Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
AFP Secret Files Leak 2022
https://cdn-images-1.medium.com/max/1080/0*uXJt9Cwo4TYMND5q.jpg
Intelligence Document Leak
Continue reading on Medium »
AFP Secret Files Leak 2022
https://cdn-images-1.medium.com/max/1080/0*uXJt9Cwo4TYMND5q.jpg
Intelligence Document Leak
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Common Password Attacks
https://cdn-images-1.medium.com/max/768/1*Aeqc-f3a2HA5pdet8l-lgQ.jpeg
Password is a secret key to authorize or authenticate a user. With the help of username and password, users can confirm their identity and…
Continue reading on Medium »
Common Password Attacks
https://cdn-images-1.medium.com/max/768/1*Aeqc-f3a2HA5pdet8l-lgQ.jpeg
Password is a secret key to authorize or authenticate a user. With the help of username and password, users can confirm their identity and…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Afrog explained for bug bounty hunters
https://cdn-images-1.medium.com/max/2600/1*Do_X44a6TDNvoa8lcJN5rg.jpeg
When working as a pentester or bug hunter it is normal to want to automate some of our work.
Continue reading on Medium »
Afrog explained for bug bounty hunters
https://cdn-images-1.medium.com/max/2600/1*Do_X44a6TDNvoa8lcJN5rg.jpeg
When working as a pentester or bug hunter it is normal to want to automate some of our work.
Continue reading on Medium »
https://b.thumbs.redditmedia.com/wetf8mYhcfePnLCnJmWq2gqkFWpJkrPrx8aCM7vdCck.jpg Hello,
First, sorry if I sound very ignorant. I'm a former Python dev just getting into hacking with an interest in pentesting. I'm currently studying for the A+ certification and I'm planning to go all the way to CEH.
Now, my "error".
Okay, so, to challenge myself I've decided to try on a popular CTF : Mr.Robot (which I found on vulnhub).
I'm at the part where I'm trying a brute force attack to find the user Elliot's wordpress password from a dictionary (which does contain the correct password).
On my terminal, I type the following command :
hydra -l Elliot -P fsocity.dic 10.35.1.11 http-post-form "/wp-login.php:log=\USER^&pwd=^PSWD^:The password you entered for the username Elliot is incorrect." -t 30)
The correct password is supposed to be ER28-0652. But hydra returns a lot of false positives, and no sign of the correct password. (check the attached screenshot to see the terminal)
What am I doing wrong? How could I fix the issue?
Again, sorry for sounding ignorant (I am).
Thank you!
Hydra returns false positives when trying to brute force a wordpress's password on a vulnerable server.
submitted by /u/No-Nail-7227
[link] [comments]
First, sorry if I sound very ignorant. I'm a former Python dev just getting into hacking with an interest in pentesting. I'm currently studying for the A+ certification and I'm planning to go all the way to CEH.
Now, my "error".
Okay, so, to challenge myself I've decided to try on a popular CTF : Mr.Robot (which I found on vulnhub).
I'm at the part where I'm trying a brute force attack to find the user Elliot's wordpress password from a dictionary (which does contain the correct password).
On my terminal, I type the following command :
hydra -l Elliot -P fsocity.dic 10.35.1.11 http-post-form "/wp-login.php:log=\USER^&pwd=^PSWD^:The password you entered for the username Elliot is incorrect." -t 30)
The correct password is supposed to be ER28-0652. But hydra returns a lot of false positives, and no sign of the correct password. (check the attached screenshot to see the terminal)
What am I doing wrong? How could I fix the issue?
Again, sorry for sounding ignorant (I am).
Thank you!
Hydra returns false positives when trying to brute force a wordpress's password on a vulnerable server.
submitted by /u/No-Nail-7227
[link] [comments]
Hacking Articles Tips Tricks Videos Tutorials
Photo
Minalic 2.0.0 Buffer Overflow Exploit
https://www.reddit.com/r/Pentesting/comments/13s2tax/minalic_200_buffer_overflow_exploit/
<!-- SC_OFF -->It's a bit of an obscure one, but has anyone here had any success exploiting the buffer overflow vulnerability in Minalic 2.0.0? I'm following all the online guides, recieving the same offsets as the exploit requires, but the value defined in the Host header isn't being read into the EBX register which is essential for the program to work. I'm using this exploit from Exploit-DB: https://www.exploit-db.com/exploits/24958 Any help would be much appreciated, and please let me know if this is the wrong subreddit for this type of post. Thanks! <!-- SC_ON --> submitted by /u/Manu1299 (https://www.reddit.com/user/Manu1299)
[link] (https://www.reddit.com/r/Pentesting/comments/13s2tax/minalic_200_buffer_overflow_exploit/) [comments] (https://www.reddit.com/r/Pentesting/comments/13s2tax/minalic_200_buffer_overflow_exploit/)
https://www.reddit.com/r/Pentesting/comments/13s2tax/minalic_200_buffer_overflow_exploit/
<!-- SC_OFF -->It's a bit of an obscure one, but has anyone here had any success exploiting the buffer overflow vulnerability in Minalic 2.0.0? I'm following all the online guides, recieving the same offsets as the exploit requires, but the value defined in the Host header isn't being read into the EBX register which is essential for the program to work. I'm using this exploit from Exploit-DB: https://www.exploit-db.com/exploits/24958 Any help would be much appreciated, and please let me know if this is the wrong subreddit for this type of post. Thanks! <!-- SC_ON --> submitted by /u/Manu1299 (https://www.reddit.com/user/Manu1299)
[link] (https://www.reddit.com/r/Pentesting/comments/13s2tax/minalic_200_buffer_overflow_exploit/) [comments] (https://www.reddit.com/r/Pentesting/comments/13s2tax/minalic_200_buffer_overflow_exploit/)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
[HTB] Cronos靶機 Write-Up
https://cdn-images-1.medium.com/max/775/1*vlldBUN06Xml7JOp5AYlIQ.png
Hack The Box Cronos machine Write-Up
Continue reading on Medium »
[HTB] Cronos靶機 Write-Up
https://cdn-images-1.medium.com/max/775/1*vlldBUN06Xml7JOp5AYlIQ.png
Hack The Box Cronos machine Write-Up
Continue reading on Medium »
Need help with finding crossdomain.xml and another question
https://www.reddit.com/r/Pentesting/comments/13s5y4x/need_help_with_finding_crossdomainxml_and_another/
<!-- SC_OFF -->Hey, I'm currently doing an internship on cybersecurity, and need to conduct some PEN-tests.
One of them is to test the RIA cross domain policy, but I'm having trouble finding the file. I've tried a few ways of navigating to the file, but I always get a 404 error. Does this mean that the site doesn't have a crossdomain.xml or clientaccesspolicy.xml file? I have also done a check on their HTTP headers, and found out they use Feature-Policy, which if I understand correctly is outdated and should be replaced with Permissions-Policy? Many thanks for the help! <!-- SC_ON --> submitted by /u/Hot-Boulder (https://www.reddit.com/user/Hot-Boulder)
[link] (https://www.reddit.com/r/Pentesting/comments/13s5y4x/need_help_with_finding_crossdomainxml_and_another/) [comments] (https://www.reddit.com/r/Pentesting/comments/13s5y4x/need_help_with_finding_crossdomainxml_and_another/)
https://www.reddit.com/r/Pentesting/comments/13s5y4x/need_help_with_finding_crossdomainxml_and_another/
<!-- SC_OFF -->Hey, I'm currently doing an internship on cybersecurity, and need to conduct some PEN-tests.
One of them is to test the RIA cross domain policy, but I'm having trouble finding the file. I've tried a few ways of navigating to the file, but I always get a 404 error. Does this mean that the site doesn't have a crossdomain.xml or clientaccesspolicy.xml file? I have also done a check on their HTTP headers, and found out they use Feature-Policy, which if I understand correctly is outdated and should be replaced with Permissions-Policy? Many thanks for the help! <!-- SC_ON --> submitted by /u/Hot-Boulder (https://www.reddit.com/user/Hot-Boulder)
[link] (https://www.reddit.com/r/Pentesting/comments/13s5y4x/need_help_with_finding_crossdomainxml_and_another/) [comments] (https://www.reddit.com/r/Pentesting/comments/13s5y4x/need_help_with_finding_crossdomainxml_and_another/)