Indholdsfortegnelse for June 2025 i Hackercool Magazine

Hello, aspiring ethical hackers and Red Team wannabes. Welcome to June 2025 Issue of our Hackercool Magazine. In this Issue of Hackercool Magazine, we will start with a Red Team tactic of tunneling through Firewall using Chisel. Then, we will do a deep dive into ClickFix hacking technique that has been so widely being used by threat actors around the world to distribute malware and payloads. At the end, we will teach you what measures you need to take to stay safe from this type of attack. Then, we will break down to you few of the most talked about vulnerabilities disclosed this month. They are, CVE-2025-53370: a critical vulnerability in SharePoint (on-premises) that is already being exploited in the wild by threat actors. CVE-2025-6463: A RCE vulnerability threatening over…

Alfred, (no, not Batman’s butler) was looking for a job change. He has been working as a Quality Analyst in a company. As part of his career growth, he was looking for new opportunities. One day, while checking his jobrelated mails, a mail caught his interest. The subject of the mail was named “Salary details”. Alfred opened the mail. It was indeed a job offer with a Word document named “Salary_details” attached to it. Heclickedonthe attachment. But instead of getting opened, it presented a dialog box. The dialog box prompted that there was an error in opening the document as there was no “Word online” extension. It also suggested a solution to this problem. It displayed two buttons on the dialog box: “How to fix” and “Auto-fix”. He clicked on…

A critical security vulnerability has been discovered Fortinet’s Fortiweb that is being exploited in the wild already by threat actors. Fortiweb is a Web Application Firewall (WAF) from Fortinet that protects web applications from various threats. About the vulnerability The vulnerability being tracked as CVE-2025-25257 is an unauthenticated SQL injection vulnerability in Fortinet Fortiweb’s fabric connector’s authentication method. It has a CVSS Score of 9.6. Fabric connector serves as a middleware between Fortiweb web application firewalls and other Fortinet products in the network to enable dynamic policy updates based on real-time infrastructure changes and threat intelligence. The vulnerability is present in the function of fabric connector named “get_fabric_user_by_token” function that processes authentication tokens from other Fortinet devices trying to integrate with Fortiweb. As you might have guessed it, improper conditioning…

Chisel tool https://github.com/jpillora/chisel Indicators of Compromise (IoC) of Scanception PDF’s and URLs https://github.com/CRIL-ThreatIntelligence/IOCs/tree/main/Scanception_%20A_QRiosity-Driven_Phishing_Campaign USEFUL RESOURCES Check whether your email is a part of any data breach https://haveibeenpwned.com Follow Hackercool Magazine for latest updates https://www.facebook.com/hackercoolmagazine/ https://twitter.com/Hackercool_mag?lang=en https://www.linkedin.com/company/73209020/admin/ https://www.instagram.com/hackercool_magazine/ “There are only two types of companies: those that have been hacked, and those who don’t know they have been hacked.”—John Chambers…

In this month’s “Red Team Hacking” feature, you will learn how to use Chisel to access restricted intenal network of our target organization. Let’s start with what chisel is. What is Chisel? Chisel is a traffic tunneller that can tunnel SSH traffic over HTTP. It is mainly useful in Red Team operations and pen test exercises to bypass firewall restrictions, forward remote ports, SOCKS proxy etc. In this Issue, we will show you how to access the restricted internal network and resources of target organization using Chisel. Scenario Imagine you are in midst of a pen test or a Red Team operation. You have already gained initial access on a system belonging to the organization. While scanning the internal network for pivoting purposes, you find a web server that is…

A critical file deletion vulnerability has been discovered in the popular plugin of WordPress that affects over 6,00,000 active installations. Forminator is a Wordpress from builder plugin that is used to create forms, surveys etc for Wordpress websites. About the vulnerability The vulnerability tracked as CVE-2025-6463 has a vulnerability rating of 8.8. It allows unauthenticated attackers to delete any critical system files including “wpconfig.php” and can lead to remote code execution and even complete site takeover. This vulnerability affects all versions of Forminator plugin up to 1.44.2. The vulnerability is due to an insufficient file path validation in the “entry_delete_upload_files” function. This function processes form submission deletions as it doesn’t perform proper security checks. It processes all metadata values without verifying files types, the extension of the file, or the…

Some unusual witnesses helped convict Alex Murdaugh of the murders of his wife, Maggie, and son, Paul. The first was Bubba, Maggie’s yellow Labrador retriever. Prosecutors used a recording of Bubba to place Alex at the site of the murders. Given Alex’s presence at the crime scene, other witnesses then revealed his movements, tracked his speed and explained what he had in his hands. Those other witnesses were a 2021 Chevy Suburban and Maggie, Paul and Alex’s cellphones, which all provided data. They’re all part of the Internet of Things, also known as IoT. The privacy implications of devices connected to the internet are not often the most important consideration in solving a murder case. But outside of criminal prosecution, they affect people’s privacy in ways that should give everyone…

A critical zero-day vulnerability has been discovered affecting Microsoft SharePoint Servers installed on the on-premises installations which was being exploited by threat actors in the wild before its detection. About the vulnerability The vulnerabilities tracked as CVE-2025-53770 and CVE-2025-53771, with a CVSS rating of 9.8 is a result of deserialization of untrusted data flaw within the SharePoint server. The application improperly handles serialized data objects. This allows attackers to craft specific payloads that trigger remote code execution. The products affected with this vulnerability are Microsoft SharePoint server Subscription Edition (on-premises), Microsoft SharePoint server 2019 (onpremises) and Microsoft SharePoint server 2016 (on-premises). Microsoft 365 are not vulnerable. How is this vulnerability exploited? Exploitation of this vulnerability is very simple. He doesn’t need any credentials and all a hacker needs to have…

If you regularly receive PDF files as attachments to your email, you should definitely read this article. Researchers at Cyble have identified a sophisticated phishing campaign they have named as “Scanception”. This is an ongoing Quishing campaign using QR codes to bypass defenses and harvest credentials. It is widespread and ongoing campaign. Let’s study in detail about this threat and how to stay safe. Image source: Android Threat identification Tactics, Techniques & Procedures: This campaign begins with target users receiving an email with a PDF file as attachment. These PDFs are masqueraded as an employee handbook sent by the company’s HR department. The email also contains advanced social engineering artifacts like Email, Logo etc. Scanception represents an evolution in phishing tactics, combining traditional PDF lures with QR code-based ‘quishing’ attacks to…

CISA has issued an urgent warning about a critical zero-day vulnerability affecting Google chrome browser and being exploited in wild by threat actors. About the vulnerability The vulnerability being tracked as CVE-2025-6554 affects V8 JavaScript engine of chromium. The chromium V8 JavaScript engine serves as the core processing unit for executing Java script code in web browser. The vulnerability is a type confusion vulnerability and occurs when the V8 engine incorrectly handles data types allowing hackers to manipulate memory and potentially execute malicious code on target systems. Versions of Google chrome affected by this vulnerability are versions prior to 138.0.7204.96/97 for Windows, versions prior to 138.0.7204.92/93 for Mac and versions prior to 138.0.7204.96 for Linux. Versions of Microsoft Edge that are vulnerable are versions prior to 138.0.3351.65. How hackers can…