Hello everyone, in our latest penetration testing, our customer has a mobile application with 2FA implementation. I will explain how I…Continue reading on Medium » (https://medium.com/@yagizkocer/a-trivial-otp-bypass-based-on-business-logic-abuse-1513872716b0?source=rss------bug_bounty-5)
Chat GPT For Bug Bounty: Recon, Generate wordlist, Nuclei Template, Convert p3 or p4 in P2 or P1 ✨
https://medium.com/@qaafqasim/chat-gpt-for-bug-bounty-recon-generate-wordlist-nuclei-template-convert-p3-or-p4-in-p2-or-p1-8d35524b1d76?source=rss------bug_bounty-5
https://medium.com/@qaafqasim/chat-gpt-for-bug-bounty-recon-generate-wordlist-nuclei-template-convert-p3-or-p4-in-p2-or-p1-8d35524b1d76?source=rss------bug_bounty-5
Empowering Bug Bounty Hunters with Chat GPT Prompts and Dynamic OutputsContinue reading on Medium » (https://medium.com/@qaafqasim/chat-gpt-for-bug-bounty-recon-generate-wordlist-nuclei-template-convert-p3-or-p4-in-p2-or-p1-8d35524b1d76?source=rss------bug_bounty-5)
Chat GPT For Bug Bounty: Recon, Generate wordlist, Nuclei Template, Convert p3 or p4 in P2 or P1 ✨
Empowering Bug Bounty Hunters with Chat GPT Prompts and Dynamic OutputsContinue reading on Medium »
Read more...
Empowering Bug Bounty Hunters with Chat GPT Prompts and Dynamic OutputsContinue reading on Medium »
Read more...
Medium
Chat GPT For Bug Bounty: Recon, Generate wordlist, Nuclei Template, Convert p3 or p4 in P2 or P1 ✨
Empowering Bug Bounty Hunters with Chat GPT Prompts and Dynamic Outputs
Identifying devices on a wireless network (externally)
https://www.reddit.com/r/redteamsec/comments/14t685d/identifying_devices_on_a_wireless_network/
<!-- SC_OFF -->Hi all, Been messing around with my personal lab recently which includes a cheap NUC (Win OS) & old Android phone connected to a mobile router. I've been trying to look at the network externally and get information which i can then take back to harden my actual home network and any IoT connected. Using Kali & and an Alfa card I've successfully managed to find the network (wifite/airmon/airodump) then focused on it whereby i can also pick up any devices trying to connect whereby I've then grabbed a handshake (.pcap file) to mess around with. My question though is... could i use something like nmap or similar to analyse the network and find these devices connected or access the ARP table to locate historic devices connected potentially or those regularly used? along with finding out whether these are updated (running latest OS/firmware etc?) Or are you only able to scan in this way once within the network locally? Any guidance is much appreciated. I'm quite new to this so still very much learning and taking notes as i go. <!-- SC_ON --> submitted by /u/johnnyfatwods (https://www.reddit.com/user/johnnyfatwods)
[link] (https://www.reddit.com/r/redteamsec/comments/14t685d/identifying_devices_on_a_wireless_network/) [comments] (https://www.reddit.com/r/redteamsec/comments/14t685d/identifying_devices_on_a_wireless_network/)
https://www.reddit.com/r/redteamsec/comments/14t685d/identifying_devices_on_a_wireless_network/
<!-- SC_OFF -->Hi all, Been messing around with my personal lab recently which includes a cheap NUC (Win OS) & old Android phone connected to a mobile router. I've been trying to look at the network externally and get information which i can then take back to harden my actual home network and any IoT connected. Using Kali & and an Alfa card I've successfully managed to find the network (wifite/airmon/airodump) then focused on it whereby i can also pick up any devices trying to connect whereby I've then grabbed a handshake (.pcap file) to mess around with. My question though is... could i use something like nmap or similar to analyse the network and find these devices connected or access the ARP table to locate historic devices connected potentially or those regularly used? along with finding out whether these are updated (running latest OS/firmware etc?) Or are you only able to scan in this way once within the network locally? Any guidance is much appreciated. I'm quite new to this so still very much learning and taking notes as i go. <!-- SC_ON --> submitted by /u/johnnyfatwods (https://www.reddit.com/user/johnnyfatwods)
[link] (https://www.reddit.com/r/redteamsec/comments/14t685d/identifying_devices_on_a_wireless_network/) [comments] (https://www.reddit.com/r/redteamsec/comments/14t685d/identifying_devices_on_a_wireless_network/)
Badsecrets - A Library For Detecting Known Secrets Across Many Web Frameworks
http://www.kitploit.com/2023/07/badsecrets-library-for-detecting-known.html
http://www.kitploit.com/2023/07/badsecrets-library-for-detecting-known.html
Current Modules Name Description ASPNET_Viewstate Checks the viewstate/generator against a list of known machine keys. Telerik_HashKey Checks patched (2017+) versions of Telerik UI for a known Telerik.Upload.ConfigurationHashKey Telerik_EncryptionKey Checks patched (2017+) versions of Telerik UI for a known Telerik.Web.UI.DialogParametersEncryptionKey Flask_SignedCookies Checks for weak Flask cookie signing password. Wrapper for flask-unsign (https://github.com/Paradoxis/Flask-Unsign) Peoplesoft_PSToken Can check a peoplesoft PS_TOKEN for a bad/weak signing password Django_SignedCookies Checks django's session cookies (when in signed_cookie mode) for known django secret_key Rails_SecretKeyBase Checks Ruby on Rails (https://www.kitploit.com/search/label/Ruby%20on%20Rails) signed or encrypted session cookies (from multiple major releases) for known secret_key_base Generic_JWT Checks JWTs for known HMAC secrets or RSA private keys Jsf_viewstate Checks Both Mojarra and Myfaces implimentations of Java Server Faces (JSF) for use of known or weak secret keys Symfony_SignedURL Checks symfony "_fragment" urls for known HMAC key. Operates on Full URL, including hash Express_SignedCookies Checks express.js signed cookies and session cookies for known 'session secret' Laravel_SignedCookies Checks 'laravel_session' cookies for known laravel 'APP_KEY' Installation We have a pypi (https://pypi.org/project/badsecrets/) package, so you can just do pip install badsecrets to make use of the library. Simple Usage The absolute easiest way to use Badsecrets is by simply running badsecrets after doing a pip install: pip install badsecrets
badsecrets eyJhbGciOiJIUzI1NiJ9.eyJJc3N1ZXIiOiJJc3N1ZXIiLCJVc2VybmFtZSI6IkJhZFNlY3JldHMiLCJleHAiOjE1OTMxMzM0ODMsImlhdCI6MTQ2NjkwMzA4M30.ovqRikAo_0kKJ0GVrAwQlezymxrLGjcEiW_s3UJMMCo
This is doing the same thing as the cli.py example shown below. Examples To use the examples, after doing the pip install just git clone the repo and cd into the badsecrets directory: git clone https://github.com/blacklanternsecurity/badsecrets.git
cd badsecrets
The commands in the example section below assume you are in this directory. If you are using the Badsecrets BBOT (https://github.com/blacklanternsecurity/bbot) module, you don't need to do anything else - BBOT will install the package for you. cli.py Bad secrets includes an example CLI (https://github.com/blacklanternsecurity/badsecrets/blob/dev/examples/cli.py) for convenience when manually checking secrets. It also has a URL mode, which will connect to a target and attempt to carve for cryptographic products and check any it finds against all modules. Basic usage - checking a crytographic product for a known secret (against all modules): python ./badsecrets/examples/cli.py eyJhbGciOiJIUzI1NiJ9.eyJJc3N1ZXIiOiJJc3N1ZXIiLCJVc2VybmFtZSI6IkJhZFNlY3JldHMiLCJleHAiOjE1OTMxMzM0ODMsImlhdCI6MTQ2NjkwMzA4M30.ovqRikAo_0kKJ0GVrAwQlezymxrLGjcEiW_s3UJMMCo URL Mode - Connecting to a target and carving for a cryptographic product, and if found checking it for known secrets (against all modules): python ./badsecrets/examples/cli.py --url http://example.com/contains_bad_secret.html You can also set a custom user-agent with --user-agent "user-agent string" or a proxy with --proxy http://127.0.0.1 in this mode. Example output: command line interface *********************** Known Secret Found! Detecting Module: Generic_JWT Secret: 1234 Details: {'Issuer': 'Issuer', 'Username': 'BadSecrets', 'exp': 1593133483, 'iat': 1466903083, 'jwt_headers': {'alg': 'HS256'}} ***********************" dir="auto">$ python ./badsecrets/examples/cli.py eyJhbGciOiJIUzI1NiJ9.eyJJc3N1ZXIiOiJJc3N1ZXIiLCJVc2VybmFtZSI6IkJhZFNlY3JldHMiLCJleHAiOjE1OTMxMzM0ODMsImlhdCI6MTQ2NjkwMzA4M30.ovqRikAo_0kKJ0GVrAwQlezymxrLGjcEiW_s3UJMMCo
badsecrets - example command line interface
***********************
badsecrets eyJhbGciOiJIUzI1NiJ9.eyJJc3N1ZXIiOiJJc3N1ZXIiLCJVc2VybmFtZSI6IkJhZFNlY3JldHMiLCJleHAiOjE1OTMxMzM0ODMsImlhdCI6MTQ2NjkwMzA4M30.ovqRikAo_0kKJ0GVrAwQlezymxrLGjcEiW_s3UJMMCo
This is doing the same thing as the cli.py example shown below. Examples To use the examples, after doing the pip install just git clone the repo and cd into the badsecrets directory: git clone https://github.com/blacklanternsecurity/badsecrets.git
cd badsecrets
The commands in the example section below assume you are in this directory. If you are using the Badsecrets BBOT (https://github.com/blacklanternsecurity/bbot) module, you don't need to do anything else - BBOT will install the package for you. cli.py Bad secrets includes an example CLI (https://github.com/blacklanternsecurity/badsecrets/blob/dev/examples/cli.py) for convenience when manually checking secrets. It also has a URL mode, which will connect to a target and attempt to carve for cryptographic products and check any it finds against all modules. Basic usage - checking a crytographic product for a known secret (against all modules): python ./badsecrets/examples/cli.py eyJhbGciOiJIUzI1NiJ9.eyJJc3N1ZXIiOiJJc3N1ZXIiLCJVc2VybmFtZSI6IkJhZFNlY3JldHMiLCJleHAiOjE1OTMxMzM0ODMsImlhdCI6MTQ2NjkwMzA4M30.ovqRikAo_0kKJ0GVrAwQlezymxrLGjcEiW_s3UJMMCo URL Mode - Connecting to a target and carving for a cryptographic product, and if found checking it for known secrets (against all modules): python ./badsecrets/examples/cli.py --url http://example.com/contains_bad_secret.html You can also set a custom user-agent with --user-agent "user-agent string" or a proxy with --proxy http://127.0.0.1 in this mode. Example output: command line interface *********************** Known Secret Found! Detecting Module: Generic_JWT Secret: 1234 Details: {'Issuer': 'Issuer', 'Username': 'BadSecrets', 'exp': 1593133483, 'iat': 1466903083, 'jwt_headers': {'alg': 'HS256'}} ***********************" dir="auto">$ python ./badsecrets/examples/cli.py eyJhbGciOiJIUzI1NiJ9.eyJJc3N1ZXIiOiJJc3N1ZXIiLCJVc2VybmFtZSI6IkJhZFNlY3JldHMiLCJleHAiOjE1OTMxMzM0ODMsImlhdCI6MTQ2NjkwMzA4M30.ovqRikAo_0kKJ0GVrAwQlezymxrLGjcEiW_s3UJMMCo
badsecrets - example command line interface
***********************
Known Secret Found!
Detecting Module: Generic_JWT
Secret: 1234
Details: {'Issuer': 'Issuer', 'Username': 'BadSecrets', 'exp': 1593133483, 'iat': 1466903083, 'jwt_headers': {'alg': 'HS256'}}
*********************** Blacklist3r.py Bad secrets includes a fully functional CLI example (https://github.com/blacklanternsecurity/badsecrets/blob/dev/badsecrets/examples/blacklist3r.py) which replicates the functionality of blacklist3r (https://github.com/NotSoSecure/Blacklist3r) in python badsecrets/examples/blacklist3r. python ./badsecrets/examples/blacklist3r.py --url http://vulnerablesite/vulnerablepage.aspx
python ./badsecrets/examples/blacklist3r.py --viewstate /wEPDwUJODExMDE5NzY5ZGQMKS6jehX5HkJgXxrPh09vumNTKQ== --generator EDD8C9AE Telerik_knownkey.py Fully functional CLI example for identifying known Telerik Hash keys and Encryption (https://www.kitploit.com/search/label/Encryption) keys for Post-2017 versions (those patched for CVE-2017-9248), and brute-forcing version / generating exploitation (https://www.kitploit.com/search/label/Exploitation) DialogParameters values. python ./badsecrets/examples/telerik_knownkey.py --url http://vulnerablesite/Telerik.Web.UI.DialogHandler.aspx Optionally include ASP.NET MachineKeys with --machine-keys (Will SIGNIFICANTLY increase brute-forcing time) Symfony_knownkey.py Brute-force detection of Symfony known secret key when "_fragment" URLs are enabled, even when no example URL containing a hash can be located. Relevent Blog Post (https://www.ambionics.io/blog/symfony-secret-fragment). python ./badsecrets/examples/symfony_knownkey.py --url https://localhost/ BBOT Module One of the best ways to use Badsecrets, especially for the ASPNET_Viewstate and Jsf_viewstate modules is with the Badsecrets BBOT (https://github.com/blacklanternsecurity/bbot) module. This will allow you to easily check across thousands of systems in conjunction with subdomain enummeration. bbot -f subdomain-enum -m badsecrets -t evil.corp
Detecting Module: Generic_JWT
Secret: 1234
Details: {'Issuer': 'Issuer', 'Username': 'BadSecrets', 'exp': 1593133483, 'iat': 1466903083, 'jwt_headers': {'alg': 'HS256'}}
*********************** Blacklist3r.py Bad secrets includes a fully functional CLI example (https://github.com/blacklanternsecurity/badsecrets/blob/dev/badsecrets/examples/blacklist3r.py) which replicates the functionality of blacklist3r (https://github.com/NotSoSecure/Blacklist3r) in python badsecrets/examples/blacklist3r. python ./badsecrets/examples/blacklist3r.py --url http://vulnerablesite/vulnerablepage.aspx
python ./badsecrets/examples/blacklist3r.py --viewstate /wEPDwUJODExMDE5NzY5ZGQMKS6jehX5HkJgXxrPh09vumNTKQ== --generator EDD8C9AE Telerik_knownkey.py Fully functional CLI example for identifying known Telerik Hash keys and Encryption (https://www.kitploit.com/search/label/Encryption) keys for Post-2017 versions (those patched for CVE-2017-9248), and brute-forcing version / generating exploitation (https://www.kitploit.com/search/label/Exploitation) DialogParameters values. python ./badsecrets/examples/telerik_knownkey.py --url http://vulnerablesite/Telerik.Web.UI.DialogHandler.aspx Optionally include ASP.NET MachineKeys with --machine-keys (Will SIGNIFICANTLY increase brute-forcing time) Symfony_knownkey.py Brute-force detection of Symfony known secret key when "_fragment" URLs are enabled, even when no example URL containing a hash can be located. Relevent Blog Post (https://www.ambionics.io/blog/symfony-secret-fragment). python ./badsecrets/examples/symfony_knownkey.py --url https://localhost/ BBOT Module One of the best ways to use Badsecrets, especially for the ASPNET_Viewstate and Jsf_viewstate modules is with the Badsecrets BBOT (https://github.com/blacklanternsecurity/bbot) module. This will allow you to easily check across thousands of systems in conjunction with subdomain enummeration. bbot -f subdomain-enum -m badsecrets -t evil.corp
Basic library usage check_secret See if a token or other cryptographic product was produced with a known key from badsecrets import modules_loaded
Django_SignedCookies = modules_loaded["django_signedcookies"]
ASPNET_Viewstate = modules_loaded["aspnet_viewstate"]
Flask_SignedCookies = modules_loaded["flask_signedcookies"]
Peoplesoft_PSToken = modules_loaded["peoplesoft_pstoken"]
Telerik_HashKey = modules_loaded["telerik_hashkey"]
Telerik_EncryptionKey = modules_loaded["telerik_encryptionkey"]
Rails_SecretKeyBase = modules_loaded["rails_secretkeybase"]
Generic_JWT = modules_loaded["generic_jwt"]
Jsf_viewstate = modules_loaded["jsf_viewstate"]
Symfony_SignedURL = modules_loaded["symfony_signedurl"]
Express_SignedCookies = modules_loaded["express_signedcookies"]
Laravel_SignedCookies = modules_loaded["laravel_signedcookies"]
x = ASPNET_Viewstate()
print(f"###{str(x.__class__.__name__)}###")
r = x.check_secret("AgF5WuyVO11CsYJ1K5rjyuLXqUGCITSOapG1cYNiriYQ6VTKochMpn8ws4eJRvft81nQIA==","EDD8C9AE")
if r:
print(r)
else:
print("KEY NOT FOUND :(")
x = Telerik_HashKey()
print(f"###{str(x.__class__.__name__)}###")
r = x.check_secret("vpwClvnLODIx9te2vO%2F4e06KzbKkjtwmNnMx09D1Dmau0dPliYzgpqB9MnEqhPNe3fWemQyH25eLULJi8KiYHXeHvjfS1TZAL2o5Gku1gJbLuqusRXZQYTNlU2Aq4twXO0o0CgVUTfknU89iw0ceyaKjSteOhxGvaE3VEDfiKDd8%2B9j9vD3qso0mLMqn%2Btxirc%2FkIq5oBbzOCgMrJjkaPMa2SJpc5QI2amffBJ%2BsAN25VH%2BwabEJXrjRy%2B8NlYCoUQQKrI%2BEzRSdBsiMOxQTD4vz2TCjSKrK5JEeFMTyE7J39MhXFG38Bq%2FZMDO%2FETHHdsBtTTkqzJ2odVArcOzrce3Kt2%2FqgTUPW%2BCjFtkSNmh%2FzlB9BhbxB1kJt1NkNsjywvP9j7PvNoOBJsa8OwpEyrPTT3Gm%2BfhDwtjvwpvN7l7oIfbcERGExAFrAMENOOt4WGlYhF%2F8c9NcDv0Bv3YJrJoGq0rRurXSh9kcwum9nB%2FGWcjPikqTDm6p3Z48hEnQCVuJNkwJwIKEsYxJqCL95IEdX3PzR81zf36uXPlEa3YdeAgM1RD8YGlwlIXnrLhvMbRvQW0W9eoPzE%2FjP68JGUIZc1TwTQusIWjnuVubFTEUMDLfDNk12tMwM9mfnwT8lWFTMjv9pF70W5OtO7gVN%2BOmCxqAuQmScRVExNds%2FF%2FPli4oxRKfgI7FhAaC%2Fu1DopZ6vvBdUq1pBQE66fQ9SnxRTmIClCpULUhNO90ULTpUi9ga2UtBCTzI8z6Sb6qyQ52NopNZMFdrn9orzdP8 oqFeyYpF%2BQEtbp%2F5AMENkFkWUxHZn8NoSlO8P6G6ubSyDdY4QJPaFS4FxNhhm85WlZC9xfEZ1AGSSBOu9JJVYiKxXnL1yYLqrlWp5mfBHZeUBwEa%2FMjGxZEVYDhXo4PiU0jxN7fYmjaobp3DSgA5H3BcFuNG5d8CUnOlQcEie5b%2BUHOpI9zAk7qcuEUXbaZ5Mvh0t2jXCRALRKYDyBdbHlWAFo10dTIM6L3aSTM5uEz9%2FalXLXoWlMo7dTDpuO5bBfTq7YkoPExL3g3JJX47UhuLq85i3%2Bzxfvd7r%2Fmid69kbD3PnX%2Bj0QxaiShhyOZg6jl1HMeRRXvZap3FPCIfxbCf7j2TRqB5gYefBIIdGYjrdiL6HS8SbjXcROMwh2Fxnt505X4jmkmDcGmneU3z%2B84TSSFewcSpxGEGvHVkkU4OaT6vyFwsxCmdrR187tQZ7gn3ZkAiTps%2FfOPcL5QWXja06Z%2FHT3zboq6Hj9v9NBHzpC1eAK0YN8r4V2UMI3P0%2FsIPQYXhovoeLjJwq6snKZTX37ulE1mbS1uOY%2BZrvFYbLN5DdNL%2B%2Bl%2F%2BcWIpc0RSYBLo19xHpKeoeLjU2sxaYzK%2B92D4zKANdPPvsHPqJD1Y%2FBwCL%2FfZKaJfRK9Bj09ez1Z1ixTEKjIRCwuxijnJGq33faZchbwpMPpTfv43jEriGwXwoqOo9Mbj9ggPAil7O81XZxNT4vv4RoxXTN93V100rt3ClXauL%2BlNID%2BseN2CEZZqnygpTDf2an%2FVsmJGJJcc0goW3l43mhx2U79zeuT94cFPGpvITEbMtjmuNsUbOBuw6nqm5rAs%2FxjIsDRqfQxGQWfS0kuwuU6RRmiME2Ps0NrBENIbZzcbgw6%2BRIwClWkvEG%2BK%2FPdcAdfmRkAPWUNadxnhjeU2jNnzI1yYNIOhziUBPxgFEcAT45E7rWvf8gh T08HZvphzytPmD%2FxuvJaDdRgb6a30TjSpa7i%2BEHkIMxM5eH1kiwhN6xkTcBsJ87epGdFRWKhTGKYwCbaYid1nRs7%2BvQEU7MRYghok8KMTueELipohm3otuKo8V4a7w4TgTSBvPE%2BLPLJRwhM8KcjGlcpzF1NowRo6zeJJhbdPpouUH2NJzDcp7P4uUuUB9Cxt9B986My6zDnz1eyBvRMzj7TABfmfPFPoY3RfzBUzDm%2FA9lOGsM6d9WZj2CH0WxqiLDGmP1Ts9DWX%2FsYyqEGK5R1Xpnp7kRIarPtYliecp50ZIH6nqSkoCBllMCCE6JN%2BdoXobTpulALdmQV0%2Bppv%2FAjzIJrTHgX7jwRGEAeRgAxTomtemmIaH5NtV7xt8XS%2BqwghdJl1D06%2FWhpMtJ1%2FoQGoJ0%2F7ChYyefyAfsiQNWsO66UNVyl71RVPwATnbRO5K5mtxn0M2wuXXpAARNh6pQTcVX%2FTJ4jmosyKwhI6I870NEOsSaWlKVyOdb97C3Bt0pvzq8BagV5FMsNtJKmqIIM0HRkMkalIyfow9iS%2B5xGN5eKM8NE4E6hO4CvmpG%2BH2xFHTSNzloV0FjLdDmj5UfMjhUuEb3rkKK1bGAVaaherp6Ai6N4YJQzh%2FDdpo6al95EZN2OYolzxitgDgsWVGhMvddyQTwnRqRY04hdVJTwdhi4TiCPbLJ1Wcty2ozy6VDs4w77EOAQ5JnxUmDVPA3vXmADJZR0hIJEsuxXfYg%2BRIdV4fzGunV4%2B9jpiyM9G11iiesURK82o%2BdcG7FaCkkun2K2bvD6qGcL61uhoxNeLVpAxjrRjaEBrXsexZ9rExpMlFD8e3NM%2B0K0LQJvdEvpWYS5UTG9cAbNAzBs%3DpDsPXFGf2lEMcyGaK1ouARHUfqU0fzkeVwjXU9ORI%2Fs%3D")
if r:
print(r)< br/>else:
Django_SignedCookies = modules_loaded["django_signedcookies"]
ASPNET_Viewstate = modules_loaded["aspnet_viewstate"]
Flask_SignedCookies = modules_loaded["flask_signedcookies"]
Peoplesoft_PSToken = modules_loaded["peoplesoft_pstoken"]
Telerik_HashKey = modules_loaded["telerik_hashkey"]
Telerik_EncryptionKey = modules_loaded["telerik_encryptionkey"]
Rails_SecretKeyBase = modules_loaded["rails_secretkeybase"]
Generic_JWT = modules_loaded["generic_jwt"]
Jsf_viewstate = modules_loaded["jsf_viewstate"]
Symfony_SignedURL = modules_loaded["symfony_signedurl"]
Express_SignedCookies = modules_loaded["express_signedcookies"]
Laravel_SignedCookies = modules_loaded["laravel_signedcookies"]
x = ASPNET_Viewstate()
print(f"###{str(x.__class__.__name__)}###")
r = x.check_secret("AgF5WuyVO11CsYJ1K5rjyuLXqUGCITSOapG1cYNiriYQ6VTKochMpn8ws4eJRvft81nQIA==","EDD8C9AE")
if r:
print(r)
else:
print("KEY NOT FOUND :(")
x = Telerik_HashKey()
print(f"###{str(x.__class__.__name__)}###")
r = x.check_secret("vpwClvnLODIx9te2vO%2F4e06KzbKkjtwmNnMx09D1Dmau0dPliYzgpqB9MnEqhPNe3fWemQyH25eLULJi8KiYHXeHvjfS1TZAL2o5Gku1gJbLuqusRXZQYTNlU2Aq4twXO0o0CgVUTfknU89iw0ceyaKjSteOhxGvaE3VEDfiKDd8%2B9j9vD3qso0mLMqn%2Btxirc%2FkIq5oBbzOCgMrJjkaPMa2SJpc5QI2amffBJ%2BsAN25VH%2BwabEJXrjRy%2B8NlYCoUQQKrI%2BEzRSdBsiMOxQTD4vz2TCjSKrK5JEeFMTyE7J39MhXFG38Bq%2FZMDO%2FETHHdsBtTTkqzJ2odVArcOzrce3Kt2%2FqgTUPW%2BCjFtkSNmh%2FzlB9BhbxB1kJt1NkNsjywvP9j7PvNoOBJsa8OwpEyrPTT3Gm%2BfhDwtjvwpvN7l7oIfbcERGExAFrAMENOOt4WGlYhF%2F8c9NcDv0Bv3YJrJoGq0rRurXSh9kcwum9nB%2FGWcjPikqTDm6p3Z48hEnQCVuJNkwJwIKEsYxJqCL95IEdX3PzR81zf36uXPlEa3YdeAgM1RD8YGlwlIXnrLhvMbRvQW0W9eoPzE%2FjP68JGUIZc1TwTQusIWjnuVubFTEUMDLfDNk12tMwM9mfnwT8lWFTMjv9pF70W5OtO7gVN%2BOmCxqAuQmScRVExNds%2FF%2FPli4oxRKfgI7FhAaC%2Fu1DopZ6vvBdUq1pBQE66fQ9SnxRTmIClCpULUhNO90ULTpUi9ga2UtBCTzI8z6Sb6qyQ52NopNZMFdrn9orzdP8 oqFeyYpF%2BQEtbp%2F5AMENkFkWUxHZn8NoSlO8P6G6ubSyDdY4QJPaFS4FxNhhm85WlZC9xfEZ1AGSSBOu9JJVYiKxXnL1yYLqrlWp5mfBHZeUBwEa%2FMjGxZEVYDhXo4PiU0jxN7fYmjaobp3DSgA5H3BcFuNG5d8CUnOlQcEie5b%2BUHOpI9zAk7qcuEUXbaZ5Mvh0t2jXCRALRKYDyBdbHlWAFo10dTIM6L3aSTM5uEz9%2FalXLXoWlMo7dTDpuO5bBfTq7YkoPExL3g3JJX47UhuLq85i3%2Bzxfvd7r%2Fmid69kbD3PnX%2Bj0QxaiShhyOZg6jl1HMeRRXvZap3FPCIfxbCf7j2TRqB5gYefBIIdGYjrdiL6HS8SbjXcROMwh2Fxnt505X4jmkmDcGmneU3z%2B84TSSFewcSpxGEGvHVkkU4OaT6vyFwsxCmdrR187tQZ7gn3ZkAiTps%2FfOPcL5QWXja06Z%2FHT3zboq6Hj9v9NBHzpC1eAK0YN8r4V2UMI3P0%2FsIPQYXhovoeLjJwq6snKZTX37ulE1mbS1uOY%2BZrvFYbLN5DdNL%2B%2Bl%2F%2BcWIpc0RSYBLo19xHpKeoeLjU2sxaYzK%2B92D4zKANdPPvsHPqJD1Y%2FBwCL%2FfZKaJfRK9Bj09ez1Z1ixTEKjIRCwuxijnJGq33faZchbwpMPpTfv43jEriGwXwoqOo9Mbj9ggPAil7O81XZxNT4vv4RoxXTN93V100rt3ClXauL%2BlNID%2BseN2CEZZqnygpTDf2an%2FVsmJGJJcc0goW3l43mhx2U79zeuT94cFPGpvITEbMtjmuNsUbOBuw6nqm5rAs%2FxjIsDRqfQxGQWfS0kuwuU6RRmiME2Ps0NrBENIbZzcbgw6%2BRIwClWkvEG%2BK%2FPdcAdfmRkAPWUNadxnhjeU2jNnzI1yYNIOhziUBPxgFEcAT45E7rWvf8gh T08HZvphzytPmD%2FxuvJaDdRgb6a30TjSpa7i%2BEHkIMxM5eH1kiwhN6xkTcBsJ87epGdFRWKhTGKYwCbaYid1nRs7%2BvQEU7MRYghok8KMTueELipohm3otuKo8V4a7w4TgTSBvPE%2BLPLJRwhM8KcjGlcpzF1NowRo6zeJJhbdPpouUH2NJzDcp7P4uUuUB9Cxt9B986My6zDnz1eyBvRMzj7TABfmfPFPoY3RfzBUzDm%2FA9lOGsM6d9WZj2CH0WxqiLDGmP1Ts9DWX%2FsYyqEGK5R1Xpnp7kRIarPtYliecp50ZIH6nqSkoCBllMCCE6JN%2BdoXobTpulALdmQV0%2Bppv%2FAjzIJrTHgX7jwRGEAeRgAxTomtemmIaH5NtV7xt8XS%2BqwghdJl1D06%2FWhpMtJ1%2FoQGoJ0%2F7ChYyefyAfsiQNWsO66UNVyl71RVPwATnbRO5K5mtxn0M2wuXXpAARNh6pQTcVX%2FTJ4jmosyKwhI6I870NEOsSaWlKVyOdb97C3Bt0pvzq8BagV5FMsNtJKmqIIM0HRkMkalIyfow9iS%2B5xGN5eKM8NE4E6hO4CvmpG%2BH2xFHTSNzloV0FjLdDmj5UfMjhUuEb3rkKK1bGAVaaherp6Ai6N4YJQzh%2FDdpo6al95EZN2OYolzxitgDgsWVGhMvddyQTwnRqRY04hdVJTwdhi4TiCPbLJ1Wcty2ozy6VDs4w77EOAQ5JnxUmDVPA3vXmADJZR0hIJEsuxXfYg%2BRIdV4fzGunV4%2B9jpiyM9G11iiesURK82o%2BdcG7FaCkkun2K2bvD6qGcL61uhoxNeLVpAxjrRjaEBrXsexZ9rExpMlFD8e3NM%2B0K0LQJvdEvpWYS5UTG9cAbNAzBs%3DpDsPXFGf2lEMcyGaK1ouARHUfqU0fzkeVwjXU9ORI%2Fs%3D")
if r:
print(r)< br/>else:
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
How do I pull IPs?
I am a member of an Anti Pedophile Organization called the APA. We have worked in sting operations for quite a while now but we want to expand to IP pulling outside of state. This is so we can report the pedos to local authorities. What is the best way I can go about pulling these pedos IPs. I would be more than happy to explain in detail if need be.
submitted by /u/ImMr200IQ
[link] [comments]
How do I pull IPs?
I am a member of an Anti Pedophile Organization called the APA. We have worked in sting operations for quite a while now but we want to expand to IP pulling outside of state. This is so we can report the pedos to local authorities. What is the best way I can go about pulling these pedos IPs. I would be more than happy to explain in detail if need be.
submitted by /u/ImMr200IQ
[link] [comments]
Hacking Articles Tips Tricks Videos Tutorials
Photo
Black Hat Ethical Hacking
OSINT Tool: Maryam
OSINT Tool: MaryamPost Views: 112 Premium ContentSubscribe to Patreon to watch this episode. https://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon-1.png Reading Time: 2 Minutes DescriptionOWASP Maryam by saeeddhqan, is a modular open-source framework based on OSINT (Open Source Intelligence) and data gathering. It is designed to provide a robust environment to harvest data from open sources and search engines quickly and thoroughly.
The tool offers several usage options, showcasing different functionalities. For example, it allows DNS search with options to specify the maximum number of resources, retrieve results in JSON format, and utilize multi-threading. It also supports searching on platforms like YouTube and Google, as well as performing DNS brute force attacks. The framework provides commands to display available modules, set options such as proxy and agent, and configure the timeout. Additionally, it offers the ability to run a web API for hosting the framework.
See Also: So you want to be a hacker? Offensive Security Courses InstallationSupported OS* Linux
* FreeBSD
* Darwin
* OSX
See Also: Offensive Security Tool: WEF (WiFi Exploitation Framework) Usagehttps://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/SS1.png Latest Updates* Added image_search module
* Clustering, Meta Search Engine, Dark-Web Search
* Iris: the first beta version
* Added famous_person
* Core speedup optimizations
* Added setup.py
See Also: Write up: Post-Exploitation Techniques: Maintaining Access, Escalating Privileges, Gathering Credentials, Covering Tracks Clone the repo from here: GitHub Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/06/Logsensor-300x150.png Recon Tool: LogsensorJune 30, 2023
Logsensor is a powerful tool designed to help identify login …
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/06/SSRFPwned-300x150.png Offensive Security Tool: SSRFPwnedJune 23, 2023
SSRFPwned is a tool that checks for SSRF vulnerabilities using …
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/06/PhoneSploit-Pro-300x150.png Offensive Security Tool: PhoneSploit ProJune 16, 2023
PhoneSploit Pro is an all-in-one hacking tool designed to exploit …
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/06/Octopus-300x150.png Offensive Security Tool: OctopusJune 9, 2023
Octopus is an open source pre-operation C2 server based on … https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now! https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Solutions.png Information Security SolutionsFind out how Pentesting Services can help you.
The post OSINT Tool: Maryam first appeared on Black Hat Ethical Hacking.
OSINT Tool: Maryam
OSINT Tool: MaryamPost Views: 112 Premium ContentSubscribe to Patreon to watch this episode. https://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon-1.png Reading Time: 2 Minutes DescriptionOWASP Maryam by saeeddhqan, is a modular open-source framework based on OSINT (Open Source Intelligence) and data gathering. It is designed to provide a robust environment to harvest data from open sources and search engines quickly and thoroughly.
The tool offers several usage options, showcasing different functionalities. For example, it allows DNS search with options to specify the maximum number of resources, retrieve results in JSON format, and utilize multi-threading. It also supports searching on platforms like YouTube and Google, as well as performing DNS brute force attacks. The framework provides commands to display available modules, set options such as proxy and agent, and configure the timeout. Additionally, it offers the ability to run a web API for hosting the framework.
See Also: So you want to be a hacker? Offensive Security Courses InstallationSupported OS* Linux
* FreeBSD
* Darwin
* OSX
$ pip install maryamAlternatively, you can install the latest version with the following command (Recommended): pip install git+https://github.com/saeeddhqan/maryam.gitSee Also: Offensive Security Tool: SSRFPwnedSee Also: Offensive Security Tool: WEF (WiFi Exploitation Framework) Usagehttps://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/SS1.png Latest Updates* Added image_search module
* Clustering, Meta Search Engine, Dark-Web Search
* Iris: the first beta version
* Added famous_person
* Core speedup optimizations
* Added setup.py
See Also: Write up: Post-Exploitation Techniques: Maintaining Access, Escalating Privileges, Gathering Credentials, Covering Tracks Clone the repo from here: GitHub Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/06/Logsensor-300x150.png Recon Tool: LogsensorJune 30, 2023
Logsensor is a powerful tool designed to help identify login …
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/06/SSRFPwned-300x150.png Offensive Security Tool: SSRFPwnedJune 23, 2023
SSRFPwned is a tool that checks for SSRF vulnerabilities using …
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/06/PhoneSploit-Pro-300x150.png Offensive Security Tool: PhoneSploit ProJune 16, 2023
PhoneSploit Pro is an all-in-one hacking tool designed to exploit …
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/06/Octopus-300x150.png Offensive Security Tool: OctopusJune 9, 2023
Octopus is an open source pre-operation C2 server based on … https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now! https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Solutions.png Information Security SolutionsFind out how Pentesting Services can help you.
The post OSINT Tool: Maryam first appeared on Black Hat Ethical Hacking.
Hacking on Medium
Chat GPT For Bug Bounty: Recon, Generate wordlist, Nuclei Template, Convert p3 or p4 in P2 or P1 ✨
https://cdn-images-1.medium.com/max/600/1*XropUjK5MIjkt9Pc_rB3uQ.png
Empowering Bug Bounty Hunters with Chat GPT Prompts and Dynamic Outputs
Continue reading on Medium »
Chat GPT For Bug Bounty: Recon, Generate wordlist, Nuclei Template, Convert p3 or p4 in P2 or P1 ✨
https://cdn-images-1.medium.com/max/600/1*XropUjK5MIjkt9Pc_rB3uQ.png
Empowering Bug Bounty Hunters with Chat GPT Prompts and Dynamic Outputs
Continue reading on Medium »
Medium
Chat GPT For Bug Bounty: Recon, Generate wordlist, Nuclei Template, Convert p3 or p4 in P2 or P1 ✨
Empowering Bug Bounty Hunters with Chat GPT Prompts and Dynamic Outputs
Hacking on Medium
HackTheBox: Active Walkthrough
https://cdn-images-1.medium.com/max/600/0*4We2obJR4nefl9lA.png
Active was an example of an easy box that still provided a lot of opportunity to learn. The box was centered around common vulnerabilities…
Continue reading on Medium »
HackTheBox: Active Walkthrough
https://cdn-images-1.medium.com/max/600/0*4We2obJR4nefl9lA.png
Active was an example of an easy box that still provided a lot of opportunity to learn. The box was centered around common vulnerabilities…
Continue reading on Medium »
Medium
HackTheBox: Active Walkthrough
Active was an example of an easy box that still provided a lot of opportunity to learn. The box was centered around common vulnerabilities…