IDOR (Insecure Direct Object Reference)
https://antaramane.medium.com/idor-insecure-direct-object-reference-df94f5b3afbb?source=rss------bug_bounty-5

Accessing Arbitrary Customer dataContinue reading on Medium » (https://antaramane.medium.com/idor-insecure-direct-object-reference-df94f5b3afbb?source=rss------bug_bounty-5)

Nmap MS-SQL Server Recon
https://www.reddit.com/r/redteamsec/comments/ntsa2l/nmap_mssql_server_recon/

<!-- SC_OFF -->MSSQL is Microsoft' SQL Server used by many companies. In this post, I have covered how to perform reconnaissance against the MSSQL server with the Nmap tool. From scanning ports to execute arbitrary system commands, Nmap is used https://www.secjuice.com/recon-basics-mssql-server/ <!-- SC_ON --> submitted by /u/tbhaxor (https://www.reddit.com/user/tbhaxor)
[link] (https://www.reddit.com/r/redteamsec/comments/ntsa2l/nmap_mssql_server_recon/) [comments] (https://www.reddit.com/r/redteamsec/comments/ntsa2l/nmap_mssql_server_recon/)

Deep Web
social media icons hover effect using html and css | social media icon with html & css

https://external-preview.redd.it/vtHOp6MH-dO5kcmJHWrwcAJmLoowyDr9wHtxG0iORTg.jpg?width=320&crop=smart&auto=webp&s=d36d7d929d79e3ef07a41d5c1e1def0a4c23338a submitted by /u/TaylorM_Clark
[link] [comments]

hacking: security in practice
Cyberterrorism or 'ransomware-as-a-service model'? Group claims credit, explains 'business model'

So, there is a hacking group that has taken credit for several such recent attacks and according to this, do not mind being characterized as cyberterrorists

I am not skeptical about it, but I do recall that after some unclaimed acts of terrorism, group not responsible occasionally claim credit to boost their own status or to help the actual perpetrators (or both), perhaps that's inaccurate though.

That I don't really care about tbh, I am more wondering if the targets really are so disconnected, because there seems to be the potential for an ideological thread of 'ecoterrorism', that is terrorists motivated by environmentalist sentiments. Oil and meat are said to be major contributors to greenhouse gases, destruction of local ecosystems, and displacement of people (often Indigenous peoples).

That they were targeting Brazil, still doesn't make that implausible. Considering the actions of Bolsonaro towards Indigenous people there, as well as the rain forest destruction caused by farming, it makes a target that still fits that motive IMO.

However, they discuss their business model and I think that it's still very plausible this is motivated by profit and nationalism, because that's what it seems on the face of it and sometimes a something is just a something.

Also their targets may line up because they are industries that cut corners on security and modernization, so essentially they're convenient and reliable. Like picking off the weak of the herd or whatever. I find the assertion they'd be killed if they came to the United States odd; I have no faith in the USA to be fair, but that seems like an almost sheltered view of what might happen, which seems ideological/nationalist.

Or perhaps indicates this is a paramilitary or quasi-governmental group; regardless of what, a black site or indefinite detention seems more plausible to me. Visibility now would be their biggest asset in that, as such detainment would be more obvious to the world.

I don't know really, I haven't watched their videos or done more research yet, so most of this is just speculation other than what they say in those linked articles above. Still, interesting.

PS - the name of their ransomware reminds me of an old Linux game. You might want to try it, but it probably helps if you're a bit masochistic and into games from the 90s. It also cracks me up about the casino affiliate thing or whatever it is.

submitted by /u/redrosesburningblack
[link] [comments]

hacking: security in practice
Obfuscating powershell scripts using Invoke-Obfuscation ** Only for educational purposes!!! **

Hello everyone, hope you all are doing great and are safe, in this video, we will have a look at a tool known as invoke-obfuscation, please note that this video is strictly for educational purposes only! Thank you! Peace!

https://youtu.be/6o7hMytqBfA

submitted by /u/Vedant-Bhalgama
[link] [comments]

hacking: security in practice
Is it possible to crack a password?

If anyone can help me, I’ll be happy to pay for it

submitted by /u/furheirbduebdd
[link] [comments]

hacking: security in practice
Mymathlab

I am a science major, I am taking Calculus 1 for summer and this teacher uses mymathlab.

Reasons I have conflict with mymathlab:

1. It only let's you open one tab during homework. The internet is the greatest learning tool we have discovered since the beginning of mankind, tab opening is crucial.
2. It cost another $100 dollars when school is already expensive.
3. Pearson lobbies state laws and forces itself into student's education system.

With that being said, who knows how to rig this shit?

submitted by /u/jwdino
[link] [comments]

hacking: security in practice
Web or Native R.A.T. UI?

Which is better and why?

Web or native user interface for Remote Administration Tools?

In my mind web UI is the way to go, since less foot-print is left onto the machine, plus it is accessible directly from the Tor browser.

I'm asking because I'm soon releasing an Open-Source RAT framework. (not a commercial project, it will be open and free)

submitted by /u/Blagojee
[link] [comments]

hacking: security in practice
Nmap MS-SQL Server Recon

MSSQL is Microsoft' SQL Server used by many companies. In this post, I have covered how to perform reconnaissance against the MSSQL server with the Nmap tool.

From scanning ports to execute arbitrary system commands, Nmap is used

https://www.secjuice.com/recon-basics-mssql-server/

submitted by /u/tbhaxor
[link] [comments]

hacking: security in practice
Is it possible for a totally random stranger on kik to find my address? They know nothing about me

They're threatening to find me and stuff....... I'm a little scared

submitted by /u/WereWolf_Engine
[link] [comments]

Functionality Bypass — IDOR
https://antaramane.medium.com/functionality-bypass-idor-7df76e15e77b?source=rss------bug_bounty-5

OTP Bypass to IDOR (Insecure Direct Object Reference)Continue reading on Medium » (https://antaramane.medium.com/functionality-bypass-idor-7df76e15e77b?source=rss------bug_bounty-5)

Medical Provider — Reflected XSS in Search Results
https://medium.com/@pr1sas/medical-provider-reflected-xss-in-search-results-2dc829c50543?source=rss------bug_bounty-5

Yesterday I read a Medium article where another security researcher discovered some interesting issues in a medical provider subdomains…Continue reading on Medium » (https://medium.com/@pr1sas/medical-provider-reflected-xss-in-search-results-2dc829c50543?source=rss------bug_bounty-5)