hacking: security in practice
What’s the worst that can happen with reflected XSS?

I’ve found an issue in a web app where I can use a parameter in the url for reflected XSS. But I don’t know how big of an issue is it?

I want to know so I can cash on the report in the same way.

submitted by /u/andenate08
[link] [comments]

How Not to Get Hacked on Telegram
https://medium.com/immunefi/how-not-to-get-hacked-on-telegram-2db2b93a5fa2?source=rss------bug_bounty-5

The lightweight chat client Telegram is one of the most common methods of communication in crypto, and there’s a good reason for that. SIM…Continue reading on Immunefi » (https://medium.com/immunefi/how-not-to-get-hacked-on-telegram-2db2b93a5fa2?source=rss------bug_bounty-5)

Is port scanning on external pentest still relevant?
https://www.reddit.com/r/Pentesting/comments/osxmm1/is_port_scanning_on_external_pentest_still/

<!-- SC_OFF -->Do you still perform port scanning on external pentest? Or do you just focusing on web app testing only? The reason I'm asking this is port scanning doesn't seems so efficient nowadays as there are more security devices protecting the parameter such as firewall, waf, etc. I used to get immediate result, but nowadays it takes like forever for certain site. <!-- SC_ON --> submitted by /u/w0lfcat (https://www.reddit.com/user/w0lfcat)
[link] (https://www.reddit.com/r/Pentesting/comments/osxmm1/is_port_scanning_on_external_pentest_still/) [comments] (https://www.reddit.com/r/Pentesting/comments/osxmm1/is_port_scanning_on_external_pentest_still/)

Hacking on Medium
How Not to Get Hacked on Telegram

https://cdn-images-1.medium.com/max/2600/1*TJMlSskm4YqOhY2WDz5UkA.jpeg
The lightweight chat client Telegram is one of the most common methods of communication in crypto, and there’s a good reason for that. SIM…

Continue reading on Immunefi »

Hacking on Medium
47 Insanely Useful Websites You Probably Have Never Seen

https://cdn-images-1.medium.com/max/612/0*cnKxVcS5HG90eA-L
These websites will give you a jaw-dropping experience, and you will embrace the ~world wide~ web even more.

Continue reading on Medium »

How Not to Get Hacked on Telegram

The lightweight chat client Telegram is one of the most common methods of communication in crypto, and there’s a good reason for that. SIM…Continue reading on Immunefi »
Read more...

hacking: security in practice
Anyone have any troubleshooting tips for a rubber ducky??

So I've been messing around with my own laptops with a rubber ducky and have gotten to execute a script to download a payload from a server and have netcat listen for a connection. I have had it work wonderfully and on multiple occasions over the past week and now, all of a sudden, it won't work. I've noticed that the file is now downloaded maybe once every 3 times and the connection is never fully made to netcat. My target system is Windows 10 while my host system is running Kali Linux. It's a simple command to run a PowerShell script hidden to download and execute a ps1 file from a specific webserver. I've only been using it internally on my network.

submitted by /u/Caddburry00
[link] [comments]

Hacking on Medium
Healthcare VulnHub Writeup

https://cdn-images-1.medium.com/max/1649/1*lzBq07WHid4t3liTpxreiA.png
This was a fun box. Given that my main occupation is in healthcare, it seemed fitting that I should attempt it. It was a fun box, but very…

Continue reading on Medium »

Hacking on Medium
How to measure and compare flashlights.

https://cdn-images-1.medium.com/max/2600/1*apwjRi2P-tvmBuY9Mxge2w.jpeg
Flashlights are available in a huge variety of sizes and shapes and power. Since, we review flashlights in our publication, an independent…

Continue reading on Friends of the 2nd Amendment »

Hacking Articles|Raj Chandel's Blog
Metasploit for Pentester: Clipboard

In this series of articles, we will be focusing on the various mechanisms of the Metasploit Framework that can be used by Penetration Testers. Here, we will be discussing about the External API extension provided by the Metasploit.  Among other things it provides the ability to target the clipboard of the target. Table of Content· Introduction· Starting Clipboard Monitoring· Getting a File from Clipboard· Dumping Clipboard Data· Pausing the Clipboard Capture· Purging Clipboard Capture· Setting Clipboard Data· Stopping Clipboard Capture· ConclusionDuring the late 2014s the Metasploit got an update featuring a functionality similar to the OJ TheColonial Reeves Extended API (extapi). It is originally intended for the Windows targets only, but it was refined and developed over time. It included 3 functionalities:load extapi Starting Clipboard MonitoringThis module doesn’t not indefinitely capture the clipboard data as the clipboard gets overwritten time to time as soon as the target copies another data into the memory. This data can range from text to files. It is surprising the amount of data that can be obtained from the clipboard. To initialize the capture, we will use the clipboard_monitor_start command.clipboard_monitor_start Getting a File from ClipboardAfter starting the clipboard monitoring using the command in the previous section, we move to our target machine to stimulate the Copying of files. Here we can see that inside a directory we are copying a PowerShell script file named openssh. It is quite possible that [...]

___________________________
@hacking_Attack
@Hacking_Video

it might contain a key that can be used to connect via SSH service.clipboard_get_data Dumping Clipboard DataWe just grabbed a singular file from the target but what if we want to get multiple files that are copied on its clipboard. To stimulate this, we again get back to the target machine. Here, we see that the target has an image file, text file and an application file inside a directory by the name of data. As target user, we copied all the files inside the directory.clipboard_monitor_dump Pausing the Clipboard CaptureIt is possible to get a large capture that could result into a failure and the amount of data transfer can raise some flags. Hence, it is recommended to pause the capture when you are not actively gathering the clipboard data from the target machine. If you ever want to un pause the capture, use the resume command.clipboard_monitor_pause Purging Clipboard CaptureNext command to discover is another that can help while working with the clipboard data. The amount of data captured by the clipboard can be overwhelming or maybe you just want to remove the captured data altogether. In such scenarios, you can use the purge command. In the demonstration we tried to dump the capture after running the purge and we can see that there is no data in the capture.clipboard_monitor_purge Setting Clipboard DataWhile introducing the clipboard commands, we said that it is possible to set the clipboard of the target machine as well. We need to use the set text command for this task. We take the text that we want to be stored inside the clipboard of the target user and then use it as a parameter between the double quotes as demonstrated in the image below. clipboard_set_text “You have been hacked”https://1.bp.blogspot.com/-BtVGrfoozzw/YQDnWt2YIMI/AAAAAAAAx48/8Lb7KdYsG008QjIB8nqiMTqqASbpqPnYQCLcBGAsYHQ/s16000/10.png Stopping Clipboard CaptureSimilar to the Pausing of the Clipboard. [...]

___________________________
@hacking_Attack
@Hacking_Video

There is a command to stop the capture altogether. The difference between the both is that while Paused capture can be resumed but the stopped cannot be resumed and the data that is captured is not accessible after the fact. clipboard_monitor_stop ConclusionConcluding this article, we can say that this was one of the lesser-known mechanism of the Metasploit Framework that can be used by any Penetration Tester. We will be discussing about the External API extension provided by the Metasploit later.___________________________
@hacking_Attack
@Hacking_Video