Hacking Articles Tips Tricks Videos Tutorials

How You Can Escalate a Simple HTML Injection Into a Critical SSRF

SSRF or Server Side Request Forgery is a type of vulnerability where the attacker can make the request on behalf of the vulnerable web…Continue reading on Medium »
Read more...

12 views19:15

11 views20:28

Hacking Articles Tips Tricks Videos Tutorials

Photo

Deep Web
How To Create Teat around A Cricle Using HTML AND CSS

https://external-preview.redd.it/5qOQoqFt8bqrUJGvF72yZ1QLt9Bj1ZiWNu_V7KKKqTw.jpg?width=320&crop=smart&auto=webp&s=30bb8a480b91c821adce3c9e346f70978ffabf3e submitted by /u/TaylorM_Clark
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

r/deepweb - How To Create Teat around A Cricle Using HTML AND CSS

0 votes and 2 comments so far on Reddit

9 viewsedited 20:28

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Curious login info

How hard on a scale of 1 to 10 (10 being forget about it) would it be to get around this and get access? I have 0 idea on this kind of stuff and was just curious for informational purposes only.

http://archeology.uark.edu/amasdaonline/index.html

submitted by /u/realbigweiner
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Curious login info

How hard on a scale of 1 to 10 (10 being forget about it) would it be to get around this and get access? I have 0 idea on this kind of stuff and...

8 viewsedited 21:19

Hacking Articles Tips Tricks Videos Tutorials

https://a.thumbs.redditmedia.com/snkX5t1TTfSDJf05VyIZnQwFjjDahU8TuvQZYuA1Ev0.jpg The bracelets are a tiny chip strapped to an elastic bracelet.

The chip is inside the plastic. It's a hotel key card but on a bracelet.

How do I access the chip inside the card?

*for white hat hacking purposes

picture of the bracelets

vvv

https://preview.redd.it/o6ywzh07pn671.png?width=1990&format=png&auto=webp&s=204f4f633cec30a2c3d7641fdd2b2ddd56b58038

submitted by /u/Guy_withThe_Hat
[link] [comments]

10 views21:19

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Am I a fraud?

I landed an IT Security Professional position for this small insurance carrier about a year ago. I was a jack of all trades sysadmin before landing this job. A giant portion of the security job was vulnerability scanning/pen testing 50 websites and 20 web apps. I was 24 years old, only had an associates degree in IT systems administration, and was using all of my Sec+ knowledge to get this done.

I had a good understanding of IT-Sec and NetSec due to being a sysadmin, but didn't have the high level understanding. I had a blast learning about it and using the tools to find vulnerabilities and tell our DevOps team about it. I used Burp Suite, Nmap, SQLmap, Metasploit, Armitage, (lots of kali tools) etc. and I learned all of this from youtube videos and hacking IRC chats in a matter of months.

My bosses were incredibly happy with the reports I was generating and eventually as a part of our contracts with the big boy insurance carriers (New York Life, State Farm etc.) we had to get an external pen testing/security company to come in and do an audit. They didn't find anything big and my bosses were very happy to hear that.

Eventually the pay at that job stagnated but the responsibilities kept growing so I reached out that same pen-testing/consulting company and actually landed a security consultant job at the age of 25... I'm making 6 figures and I only have an associate's degree, no major certs other than Sec+ course I took in college, and definitely lack 10+ years of hacking experience it takes to become a consultant.

Is this what pen-testing is nowadays? I brought this up with a co-worker and he laughed and said "the requirement for a corporate level pen test is not as extreme as you think it is." Is this true? What happened to hacking? Are the tools we have now really that advanced that we don't really need manual prodding? SQLmap literally tells you the command you need to type to mess with an SQL server!

EDIT: I'm a Security Consultant, on the sales side of the organization. I do launch initial vuln scans and prod around a bit, but we have actual pen testers that know all of the programming languages and manually prod around the environments. I'm just wondering if I really have the knowledge to do this job, it's not that difficult but hearing actual pen testers tell me that I could learn this actual pen testing stuff in a year is kind of weird. I always thought this stuff was really really difficult.

submitted by /u/penis-retard42069
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

r/hacking - Am I a fraud?

0 votes and 0 comments so far on Reddit

15 viewsedited 21:19

Hacking Articles Tips Tricks Videos Tutorials

Squalr - Squalr Memory Editor - Game Hacking Tool Written In C#
http://www.kitploit.com/2021/06/squalr-squalr-memory-editor-game.html

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

Squalr - Squalr Memory Editor - Game Hacking Tool Written In C#

9 viewsedited 21:35

Hacking Articles Tips Tricks Videos Tutorials

8 views21:35

Hacking Articles Tips Tricks Videos Tutorials

Documentation
You can find detailed documentation on the Wiki (https://squalr.github.io/SqualrDocs/). There are three ways to use Squalr: Front end GUI Scripting API Back end NuGet packages Below is some brief documentation on the NuGet package APIs
Receiving Engine Output:
If using the NuGet packages, it is important to hook into the engine's output to receive logs of events. These are invaluable for diagnosing issues. using Squalr.Engine.Logging;

...

// Receive logs from the engine
Logger.Subscribe(new EngineLogEvents());

...

class EngineLogEvents : ILoggerObserver
{
public void OnLogEvent(LogLevel logLevel, string message, string innerMessage)
{
Console.WriteLine(message);
Console.WriteLine(innerMessage);
}
}
Attaching The Engine
processes = Processes.Default.GetProcesses(); // Pick a process. For this example, we are just grabbing the first one. Process process = processes.FirstOrDefault(); Processes.Default.OpenedProcess = process; ">using Squalr.Engine.OS;
...

IEnumerable processes = Processes.Default.GetProcesses();

// Pick a process. For this example, we are just grabbing the first one.
Process process = processes.FirstOrDefault();

Processes.Default.OpenedProcess = process;

Manipulating Memory:
(address); Writer.Default.Write(address); Allocator.Alloc(address, 256); IEnumerable regions = Query.GetVirtualPages(requiredProtection, excludedProtection, allowedTypes, startAddress, endAddress); IEnumerable modules = Query.GetModules(); ">using Squalr.Engine.Memory;

...

Reader.Default.Read(address);
Writer.Default.Write(address);
Allocator.Alloc(address, 256);
IEnumerable regions = Query.GetVirtualPages(requiredProtection, excludedProtection, allowedTypes, startAddress, endAddress);
IEnumerable modules = Query.GetModules();
Assembling/Disassembling:
Squalr can assemble and disassemble x86/x64 instructions, leveraging NASM. using Squalr.Engine.Architecture;
using Squalr.Engine.Architecture.Assemblers;

...

// Perform assembly
AssemblerResult result = Assembler.Default.Assemble(assembly: "mov eax, 5", isProcess32Bit: true, baseAddress: 0x10000);

Console.WriteLine(BitConverter.ToString(result.Bytes).Replace("-", " "));

// Disassemble the result (we will get the same instructions back)
Instruction[] instructions = Disassembler.Default.Disassemble(bytes: result.Bytes, isProcess32Bit: true, baseAddress: 0x10000);

Console.WriteLine(instructions[0].Mnemonic);
Scanning:
Squalr has an API for performing high performance (https://www.kitploit.com/search/label/High%20Performance) memory scanning: valueCollectorTask = ValueCollector.CollectValues( SnapshotManager.GetSnapshot(Snapshot.SnapshotRetrievalMode.FromActiveSnapshotOrPrefilter, dataType)); // Perform manual scan on value collection complete valueCollectorTask.CompletedCallback += ((completedValueCollection) => { Snapshot snapshot = completedValueCollection.Result; // Constraints ScanConstraintCollection scanConstraints = new ScanConstraintCollection(); scanConstraints.AddConstraint(new ScanConstraint(ScanConstraint.ConstraintType.Equal, 25)); TrackableTask scanTask = ManualScanner.Scan( snapshot, allScanConstraints); SnapshotManager.SaveSnapshot(scanTask.Result); }); for (UInt64 index = 0; index < snapshot.ElementCount; index++) { SnapshotElementIndexer element = snapshot[index]; Object currentValue = element.HasCurrentValue() ? element.LoadCurrentValue() : null; Object previousValue = element.HasPreviousValue() ? element.LoadPreviousValue() : null; } ">using Squalr.Engine.Scanning;
using Squalr.Engine.Scanning.Scanners;
using Squalr.Engine.Scanning.Scanners.Constraints;
using Squalr.Engine.Scanning.Snapshots;

...

DataType dataType = DataType.Int32;

// Collect values
TrackableTask valueCollectorTask = ValueCollector.CollectValues(
SnapshotManager.GetSnapshot(Snapshot.SnapshotRetrievalMode.FromActiveSnapshotOrPrefilter, dataType));

___________________________
@hacking_Attack
@Hacking_Video

12 viewsedited 21:35

Hacking Articles Tips Tricks Videos Tutorials

// Perform manual scan on value collection complete
valueCollectorTask.CompletedCallback += ((completedValueCollection) =>
{
Snapshot snapshot = completedValueCollection.Result;

// Constraints
ScanConstraintCollection scanConstraints = new ScanConstraintCollection();
scanConstraints.AddConstraint(new ScanConstraint(ScanConstraint.ConstraintType.Equal, 25));

TrackableTask scanTask = ManualScanner.Scan(
snapshot,
allScanConstraints);

Snapsh otManager.SaveSnapshot(scanTask.Result);
});

for (UInt64 index = 0; index < snapshot.ElementCount; index++)
{
SnapshotElementIndexer element = snapshot[index];

Object currentValue = element.HasCurrentValue() ? element.LoadCurrentValue() : null;
Object previousValue = element.HasPreviousValue() ? element.LoadPreviousValue() : null;
}
Debugging:
// Example: Tracing write events on a float
BreakpointSize size = Debugger.Default.SizeToBreakpointSize(sizeof(float));
CancellationTokenSource cancellationTokenSource = Debugger.Default.FindWhatWrites(0x10000, size, this.CodeTraceEvent);

...

// When finished, cancel the instruction collection
cancellationTokenSource.cancel();

...

private void CodeTraceEvent(CodeTraceInfo codeTraceInfo)
{
Console.WriteLine(codeTraceInfo.Instruction.Address.ToString("X"));
Console.WriteLine(codeTraceInfo.Instruction.Mnemonic);
}
Recommended Visual Studio Extensions
Reference Description XAML Formatter (https://marketplace.visualstudio.com/items?itemName=TeamXavalon.XAMLStyler) XAML should be run through this formatter StyleCop (https://marketplace.visualstudio.com/items?itemName=ChrisDahlberg.StyleCop) StyleCop to enforce code conventions. Note that we deviate on some standard conventions. We use the full type name for variables (ex Int32 rather than int). The reasoning is that this is a memory editor, so we prefer to use the type name that is most explicit to avoid coding mistakes.
Build
In order to compile Squalr, you should only need Visual Studio 2017. This should be up to date, we frequently update Squalr to use the latest version of the .NET framework. Here are the important 3rd party libraries that this project uses: Library Description EasyHook (https://github.com/EasyHook/EasyHook) Managed/Unmanaged API Hooking SharpDisasm (https://github.com/spazzarama/SharpDisasm) Udis86 Assembler (https://www.kitploit.com/search/label/Assembler) Ported to C# CsScript (https://github.com/oleg-shilo/cs-script) C# Scripting (https://www.kitploit.com/search/label/Scripting) Library AvalonEdit (https://github.com/icsharpcode/AvalonEdit) Code Editing Library SharpDX (https://github.com/sharpdx/SharpDX) DirectX Wrapper CLRMD (https://github.com/Microsoft/clrmd) .NET Application Inspection Library AvalonDock (https://avalondock.codeplex.com/) Docking Library LiveCharts (https://github.com/beto-rodriguez/Live-Charts) WPF Charts
Planned Features
Library Description Purpose AsmJit (https://github.com/hypeartist/AsmJit) x86/x64 Assembler Replace FASM, improve scripting drastically AsmJit (https://github.com/asmjit/asmjit) x86/x64 Assembler Original C++ project. May port/interop this if the above version does not work (Neither may fully work, and something custom may be needed) WpfHexEditorControl (https://github.com/abbaye/WpfHexEditorControl) Hex Editor Hex editor / Memory Hex Editor OpenTK (https://github.com/opentk/opentk) OpenGL Wrapper Graphics Injection SharpDX (https://github.com/sharpdx/SharpDX) DirectX Wrapper Graphics Injection (https://www.kitploit.com/search/label/Injection) (Currently using SharpDX just for input) SharpPCap (https://github.com/chmorgan/sharppcap) Packet Capture Packet Editor Packet.Net (https://github.com/antmicro/Packet.Net) Packet Capture Packet Editor

___________________________
@hacking_Attack
@Hacking_Video

Visualstudio

XAML Styler - Visual Studio Marketplace

Extension for Visual Studio - XAML Styler is a visual studio extension that formats XAML source code based on a set of styling rules. This tool can help you/your team maintain a better XAML coding style as well as a much better XAML readability.

10 viewsedited 21:35

About

Blog

Apps

Platform