Hello everyone, sharing with you my first bug bounty write-up on how I was able to brute force an OTP (One Time Password) mechanism where…Continue reading on Medium » (https://bilalabdulmuqeet.medium.com/brute-forcing-otp-via-bypassing-rate-limit-c5ee6b25c2a8?source=rss------bug_bounty-5)

Deep Web
I fucked up

I tried accessing the dark web as a joke but later I saw link about a porn site I opened it and it said gotcha asshole trying to access child porn I swear I was just accessing that part of the web for fun am I gonna be in trouble are the police after me is my internet provider gonna get an email

submitted by /u/tahalifedive82
[link] [comments]

hacking: security in practice
“Expert” hackers used 11 0-days to infect Windows, iOS, and Android users

https://a.thumbs.redditmedia.com/OhOaTf_VpyLptd9GnVzR0v1g9SdHe9315clDxgR3538.jpg submitted by /u/woojoo666
[link] [comments]

hacking: security in practice
Relevance of CTF to real hacking

CTF is recommend here.

https://www.reddit.com/r/hacking/comments/a3oicn/how_to_start_hacking_the_ultimate_two_path_guide/

But it is not clear how relevant it is to real hacking. For example, it mentions reverse engineering below. How important it is to participate in rev CTF? It seems to be most of the CTF are made up. Do they really reflect the vulnerabilities binaries in real applications have?

https://youtu.be/8ev9ZX9J45A?t=105

​

It also mentions, pwn, crypto, web, misc in the video. It seems the only thing relevant is web.

​

Could anybody explain why the CTF matters for real applications? Thanks.

submitted by /u/qjYAN6lpHi
[link] [comments]

hacking: security in practice
SMTP enumeration - where am I going wrong?

I'm learning about some recon elements of a hacking strategy, with OSINT as my objective. I understand the principal of SMTP enumeration to identify email addresses that exist on a domain.

I'm figuring out how to use smtp-user-enum - the form that is pre-installed in Kali. I've troubleshot mostly everything and got the tool to work, but the results are weird. I'm running it against a mail server that I have permission to do so, and on which I know some of the existing email addresses. I created a short users.txt file containing some of the known users and some that definitely are not users.

When I run
smtp-user-enum -M VRFY -U user.txt -t <ip
Ir sets off scanning and then returns a line for every user in my wordlist:
<ip: <userexists


This is regardless of whether or not there is such a user exists. I get the same is I use
-u <single
and also if I use
-D <target
It just keeps telling me that everything I am checking for exists.

Am I missing something obvious?

submitted by /u/_Pohaku_
[link] [comments]

Invoke-SocksProxy - Socks Proxy, And Reverse Socks Server Using Powershell
http://www.kitploit.com/2021/03/invoke-socksproxy-socks-proxy-and.html

Creates a local or "reverse" Socks (https://www.kitploit.com/search/label/Socks) proxy using powershell. The local proxy is a simple Socks 4/5 proxy. The reverse (https://www.kitploit.com/search/label/Reverse) proxy creates a tcp tunnel by initiating outbond SSL connections that can go through the system's proxy. The tunnel can then be used as a socks proxy on the remote (https://www.kitploit.com/search/label/Remote) host to pivot into the local host's network.
Examples

Local
Create a Socks 4/5 proxy on port 1080: Import-Module .\Invoke-SocksProxy.psm1
Invoke-SocksProxy -bindPort 1080
Increase the maximum number of threads from 200 to 400 Import-Module .\Invoke-SocksProxy.psm1
Invoke-SocksProxy -threads 400

Reverse
Create a "reverse" Socks 4/5 proxy on port 1080 of a remote host: # On the remote host:
# Generate a private key and self signed cert
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout private.key -out cert.pem

# Get the certificate fingerprint (https://www.kitploit.com/search/label/Fingerprint) to verify it:
openssl x509 -in cert.pem -noout -sha1 -fingerprint | cut -d "=" -f 2 | tr -d ":"

# Start the handler
python ReverseSocksProxyHandler.py 443 1080 ./cert.pem ./private.key

# On the local host:
Import-Module .\Invoke-SocksProxy.psm1
Invoke-ReverseSocksProxy -remotePort 443 -remoteHost 192.168.49.130

# Go through the system proxy:
Invoke-ReverseSocksProxy -remotePort 443 -remoteHost 192.168.49.130 -useSystemProxy

# Validate certificate
Invoke-ReverseSocksProxy -remotePort 443 -remoteHost 192.168.49.130 -certFingerprint '93061FDB30D69A435ACF96430744C5CC5473D44E'

# Give up after a number of fail ed connections to the handler:
Invoke-ReverseSocksProxy -remotePort 443 -remoteHost 192.168.49.130 -maxRetries 10

Credit for the System Proxy trick: https://github.com/Arno0x/PowerShellScripts/blob/master/proxyTunnel.ps1
Limitations
This is only a subset of the Socks 4 and 5 protocols: It does not support authentication, It does not support UDP or bind (https://www.kitploit.com/search/label/BIND) requests. When the Socks Proxy runs out of available threads, new connections cannot be established until a thread is freed. New features will be implemented in the future. PR are welcome.
Disclaimer
This project is intended for security researchers and penetration testers and should only be used with the approval of system owners.

Download Invoke-SocksProxy (https://github.com/p3nt4/Invoke-SocksProxy)

Invoke-SocksProxy - Socks Proxy, And Reverse Socks Server Using Powershell

Creates a local or "reverse" Socks proxy using powershell. The local proxy is a simple Socks 4/5 proxy. The reverse proxy creates a tcp tunnel by initiating outbond SSL connections that can go through the system's proxy. The tunnel can then be used as a socks proxy on the remote host to pivot into the local host's network.Examples Local Create a Socks 4/5 proxy on port 1080: Import-Module .\Invoke-SocksProxy.psm1Invoke-SocksProxy -bindPort 1080 Increase the maximum number of threads from 200 to 400 Import-Module .\Invoke-SocksProxy.psm1Invoke-SocksProxy -threads 400 Reverse Create a "reverse" Socks 4/5 proxy on port 1080 of a remote host: # On the remote host: # Generate a private key and self signed certopenssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout private.key -out cert.pem# Get the certificate fingerprint to verify it:openssl x509 -in cert.pem -noout -sha1 -fingerprint | cut -d "=" -f 2 | tr -d ":"# Start the handlerpython ReverseSocksProxyHandler.py 443 1080 ./cert.pem ./private.key# On the local host:Import-Module .\Invoke-SocksProxy.psm1Invoke-ReverseSocksProxy -remotePort 443 -remoteHost 192.168.49.130 # Go through the system proxy:Invoke-ReverseSocksProxy -remotePort 443 -remoteHost 192.168.49.130 -useSystemProxy# Validate certificateInvoke-ReverseSocksProxy -remotePort 443 -remoteHost 192.168.49.130 -certFingerprint '93061FDB30D69A435ACF96430744C5CC5473D44E'# Give up after a number of fail ed connections to the handler:Invoke-ReverseSocksProxy -remotePort 443 -remoteHost 192.168.49.130 -maxRetries 10 Credit for the System Proxy trick: https://github.com/Arno0x/PowerShellScripts/blob/master/proxyTunnel.ps1 Limitations This is only a subset of the Socks 4 and 5 protocols: It does not support authentication, It does not support UDP or bind requests. When the Socks Proxy runs out of available threads, new connections cannot be established until a thread is freed. New features will be implemented in the future. PR are welcome. Disclaimer This project is intended for security researchers and penetration testers and should only be used with the approval of system owners. Download Invoke-SocksProxy
Read more...

Hacking on Medium
Hacking your way into the local ‘product’ design scene — A cheatsheet

https://cdn-images-1.medium.com/max/2600/0*tz7b7WHn_MeJ1P2W
Over the past couple of quarters, it’s been great to see tech and the startup scene in Pakistan pick up pace. Even with a mutating virus…

Continue reading on Medium »

KitPloit - PenTest Tools!
Invoke-SocksProxy - Socks Proxy, And Reverse Socks Server Using Powershell

https://1.bp.blogspot.com/-RhxNuVf5iGY/YE6JbQoBRYI/AAAAAAAAVnQ/B3RbMCLzpF8CNOd139Rg5tUxTt9MwBdrwCNcBGAsYHQ/w640-h318/proxy.png
Creates a local or "reverse" Socks proxy using powershell.

The local proxy is a simple Socks 4/5 proxy.

The reverse proxy creates a tcp tunnel by initiating outbond SSL connections that can go through the system's proxy. The tunnel can then be used as a socks proxy on the remote host to pivot into the local host's network.
Examples

Local

Create a Socks 4/5 proxy on port 1080:
Import-Module .\Invoke-SocksProxy.psm1
Invoke-SocksProxy -bindPort 1080

Increase the maximum number of threads from 200 to 400
Import-Module .\Invoke-SocksProxy.psm1
Invoke-SocksProxy -threads 400

Reverse

Create a "reverse" Socks 4/5 proxy on port 1080 of a remote host:
# On the remote host:
# Generate a private key and self signed cert
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout private.key -out cert.pem

# Get the certificate fingerprint to verify it:
openssl x509 -in cert.pem -noout -sha1 -fingerprint | cut -d "=" -f 2 | tr -d ":"

# Start the handler
python ReverseSocksProxyHandler.py 443 1080 ./cert.pem ./private.key

# On the local host:
Import-Module .\Invoke-SocksProxy.psm1
Invoke-ReverseSocksProxy -remotePort 443 -remoteHost 192.168.49.130

# Go through the system proxy:
Invoke-ReverseSocksProxy -remotePort 443 -remoteHost 192.168.49.130 -useSystemProxy

# Validate certificate
Invoke-ReverseSocksProxy -remotePort 443 -remoteHost 192.168.49.130 -certFingerprint '93061FDB30D69A435ACF96430744C5CC5473D44E'

# Give up after a number of fail ed connections to the handler:
Invoke-ReverseSocksProxy -remotePort 443 -remoteHost 192.168.49.130 -maxRetries 10


Credit for the System Proxy trick: https://github.com/Arno0x/PowerShellScripts/blob/master/proxyTunnel.ps1

Limitations

* This is only a subset of the Socks 4 and 5 protocols: It does not support authentication, It does not support UDP or bind requests.
* When the Socks Proxy runs out of available threads, new connections cannot be established until a thread is freed.
* New features will be implemented in the future. PR are welcome.

Disclaimer

This project is intended for security researchers and penetration testers and should only be used with the approval of system owners.
Download Invoke-SocksProxy

hacking: security in practice
How to farm views on sermon audio

I want to screw with my pastor and make it look like our live stream has 100+ viewers. I have no idea how to do it, though I’d imagine you can make a server run multiple views at a time. Does anyone know how to do this?

submitted by /u/Icy_aidsmaster
[link] [comments]

hacking: security in practice
Something good to show your friends that are still skeptical, get them thinking. Nothing youre unlikely to not understand already

https://b.thumbs.redditmedia.com/VkgbNrMRdFPizRaVe0Xh1Ykk8rz-SkJO6oyY0q5e7Cc.jpg submitted by /u/Whatevernameisnt
[link] [comments]

hacking: security in practice
Worth noting. Lots of good points

https://b.thumbs.redditmedia.com/7VUksI6SbAoPAxCVBBK5_0H2hipE3soAbacu0I2iD2Q.jpg submitted by /u/Whatevernameisnt
[link] [comments]

hacking: security in practice
Forgot password IG hack not working

So there’s a weird account that dms me and has no followers or anything. It only follows me. I usually attempt to login by typing their username and clicking on forgot password just to get some info on the email address they are using. It works with every account even international ones but for this specific account when I click on “next” nothing happens. It just refreshes and no messenge pops us telling me of an error or of an email was sent. Why do you think that is?

As I’m writing this I am thinking that maybe it’s because they don’t have an email attached but used their phone number. Lol idk

submitted by /u/RevolutionaryDot6205
[link] [comments]