Hackercool Magazine June 2025

Hello, aspiring ethical hackers and Red Team wannabes. Welcome to June 2025 Issue of our Hackercool Magazine. In this Issue of Hackercool Magazine, we will start with a Red Team tactic of tunneling through Firewall using Chisel. Then, we will do a deep dive into ClickFix hacking technique that has been so widely being used by threat actors around the world to distribute malware and payloads. At the end, we will teach you what measures you need to take to stay safe from this type of attack. Then, we will break down to you few of the most talked about vulnerabilities disclosed this month. They are, CVE-2025-53370: a critical vulnerability in SharePoint (on-premises) that is already being exploited in the wild by threat actors. CVE-2025-6463: A RCE vulnerability threatening over…

In this month’s “Red Team Hacking” feature, you will learn how to use Chisel to access restricted intenal network of our target organization. Let’s start with what chisel is. What is Chisel? Chisel is a traffic tunneller that can tunnel SSH traffic over HTTP. It is mainly useful in Red Team operations and pen test exercises to bypass firewall restrictions, forward remote ports, SOCKS proxy etc. In this Issue, we will show you how to access the restricted internal network and resources of target organization using Chisel. Scenario Imagine you are in midst of a pen test or a Red Team operation. You have already gained initial access on a system belonging to the organization. While scanning the internal network for pivoting purposes, you find a web server that is…

A critical zero-day vulnerability has been discovered affecting Microsoft SharePoint Servers installed on the on-premises installations which was being exploited by threat actors in the wild before its detection. About the vulnerability The vulnerabilities tracked as CVE-2025-53770 and CVE-2025-53771, with a CVSS rating of 9.8 is a result of deserialization of untrusted data flaw within the SharePoint server. The application improperly handles serialized data objects. This allows attackers to craft specific payloads that trigger remote code execution. The products affected with this vulnerability are Microsoft SharePoint server Subscription Edition (on-premises), Microsoft SharePoint server 2019 (onpremises) and Microsoft SharePoint server 2016 (on-premises). Microsoft 365 are not vulnerable. How is this vulnerability exploited? Exploitation of this vulnerability is very simple. He doesn’t need any credentials and all a hacker needs to have…

Alfred, (no, not Batman’s butler) was looking for a job change. He has been working as a Quality Analyst in a company. As part of his career growth, he was looking for new opportunities. One day, while checking his jobrelated mails, a mail caught his interest. The subject of the mail was named “Salary details”. Alfred opened the mail. It was indeed a job offer with a Word document named “Salary_details” attached to it. Heclickedonthe attachment. But instead of getting opened, it presented a dialog box. The dialog box prompted that there was an error in opening the document as there was no “Word online” extension. It also suggested a solution to this problem. It displayed two buttons on the dialog box: “How to fix” and “Auto-fix”. He clicked on…

A critical file deletion vulnerability has been discovered in the popular plugin of WordPress that affects over 6,00,000 active installations. Forminator is a Wordpress from builder plugin that is used to create forms, surveys etc for Wordpress websites. About the vulnerability The vulnerability tracked as CVE-2025-6463 has a vulnerability rating of 8.8. It allows unauthenticated attackers to delete any critical system files including “wpconfig.php” and can lead to remote code execution and even complete site takeover. This vulnerability affects all versions of Forminator plugin up to 1.44.2. The vulnerability is due to an insufficient file path validation in the “entry_delete_upload_files” function. This function processes form submission deletions as it doesn’t perform proper security checks. It processes all metadata values without verifying files types, the extension of the file, or the…

If you regularly receive PDF files as attachments to your email, you should definitely read this article. Researchers at Cyble have identified a sophisticated phishing campaign they have named as “Scanception”. This is an ongoing Quishing campaign using QR codes to bypass defenses and harvest credentials. It is widespread and ongoing campaign. Let’s study in detail about this threat and how to stay safe. Image source: Android Threat identification Tactics, Techniques & Procedures: This campaign begins with target users receiving an email with a PDF file as attachment. These PDFs are masqueraded as an employee handbook sent by the company’s HR department. The email also contains advanced social engineering artifacts like Email, Logo etc. Scanception represents an evolution in phishing tactics, combining traditional PDF lures with QR code-based ‘quishing’ attacks to…