Buna Byte Cybersecurity
841 subscribers
273 photos
10 videos
2 files
192 links
Learn, Hack, and Defend

Website: bunabyte.com
YouTube: youtube.com/@bunabyte
BunaByte Files: @hacker_habesha

πŸ“§ Contact Email: info@bunabyte.com
Download Telegram
πŸ’‰The Ultimate SQLmap Tutorial: Master SQL Injection and Vulnerability Assessment!

πŸ“SQL Injection is a type of cyber attack where malicious actors exploit vulnerabilities in web applications to inject malicious SQL code into backend databases. This can lead to the exposure of sensitive data, unauthorized access to systems, and even complete system compromise.

SQLmap is a powerful open-source tool used to automate the process of detecting and exploiting SQL Injection vulnerabilities in web applications. It is a command-line tool that can be used to enumerate databases, extract data, and even execute operating system commands on the underlying system.

πŸ”—https://en.hacks.gr/2023/12/15/the-ultimate-sqlmap-tutorial-master-sql-injection-and-vulnerability-assessment/

Join:🟒@hacker_habeshaπŸ‡ͺπŸ‡Ή
❀2πŸ”₯1πŸ‘1
🟒WEB APPLICATION SECURITY TESTING COURSES

▫️Web Application Security Testing Encoding, Filtering & Evasion Basics (4.36GB)
▫️Web Application Penetration Testing File & Resource Attacks (4.61GB)
▫️Web Application Security Testing Web Service Security Testing (3.37GB)
▫️Web Application Security Testing Testing for Common Attacks (3.23GB)
▫️Web Application Security Testing CMS Security Testing (6.31GB)

πŸ”—https://mega.nz/folder/byp2CIra#Jvj3A1qZCgUFeawGL_3Wxg

Join:🟒@hacker_habeshaπŸ‡ͺπŸ‡Ή
πŸ‘2❀1πŸ₯°1
🟒⚑Automatic Vulnerability Scanning for APIs Using OWASP ZAP (crAPI as an exmaple)

πŸ•΅οΈVulnerability Scanning is the technique with which we will try to find vulnerabilities in the system and/or web application, API, Mobile App, using some sort of an automated scanner to get security misconfigurations.

βš’οΈthere are many vulnerability scanners that are great tools to pentesters. Such as Acunetix, Netsparker, Nessus, Openvas, Burp Suite Professional, etc. But in this article we will be using the free and opensource OWASP ZAP as our Vulnerability Scanner.

βš™οΈAPIs are a bit different than normal Web Applications and sometimes using Automated tools like Nikto won’t show us any good results.

πŸ”—https://en.hacks.gr/2023/12/15/automatic-vulnerability-scanning-for-apis-using-owasp-zap-crapi-as-an-exmaple/

Join:🟒@hacker_habeshaπŸ‡ͺπŸ‡Ή
πŸ‘2❀1🀩1
⛏Virtual Host Enumeration for Uncovering Hidden Subdomains

πŸ“Tools and Techniques for efficient virtual host discovery

πŸ”—https://en.hacks.gr/2023/12/12/virtual-host-enumeration-for-uncovering-hidden-subdomains/

Join:🟒@hacker_habeshaπŸ‡ͺπŸ‡Ή
πŸ‘5❀1πŸ‘1
⚑️Bypass SSL Pinning for Flutter

πŸ“Flutter is an open source framework by Google for building beautiful, natively compiled, multi-platform applications from a single codebase.

When Flutter launched in 2018, it mainly supported mobile app development. Flutter now supports application development on six platforms: iOS, Android, the web, Windows, MacOS, and Linux.

πŸ”—https://en.hacks.gr/2023/12/19/bypass-ssl-pinning-for-flutter/

Join:🟒@hacker_habeshaπŸ‡ͺπŸ‡Ή
πŸ‘4❀1πŸ₯°1
🌍Hackers Search Engines

πŸ“Security researchers, analysts, and others can use hacker-friendly search engines. In the field of security operations, these tools can help in the discovery of vulnerable devices, tracking of threats, planning for spear phishing simulations, and much more.

This list includes special search engines that assist security professionals in finding information on connected devices, private data on individuals (in a more curated manner than traditional search engines offer), breached credentials, and other topics.

πŸ”—https://en.iguru.gr/shodan-pio-epikindyni-michani-anazitisis-ston-kosmo/

JOIN:🟒@hacker_habeshaπŸ‡ͺπŸ‡Ή
πŸ‘5πŸ‘1🀩1
πŸ“±Android Pentesting 101: A Novice’s Handbook to Getting Started

πŸ“Android pentesting is the process of evaluating the security of an Android application by identifying its vulnerabilities and weaknesses. It involves analyzing the application’s source code, binary files, and network traffic to find security flaws. There are mainly 2 parts Static and Dynamic analysis

Static analysis involves examining an application’s code and configuration files without executing it, while dynamic analysis involves testing the application in a running state to observe its behavior and interactions. Both approaches are important for testing the security of an Android application.

πŸ”—https://en.hacks.gr/2023/12/20/android-pentesting-101-a-novices-handbook-to-getting-started/

Join:🟒@hacker_habeshaπŸ‡ͺπŸ‡Ή
πŸ‘3πŸ₯°1
πŸ“šPractical Ethical Hacking from Beginning to Advance!

πŸ“A Complete Free Course: Learn Ethical Hacking From Scratch!

πŸ”—https://drive.google.com/drive/u/0/mobile/folders/1if6MCeBCj8sxWwJIKhtgwU0GBuBW8uLx?s=09&pli=1

Join:🟒@hacker_habeshaπŸ‡ͺπŸ‡Ή
πŸ”₯2πŸ₯°1🀩1
⚠️DLL Hijacking Basics

πŸ“DLL Hijacking is a type cyberattack where a malicious actor takes advantage of a system’s search order for dynamic link libraries (DLL) to load and execute malicious code instead of legitimate libraries. In other words, it refers to tricking a program to load a harmful code library instead of the intended safe one. Before going into details, let’s take a look at DLL Files.

πŸ”—https://en.hacks.gr/2023/12/20/dll-hijacking-basics/

Join:🟒@hacker_habeshaπŸ‡ͺπŸ‡Ή
πŸ₯°3πŸ‘1
πŸ“Captcha Bypass

Join:🟒@hacker_habeshaπŸ‡ͺπŸ‡Ή
πŸ‘3😁1
🩸Exploit Eternal Blue (MS17–010) for Window 7 and higher (custom payload)

πŸ“This article shows you how to exploit the MS17–010 vulnerability on Windows 7 or higher.

πŸ”—https://en.hacks.gr/2023/12/22/exploit-eternal-blue-ms17-010-for-window-7-and-higher-custom-payload/

Join🟒@hacker_habeshaπŸ‡ͺπŸ‡Ή
❀3πŸ₯°1
🟒This year we made a ranking with the most popular tools between January and December 2023.πŸ˜‹



The tools of this year encompass a diverse range of cybersecurity disciplines, including AI-Enhanced Penetration Testing, Advanced Vulnerability Management, Stealth Communication Techniques, Open-Source General Purpose Vulnerability Scanning, and more.πŸ€—


Without going into further details, we have prepared a useful list of the most popular tools in Kitploit 2023:πŸ˜‹

🟒 (https://www.kitploit.com/2022/12/top-20-most-popular-hacking-tools-in.html)

Join:🟒@hacker_habeshaπŸ‡ͺπŸ‡Ή
❀2πŸ”₯1πŸ₯°1
🧰CrackMapexec | SMB & AD Enumeration Simplified!

πŸ“Have you ever found yourself staring at a Windows network, wondering how to find vulnerabilities and security holes? Don’t worry, CrackMapExec is here to save the day! It’s like having a Swiss Army knife for your penetration testing needs.

πŸ”—https://en.hacks.gr/2023/12/15/crackmapexec-smb-ad-enumeration-simplified/

Join:🟒@hacker_habeshaπŸ‡ͺπŸ‡Ή
❀3πŸ‘1
πŸ’£ Buffer Overflow

πŸ“From memory structure and ROP to Linux and Windows 11 real examples.

πŸ”ΉPart 1 https://en.hacks.gr/2023/10/28/buffer-overflow-part-i/

πŸ”ΉPart 2 https://en.hacks.gr/2023/10/29/buffer-overflow-part-ii/

πŸ”ΉPart 3 https://en.hacks.gr/2023/11/08/buffer-overflow-part-iii/

πŸ”ΉPart 4 https://en.hacks.gr/2023/11/09/buffer-overflow-part-iv/


Join: 🟒@hacker_habeshaπŸ‡ͺπŸ‡Ή
πŸ‘3πŸ”₯1
πŸ•ΈοΈCloakQuest3r - Uncover The True IP Address Of Websites Safeguarded By Cloudflare

πŸ“CloakQuest3r is a powerful Python tool meticulously crafted to uncover the true IP address of websites safeguarded by Cloudflare, a widely adopted web security and performance enhancement service.

πŸ“ŒFeatures

πŸ”ΉReal IP Detection: CloakQuest3r excels in the art of discovering the real IP address of web servers employing Cloudflare's services. This crucial information is paramount for conducting comprehensive penetration tests and ensuring the security of web assets.

πŸ”ΉSubdomain Scanning: Subdomain scanning is harnessed as a fundamental component in the process of finding the real IP address. It aids in the identification of the actual server responsible for hosting the website and its associated subdomains.

πŸ”ΉThreaded Scanning: To enhance efficiency and expedite the real IP detection process, CloakQuest3r utilizes threading. This feature enables scanning of a substantial list of subdomains without significantly extending the execution time.

πŸ”ΉDetailed Reporting: The tool provides comprehensive output, including the total number of subdomains scanned, the total number of subdomains found, and the time taken for the scan. Any real IP addresses unveiled during the process are also presented, facilitating in-depth analysis and penetration testing.

πŸ”—https://github.com/spyboy-productions/CloakQuest3r



Join:🟒@hacker_habeshaπŸ‡ͺπŸ‡Ή
❀2πŸ”₯1🀩1
πŸ’‰SQL injection to RCE

πŸ“SQL injection is a type of web application vulnerability that allows an attacker to execute arbitrary SQL commands on a vulnerable web application’s backend database. If the web application is not properly secured, an attacker can leverage a successful SQL injection attack to achieve Remote Code Execution (RCE) on the target server.

πŸ“‹In this blog, we will explore how SQL injection vulnerabilities can be exploited to achieve RCE on a vulnerable server, along with examples of payloads that can be used to exploit these vulnerabilities.

πŸ”—https://en.hacks.gr/2023/12/27/sql-injection-to-rce/

Join:🟒@hacker_habeshaπŸ‡ͺπŸ‡Ή
πŸ‘4😱1
🧡 Complete Cybersecurity Professional Roadmap 🧡


1. Introduction to Ethical Hacking
   - Definition
   - Purpose
   - Types of Hackers
   - Legal and Ethical Considerations

2. Networking Basics
   - TCP/IP
   - OSI Model
   - Subnetting
   - DNS
   - DHCP

3. Operating Systems
   - Linux
   - Windows
   - macOS
   - Command Line Basics

4. Cybersecurity Fundamentals
   - Encryption
   - Firewalls
   - Antivirus
   - IDS/IPS

5. Programming Languages
   - Python
   - Javascript
   - Bash Scripting
   - SQL
   - C/ C++/ Java/ Ruby

6. Scanning and Enumeration
   - Port Scanning
   - Service Enumeration
   - Vulnerability Scanning

7. Exploitation
   - Common Vulnerabilities and Exploits
   - Metasploit Framework
   - Buffer Overflows

8. Web Application Security
   - OWASP Top Ten
   - SQL Injection
   - Cross-Site Scripting (XSS)

9. Wireless Network Hacking
   - Wi-Fi Security
   - WEP, WPA, WPA2
   - Wireless Attacks

10. Social Engineering
    - Phishing
    - Spear Phishing
    - Social Engineering Toolkit (SET)

11. Sniffing and Spoofing
    - Man-in-the-Middle Attacks
    - ARP Spoofing
    - DNS Spoofing

12. Malware Analysis
    - Types of Malware
    - Sandbox Analysis
    - Signature-Based and Behavior-Based Detection

13. Incident Response and Handling
    - Incident Response Process
    - Digital Forensics
    - Chain of Custody

14. Penetration Testing
    - Types of Penetration Testing
    - Methodology
    - Reporting

15. Cryptography
    - Symmetric and Asymmetric Encryption
    - Hashing Algorithms
    - Digital Signatures

16. Mobile Hacking
    - Android and iOS Security
    - Mobile Application Security

17. Cloud Security
    - AWS, Azure, Google Cloud
    - Security Best Practices

18. IoT Security
    - Internet of Things Risks
    - Securing IoT Devices

19. Legal and Compliance
    - Computer Fraud and Abuse Act (CFAA)
    - GDPR, HIPAA, PCI DSS

20. Cybersecurity Tools
    - Nmap, Wireshark, Burp Suite
    - Snort, Nessus, Aircrack-ng

21. Career Path and Certifications
    - Certified Ethical Hacker (CEH)
    - Offensive Security Certified Professional (OSCP)
    - CISSP, CompTIA Security+

Join:🟒@hacker_habeshaπŸ‡ͺπŸ‡Ή
πŸ‘4πŸ‘1
FREE 45-Day Cybersecurity Internship

πŸ›‘ Program Highlights:
πŸ‘‰ Duration: 45 days of immersive learning and hands-on experience.
πŸ‘‰Focus: Dive deep into cybersecurity fundamentals and real-world applications.
πŸ‘‰Interactive Sessions: Engage in live sessions, workshops, and practical exercises.
πŸ‘‰Expert Guidance: Learn from industry professionals passionate about sharing their knowledge.
πŸ‘‰Certification: Receive a certificate upon successful completion.


This internship is an incredible opportunity to explore the dynamic field of cybersecurity, and it's completely FREE! Secure your spot now and kickstart your cybersecurity journey with SenseLearner.

πŸ”— Limited spots available! Apply now at https://forms.gle/KagLYtyiVjF8NZ5K8


#Cybersecurity #InternshipOpportunity #Senselearner #CyberSecurityInternship #InfoSec #LearnSecurity
❀3πŸ‘1πŸ₯°1
⚑️Exploiting XSS using Polyglot JPEGs+Javascript to bypass CSP

πŸ“This vulnerability allows an attacker to use a JPEG polyglot with JavaScript to hide the malicious JavaScript payload in the image successfully without corrupting the image to bypass the site’s CSP. For this exploit you will need two parameters, one to call the malicious image and the other one to upload it.

πŸ”—https://en.hacks.gr/2023/12/27/exploiting-xss-using-polyglot-jpegsjavascript-to-bypass-csp/

🟒@hacker_habeshaπŸ‡ͺπŸ‡Ή
πŸ‘3πŸ₯°1
🏹Exploiting FTP

πŸ“FTP (File Transfer Protocol) is a service or so-called protocol for transferring files between computers via the Transmission Control Protocol / Internet Protocol (TCP / IP). It is considered as an Application Layer Protocol.

πŸ”—https://en.hacks.gr/2023/12/27/exploiting-ftp/

Join:🟒@hacker_habeshaπŸ‡ͺπŸ‡Ή
πŸ‘5πŸ₯°1
☣️ Free Labs to Train Your Pentest / CTF Skills ☣️

πŸ”Έ Academy Hackaflag -BR https://academy.hackaflag.com.br

πŸ”Έ Try Hack Me https://tryhackme.com

πŸ”Έ Attack-Defense https://attackdefense.com

πŸ”Έ alert to win https://alf.nu/alert1

πŸ”Έ CTF Komodo Security https://ctf.komodosec.com

πŸ”Έ CMD Challenge https://cmdchallenge.com

πŸ”Έ Explotation Education https://exploit.education

πŸ”Έ Google CTF https://capturetheflag.withgoogle.com

πŸ”Έ HackTheBox https://www.hackthebox.eu

πŸ”Έ Hackthis https://www.hackthis.co.uk

πŸ”Έ Hacksplaining https://www.hacksplaining.com/exercises

πŸ”Έ Hacker101 https://ctf.hacker101.com

πŸ”Έ Hacker Security https://capturetheflag.com.br

πŸ”Έ Hacking-Lab https://www.hacking-lab.com/index.html

πŸ”Έ HSTRIKE https://hstrike.com

πŸ”Έ ImmersiveLabs https://immersivelabs.com

πŸ”Έ Labs Wizard Security https://labs.wizard-security.net

πŸ”Έ NewbieContest https://www.newbiecontest.org

πŸ”Έ OverTheWire http://overthewire.org

πŸ”Έ Practical Pentest Labs https://practicalpentestlabs.com

πŸ”Έ Pentestlab https://pentesterlab.com

πŸ”Έ Penetration Testing Practice Labs http://www.amanhardikar.com/mindmaps/Practice.html

πŸ”Έ PentestIT LAB https://lab.pentestit.ru

πŸ”Έ PicoCTF https://picoctf.com

πŸ”Έ PWNABLE https://pwnable.kr/play.php

πŸ”Έ Root-Me https://www.root-me.org

πŸ”Έ Root in Jail http://ctf.rootinjail.com

πŸ”Έ Shellter https://shellterlabs.com/pt

πŸ”Έ SANS Challenger https://www.holidayhackchallenge.com

πŸ”Έ SmashTheStack http://smashthestack.org/wargames.html

πŸ”Έ Try Hack Me https://tryhackme.com

πŸ”Έ The Cryptopals Crypto Challenges https://cryptopals.com

πŸ”Έ Vulnhub https://www.vulnhub.com

πŸ”Έ W3Challs https://w3challs.com

πŸ”Έ WeChall http://www.wechall.net

πŸ”Έ Zenk-Security https://www.zenk-security.com/epreuves.php


Join🟒@hacker_habeshaπŸ‡ͺπŸ‡Ή
πŸ‘3πŸ‘Œ1