🔰🔰How to protect yourself from Evil Twin Attack?🔰🔰
1) Do not connect to public networks, everyone can smell your data while in a public network. The Twin Throw attack will be done as a public network, so restrict as much as possible the connection to all open or public networks mainly if the wifi name is the same as your wifi name
2) When the Internet connection stops working suddenly, it can be under DOS attack using a double evil attack, just restart the router and the attacker must restart the attack and it takes time. Maybe they will leave or continue at another time
3) Run a VPN to ensure that all browsing and data transmission is performed through an encrypted tunnel that can not be easily spied.
4) Do not always trust the name of the network, make sure it is a legitimate and reliable network or not.
1) Do not connect to public networks, everyone can smell your data while in a public network. The Twin Throw attack will be done as a public network, so restrict as much as possible the connection to all open or public networks mainly if the wifi name is the same as your wifi name
2) When the Internet connection stops working suddenly, it can be under DOS attack using a double evil attack, just restart the router and the attacker must restart the attack and it takes time. Maybe they will leave or continue at another time
3) Run a VPN to ensure that all browsing and data transmission is performed through an encrypted tunnel that can not be easily spied.
4) Do not always trust the name of the network, make sure it is a legitimate and reliable network or not.
🔰CEO FRAUD🔰
Online crimes are on a consequent rise and every sector is vulnerable to it. However, corporate sector is at a high risk as there is a constant threat of data breach.
CEO Fraud is the recent cyber-attack that has taken a toll over business sector. Also known as Business Email Compromise (BEC), it is an attack in which the attacker masquerades his original identity. They often pose themselves as the CEO or any other senior executive of an organization and send emails to the staff members. They generally ask for confidential information or make you do something which should not be done otherwise.
Such attacks are launched after careful planning & research. Cyber-criminals often search the organizations website to gather information such as physical location of the business, employee details, business partners etc. They might also gather employee specific data from sites such as LinkedIn, Facebook, Twitter, etc
Online crimes are on a consequent rise and every sector is vulnerable to it. However, corporate sector is at a high risk as there is a constant threat of data breach.
CEO Fraud is the recent cyber-attack that has taken a toll over business sector. Also known as Business Email Compromise (BEC), it is an attack in which the attacker masquerades his original identity. They often pose themselves as the CEO or any other senior executive of an organization and send emails to the staff members. They generally ask for confidential information or make you do something which should not be done otherwise.
Such attacks are launched after careful planning & research. Cyber-criminals often search the organizations website to gather information such as physical location of the business, employee details, business partners etc. They might also gather employee specific data from sites such as LinkedIn, Facebook, Twitter, etc
🔰🔰VPN ROUTERS🔰🔰
A VPN router is a routing device that helps in enabling network communications within a VPN environment. It connects & communicates between multiple VPN end devices that are located at separate locations.
These routers are specifically designed to protect your system from a cyber-attack. This is made possible because all the devices connected with a VPN router are protected by a Virtual Private Network
.
Methods Of VPN Router Setup
There are 3 main methods and one can go with any one of these:
Buying a pre-configured VPN router
Using a VPN enabled router that supports OpenVPN
Flashing a non VPN compatible router with new firmware to support VPN.
Benefits of using VPN routers:
➖Easy to install .
➖Less expensive.
➖ Device friendly.
➖Ensures security.
Credits : @DeepHackerVendors .
A VPN router is a routing device that helps in enabling network communications within a VPN environment. It connects & communicates between multiple VPN end devices that are located at separate locations.
These routers are specifically designed to protect your system from a cyber-attack. This is made possible because all the devices connected with a VPN router are protected by a Virtual Private Network
.
Methods Of VPN Router Setup
There are 3 main methods and one can go with any one of these:
Buying a pre-configured VPN router
Using a VPN enabled router that supports OpenVPN
Flashing a non VPN compatible router with new firmware to support VPN.
Benefits of using VPN routers:
➖Easy to install .
➖Less expensive.
➖ Device friendly.
➖Ensures security.
Credits : @DeepHackerVendors .
🔰🔰DIFFERENT TYPES OF WEB BASED ATTACKS🔰🔰
Structured Query Language (SQL) Injection
SQL injection is a common technique that involves injecting a malicious code to alter the sensitive information in the website’s back-end database. It may also be performed to steal payment card details, username and password as well as insert spam links to the website. SQL attacks are quite easy to execute and can severely compromise the data security of a company.
Cross-Site Scripting (XSS)
Cross-site scripting (XSS) can be defined as a client-side code injection attack in which the hacker injects a malicious script, predominantly JavaScript, in a legitimate website. As these scripts appear to be from a trusted source, they are often executed by the end users. This, in turn, allows the hacker to gain access to the cookies, session tokens, passwords and other sensitive information.
Drive-By Downloads
In this type of attack, the hackers tamper a web application with an HTML code that stealthily downloads a malware whenever a user visits the website. Once downloaded, the program may execute itself to record keystrokes, access important files, hijack online banking sessions or use the computer as a part of botnet.
DoS And DDoS
Denial of service (DoS) and distributed denial of service (DDoS) attacks are carried out by flooding a website with traffic from multiple sources, making it unavailable for the genuine users. In a DoS attack, a single computer system may attempt to crash the target server with data packets. A DDoS attack is when multiple computers, widely distributed in a botnet, send simultaneous requests to slow down and ultimately halt the web server.
@Leave89
Structured Query Language (SQL) Injection
SQL injection is a common technique that involves injecting a malicious code to alter the sensitive information in the website’s back-end database. It may also be performed to steal payment card details, username and password as well as insert spam links to the website. SQL attacks are quite easy to execute and can severely compromise the data security of a company.
Cross-Site Scripting (XSS)
Cross-site scripting (XSS) can be defined as a client-side code injection attack in which the hacker injects a malicious script, predominantly JavaScript, in a legitimate website. As these scripts appear to be from a trusted source, they are often executed by the end users. This, in turn, allows the hacker to gain access to the cookies, session tokens, passwords and other sensitive information.
Drive-By Downloads
In this type of attack, the hackers tamper a web application with an HTML code that stealthily downloads a malware whenever a user visits the website. Once downloaded, the program may execute itself to record keystrokes, access important files, hijack online banking sessions or use the computer as a part of botnet.
DoS And DDoS
Denial of service (DoS) and distributed denial of service (DDoS) attacks are carried out by flooding a website with traffic from multiple sources, making it unavailable for the genuine users. In a DoS attack, a single computer system may attempt to crash the target server with data packets. A DDoS attack is when multiple computers, widely distributed in a botnet, send simultaneous requests to slow down and ultimately halt the web server.
@Leave89
🔰🔰PASSWORD SALTING🔰🔰
Password salting is a form of password encryption that involves appending a password to a given username and then hashing the new string of characters. This is usually done via an MD5 hashing algorithm. Password-salting is most commonly found within Linux operating systems, and it is generally considered a more secure password encryption model than any of the models used within the various Microsoft distributions...
Credits: @DeepHackerVendors
Password salting is a form of password encryption that involves appending a password to a given username and then hashing the new string of characters. This is usually done via an MD5 hashing algorithm. Password-salting is most commonly found within Linux operating systems, and it is generally considered a more secure password encryption model than any of the models used within the various Microsoft distributions...
Credits: @DeepHackerVendors
🔺Joomscan – Open Source Joomla Vulnerability Scanner🔺
Joomscan is a scanner by OWASP, which aims to automate the task for vulnerability assessments for Joomla based sites. Based in perl, this tool can enumerate the version, vulnerabilities, components, firewalls and more, all in one friendly to use interface.
Installing Joomscan
First, let’s clone the repository to our machine.
git clone https://github.com/rezasp/joomscan.git
Joomscan is a scanner by OWASP, which aims to automate the task for vulnerability assessments for Joomla based sites. Based in perl, this tool can enumerate the version, vulnerabilities, components, firewalls and more, all in one friendly to use interface.
Installing Joomscan
First, let’s clone the repository to our machine.
git clone https://github.com/rezasp/joomscan.git
GitHub
GitHub - OWASP/joomscan: OWASP Joomla Vulnerability Scanner Project https://www.secologist.com/
OWASP Joomla Vulnerability Scanner Project https://www.secologist.com/ - OWASP/joomscan
🍁Synthetic Fingerprints Make Biometric/Fingerprint Recognition Systems Vulnerable🍁
From smartphone lock systems to identity verification, people consider fingerprint scans a viable method of security. However, scientists have figured out ways to ditch fingerprint recognition and biometric systems via synthetic fingerprints. It means all systems and devices relying on fingerprints could be vulnerable to spoofing.
A team of researchers from the New York University Tandon School of Engineering has shared its study regarding synthetic fingerprints. As demonstrated, using neural networks, synthesizing human fingerprints artificially has now become possible. The researchers even succeeded in developing a fake fingerprint that could potentially spoof any fingerprint recognition system. They have published their findings as a research paper.
From smartphone lock systems to identity verification, people consider fingerprint scans a viable method of security. However, scientists have figured out ways to ditch fingerprint recognition and biometric systems via synthetic fingerprints. It means all systems and devices relying on fingerprints could be vulnerable to spoofing.
A team of researchers from the New York University Tandon School of Engineering has shared its study regarding synthetic fingerprints. As demonstrated, using neural networks, synthesizing human fingerprints artificially has now become possible. The researchers even succeeded in developing a fake fingerprint that could potentially spoof any fingerprint recognition system. They have published their findings as a research paper.
REVERSE BRUTEFORCE ATTACK
Reverse-brute-force attacks are of an entirely different kind. Here, the attacker has the entire list of valid usernames (which the bank happily gives away by employing some stupid security measures, as described in the following section) and one most commonly used password is tried against these complete set of usernames. This type of attack does not render the username blocked, as the attacker tries only one password against each username and the same password against all the usernames. Moreover if the Bank does not enforce a strong password policy, it makes it very easier for the attacker to get working combinations of username and password within a few hours, which he can later use for malicious purposes.
@deephackervendors
Reverse-brute-force attacks are of an entirely different kind. Here, the attacker has the entire list of valid usernames (which the bank happily gives away by employing some stupid security measures, as described in the following section) and one most commonly used password is tried against these complete set of usernames. This type of attack does not render the username blocked, as the attacker tries only one password against each username and the same password against all the usernames. Moreover if the Bank does not enforce a strong password policy, it makes it very easier for the attacker to get working combinations of username and password within a few hours, which he can later use for malicious purposes.
@deephackervendors
How Cloud Computing Works?💁🏻♂️💁🏻♂️
Information and data is stored on physical or virtual servers, which are maintained and controlled by a cloud computing provider, such as Amazon and their AWS product. As a personal or business cloud computing user, you access your stored information on the ‘cloud’, via an Internet connection.🀄️@deephackervendors🎴
The big cloud maintenance servers today are held by Microsoft, Google, Amazon, Alibaba etc.
DIRECTORY TRAVERSAL
🔰🔰Directory traversal is primarily a type of attack performed by a hacker or a cracker that induces the server to traverse to the parent directory or to expose server-specific controls. Directory traversal generally happens as a result of a lack of or insufficient validation within the code of the application hosted/executed on the Web server.
In a directory traversal, the hacker/cracker typically sends in an HTTP request with a series of ../, in order to traverse or climb to a parent directory. The application/server is unable to validate the input data from the Web browser and grants access to the internal and restricted directories and the data they contain. Once the cracker/hacker gains access to the parent directory, he or she can view, edit and delete files, or even execute specific commands.🔰🔰
Credits : @Deephackervendors
🔰🔰Directory traversal is primarily a type of attack performed by a hacker or a cracker that induces the server to traverse to the parent directory or to expose server-specific controls. Directory traversal generally happens as a result of a lack of or insufficient validation within the code of the application hosted/executed on the Web server.
In a directory traversal, the hacker/cracker typically sends in an HTTP request with a series of ../, in order to traverse or climb to a parent directory. The application/server is unable to validate the input data from the Web browser and grants access to the internal and restricted directories and the data they contain. Once the cracker/hacker gains access to the parent directory, he or she can view, edit and delete files, or even execute specific commands.🔰🔰
Credits : @Deephackervendors