How I found my first IDOR in HackerOne

In the name of Almighty, Allah, i begin. This write up is about how I found my first IDOR in HackerOne and got my first swag.Continue reading on Medium »
Read more...

GraphQL Top 10 Series: A1 — Broken Object-Level Authorization

Is it so hard to apply Access Controls rightly? Turns out to be true! Let me show you the most dangerous of all vulnerabilities in API…Continue reading on Medium »
Read more...

KitPloit - PenTest Tools!
CredPhish - A PowerShell Script Designed To Invoke Legitimate Credential Prompts And Exfiltrate Passwords Over DNS

http://4.bp.blogspot.com/-elK0-Q4cpm8/YQG8kRJ_3uI/AAAAAAAAozM/9MpPvJRRTjYk-XWlFy_shY1RhF2xTTmIgCK4BGAYYCw/w640-h272/CredPhish_1_credphish-752010.gif
CredPhish is a PowerShell script designed to invoke credential prompts and exfiltrate passwords. It relies on CredentialPicker to collect user passwords, Resolve-DnsName for DNS exfiltration, and Windows Defender's ConfigSecurityPolicy.exe to perform arbitrary GET requests.
For a walkthrough, see the Black Hills Infosec publication.
Download CredPhish

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Самый маленький PHP shell

https://cdn-images-1.medium.com/max/1000/1*9jkvgrFN74u30i-DAaACzg.jpeg
Или атаки хакеров на PHP в 2021 году

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Los piratas informáticos chinos implantan la variante PlugX en servidores MS Exchange comprometidos.

https://cdn-images-1.medium.com/max/941/0*EiBZfqOvQnvdv9Pp
POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Chill Hack — Tryhackme.com

https://cdn-images-1.medium.com/max/600/0*HAcBbY4QEIVkXLz-.png
Room link: https://tryhackme.com/room/chillhack

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
EDR Research

Notes on EDR detection, ongoing

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
Any .onion forum recommendations other than the basic ones like Dread?

submitted by /u/artemis123159
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
options to prolong an android/meterpreter/reverse_tcp knowing it will soon be removed from target device?

my coworker and i are having a lazy day and experimenting with metasploit, though we were curious about the fact that once we have an active session, what's to stop someone from adding another apk/exploit/persistence script? .. and what would be one of the most common setups if someone were to remove the original backdoor and you wanted to keep it active and that person unaware? would love to hear your thoughts.

submitted by /u/RyansRad
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

How I could have hacked your medium account by phishing your FB, Twitter & Google credentials.
https://infosecwriteups.com/how-i-could-have-hacked-your-medium-account-by-phishing-your-fb-twitter-google-credentials-d53bf7096da7?source=rss------bug_bounty-5

Hi There,Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/how-i-could-have-hacked-your-medium-account-by-phishing-your-fb-twitter-google-credentials-d53bf7096da7?source=rss------bug_bounty-5)

Hacking on Medium
How I could have hacked your medium account by phishing your FB, Twitter & Google credentials.

https://cdn-images-1.medium.com/max/1054/1*W1NFv8wSKfxHJvnK1oLKbw.png
Hi There,

Continue reading on InfoSec Write-ups »

Hacking on Medium
TryHackMe: Bolt walkthrough

https://cdn-images-1.medium.com/max/1913/1*rysr796Fq3_M7vPQ0Zev1Q.png
Hello People, In this write up I have covered a walkthrough for the Tryhackme box called “Bolt”. So let’s get started.
Link…

Continue reading on Medium »