Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Why don't companies or webservices check users' new passwords against the main publicly known wordlists before accepting them? (Or do some?)

I am farely new to all the cyber security and one of the first things I saw is that you don't just brute force hashes but work with wordlists to break the most common passwords (like "p4ssw@rd" for example) in very little time. As a company i would assume that, in case of a data breach or an attack against employees, hackers would check the whole list of accounts against the most commenly known wordlists (like prepacked in kali) before anything else. Why dont they check new password against those wordlists or on "have I been pwned" to prevent those bad ones that still fulfill their password rules?

Is it to computationally intensive to be done for every user (not soo many users to manage in a single company i guess) or is it to much of an inconvenience for the user to maybe wait a few seconds for the safety check to be done? Or is it maybe not so much of an improvement in security as I think? Maybe it is even against the law to try to break their chosen password?
I personnaly never experienced waiting time for my password to be checked or a warning like a password fulfilling the rules but being to weak anyway so I assume it is not common practice.

submitted by /u/Redditblobster
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

r/hacking - Why don't companies or webservices check users' new passwords against the main publicly known wordlists before accepting…

1 vote and 1 comment so far on Reddit

9 viewsedited 22:03

10 views22:04

Hacking Articles Tips Tricks Videos Tutorials

Photo

hacking: security in practice
Pegasus Spyware - Is it really possible to completely hack a mobile device just with a text message?

After extensive research by OCCRP, The Guardian, and other reliable sources, the investigators have confirmed that 10 governments have been spying on their journalists, activists, businesspeople, and even government officials using software developed by an Israeli cyber firm NSO group. You can read about it here: https://www.occrp.org/en/the-pegasus-project/

I personally know a lot of people (mainly journalists) who were victims, and after Amnesty International Security Office did an analysis on their phone, they found the Pegasus app itself, if not its traces showing that the software deleted itself for not exposing it to the owner. The owners knew the government might have been listening to them (e.g. intercepting cellular signals or not even need to think deeply, all cell carriers are compromised), but they had no idea such an app could have been installed in their phone. Most of them were also very practical at security, not clicking any links even from friends or using only anonymous chatting apps.

Then I saw this video by The Guardian. In the first minute, it tells how the software can be injected into the operating system just by a text message. I have been doing programming for many years now, even got into learning some hacking, but I can't think of a proper way that there is such thing as hacking only with a text message. The only such vulnerability would mean the OSs themselves have a big security issue (don't know the mobile term for this, but something like XSS injection), but that is of very low probability. Nowadays all updated versions of the mobile OS even ask for permissions for all apps, so I cannot really believe how this happened. I would like to hear what do you think about it. Is such hacking really possible?

submitted by /u/BarishNamazov
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

From the hacking community on Reddit: Pegasus Spyware - Is it really possible to completely hack a mobile device just with a text…

Explore this post and more from the hacking community

12 viewsedited 22:04

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
How to crack username with ssh key?

I managed to get a ssh key from an (authorized) nfs server, now i want to crack the ssh username but i don't know how to pass my prívate key to the cracker(i'm currently using hydra) how can i do it?

submitted by /u/tuviejaentanga37
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

r/hacking - How to crack username with ssh key?

0 votes and 0 comments so far on Reddit

9 viewsedited 22:04

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Guys, so I wanted to ask about a real-life experience you had of the cyber-attacks exploiting a VPN connection to get into a network.

To make things clear, basically, I want to get multiple scenarios that happened in your experience with preventing cyber-attacks where VPN IPsec or SSL VPN were exploited (it doesn't matter what specifically). To clarify, due to a pandemic decent amount of companies started using a VPN for their employees, and I want to go through what can happen and what happened based on your experience and how you prevented it.

PS. just curious ))

submitted by /u/rubenamizyan
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

r/hacking - Guys, so I wanted to ask about a real-life experience you had of the cyber-attacks exploiting a VPN connection to get…

0 votes and 0 comments so far on Reddit

9 viewsedited 22:04

Hacking Articles Tips Tricks Videos Tutorials

Pentesting iOS| Starting With iOS Emulator Corellium & Re-signing IPA

Corellium provided virtual iOS-based devices for individual accounts on our groundbreaking security research platform, CORSEC. Corellium’s…Continue reading on InfoSec Write-ups »
Read more...

9 views22:15

Hacking Articles Tips Tricks Videos Tutorials

MANSPIDER - Spider Entire Networks For Juicy Files Sitting On SMB Shares. Search Filenames Or File Content - Regex Supported!
http://www.kitploit.com/2021/07/manspider-spider-entire-networks-for.html

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

MANSPIDER - Spider Entire Networks For Juicy Files Sitting On SMB Shares. Search Filenames Or File Content - Regex Supported!

9 viewsedited 22:22

Hacking Articles Tips Tricks Videos Tutorials

8 views22:22

Hacking Articles Tips Tricks Videos Tutorials

Crawl SMB shares for juicy information. File content searching + regex is supported!

___________________________
@hacking_Attack
@Hacking_Video

7 viewsedited 22:22

Hacking Articles Tips Tricks Videos Tutorials

7 views22:22

Hacking Articles Tips Tricks Videos Tutorials

File types supported:
PDF DOCX XLSX PPTX any text-based format and many more!!
MAN-SPIDER will crawl every share on every target system. If provided creds don't work, it will fall back to "guest", then to a null session.

___________________________
@hacking_Attack
@Hacking_Video

7 viewsedited 22:23

About

Blog

Apps

Platform