Dark Reading: Attacks/Breaches
Patch Now: Cisco AnyConnect Bug Exploit Released in the Wild

A ready-made, low-complexity path to pwning the popular enterprise VPN clients for remote workers is now circulating in the wild.

Dark Reading: Attacks/Breaches
6 Attack Surfaces You Must Protect

More connectivity means more potential ways into your enterprise, so securing every main attack surface is imperative.

Dark Reading: Attacks/Breaches
USB Drives Spread Spyware as China's Mustang Panda APT Goes Global

Camaro Dragon (Mustang Panda) is spreading a malware variant of WispRider quickly across the globe even through air gaps, often unbeknown to users.

Dark Reading: Attacks/Breaches
Lessons From a Pen Tester: 3 Steps to Stay Safer

From hardening Windows systems to adding access control and segmenting the network, there are steps organizations can take to better secure corporate data.

Dark Reading: Attacks/Breaches
2 More Apple Zero-Days Exploited in Ongoing iOS Spy Campaign

The zero-day security bugs are being used to deploy the sophisticated but "odd" TriangleDB spying implant on targeted iOS devices.

Kali Linux Tutorials
Scriptkiddi3 – Streamline Your Recon And Vulnerability Detection Process With SCRIPTKIDDI3, A Recon And Initial Vulnerability Detection Tool Built Using Shell Script And Open Source Tools

SCRIPTKIDDI3,Streamline your recon and vulnerability detection process with SCRIPTKIDDI3, A recon and initial vulnerability detection tool built using shell script and open source tools.

Introducing SCRIPTKIDDI3, a powerful recon and initial vulnerability detection tool for Bug Bounty Hunters. Built using a variety of open-source tools and a shell script, SCRIPTKIDDI3 allows you to quickly and efficiently run a scan on the target domain and identify potential vulnerabilities.

SCRIPTKIDDI3 begins by performing recon on the target system, collecting information such as subdomains, and running services with nuclei. It then uses this information to scan for known vulnerabilities and potential attack vectors, alerting you to any high-risk issues that may need to be addressed.

In addition, SCRIPTKIDDI3 also includes features for identifying misconfigurations and insecure default settings with nuclei templates, helping you ensure that your systems are properly configured and secure.

SCRIPTKIDDI3 is an essential tool for conducting thorough and effective recon and vulnerability assessments. Let’s Find Bugs with SCRIPTKIDDI3

[Thanks ChatGPT for the Description] How it Works ?This tool mainly performs 3 tasks

1. Effective Subdomain Enumeration from Various Tools
2. Get URLs with open HTTP and HTTPS service.
3. Run a Nuclei and other scans on previous output So basically, this is an autmation script for your initial recon in bugbounty Install SCRIPTKIDDI3SCRIPTKIDDI3 requires different tools to run successfully. Run the following command to install the latest version with all requirments-
git clone https://github.com/thecyberneh/scriptkiddi3.git
cd scriptkiddi3
bash installer.sh Usagescriptkiddi3 -h
This will display help for the tool. Here are all the switches it supports.
[ABOUT:]
Streamline your recon and vulnerability detection process with SCRIPTKIDDI3,
A recon and initial vulnerability detection tool built using shell script and open source tools.


[Usage:]
scriptkiddi3 [MODE] [FLAGS]
scriptkiddi3 -m EXP -d target.com -c /path/to/config.yaml


[MODES:]
['-m'/'--mode']
Available Options for MODE:
SUB | sub | SUBDOMAIN | subdomain Run scriptkiddi3 in SUBDOMAIN ENUMERATION mode
URL | url Run scriptkiddi3 in URL ENUMERATION mode
EXP | exp | EXPLOIT | exploit Run scriptkiddi3 in Full Exploitation mode


Feature of EXPLOI mode : subdomain enumaration, URL Enumeration,
Vulnerability Detection with Nuclei,
and Scan for SUBDOMAINE TAKEOVER

[FLAGS:]
[TARGET:] -d, --domain target domain to scan

[CONFIG:] -c, --config path of your configuration file for subfinder

[HELP:] -h, --help to get help menu

[UPDATE:] -u, --update to update tool

[Examples:]
Run scriptkiddi3 in full Exploitation mode
scriptkiddi3 -m EXP -d target.com


Use your own CONFIG file for subfinder
scriptkiddi3 -m EXP -d target.com -c /path/to/config.yaml


Run scriptkiddi3 in SUBDOMAIN ENUMERATION mode
scriptkiddi3 -m SUB -d target.com


Run scriptkiddi3 in URL ENUMERATION mode
scriptkiddi3 -m SUB -d target.com MODES1. FULL EXPLOITATION MODERun SCRIPTKIDDI3 in FULL EXPLOITATION MODE
scriptkiddi3 -m EXP -d target.com
FULL EXPLOITATION MODE contains following functions

* Effective Subdomain Enumeration with different services and open source tools
* Effective URL Enumeration ( HTTP and HTTPs service )
* R[...]

un Vulnerability Detection with Nuclei
* Subdomain Takeover Test on previous results 2. SUBDOMAIN ENUMERATION MODERun scriptkiddi3 in SUBDOMAIN ENUMERATION MODE
scriptkiddi3 -m SUB -d target.com
SUBDOMAIN ENUMERATION MODE contains following functions

* Effective Subdomain Enumeration with different services and open source tools
* You can use this mode if you only want to get subdomains from this tool or we can say Automation of Subdmain Enumeration by different tools 3. URL ENUMERATION MODERun scriptkiddi3 in URL ENUMERATION MODE
scriptkiddi3 -m URL -d target.com
URL ENUMERATION MODE contains following functions

* Same Feature as SUBDOMAIN ENUMERATION MODE but also identifies HTTP or HTTPS service

Using your own CONFIG File for subfinder
scriptkiddi3 -m EXP -d target.com -c /path/to/config.yaml
You can also provie your own CONDIF file with your API Keys for subdomain enumeration with subfinder

Updating tool to latest version You can run following command to update tool
scriptkiddi3 -u
An Example of config.yaml
binaryedge:
- 0bf8919b-aab9-42e4-9574-d3b639324597
- ac244e2f-b635-4581-878a-33f4e79a2c13
censys:
- ac244e2f-b635-4581-878a-33f4e79a2c13:dd510d6e-1b6e-4655-83f6-f347b363def9
certspotter: []
passivetotal:
- sample-email@user.com:sample_password
securitytrails: []
shodan:
- AAAAClP1bJJSRMEYJazgwhJKrggRwKA
github:
- ghp_lkyJGU3jv1xmwk4SDXavrLDJ4dl2pSJMzj4X
- ghp_gkUuhkIYdQPj13ifH4KA3cXRn8JD2lqir2d4
zoomeye:
- zoomeye_username:zoomeye_password For DevelopersIf you have ideas for new functionality or modes that you would like to see in this tool, you can always submit a pull request (PR) to contribute your changes.

If you have any other queries, you can always contact me on Twitter(thecyberneh) CreditsI would like to express my gratitude to all of the open source projects that have made this tool possible and have made recon tasks easier to accomplish. Click Here To Download
Please consider following and supporting us to stay updated with the latest info

Deep Web
Serious help needed

I need a genuine service if someone to find details about this Snapchat account that is blackmailing me saying they’ll post explicit photos of me. They are from around my area after sending photo proof and they know who I am in real life. I need help pls

submitted by /u/Mother_Discipline_30
[link] [comments]

hacking: security in practice
June Prompt# Zine

Not sure this is the right sub but wanted to see if anyone has started/completed the Prompt# Zine secret code? I have the first name and I believe I know who is sitting where. I'm at a loss on where to find the names/numbers. I don't want the answers, just tips on where to look with the 3-D glasses.

submitted by /u/youreeeka
[link] [comments]

hacking: security in practice
IoT devices and Linux-based systems targeted by OpenSSH trojan campaign

https://external-preview.redd.it/uwhetN7VVTVZhPhi7BzwYcVMIJfnc-aRJVhy9LjyatI.jpg?width=640&crop=smart&auto=webp&s=4d219bcbc6d040ceec4b471e1dcdcf92d3f749ca submitted by /u/SCI_Rusher
[link] [comments]

hacking: security in practice
certifications for first job at pt

from your own perspective what is better

cpts+crtp and maybe another cert vs oscp alone

i know that doing just one cert is more convenient but i just dont feel i can pass oscp right now

i think from logic perspective if i have 2-3 certs on my cv i will get interviews but what you all think?

thanks

submitted by /u/General_Roof9555
[link] [comments]

hacking: security in practice
Is there such thing as rubber ducky USB or even LAN2USB device for Routers?

Something that executes automatically commands/payloads once it is plugged in, just like it works for PCs and phones.

submitted by /u/Sascha_Wohler
[link] [comments]

Hacking on Medium
CVE 2022–33082 Practical Exploitation

https://cdn-images-1.medium.com/max/640/1*CX4iXfhXJtv3C-yiiApriA.jpeg
I have developed the first known practical exploit for CVE 2022–33082, “an issue in the AST parser (ast/compile.go) of Open Policy Agent…

Continue reading on Medium »