaddress
	from os import path
	from time import sleep
	from shlex import split
	from scapy.all import sniff
	from threading import Thread
	from subprocess import Popen, PIPE

	valid_ranges = []

	#!/bin/bash

	# This program is free software: you can redistribute it and/or modify
	# it under the terms of the GNU General Public License as published by
	# the Free Software Foundation, either version 3 of the License, or
	# (at your option) any later version.
	#
	# This program is distributed in the hope that it will be useful,
	# but WITHOUT ANY WARRANTY; without even the implied warranty of
	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

	Main Project Page -> github.com/corelan/mona

	Download the file and save it to this typical location ->
	C:\Program Files\Immunity Inc\Immunity Debugger\PyCommands

	BASIC USAGE :
	!mona in the input box and press enter
	For more information = Open log window (ALT-L)

	For Help options ->