Elevating Cross-Frame Scripting (why it matters more than experts think…)

Are you able to hijack the source of an iFrame, or execute JavaScript inside? This attack (called an XFS attack) typically is considered…Continue reading on Medium »
Read more...

Kali Linux Tutorials
Aggrokatz : An Aggressor Plugin Extension For Cobalt Strike Which Enables Pypykatz To Interface With The Beacons Remotely

aggrokatz is an Aggressor plugin extension for CobaltStrike which enables pypykatz to interface with the beacons remotely.The current version of aggrokatz allows pypykatz to parse LSASS dump files and Registry hive files to extract credentials and other secrets stored without downloading the file and without uploading any suspicious code to the beacon (Cobalt Strike is already there anyhow). In the future this project aims […]

The post Aggrokatz : An Aggressor Plugin Extension For Cobalt Strike Which Enables Pypykatz To Interface With The Beacons Remotely appeared first on Kali Linux Tutorials.

Hacking on Medium
Researchers are developing an unhackable CPU Watch out, Intel!

https://cdn-images-1.medium.com/max/724/1*aGXnn5-RipN3OsBpEpM8Aw.jpeg
Cybersecurity researchers are developing a new CPU named Morpheus that turns a PC into a complex puzzle to prevent attackers from hacking…

Continue reading on Medium »

Hacking on Medium
Top White Hat Hacker For Hire Services — White Hat Services Only

https://cdn-images-1.medium.com/max/640/1*gWTxut0K6JwBL3UrRH0SCw.jpeg
Without a doubt, RxBOT Hijacked is the best ethical hacker for hire for service information providers. Based on their high rating in the…

Continue reading on Medium »

Hacking on Medium
New job, new cert, new goals

https://cdn-images-1.medium.com/max/790/1*aTO8ZiY1O1yOWAwl1QDYZw.jpeg
As I’m trying to make my into cybersecurity from 0, I hope my journey will inspire you.

Continue reading on Medium »

Hacking on Medium
‘Joker’ is back: A malware that Google hates

https://cdn-images-1.medium.com/max/2600/0*LOBDDuefnJqEngbf
He’s back, Joker! No, not the one who appears in the Batman series, but the malware which has become a nightmare for Google.

Continue reading on Medium »

Misconfigured $3 Bucket - A Semi Opened Environment
https://medium.com/techiepedia/misconfigured-3-bucket-a-semi-opened-environment-9cfb9dee782d?source=rss------bug_bounty-5

First of all, just learn to recon and improve your methodology in recon don’t just follow another one’s recon tip if you do so there is no…Continue reading on Techiepedia » (https://medium.com/techiepedia/misconfigured-3-bucket-a-semi-opened-environment-9cfb9dee782d?source=rss------bug_bounty-5)

https://b.thumbs.redditmedia.com/HGc9fc5hJfVzQpBbW3h7J_JS2Y7NkorNuX_Oof1wglE.jpg I ain't asking for any help but just wanted to know if I did the correct thing. I basically found the process by simply using task manager, and then the program's location. Turned on windows safe mode and then deleted the program and its folder.

Does anyone know how I can see all recently created program files? Need to know if the program is still on my pc. Sorry about being a complete pc noob.

​

If anyone wants to know what the program was then: (The file is on a USB, not my pc)

https://preview.redd.it/wbfm07fezu771.png?width=627&format=png&auto=webp&s=663f347ed7eca6255c4daf8b3b48f2cab6aed2c9

https://preview.redd.it/fpy0a7fezu771.png?width=636&format=png&auto=webp&s=52802ab962540f90b169709b472669999230073f

​

https://preview.redd.it/yrwdxu2a0v771.png?width=362&format=png&auto=webp&s=15c57fd0fa9ad3a85c08a8cac0efc75383180092

I couldn't upload the text files so I took some screenshots. Hope that's cool.

​

https://preview.redd.it/yjbbsvvuzu771.png?width=1656&format=png&auto=webp&s=49e8f879905ca93e99af934a3106ef6456681e70

https://preview.redd.it/wcf3fwvuzu771.png?width=717&format=png&auto=webp&s=23cebe99e681d8bbc8a15e0618b5285ea0bd2b32

https://preview.redd.it/ajdltwvuzu771.png?width=534&format=png&auto=webp&s=5c696da98fe8553219553b3ff60345621e947161

submitted by /u/35615054
[link] [comments]

hacking: security in practice
bruteforce huawei bootloader unlocking

does ANYONE have some bruteforce bootloader unlocker for Huawei devices? im trying over 8 hours searching for WORKING program but none of them works!

my device is Huawei Y3 II Lua-L21

submitted by /u/Silver_Illustrator_4
[link] [comments]

hacking: security in practice
Steam streaming as a RAT

Tl;Dr Steam game streaming allows you to access the other computer's desktop

While goofing around the shared Steam account between me and my brother, I wanted to play a game we had installed on both of our computers. I, however, did not select my local mashine when clicking what I thought was the "Play" button and so launched the game on HIS computer. When I realised that, I pressed the windows key to exit it and this brought me to the desktop on his computer, not mine. This got me thinking, can this be used as a RAT?

Imagine the following situation: someone "gifts" you a steam account with a cheap-ish game. Nothing majour, just like a 3 dollar game or somenthing. They launch the game and at 2, 3, 4 AM you connect to stream it. Then, with direct controll over the PC, you can exfiltrate passwords saved in their browser, install apps, download their files and many other malicous purposes. I am thinking on making a POC video, what do you guys think about this? Is it a real threat?

submitted by /u/StillPackage4369
[link] [comments]

hacking: security in practice
Anyone wants to join a CTF team?

Hi,

A while ago I started a small group to do some CTF (HTB/THM) and help each other. We did lose some as time went. Hacking is not for everyone. We take anyone who wants to learn and remain ethical (no illegal stuff). Don't ask how to do anything to hack a friend or any similar request as we will ban you right away. We need people in Asia, Europe and mostly North America.

The goal is to get an active community going to participate as an official team for CTFs.

submitted by /u/alexsuavex3
[link] [comments]

Hacking Articles|Raj Chandel's Blog
Wireless Penetration Testing: Detect Hidden SSID

IntroductionYou see an SSID, you connect to it and you on board a wireless network. But what if I wanted to prevent you from seeing my SSID and thus you are unable to connect? This can be done using Hide SSID option under your router settings. However, hiding is not always the best option to prevent attacks from happening because even while hidden an attacker can capture encrypted frames in monitor mode and know the SSID. We’ll see different methods by which we can detect hidden SSIDs around us. Table of Content<o:p1. What is SSID<o:p

2. Purpose to hide SSID<o:p

3. Configure Router to Hide SSID<o:p

4. Detecting Hidden SSID using airodump-ng <o:p

5. Detecting Hidden SSID using mdk3 <o:p

6. Detecting Hidden SSID using Wireshark<o:p

<o:p What is SSID<o:pSSID Service Set Identifier also known as Network name. It is the name given to identify wireless network. In the range of the wireless AP, SSID is detected by other wireless enabled devices as it is broadcast by wireless AP. Every packet sent over wireless network consists of SSID.<o:p Purpose to Hide SSID<o:pFrom Security Point of View. Hiding your SSID is to makes your Access Point invisible and attackers won’t try to attack this directly as this is less of a low hanging fruit. However, a smart attacker knows how to detect them.<o:p

Hiding an SSID simply refers to disabling the SSID broadcast feature of your Access Point. <o:p Configure Router to Hide SSID<o:pDifferent routers have different configuration settings. Please explore your router features accordingly and find the option to hide the SSID.<o:p

We are having T-Plink router so find the configuration steps accordingly. Let us head to our router settings, Under Wireless setting, Hide SSID option is there against Network Name (SSID), you just need to mark the tick.<o:p https://1.bp.blogspot.com/-JNahehVW6qc/YNjU3R7tAYI/AAAAAAAAw28/wnodbtYJ1eoBfQqi9EkoflgwYMFsm95LQCLcBGAsYHQ/s16000/1.png <o:p

Let’s Begin:<o:p

First Interface should be in the monitor mode. Simple command to convert the interface into monitor mode.<o:p airmon-ng start wlan0<o:p<o:p Detecting Hidden SSID using airodump-ng <o:p<o:pNow when an attacker would do a recon using airodump he’d see something like this:<o:p airodump-ng wlan0mon<o:phttps://1.bp.blogspot.com/-mwYU1GuuAqo/YNjU7UEBIhI/AAAAAAAAw3A/B7QFHw5sy0otxNeBc0ALoD0WD9wa3T7EACLcBGAsYHQ/s16000/2.png As you can see the SSID isn’t visible. Let’s scan this network using its BSSID.<o:p airodump-ng -c 6 --bssid D8:47:32:E9:3F:33 wlan0mon<o:phere, -c = channel 6 on which target is operating (see above screenshot)<o:p https://1.bp.blogspot.com/-DsxdWzjJviA/YNjU_XhEwGI/AAAAAAAAw3E/nUPudMp7meg_UoJz-udjAPQZg1ax9UuTgCLcBGAsYHQ/s16000/3.png Just wait for someone to reconnect. And sure enough, after waiting for a while we see that a client has connected and we are able to retrieve the SSID<o:p

<o:p https://1.bp.blogspot.com/-Gm3TJbe-pIU/YNjVEE75eLI/AAAAAAAAw3M/qHmz2k8ZdLgeYT2sQiAy7965NMvqBBwRQCLcBGAsYHQ/s16000/4.png Detecting Hidden SSID using mdk3<o:pmdk3 is an installable tool in Kali Linux. This tool hosts a feature to conduct offensive tests against Access Points and inject some purposefully constructed data to APs without associating to it. This injection can conduct tests against various vulnerabilities like DoS, deauth, WPA downgrade attacks etc.<o:p

Here, we’d use bruteforce technique against the target AP using mdk3.<o:p apt install mdk3<o:pmdk3 wlan0mon p -b l -c 6 -t D8:47:32:E9:3F:33<o:p

Here, p is the bruteforce mode (ESSID Probing)<o:p

-b : full bruteforc[...]