Deep Web
Hi, wondering if any of you could help me find a video that I discovered while surfing about a year ago. The video was titled the curse of Matthew. It was over an hour and 20 minutes long I believe.it was a really weird black and white video. I’ll describe more in the comments due to the 300 limit.

submitted by /u/THEULTRAVIOLENTDROOG
[link] [comments]

hacking: security in practice
How to make an chrome extension undetectable from a website?

I want to use my custom made chrome extension on a website. But the website is not allowing me to use chrome extensions and will only let me in if there are no extensions. How can i make my chrome extension undetectable. Currently my chrome extension is injecting a simple js code in that website.

submitted by /u/prathamvaidya
[link] [comments]

hacking: security in practice
I'm new to hacking and I find this field really interesting. Where and how should I start learning ? I really don't want to be a script kiddie

Uh... so I'm new to this and I really like it. But I also found that this is a vast field and quite difficult to navigate. I have basic programming knowledge and I know C and C++ and a bit of python . Should I start learning some more languages ? What should I do ?

submitted by /u/DevasmitaReddit
[link] [comments]

How I was able Find mass leaked AWS s3 bucket from js File
https://notifybugme.medium.com/how-i-was-able-find-mass-leaked-aws-s3-bucket-from-js-file-6064a5c247f8?source=rss------bug_bounty-5

Hi, everyoneContinue reading on Medium » (https://notifybugme.medium.com/how-i-was-able-find-mass-leaked-aws-s3-bucket-from-js-file-6064a5c247f8?source=rss------bug_bounty-5)

How I was able Find mass leaked AWS s3 bucket from js File

Hi, everyoneContinue reading on Medium »
Read more...

Hacking on Medium
On SSRF (Server Side Request Forgery) or Simple Stuff Rodolfo Found — Part I

https://cdn-images-1.medium.com/max/1019/1*wp4r9l-wI-TlkKnJDbJn6g.jpeg
I think the most we have to test against an application the better. But as you can see by yourself (correct me if I’m wrong please) the…

Continue reading on Medium »

Hacking on Medium
How I was able Find mass leaked AWS s3 bucket from js File

https://cdn-images-1.medium.com/max/2600/1*S4ajjFwLjKin4nxFuxFhkQ.png
Hi, everyone

Continue reading on Medium »

Hacking on Medium
Researchers Discovered The New Threat Group Targeting Linux Servers For Crypto Jacking.

https://cdn-images-1.medium.com/max/900/0*ARtLvjxRTbXS9abJ
Security researchers from Bitdefender have identified a new threat group targeting Linux machines which are configured with weak…

Continue reading on Medium »

Hacking on Medium
How Biohackers Try to Update Their Minds, Bodies, and Human Nature

https://cdn-images-1.medium.com/max/1125/0*aM51DFGNbvFW-2r2
You have probably even come across some version when you have not heard the term “biohacking” before. You may have seen Twitter CEO Jack…

Continue reading on Medium »

Hacking on Medium
Error de seguridad de 16 años que afecta a millones de impresoras HP, Samsung y Xerox.

https://cdn-images-1.medium.com/max/830/0*aFldaMt5iT-joyMN
POR EHACKING

Continue reading on Medium »

Is this a good career path?
https://www.reddit.com/r/Pentesting/comments/ooai0t/is_this_a_good_career_path/

<!-- SC_OFF -->Currently work as a pentester and thinking of giving it up to go back to the devsecops work I was doing previously. From what I've seen and from talking to others in the field most of assessments have involved just running nessus scans and calling it a pentest or just performing one for the compliance check box. I have also dealt with plenty of clients that claim everything is a false positive and argue everything. Is this the norm? Anyone have a different perceptive or have any advice? <!-- SC_ON --> submitted by /u/mountainhacker1 (https://www.reddit.com/user/mountainhacker1)
[link] (https://www.reddit.com/r/Pentesting/comments/ooai0t/is_this_a_good_career_path/) [comments] (https://www.reddit.com/r/Pentesting/comments/ooai0t/is_this_a_good_career_path/)

Deep Web
can you please let people help me or you tell me on which page can i ask that

for the final thesis I am working on the topic of deep web and economics, so the central part of the thesis must be about economics. Can anyone tell me what I could write about? I've been thinking about cryptocurrencies, I'm just not sure.

submitted by /u/No-Addendum-1842
[link] [comments]

Allsafe - Intentionally Vulnerable Android Application
http://www.kitploit.com/2021/07/allsafe-intentionally-vulnerable.html

Allsafe is an intentionally vulnerable application (https://www.kitploit.com/search/label/Vulnerable%20Application) that contains various vulnerabilities. Unlike other vulnerable Android apps, this one is less like a CTF and more like a real-life application that uses modern libraries and technologies. Additionally, I have included some Frida based challenges for you to explore. Have fun and happy hacking!
Useful Frida Scripts
I have my Frida scripts (more like templates) in other repository. I'm sure they might be quite handy for the Frida related tasks. Check it out: https://github.com/t0thkr1s/frida
Tasks / Vulnerabilities

1. Insecure Logging
Simple information disclosure (https://www.kitploit.com/search/label/Information%20Disclosure) vulnerability. Use the logcat command-line tool to discover sensitive information.
Resources & HackerOne Reports:
Logcat Tool (https://developer.android.com/studio/command-line/logcat) Coinbase OAuth Response Code Leak (https://hackerone.com/reports/5314)
2. Hardcoded Credentials
Some credentials are left in the code. Your task is to reverse engineer (https://www.kitploit.com/search/label/Reverse%20Engineer) the app and find sensitive information.
Resources & HackerOne Reports:
Zomato Hardcoded Credentials (https://hackerone.com/reports/246995) 8x8 Hardcoded Credentials (https://hackerone.com/reports/412772) Reverb Hardcoded API Secret (https://hackerone.com/reports/351555)
3. Root Detection
This is purely for Frida practice. Make the code believe that you device is not rooted!
4. Arbitrary Code Execution
Loading modules securely with third-party apps are not easy. Write a PoC application and exploit the vulnerability!
Resources & HackerOne Reports:
Arbitrary Code Execution via Third-Party Package Contexts (https://blog.oversecured.com/Android-arbitrary-code-execution-via-third-party-package-contexts/)
5. Secure Flag Bypass
Another Frida-based task. No real vulnerability (https://www.kitploit.com/search/label/Vulnerability) here, just have fun bypassing the secure flag!
Resources & HackerOne Reports:
Android FLAG_SECURE Reference (https://developer.android.com/reference/android/view/WindowManager.LayoutParams#FLAG_SECURE)
6. Certificate Pinning (https://www.kitploit.com/search/label/Certificate%20Pinning) Bypass
Certificate pinning is implemented using the OkHttp library. You have to bypass it in order to view the traffic with Burp Suite.
Resources & HackerOne Reports:
Certificate and Public Key Pinning (https://owasp.org/www-community/controls/Certificate_and_Public_Key_Pinning) Coinbase Vulnerabilities (https://hackerone.com/reports/5786)
7. Insecure Broadcast Receiver
There's a vulnerable broadcast recevier in the application. Trigger it with the correct data and you're done!
Resources & HackerOne Reports:
Android Broadcasts Overview (https://developer.android.com/guide/components/broadcasts) ok.ru Broadcast Receiver Exploitation (https://hackerone.com/reports/97295) Bitwarden Vulnerable Broadcast Receiver (https://hackerone.com/reports/289000)
8. Deep Link Exploitation
Similar to the insecure broadcast receiver, you need to provide the right query parameter to complete this task!
Resources & HackerOne Reports:
Android Deep Linking (https://developer.android.com/training/app-links/deep-linking) Grab Insecure Deep Link (https://hackerone.com/reports/401793) Periscope Deep Link CSRF (https://hackerone.com/reports/583987)
9. SQL Injection
Just a regular SQL injection that you'd find in web applications. No need to reverse the code to bypass the login mechanism.
Resources & HackerOne Reports:
SQL Injection in Content Provider (https://hackerone.com/reports/291764) Show me how it's done!
# TODO


10. Vulnerable WebView
You can also complete this task without decompiling the application. Pop an alert dialog and read files!
Resources & HackerOne Reports: