Chaining Open Redirect with XSS to Account Takeover
https://radianid.medium.com/chaining-open-redirect-with-xss-to-account-takeover-36acf218a6d5?source=rss------bug_bounty-5

Hello everyone, I hope you are well. In this article I will show you how I escalated XSS to Account Takeover. Since the target is private…Continue reading on Medium » (https://radianid.medium.com/chaining-open-redirect-with-xss-to-account-takeover-36acf218a6d5?source=rss------bug_bounty-5)

Chaining Open Redirect with XSS to Account Takeover

Hello everyone, I hope you are well. In this article I will show you how I escalated XSS to Account Takeover. Since the target is private…Continue reading on Medium »
Read more...

Hacking on Medium
Defending servers from Attack Bots

https://cdn-images-1.medium.com/max/1920/1*avT6thhgNvXM_zDm3RJ1vg.jpeg
Before we jump right in I need to be clear about on thing. This is not a hacking tutorial and in no way am I promoting the idea of hacking…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Shells in Exploitation

https://cdn-images-1.medium.com/max/1298/1*Ius_IcOEPadpFx-x6Y5GBQ.png
Reverse Shell

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The Journey of Web Application

https://cdn-images-1.medium.com/max/2600/0*0lhEqM9QbSqVyhJT
Perubahan Web Aplikasi dari Era Jadul sampai Zaman Now

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Reboot of PunkSpider Tool at DEF CON Stirs Debate

https://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Reboot of PunkSpider Tool at DEF CON Stirs DebatePost Views: 81
Reading Time: 1 Minute
Researchers will release a reboot of a controversial tool that crawls the web to identify back-end vulnerabilities in websites in the hopes that companies will quickly fix them and reduce security risks.
However, experts have mixed feelings about the tool called PunkSpider, created by the analytics firm QOMPLX. They fear the tool could be hijacked by hackers to exploit vulnerabilities before companies have time to patch them.

Alejandro Caceres, director of computer network exploitation at QOMPLX, and hacker Jason Hopper will introduce a revamped version of PunkSpider at the upcoming DEF CON gathering next week.

QOMPLX cited the rise of ransomware as one of the reasons for a reboot of PunkSpider, which provides “a simple and massively scalable monitoring tool that quickly identifies gaps in collective defenses by highlighting which websites can easily fall prey to attackers,” according to a press release.  The tool can provide internet users and the cyber community a “shared perspective” on the specific dangers of the web, the company said.

“We want everyone to be able to answer a simple question: how dangerous is the internet I use?” said Jason Crabtree, CEO of QOMPLX, said in a press statement “Our extensive research revealed a large but unfortunately not surprising number of basic vulnerabilities across the web. The common exploits that PunkSpider detects serve as a key proxy for risk overall, and frankly if website owners are not fixing the fundamentals it’s unlikely they’re fully addressing bigger vulnerabilities.”
See Also: Microsoft: New Unpatched Bug in Windows Print Spooler Back by Popular Demand?Caceres and Hopper said demand was another reason to update and reintroduce the tool after a years-long hiatus, adding that myriad issues and negative attention forced the tool, originally funded by the Defense Advanced Research Projects Agency, into hibernation.

“We’ve been getting asked a lot for ‘that tool that was like Shodan but for web app vulns,’” they wrote in a write-up for their session at DEF CON. “PunkSpider … was taken down a couple of years ago due to multiple … issues and threats. We weren’t sure in which direction to keep expanding, and it ended up being a nightmare to sustain.”

The new and improved PunkSpider is a “completely re-engineered” system that also expands the capabilities of the tool to find vulnerabilities, they wrote.

“It is not only far more efficient with real-time distributed computing and checks for way more vulns, we [also] had to take some creative ways through the woods,” Caceres and Hopper wrote.

The new tool in fact will have its own dedicated ISP and data center in Canada to integrate “freely available data that anyone can get but most don’t know is available,” they said. The data they refer to will be a massive collection of known web vulnerabilities.

Caceres and Hopper also plan to release tens of thousands of vulnerabilities at the conference and will ask for suggestions about what to search for to uncover even more. See Also: Offensive Security Tool: VoIPmonitor Sniffer Bug Bounty Bonanza?As its creators know well, not everyone is thrilled about PunkSpider’s comeback, however.

In comments emailed to Wired, Electronic Frontier Foundation analyst Karen Gullo said that while the folks behind PunkSpider have “good intentions,” making the vulnerabilities public could backfire and have the opposite effect that its creators intended.

“Making th[...]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Penetration Testing alone cannot identify the maximum number of vulnerabilities in an application.

___________________________
@hacking_Attack
@Hacking_Video

em public might be the thing that pushes administrators to fix [these vulnerabilities]. But we don’t recommend it,” she told Wired. “Bad actors can exploit the vulnerabilities faster than administrators can plug them, leading to more breaches.”

And while many on Twitter have voiced support for the tool—with cybersecurity expert Stephen Frei observing that “you can’t manage what you can’t measure”– critics also took to the social-media platform to express consternation about PunkSpider.

One suggested that it may limit the opportunity for ethical hackers to win rewards for finding vulnerabilities that companies currently give them. “Ok so maybe I’m dumb but doesn’t a tool like this make bug bounties pointless?” questioned Twitter user @thedragonisreal. See Also: Hacking Stories: Andrian Lamo – The ‘homeless’ Hacker A reply to the Tweet countered that PunkSpider certainly won’t pick up every vulnerability, so there will still be plenty for ethical hackers and researchers to dig up and submit to company’s vulnerability-reward programs.

Another Twitter user raised an ethical issue with the tool, suggesting it is needlessly calling out site insecurities without proof that companies respond accordingly and make necessary changes to protect themselves.

“Not sure if exposing sites like this is a good idea without data showing it lead to meaningful changes the first time around,” tweeted a user called @cypnk who is in the medical hardware industry. “If it didn’t, then it’s needlessly malicious.”
Source: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/apple-mac-security-90x90.jpg Apple Patches Actively Exploited Zero-Day in iOS, MacOS1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/Windows-Abstract-90x90.jpg Microsoft Rushes Fix for ‘PetitPotam’ Attack PoC2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/Ransomware-Key-90x90.jpg Kaseya Obtains Universal Decryptor for REvil Ransomware3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/Atlassian-Jira-90x90.png Critical Jira Flaw in Atlassian Could Lead to RCE6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/Copy-of-Untitled-90x90.png MacOS Being Picked Apart by $49 XLoader Data Stealer1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/printer-1-90x90.jpg 16-Year-Old HP Printer-Driver Bug Impacts Millions of Windows Machines1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/p1050753-e1537277708291-90x90.jpg Leaked NSO Group Data Hints at Widespread Pegasus Spyware Infections1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/Microsoft-Office-90x90.jpg Microsoft: New Unpatched Bug in Windows Print Spooler1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/linkedin_generic-90x90.jpg Safari Zero-Day Used in Malicious LinkedIn Campaign2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/Windows-Hello-e1626260072511-90x90.jpg Windows Hello Bypass Fools Biometrics Safeguards in PCs2 weeks ago
style="display:block; text-align:center;"
data-ad-layout="in-article"
data-ad-format="fluid"
data-ad-client="ca-pub-6620833063853657"
data-ad-slot="4517761481">
The post Reboot of PunkSpider Tool at DEF CON Stirs Debate first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Passing Google OTP?

I have noticed that it seems to be getting harder and harder to make a new Google account without having to add a phone number. I have no problem with a second e-mail, but my phone number is something I dont want to be spreading too much.

Before, you could select to skip adding a phone number. I do not see that option anymore. The logical thing then would be to use an online SMS receiver to skip the OTP. The problem with this is that I have tried numerous websites and phone numbers, Google either says that those numbers are being used too much or that it is not possible to verify with 'this' number.

I read about trying it in a phone browser, which I tried but also didn't work. I am not sure what to do anymore, so I was wondering if anyone over here might know something about it!

Thank you for your time.

submitted by /u/CaffeineAndKush99
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How unique am I?

It is possible to tell how unique your digital fingerprint is, say compared to the average chrome user? If so, how, what can I use and what is the best way to make myself less unique?

P.S. out of curiosity how secure, safe and unique would running tor in tails in a vm on Mac with a VPN be? (I thought of cybersecurity and put together the first thing that popped in my head)

submitted by /u/theUnholyVenom
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Stolen MacBook

Hi! I have big issue, my MacBook was “stolen”. I sold it to a guy that give me fake dollar bills, absolutely stunning replicas for sure. I’m from Argentina and is not normal of this things to happen, I guess I’m very unlucky. Anyways, is a possibility of somehow to track my MacBook with the serial number? I obviously “try find my Mac” but I give the Mac like it was brand new, ready to use with out any app or information of mine.

Have a nice day🤙🏼

submitted by /u/OG-NISMAN
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Keybase group

Hi everyone.

I've created a group on keybase titled cybercommand. No, it has nothing to do with any government or anything. Just the name of a group.

Not much activity going on now but we do have some people there.

You can join using one of the two links:

- Website : https://keybase.io/team/cybercommand

- From app: keybase://team-page/cybercommand

submitted by /u/__Th3J0k3r__
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Can we know who was the intruder in a zoom meeting?

When we had our class zoom meeting today, someone entered and played an audio disturbing the class, so I would like to know is there anyway to know who is it or which device they use or location or anything so that we can track him next time, plzz someone kindly help. Thanks in advance.

submitted by /u/ReignofOptimus
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Apron Supports Mina Ecosystem With Node Service And Opens Apron Bug Bounty Program
https://apron-network.medium.com/apron-supports-mina-ecosystem-with-node-service-and-opens-apron-bug-bounty-program-84316e56953c?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video