-->

ABOUT US

Our development agency is committed to providing you the best service.

OUR TEAM

The awesome people behind our brand ... and their life motto.

  • Kumar Atul Jaiswal

    Ethical Hacker

    Hacking is a Speed of Innovation And Technology with Romance.

  • Kumar Atul Jaiswal

    CEO Of Hacking Truth

    Loopholes are every major Security,Just need to Understand it well.

  • Kumar Atul Jaiswal

    Web Developer

    Techonology is the best way to Change Everything, like Mindset Goal.

OUR SKILLS

We pride ourselves with strong, flexible and top notch skills.

Marketing

Development 90%
Design 80%
Marketing 70%

Websites

Development 90%
Design 80%
Marketing 70%

PR

Development 90%
Design 80%
Marketing 70%

ACHIEVEMENTS

We help our clients integrate, analyze, and use their data to improve their business.

150

GREAT PROJECTS

300

HAPPY CLIENTS

650

COFFEES DRUNK

1568

FACEBOOK LIKES

STRATEGY & CREATIVITY

Phasellus iaculis dolor nec urna nullam. Vivamus mattis blandit porttitor nullam.

PORTFOLIO

We pride ourselves on bringing a fresh perspective and effective marketing to each project.

Showing posts with label hackers. Show all posts
Showing posts with label hackers. Show all posts
  • Insider Threat Actor

     


     

    Insider threat actor

     

    Insider threat actor is the one who working for the company internal employees we used to say that employee has more access to the resources so they can have a further damage.

    How to  prevent this insider threat actor by doing a proper background check before hiring any candidate!!!

    Live example people use to say that the information was breached by Edward Snowden.
    Edward Snowden was a insider for a them which reveal the information for the NSA.

    Edward Snowden is often considered a controversial figure who gained notoriety as an insider threat actor. In 2013, Snowden, a former contractor for the National Security Agency (NSA) in the United States, leaked classified documents to the media, revealing extensive surveillance programs conducted by the NSA 



    Snowden's actions were seen as a significant breach of trust and a clear example of an insider threat. A

     

    Here are the primary categories of insider threats and their corresponding descriptions:

    # Fraud - In this type of insider threat, an individual within the organization misuses their authorized access to steal, alter, or delete data with the intention of deceiving the company or gaining personal benefit.

    # Sabotage - This category of insider threat involves an authorized employee or insider who maliciously exploits their legitimate network access to sabotage or harm the company's systems, data, or operations.



    Please note that insider threats can manifest in various forms, and these two categories represent common motivations and actions that malicious insiders may undertake. Preventing and mitigating such threats requires a comprehensive security approach that includes employee training, access control measures, and monitoring for suspicious activities.

     

     

    Disclaimer


    All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking. 




     

  • Make money legally as a Hacker without degree

     

    Make money legally as a Hacker without degree

     

    Make money legally as a Hacker


    It's okay if you don't have college degree

    Without a college degree you can make money as a hacker and you won't get arrested for it. Even this is possible you are just in your first year and you are already earning a good lumpsum of money. It's just matter of effort
    you execute over things.

    You don't need certificate to earn money, you'll just need skills to earn money!




    Teaching cyber security


    Teaching hacking is one of the most easy may to make money with the help of your skills, even the best hackers of
    world still write books related to hacking.


    Writing articles on cyber security, helping others with tutorial videos and ebooks will helo you out in earning.

    If you are an undergraduate, don't go for making tutorials, you can sell your skill in your campus.




    Bug Bounty Programs


    Companies are on the rise looking to reward ethical hackers who notify them of any bug in their software before it could be exploited by malicious hackers.

    Become a bug bounty hunter, no legislation is against it, you make money when you win it. Any no company will ask for your certificate, all they need are your fingers on those keys.


    Write Software securities


    The government won't blame you making money writing software securities that abort malicious attacks. Instead, you will get some accolades for that.

     

    Disclaimer

     
     
    All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.

     

  • Killer website for hackers

     

    Killer website for hackers

     

     

    Killer website for hackers


    Exploit Database


    Exploit database (ExploitDB) is an archive of exploits for the purpose of public security, and it explains what can be found on the database. The ExploitDB is a very useful resource for identifying possible weakness in your network and for staying up to date on current attacks occuring in other networks.




    Shodan


    Shodan works by requesting connections to every imaginable internet protocol (IP) address on the internet and indexing the information that it gets back from those connection requests. Shodan crawls the web for devices using a global network of computers and servers that are running 24/7.





    Archive org


    Intenet Archive is a non-profit library of millions of free books, Movies, software, music, websites, and more.



    Nmmapper


    Pentest tool from nmap online to subdomain finder, theHarvester, wappalyzer. Discover dns records of domains, detect cms using cmseek & whatweb.





    Builtwith


    Builtwith is a website profiler, lead generation, competitive analysis and business intelligence tool providing technology adoption, ecommerce data and usage analytics for the internet.




    Disclaimer

     
     
    All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.



  • India gave a befitting reply to foreign hackers in their stronghold, conspiracy being hatched from Malaysia and Indonesia

     

    India gave a befitting reply to foreign hackers in their stronghold, conspiracy being hatched from Malaysia and Indonesia

     

     

    India gave a befitting reply to foreign hackers


    India gave a befitting reply to foreign hackers in their stronghold, conspiracy being hatched from Malaysia and Indonesia


    After the remarks of former BJP spokesperson Nupur Sharma, hackers from some countries have hatched a cyber war against India. Information about attacks on the websites of government departments and some private institutions by hackers from countries like Malaysia and Indonesia has come to the fore. These hackers also made Nupur Sharma's mobile number and home address public on many websites.


    In order to give a befitting reply to the perpetrators of cyber attacks against India, the Ahmedabad Cyber ​​Crime Cell penetrated the hackers' website and their cyber network, found bugs and gave a befitting reply. Amit Vasava, Deputy Commissioner of Police, Ahmedabad Cyber ​​Crime Cell shared important information about this. He told that after such attacks, the cooperation of cyber expert Nisarga Shah was taken to answer the hackers in their own language.


    With the help of cyber expert Nisarg Shah, the Cyber ​​Crime Cell of Ahmedabad Police has found a bug in the network of these hackers and submitted a report to the governments of Indonesia and Malaysia. Have looked for flaws in over 100 Indonesian government websites and 70 Malaysian government websites.




    Hacker Groups of Malaysia and Indonesia


    According to Deputy Commissioner of Police Amit Vasava, with this conspiracy against India, hackers want to create disturbances by cyber attack on India's infrastructure, power grid, digital space. The names of hacker groups 'Dragon Force Malaysia' and 'Hectivist Indonesia' have come to the fore in this conspiracy so far. Their target is the websites of many important departments of the central and state government, police, universities, civic facilities networks and websites of many private industry groups.




    Inputs received from Andhra Pradesh and Maharashtra Police


    Hackers claim that so far they have hacked 200 websites in India. This is also corroborated on the basis of inputs received from Andhra Pradesh Police and Thane Police in Maharashtra. There are reports of hacking. The cyber cell of Ahmedabad Police has challenged by reaching the network of hackers. The cyber cell says that we cannot sit on our hands.




    Disclaimer

     

    All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.


     

  • 8th student e-mail hacked; 27-year-old hacker said

     


     

    8th student e-mail hacked; 27-year-old hacker said - talk about love, otherwise I will defame


    In Bhopal, the accused hacked the e-mail ID from the mobile number of the 8th student. He took out his personal messages and photos and started sending them. Threatening to discredit, he said that if she does not talk lovingly, he will discredit her. In fact, the girl kept the password of her email as her mobile phone number. The accused took advantage of this. Cybercrime team caught the accused from Telangana on the complaint of a minor who has suffered mental torture for almost two months. Although the female partner of the accused is absconding.



    Cybercrime ASP Neetu Singh said that the minor girl studying in 8th class had complained. The student said that the young man with fake ID had hacked his email by befriending him. He was blackmailing her by taking out her personal photos. He was threatening to discredit her for not having spoken affectionately for two months. On the complaint of the student, the team of Cybercrime Branch arrested the accused Turupu Sai Kumar, father Chandrashekhar Reddy, 27, from village Gagna Gudham police station Durg district Ranga Reddy Telangana. He along with his partner Kumari Shravani used to create fake Instagram IDs. Kumari is absconding.


     

     

    This is how hacking used


    Accused Turupu said that he used to send fake request to girls by creating fake ID on Instagram. After friendship, he used to take out his mobile phone number and open his email ID. This gave him personal information about them. In the same way, he implicated this umbrella of Bhopal. 8th student e-mail hacked; 27-year-old hacker said

     

     

    Used to control mobile


    After blocking the e-mail ID, he used to extract all the information from him like personal photos and videos and other information. The victim then blackmailed Instagram ID and started asking him to talk loving things. He used to control even his mobile phone.



    Worst Password :- Click Here



    Password you should never use :-


    1. Don't make short passwords.
    2. Don't store your password where it can be easily found.
    3. Don't make a password that's easy to guess.
    4. Don't use a phone number to make a password
    5. Don't use the Date of Your Wedding (or Birthday, or Child’s Birthday…)



    I hope you liked this post, then you should not forget to share this post at all.
    Thank you so much :-)

     

     

  • 35 lakh rupees waiting for you even a little knowledge of hacking is there


    35 lakh rupees waiting for you even a little knowledge of hacking is there



    35 lakh rupees waiting for you even a little knowledge of hacking is there


    If you too have a fondness for hacking, you know about coding, then 35 lakh rupees are waiting for you. Sony, the leading electronic company, has announced the bug bounty program for the gaming console PlayStation. Under this program, gamers or any common man may be entitled to this award by removing bugs in the PlayStation 4 and PlayStation Network. Earlier, Sony's PlayStation bug bounty program used to be private, but this year for the first time the company has announced to make it public. hacker101




    Announcing this bug bounty program, Sony wrote in its blog, 'It is a fundamental part of our product security that gives a great experience to our community. To strengthen the security, we attach great importance to the research community. We are excited to announce the new bug bounty program. hackerone



    The company has partnered with HackerOne for this and under this program, work is going on to find flaws in PS4 system, operating system, accessories and PlayStation network. It must be mentioned here that PS3 and PS2 are not part of this program. Bug Bounty Program



    35 lakh rupees waiting for you even a little knowledge of hacking is there





    Sony has divided the prize money of Bug Bounty into four parts, which include Critical, High Severity, Medium Severity and Low Severity. For finding Critical Bugs in PlayStation 4, you will get 50,000 dollars i.e. about 38 lakh rupees, while searching for High, Medium and Low Severity bugs will get 10,000 dollars i.e. about 7.5 lakh rupees, 2,500 dollars i.e. two lakh rupees and 500 dollars i.e. about 38,000 rupees respectively. Bug crowd





    Talking about the PlayStation Network (PSN), if you find a critical bug in it, then you will get 3,000 dollars i.e. about 2.5 lakh rupees, while on searching for high, medium and low severity bugs, 1,000 dollars i.e. about 75,500 rupees, 400 dollars i.e. 30,000 rupees respectively. 100 dollars i.e. about 7,500 rupees.



    I hope you liked this post, then you should not forget to share this post at all.
    Thank you so much :-)

  • How SQL Query works in database and how to hack database


    How SQL Query works in database and how to hack database


    SQL Injection


    SQL injection attacks uses SQL websites or web applications. It relies on the strategic injection of malicious code or script into existing queries. This malicious code is drafted with the intention of revealing or manipulating data that is stored in the tables within the database. SQL injection

    SQL Injection is a powerful and dangerous attack. It identifies the flaws and vulnerabilities in a website or application. The fundamental concept of SQL injection is to impact commands to reveal sensitive information from the database. Hence, it can result to a high profile attack. How SQL Query works in database and how to hack database


    Attack Surface of SQL Injection


    Bypassing the authentication
    Revealing Sensitive Information
    Compromised Data Integrity
    Erasing The Database
    Remote Code Execution




    https://www.youtube.com/channel/UCa2s3RmE4B-hRsgKSjJLx_w



    How SQL Query Works ?

    Injection of SQL query will be executed on the server and replied by the response. For example, following SQL Query is requester to the server.



    • SELECT  *  FROM  [ Orders ]
    • SELECT column1, column2, ....  FROM table_name;


    These commands will reveal all information stored in the databse "Oredrs" table. If an organization maintains records of their orders into a database, all information kept in this database table will be extracted by the command.






    Learn and understand CEH from scratch. A complete beginner's guide to learn CEH.

    Try it :- It's a Free 





    Otherwise let's understand with another Example



    In the following example, an attacker with the username link inserts their name after the = sign following the WHERE owner, which used to include the string 'name'; DELETE FROM items; -- for itemName , into an existing SQL command, and the query becomes the following two queries:



    • SELECT * FROM items WHERE owner = 'link' AND itemname = 'name'; DELETE FROM items;--






    Many of the common database products such as Microsoft’s SQL Server and Oracle’s Siebel allow several SQL statements separated by semicolons to be executed at once. This technique, known as batch execution, allows an attacker to execute multiple arbitrary
    commands against a database. In other databases, this technique will generate an error and fail, so knowing the database you are attacking is essential.



    If an attacker enters the string 'name'; DELETE FROM items; SELECT * FROM items WHERE   'a' = 'a' ,   the following three valid statements will be created:





    • SELECT * FROM items WHERE owner = 'link' AND itemname = 'name'; 

    • DELETE FROM items; SELECT * FROM items WHERE 'a' = 'a';



    A good way to prevent SQL injection attacks is to use input validation, which ensures that only approved characters are accepted. Use whitelists, which dictate safe characters, and blacklists, which dictate unsafe characters.


    Database





    SQL Delete Query

    The DELETE statement is used to delete existing records in a table. To understand, consider a table "Customers" in a database. The following information is the table "Customers" is containing.






    Execution of  "delete" command will eraase the record.


    • DELETE FROM Customers WHERE CustomerName='Alfreds Futterkiste';


    Now the database table will be like this :-






    There are lots of SQL query commands that can be used. Above are some of the most common and effective commands that are being used for injection.
    for example :-


    • UPDATE Customers SET ContactName = 'KumarAtulJaiswal', city= 'Delhi' WHERE CustomerID = 56;
    • INSERT INTO Customers (column1, column2, column3, ...)
      VALUES (value1, value2, value3, ...); 

    • Customers is a Table Name.


    SQL Injection Tools

    There are several tools available for SQL injection such as :-

    • BSQL Hacker
    • Marathon Tool
    • SQL Power Injecto
    • Havij


     Server Side Technologies

    Server-side technologies come in many varieties and types, each of which offers
    something specific to the user. Generally, each of the technologies allows the creation of dynamic and data-driven web applications. You can use a wide range of server-side technologies to create these types of web applications; among them are the following:

    • ASP
    • ASP.NET
    • Oracle
    • PHP
    • JSP
    • SQL Server
    • IBM DB2
    • MySQL
    • Ruby on Rails

    All of these technologies are powerful and offer the ability to generate web applications that are extremely versatile. Each also has vulnerabilities that can lead to it being compromised, but this chapter is not about those.



    I hope you liked this post, then you should not forget to share this post at all.
    Thank you so much :-)




  • Learn and understand CEH from scratch. A complete beginner's guide to learn CEH

     


    Learn and understand CEH from scratch. A complete beginner's guide to learn CEH.



    You've likely heard about hacking—perhaps in movies or on the news—and you've certainly taken steps to protect your online identity from hackers. But what is hacking, who does it, and why? In this comprehensive course on the fundamentals of web hacking, answer these questions and more. Begin by reviewing the hacker methodology, types of hack attacks, and learn to configure test servers to hack yourself! Finally, review network mapping, and think through potential careers in cyber security. Learn and understand CEH from scratch. A complete beginner's guide to learn CEH


    Who this course is for:

    •     People who interested in hacking





    https://www.youtube.com/channel/UCa2s3RmE4B-hRsgKSjJLx_w



    Course content


    Certified Ethical Hacking(CEH) Course [May 2020 Edition]


    • CEH Tutorial - Lecture 1
    • CEH Tutorial - Lecture 2
    • CEH Tutorial - Lecture 3
    • CEH Tutorial - Lecture 4
    • CEH Tutorial - Lecture 5
    • CEH Tutorial - Lecture 6
    • CEH Tutorial - Lecture 7

     This course includes


    • 43 mins on-demand video
    • Full lifetime access
    • Access on mobile and TV
    • Certificate of Completion

     




    I hope you liked this post, then you should not forget to share this post at all.
    Thank you so much :-)




  • Top 9 Advance phishing Tool for hack a social site, website etc



    Top 9 Advance phishing Tool for hack a social site, website etc



    Top 9 phishing Tool for hack a social site, website etc


    Today's youth was interested and more is being seen on hacking tomorrow, due to which if no one has technical knowledge.  He can also do hacking using a hacking tool and is a very well-known tool.  Which is called a fishing tool and this tool helps in many different types of fishing attacks. Top 9 Advance phishing Tool for hack a social site, website etc


    Here you will be told about different types of fishing attack tools and the first tool is our Evilginx2.



    1) EVILGINX2

    Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication.



    Top 9 Advance phishing Tool for hack a social site, website etc



    EVILGINX2 is a  man-in-the-middle attack framework used for fixing login credentials along with session cookies, which in turns allows bypassing two factor authentication production


    Github :- https://github.com/kgretzky/evilginx2




    2) HIDDEN EYE


    Modern Phishing Tool With Advanced Functionality And Multiple Tunnelling Services [ Android-Support-Available ]


    Top 9 Advance phishing Tool for hack a social site, website etc



    Github :- https://www.cyberpunk.rs/hidden-eye-modern-phishing-tool








    3) KING PHISHER


    King Phisher is a tool for testing and promoting user awareness by simulating real world phishing attacks. It features an easy to use, yet very flexible architecture allowing full control over both emails and server content. King Phisher can be used to run campaigns ranging from simple awareness training to more complicated scenarios in which user aware content is served for harvesting credentials. Top 9 Advance phishing Tool for hack a social site, website etc







    Top 9 Advance phishing Tool for hack a social site, website etc



    King Phisher is only to be used for legal applications when the explicit permission of the targeted organization has been obtained.


    Github :- https://github.com/rsmusllp/king-phisher



    See Also :- 


    How To Change MAC Address



    • Find Leaked Email and Password via onion service :- Click Here



    Find Leaked Email and Password via onion service



    4) GOPHISH


    Gophish is open source facing toolkit design for business and penetration testers. It provides the ability to quickly and easily setup and execute phishing engagement and security awareness training.



    Top 9 Advance phishing Tool for hack a social site, website etc



    Website :- https://getgophish.com/





    5) WIFIPHISHER


    Wifiphisher is a rogue Access Point framework for conducting red team engagements or Wi-Fi security testing. Using Wifiphisher, penetration testers can easily achieve a man-in-the-middle position against wireless clients by performing targeted Wi-Fi association attacks. Wifiphisher can be further used to mount victim-customized web phishing attacks against the connected clients in order to capture credentials (e.g. from third party login pages or WPA/WPA2 Pre-Shared Keys) or infect the victim stations with malwares.



    Top 9 Advance phishing Tool for hack a social site, website etc



    Github :-  https://github.com/wifiphisher/wifiphisher




    https://www.youtube.com/channel/UCa2s3RmE4B-hRsgKSjJLx_w






    6) BLACK EYE



    The most complete phishing tool, with 32 templates+1 customizable.


    Top 9 Advance phishing Tool for hack a social site, website etc


    Github :-  https://github.com/thelinuxchoice/blackeye




    7) EDUCATION PHISHING TOOL


    Educational Phishing Tool & Information Collector.


    Top 9 Advance phishing Tool for hack a social site, website etc


    Github :- https://github.com/UndeadSec/SocialFish





    8) SOCIAL MEDIA PHISHING PAGES



    The way phishing works is that an attacker clones a trusted website or spoofs an email of a known target which leads the person to believe that he is visiting a trusted website like social media sites, e.g.,  shellphish github termux Facebook, SnapChat, Instagram, Google, Netflix, and so on. The target will then put his/her username and password on the malicious website (cloned website) and then the username and password will be sent to the attacker instead of the real website, and the target will be redirected to the real website. Let’s do a demo of phishing using shellphish. shellphish github download


    Top 9 Advance phishing Tool for hack a social site, website etc



    Website :- https://www.hackingtruth.in/2019/10/the-linux-choice-shell-phish.html






    9) ZPHISHER



    Zphisher is an upgraded form of Shellphish. The main source code is from Shellphish. But I have not fully copied it. I have upgraded it & cleared the Unnecessary Files. It has 37 Phishing Page Templates ; including Facebook , Twitter & Paypal. It also has 4 Port Forwarding Tools .



    Top 9 Advance phishing Tool for hack a social site, website etc




    Github :- https://github.com/htr-tech/zphisher






    I hope you liked this post, then you should not forget to share this post at all.
    Thank you so much :-)








  • how to change MAC address with mac changer




    how to change MAC address with mac changer


    MAC (Media Access Control) address spoofing can come useful in many situations. By changing MAC address, one can protect his/her system from system identification bots which look for MAC address to exploit network administrative privileges, fool freely available internet service in order to bypass network access and bandwidth usage restrictions, make system more secure by disguising MAC address or by replacing it with other NICs randomly generated MAC address for security purposes. how to change MAC address with mac changer 


    Sadly, basic network tools are only for changing DHCP settings, switching between different network profiles, ping DNS servers, etc., therefore, you need to use a dedicated tool to change your Network Interface MAC address. Tecnitium MAC address Changer is developed to change your Network Interface Card (NIC) MAC address. You can choose NIC from the given list whose MAC address will replace your original MAC address.





    Technitium MAC Address Changer allows you to change (spoof) Media Access Control (MAC) Address of your Network Interface Card (NIC) instantly. It has a very simple user interface and provides ample information regarding each NIC in the machine. Every NIC has a MAC address hard coded in its circuit by the manufacturer. This hard coded MAC address is used by windows drivers to access Ethernet Network (LAN). This tool can set a new MAC address to your NIC, bypassing the original hard coded MAC address. Technitium MAC Address Changer is a must tool in every security professionals tool box.







    Features



    • Works on Windows 10, 8 & 7 for both 32-bit and 64-bit.
    • Enhanced network configuration presets with IPv6 support allow you to quickly switch between network configurations.
    • Allows complete configuration of any network adapter.
    • Command line options with entire software functionality available. You can select a preset from specified preset file to apply directly.
    • Update network card vendors list feature allows you to download latest vendor data (OUI) from IEEE.org.



    How To Change MAC Address


    1. Starting MAC address changer will list all available network adapters.
    2. Select the adapter you want to change the MAC address. You will get the details of your selection below.
    3. In the Information tab, find the Change MAC Address frame. Enter new MAC address in the field and click Change Now! button. You may even click Random MAC Address button to fill up a randomly selected MAC address from the vendor list available.
    4. To restore the original MAC address of the network adapter, select the adapter, click Restore Original button in the Change MAC Address frame.


    NOTE: This tool cannot change MAC address of Microsoft Network Bridge. Network Bridge will automatically use the original MAC address of the first NIC added into bridge with the first octet of MAC address set to 0x02.




         
    Don't Forget to Subscribe




    Download Technitium MAC Address Changer

    Download All About MAC Address PDF



    I hope you liked this post, then you should not forget to share this post at all.
    Thank you so much :-)



  • critical bug in VMware opens up corporate Treasure to hackers



    critical bug in VMware opens up corporate Treasure to hackers

    critical bug in VMware opens up corporate Treasure to hackers



    A critical information-disclosure bug in VMware’s Directory Service (vmdir) could lay bare the contents of entire corporate virtual infrastructures, if exploited by cyberattackers. critical bug in VMware opens up corporate Treasure to hackers
    The vmdir is part of VMware’s vCenter Server product, which provides centralized management of virtualized hosts and virtual machines (VMs) from a single console. According to the product description, “a single administrator can manage hundreds of workloads.”



    These workloads are governed by a single sign-on (SSO) mechanism to make things easier for administrators; rather than having to sign into each host or VM with separate credentials in order to gain visibility to it, one authentication mechanism works across the entire management console.

    The vmdir in turn is a central component to the vCenter SSO (along with the Security Token Service, an administration server and vCenter Lookup Service). Also, vmdir is used for certificate management for the workloads governed by vCenter, according to VMware.






    The critical flaw (CVE-2020-3952) was disclosed and patched on Thursday; it rates 10 out of 10 on the CVSS v.3 vulnerability severity scale. At issue is a poorly implemented access control, according to the bug advisory, which could allow a malicious actor to bypass authentication mechanisms.



    “Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls,” the description explained.







    As for the attack vector, “a malicious actor with network access to an affected vmdir deployment may be able to extract highly sensitive information,” VMware noted. In turn, this information could be used to compromise the vCenter Server itself “or other services which are dependent upon vmdir for authentication.”

    There are no workarounds, but administrators are encouraged to apply the patches as soon as possible.

    vCenter Server 6.7 (embedded or external PSC) prior to 6.7u3f is affected by CVE-2020-3952 if it was upgraded from a previous release line such as 6.0 or 6.5. Clean installations of vCenter Server 6.7 (embedded or external PSC) are not affected, according to the company. To help administrators find out if their vmdir deployments are affected by CVE-2020-3952, the vendor has published a how-to knowledge base document.






    “VMware, one of, if not the most, popular virtualization software companies in the world, recently patched an extremely critical information disclosure vulnerability…one of the most severe vulnerabilities that has affected VMware software,” Chris Hass, director of information security and research at Automox, told Threatpost. “vCenter Server provides a centralized platform for controlling VMware vSphere environments, it helps manage virtual infrastructure in a tremendous number of hybrid clouds, so the scope and impact of this vulnerability is quite large. Organizations using vCenter need to check their vmdir logs for affected versions, ACL MODE: legacy, and patch immediately.”

    No specific acknowledgments were given for the bug discovery – VMware noted only that it was “disclosed privately.”


    Credit :- ThreatPost




  • WHAT WE DO

    We've been developing corporate tailored services for clients for 30 years.

    CONTACT US

    For enquiries you can contact us in several different ways. Contact details are below.

    Hacking Truth.in

    • Street :Road Street 00
    • Person :Person
    • Phone :+045 123 755 755
    • Country :POLAND
    • Email :contact@heaven.com

    Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.

    Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation.