hacking: security in practice
SQL Injection into a MySQL update query

I have a web app that has a vulnerability that allows sql injection into an update query.

So for example, I have

UPDATE user SET name=$newname WHERE id=999;

I can control the $newname variable.

The server doesn’t allow concatenation of a 2nd query, so I somehow need to embed a query where $newname is.

Any ideas?

submitted by /u/IrskoCzeska
[link] [comments]

hacking: security in practice
Problems ending lanschool process tree with process explorer.

So in my school we have lanschool and I want to disable it. Command prompt is disabled aswell as registry editing, and power options. I tried installing process explorer(v17.04) and I tried running it with the Ethernet plug disabled, but when I ran process explorer and tried ending the student.exe process tree it said access denied. Anyway to bypass this? Is there perhaps a third party process explorer that doesn’t require admin to install? Thanks.

submitted by /u/Hungry_Story
[link] [comments]

hacking: security in practice
What would you ask a Cybercrime Prosecutor?

I'm making a documentary about cybersecurity and hackers, white hat ones and black hat ones, for my school. And I was asked to make questions that would be useful to ask a cybercrime prosecutor, as if I were, hypothetically, going to interview one.

What do you think that person could contribute? What could I ask them?

submitted by /u/Thomasitos
[link] [comments]

hacking: security in practice
US: China-funded hackers attack critical infrastructure - Discover Politics

https://external-preview.redd.it/leFrUxFyb5x1X7JLgJ_X_gsT81RobJbYn0jDu7CDRkE.jpg?width=216&crop=smart&auto=webp&s=2d0b86811bbb9fe9a06e7e92437fa9106fdb0132 submitted by /u/v4r4d3r0
[link] [comments]

hacking: security in practice
Admin Access on work laptop.

Hey all!

I work as a receptionist and spend all day on this laptop, yet work is never busy, so I have nothing to do. The laptop has most of it's features locked unless you have admin access.

I'd like to find a way to give my account admin access.

The laptop is on a domain network for the company so logging into user accounts seems a little more complicated and protected; any advice?

submitted by /u/SW3910
[link] [comments]

Hacking on Medium
Hack Snapchat Account: Unveiling the Truth

Introduction

Continue reading on Medium »

Hacking on Medium
Overview of Mobile Game Hacking

https://cdn-images-1.medium.com/max/900/1*78IZza3Jn1WPtpC8PJHOlw.jpeg
If you are interested in learning about how users hack Android apps, the tools they employ, and the possibilities they can explore, you’ve…

Continue reading on Medium »

Hacking on Medium
Termux is the Ultimate Tool for Hacking

https://cdn-images-1.medium.com/max/640/0*a3dgc9tXPj2ejpkl.png
Termux is a powerful terminal emulator and Linux environment app that has gained popularity among hackers and cybersecurity enthusiasts.

Continue reading on Medium »

Hacking on Medium
Price Manipulation Vulnerability: Potential Exploitation in Dating Website

https://cdn-images-1.medium.com/max/600/0*MW371HWSEMrT_3hu.png
Parameter Tempering !!

Continue reading on Medium »

Hacking on Medium
Unmasking O.MG Elite Cables: Safeguarding Your Data in a Connected World

https://cdn-images-1.medium.com/max/1200/0*41MzQEBuOhmOf6wB
Introduction: In our digital world, it’s essential to be aware of potential risks and take steps to protect our personal information. One…

Continue reading on Medium »

Hacking on Medium
Cyber Shadows: Unravelling the Rs 13 Lakh Cyber Attack on Pune’s Leading Construction Tech Firm

https://cdn-images-1.medium.com/max/2600/0*D6UVVo1fFw2chB8I
Email Hacking: An Inside Look into the New Age of Online Scams

Continue reading on Medium »

rebindMultiA - Tool To Perform a Multiple A Record Rebind Attack
http://www.kitploit.com/2023/05/rebindmultia-tool-to-perform-multiple.html

rebindMultiA is a tool to perform a Multiple A Record rebind attack. rebindmultia.com is a domain that I've set up to assist with these attacks. It makes every IP its own authoritative nameserver (https://www.kitploit.com/search/label/Nameserver) for the domain [IP].ns.rebindmultia.com. For example, 13.33.33.37.ns.rebindmultia.com's authoritative nameserver is 13.33.33.37.ip.rebindmultia.com which resolves (as you might have guessed) to 13.33.33.37.
Multiple A Record Rebind Attack The MultiA Record Rebind attack is a variant of DNS Rebinding that weaponizes an attacker's ability to respond with two IP address in response to a DNS request and the browser's tendency to fallback to the second IP in the DNS response when the first one doesn't respond. In this attack, the attacker will configure a malicious DNS server and two malicious HTTP servers. The DNS server will respond with two A records: 127.0.0.1.target.13.33.33.37.ns.rebindmultia.com. 0 IN A 13.33.33.37
127.0.0.1.target.13.33.33.37.ns.rebindmultia.com. 0 IN A 127.0.0.1
The victim browser will then connect to the first IP and begin interacting with the attacker's first malicious HTTP server. This server will respond with a page that contains two iframes, one to /steal and one to /rebind. The /steal iframe will load up a malicious page to reach into the second iframe and grab the content. The /rebind endpoint, when hit, will issue a 302 redirect to / and kill the first malicious HTTP server. As a result, when the browser reaches back out to the attacker's HTTP server, it will be met with a closed port. As such, it will fallback to the second IP. Once the target content has been loaded in the second iframe, the first iframe can reach into it, steal the data, and exfiltrate it to the attacker's second malicious HTTP server - the callback server. This attack only works in a Windows (https://www.kitploit.com/search/label/Windows) environment. Linux (https://www.kitploit.com/search/label/Linux) and Mac will default to the private IP first and the attacker's server will never be queried. Graphic + Explaination