Hacking on Medium
Descubren el primer malware conocido dirigido a contenedores de Windows.

https://cdn-images-1.medium.com/max/1014/0*uPyo2UWLX25d9ud8
PUBLICADO EN 7 JUNIO, 2021 POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
That Anonymous Video Threatening Elon Musk is Incredibly Lame. Here’s Why.

https://cdn-images-1.medium.com/max/1280/0*7NLIswKPTRt3xrYL
The infamous hacker group ‘Anonymous’ (although not considered contiguous in its nature), has launched threats against tech big-wig and…

Continue reading on The Uncomanor »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Totp-Ssh-Fluxer - Take Security By Obscurity To The Next Level (This Is A Bad Idea, Don'T Really Use This Please)

https://1.bp.blogspot.com/-AKkC7r7JH88/YLc4c7ouPTI/AAAAAAAAXu8/xUUwB4NfrB4AxMzYryAxlY0lzRMw35hOgCNcBGAsYHQ/w640-h470/totp-ssh-fluxer_1.gif
Some people change their SSH port on their servers so that it is slightly harder to find for bots or other nasties, and while that is generally viewed as an action of security through obscurity it does work very well at killing a lot of the automated logins you always see in /var/log/auth.log

However what if we could go take this to a ridiculous level? What if we could use TOTP codes that are normally used as 2nd factor codes to login to websites to actually know what port the sshd server is listening on?

For this, I present totp-ssh-flux, a way to make sure your sshd port changes every 30 seconds, and possibly causing your adversaries a small period of frustration.
What you can see here is my phone (using a generic TOTP client) generating codes, that I can then use as the port to SSH into on a server.

The software behind it is fairly simple, It runs in a loop that does the following

* Generates a TOTP token
* Takes the last digit, if the result is above 65536, do that again
* Adds a iptables PREROUTING rule to redirect that number generated above
* Waits 30 seconds, removes that rule, repeat.

The neat thing is, because this is done in PREROUTING, even if the code expires, established connections stay connected.

Installation

You will most likely find more up to date instructions on the totp-ssh-flux project readme

Beware, currently I would not really recommend running this software, it was only written as a joke.

At the time of writing the project is just a single file, You will need to install golang and then go getand go build

Run the program as root ( it needs to, sorry, it's editing iptables )

Upon first run, the program will generate a token for the host in /etc/ssh-flux-key( you can use the -keypathoption to change that ) and you can input that into your phone or other clients.

You can confirm it works by running watch iptables -vL -t natand waiting for the iptables rules to be inserted and removed.
Want to see more insanity like this? Follow me on twitter @benjojo12
Download Totp-Ssh-Fluxer

___________________________
@hacking_Attack
@Hacking_Video

As computer security auditors, what is your experience most similar to a hacker movie?
https://www.reddit.com/r/Pentesting/comments/nuq9c4/as_computer_security_auditors_what_is_your/

I'm dedicated to offensive security on websites, and once in a while I have found myself in almost comical situations where you can glimpse the occasional similarity to some exaggerated hacker movie. However other times things can get tense. Have you had an intense experience that you consider almost cinematic? submitted by /u/TimeTravel_07 (https://www.reddit.com/user/TimeTravel_07)
[link] (https://www.reddit.com/r/Pentesting/comments/nuq9c4/as_computer_security_auditors_what_is_your/) [comments] (https://www.reddit.com/r/Pentesting/comments/nuq9c4/as_computer_security_auditors_what_is_your/)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
First Known Malware Surfaces Targeting Windows Containers

Siloscape is designed to create a backdoor in Kubernetes clusters to run malicious containers.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe Walkthrough: Steel Mountain (with &without Metasploit)

https://cdn-images-1.medium.com/max/856/1*b_VRnFaXvplraQZFznKkCQ.png
This room is a box hosting two web services, and one of them is hosting a vulnerable service. We are able to use an exploit to achieve…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hack Android Dengan Mudah Menggunakan Metasploit Framework

https://cdn-images-1.medium.com/max/1920/1*fNCv8ixjU9IjqYaTJtas3Q.png
Di era teknologi yang semakin pesat melaju ini, informasi menjadi hal yang sangat mudah didapatkan. Dan karena itu juga, keamanan menjadi…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The Colonial Pipeline Hack Timeline and How Ransom Funds Were Retrieved

https://cdn-images-1.medium.com/max/2600/0*8i7WyXPRad4mfNn2
An easy to understand guide from a cyber security/computer info systems major

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
Anyone has a good guide on how to be as safe as possible using Tor browser?

and maybe something that briefly explains all the connection configurations one may have to know about. I was a reckless kid and spent lots of time on tor and weird onion sites but now that I'm old I don't know if I can just download it and use it like nothing lol

submitted by /u/lovemusicsuckatmusic
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
possible to hack canvas?

how hard would it be to unlock a locked assignment on canvas

submitted by /u/Fuzz_from_the_floor
[link] [comments]

Kali Linux Tutorials
SQLFluff : A SQL Linter And Auto-Formatter For Humans

SQLFluff is a dialect-flexible and configurable SQL linter. Designed with ELT applications in mind, SQLFluff also works with jinja templating and dbt. SQLFluff will auto-fix most linting errors, allowing you to focus your time on what matters. Getting Started To get started, install the package and run sqlfluff lint or sqlfluff fix. $ pip install sqlfluff$ echo ” […]

The post SQLFluff : A SQL Linter And Auto-Formatter For Humans appeared first on Kali Linux Tutorials.

Bugs, Bounties & Peace of Mind

As a Bug Bounty Hunter, finding Bugs or security vulnerabilities in websites always feels like finding some hidden treasure in unknown…Continue reading on Medium »
Read more...

Bugs, Bounties & Peace of Mind
https://suneets1ngh.medium.com/bugs-bounties-peace-of-mind-f8a885fb75ec?source=rss------bug_bounty-5

As a Bug Bounty Hunter, finding Bugs or security vulnerabilities in websites always feels like finding some hidden treasure in unknown…Continue reading on Medium » (https://suneets1ngh.medium.com/bugs-bounties-peace-of-mind-f8a885fb75ec?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Pentesting AWS NAT Gateways
https://www.reddit.com/r/Pentesting/comments/nuxzxf/pentesting_aws_nat_gateways/

Hi all, So recently I was given a set of public AWS IP addresses to conduct a pentest on and when I ran a port scan (all ports UDP and TCP) on the said IP addresses I nothing was showing, which led me to sort of realise that these are NAT gateways most likely. Is there anything else that I can continue to pentest on AWS NAT GATEWAYS? I'm not sure what else I can look out for to be honest and I was hoping someone here would have some ideas. Thanks! submitted by /u/sg_pepehands69 (https://www.reddit.com/user/sg_pepehands69)
[link] (https://www.reddit.com/r/Pentesting/comments/nuxzxf/pentesting_aws_nat_gateways/) [comments] (https://www.reddit.com/r/Pentesting/comments/nuxzxf/pentesting_aws_nat_gateways/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Colleges that support CTF teams

I know that a group like PPP is running out of Carnegie Mellon but I don't know many other teams working out of colleges. If you know any feel free to drop a link to their website on this post or PM me.

submitted by /u/jesus-da-wizard
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video