Hacking on Medium
Ice — TryHackMe Walkthrough in easy steps using Metasploit

https://cdn-images-1.medium.com/max/1017/1*pwEM3f4QtIxcAcMgRPzK1A.png
Hey, I am Rahul Bhichher a noob in Cyber Security same like you! This is my first write-up about TryHackMe rooms.

Continue reading on NetworkingSec »

Hacking on Medium
Explicando o csrf(Cross-site Request Forgery), o’que e? Como executar? E etc

https://cdn-images-1.medium.com/max/849/1*mgHzeEcVexyTBm_6ZcceaA.png
Nesse artigo explicarei como funciona um csrf e como se faz a verificação de tal falha de segurança.

Continue reading on Medium »

403Bypasser - Automates The Techniques Used To Circumvent Access Control Restrictions On Target Pages
http://www.kitploit.com/2021/09/403bypasser-automates-techniques-used.html

403bypasser automates the techniques used to circumvent access control restrictions (https://www.kitploit.com/search/label/Restrictions) on target pages. 403bypasser will continue to be improved and it is open to contributions.
Installation
Clone the repository to your machine. git clone https://github.com/yunemse48/403bypasser.git Install required modules by running the code pip install -r requirements.txt READY!
Usage
Arguments:
Argument Description Examples Note -u single URL to scan http://example.com (http://example.com/) or http://example.com/ All these example usages are interpreted in the same way -U path to list of URLs ./urllist.txt, ../../urllist.txt, etc. Just provide the path where the file is located :) -d single directory to scan admin or /admin or admin/ or /admin/ All these example usages are interpreted in the same way -D path to list of directories ./dirlist.txt, ../../dirlist.txt, etc. Just provide the path where the file is located :) Usage 1: python3 403bypasser.py -u https://example.com -d /secret
Usage 2: python3 403bypasser.py -u https://example.com -D dirlist.txt
Usage 3: python3 403bypasser.py -U urllist.txt -d /secret
Usage 4: python3 403bypasser.py -U urllist.txt -D dirlist.txt
IMPORTANT NOTE: All the followings are interpreted the same. Therefore, which pattern you use is just a matter of preference. python3 403bypasser.py -u https://example.com -d secret
python3 403bypasser.py -u https://example.com -d /secret
python3 403bypasser.py -u https://example.com -d /secret/
python3 403bypasser.py -u https://example.com -d secret/
python3 403bypasser.py -u https://example.com/ -d secret
ALL THE SAME! Since Python is a cross-platform language, one can run this program on different operating systems.
Output
The output of the program is saved (in the current directory) in a file with the name of the domain name given as input.
For example:
python3 403bypasser.py -u https://example.com -d /secret is given. Then the output is saved to example.txt in the current directory.
Release Notes
Changes in v2.0: Considerable changes have been done in this version. The project is completely moved to Python 3 (https://www.kitploit.com/search/label/Python%203) from Bash. New and wide variety of techniques have been added.

Changes in v1.1: It's now possible to pass files (lists) to 403bypasser (https://www.kitploit.com/search/label/403Bypasser) as input via arguments. Furthermore, two more test cases added: poisoning with 1)X-Original-URL and 2)X-Rewrite-URL headers.
To-Do List
GUI Add Rate-Limit / Threads Option Add an Option for Scan Types (fast, normal, aggressive or only path manipulation (https://www.kitploit.com/search/label/Manipulation) / header manipulation) Export cURL Command for Each Request Add Parameters to Save Output According to HTTP Status Codes Add Parameters to Save Output According to Page Size Anomalies
Which Cases Does This Tool Check?

1. Request Method Manipulation
Convert GET request to POST request
2. Path Manipulation
/%2e/secret /secret/ /secret..;/ /secret/..;/ /secret%20 /secret%09 /secret%00 /secret.json /secret.css /secret.html /secret? /secret?? /secret??? /secret?testparam /secret# /secret#test /secret/. //secret// /./secret/./
3. Overriding the Target URL via Non-Standard Headers
X-Original-URL: /secret X-Rewrite-URL: /secret
4. Other Headers (https://www.kitploit.com/search/label/Headers) & Values
Headers: X-Custom-IP-Authorization X-Forwarded-For X-Forward-For X-Remote-IP X-Originating-IP X-Remote-Addr X-Client-IP X-Real-IP Values: localhost localhost:80 localhost:443 127.0.0.1 127.0.0.1:80 127.0.0.1:443 2130706433 0x7F000001 0177.0000.0000.0001 0 127.1 10.0.0.0 10.0.0.1 172.16.0.0 172.16.0.1 192.168.1.0 192.168.1.1

Download 403Bypasser (https://github.com/yunemse48/403bypasser)

403Bypasser - Automates The Techniques Used To Circumvent Access Control Restrictions On Target Pages

403bypasser automates the techniques used to circumvent access control restrictions on target pages. 403bypasser will continue to be improved and it is open to contributions.Installation Clone the repository to your machine. git clone https://github.com/yunemse48/403bypasser.git Install required modules by running the code pip install -r requirements.txt READY! Usage Arguments: Argument Description Examples Note -u single URL to scan http://example.com or http://example.com/ All these example usages are interpreted in the same way -U path to list of URLs ./urllist.txt, ../../urllist.txt, etc. Just provide the path where the file is located :) -d single directory to scan admin or /admin or admin/ or /admin/ All these example usages are interpreted in the same way -D path to list of directories ./dirlist.txt, ../../dirlist.txt, etc. Just provide the path where the file is located :) Usage 1: python3 403bypasser.py -u https://example.com -d /secret Usage 2: python3 403bypasser.py -u https://example.com -D dirlist.txt Usage 3: python3 403bypasser.py -U urllist.txt -d /secret Usage 4: python3 403bypasser.py -U urllist.txt -D dirlist.txt IMPORTANT NOTE: All the followings are interpreted the same. Therefore, which pattern you use is just a matter of preference. python3 403bypasser.py -u https://example.com -d secret python3 403bypasser.py -u https://example.com -d /secret python3 403bypasser.py -u https://example.com -d /secret/ python3 403bypasser.py -u https://example.com -d secret/ python3 403bypasser.py -u https://example.com/ -d secret ALL THE SAME! Since Python is a cross-platform language, one can run this program on different operating systems. Output The output of the program is saved (in the current directory) in a file with the name of the domain name given as input. For example: python3 403bypasser.py -u https://example.com -d /secret is given. Then the output is saved to example.txt in the current directory. Release Notes Changes in v2.0: Considerable changes have been done in this version. The project is completely moved to Python 3 from Bash. New and wide variety of techniques have been added. Changes in v1.1: It's now possible to pass files (lists) to 403bypasser as input via arguments. Furthermore, two more test cases added: poisoning with 1)X-Original-URL and 2)X-Rewrite-URL headers. To-Do List GUI Add Rate-Limit / Threads Option Add an Option for Scan Types (fast, normal, aggressive or only path manipulation / header manipulation) Export cURL Command for Each Request Add Parameters to Save Output According to HTTP Status Codes Add Parameters to Save Output According to Page Size Anomalies Which Cases Does This Tool Check? 1. Request Method Manipulation Convert GET request to POST request 2. Path Manipulation /%2e/secret /secret/ /secret..;/ /secret/..;/ /secret%20 /secret%09 /secret%00 /secret.json /secret.css /secret.html /secret? /secret?? /secret??? /secret?testparam /secret# /secret#test /secret/. //secret// /./secret/./ 3. Overriding the Target URL via Non-Standard Headers X-Original-URL: /secret X-Rewrite-URL: /secret 4. Other Headers & Values Headers: X-Custom-IP-Authorization X-Forwarded-For X-Forward-For X-Remote-IP X-Originating-IP X-Remote-Addr X-Client-IP X-Real-IP Values: localhost localhost:80 localhost:443 127.0.0.1 127.0.0.1:80 127.0.0.1:443 2130706433 0x7F000001 0177.0000.0000.0001 0 127.1 10.0.0.0 10.0.0.1 172.16.0.0 172.16.0.1 192.168.1.0 192.168.1.1 Download 403Bypasser
Read more...

hacking: security in practice
My pc might have a virus

So about a month ago I invited some friends over I got really drunk and my dumbass decided to launch tor and browse the dark web a little while I was pretty drunk, I don't remember a lot what I did on there but I browsed a little. Now every time load my pc up command prompt pops up for a few seconds then disappears. Am I doomed?

submitted by /u/-GalaxySushi-
[link] [comments]

hacking: security in practice
Researchers disclose Meltdown-like vulnerability for AMD processors

https://external-preview.redd.it/FzhP1jiGD7MBHF8z_1VDXQpAjGsI-Z_PmVj-QcuivE4.jpg?width=640&crop=smart&auto=webp&s=44bccd28c7376ba6454a9ded615bb7072ca9b531 submitted by /u/Ranvier01
[link] [comments]

hacking: security in practice
Possibility of being hacked on Omegle?

I was on Omegle, not doing anything weird, just talking. During a conversation somebody told me their fathers name and it was my name. Which is an extremely rare name, I’ve only met 1 or 2 people outside my family with the name. It felt like they did it to freak me out because it was out of the blue they even told me their fathers name. Surname and all, who does that?

I remember another time, someone halfway across the world mentioned a location part of my family lives in, which again seemed incredibly unlikely they would know the area and somehow they did.

Both of these events just freaked me out. I have nothing worth hacking what so ever, I’m not worried about things on my device, I have no sensitive information….it’s just disturbing. Is it just pure chance or was the other person hacking me in some way?

Note: I don’t click links or leave the Omegle website or hand out any sensitive information about myself ever.

submitted by /u/CainTSR
[link] [comments]

Hacking on Medium
The 10 Most Savagest Crypto Scams (And How To Avoid Them)

https://cdn-images-1.medium.com/max/2600/0*_qHZ8ZJgF-0VRMy9
Nobody is safe from #4 on the list.

Continue reading on Everything Crypto »

SQL injection in harvard subdomain
https://noob3xploiter.medium.com/sql-injection-in-harvard-subdomain-be67a5dbf664?source=rss------bug_bounty-5

Hi. In this writeup, i will show you a sqli that i found in harvard and also, a xss as a bonusContinue reading on Medium » (https://noob3xploiter.medium.com/sql-injection-in-harvard-subdomain-be67a5dbf664?source=rss------bug_bounty-5)

When automating wayback machine and ffuf is not the answer, or manual analysis ftw
https://infosecwriteups.com/when-automating-wayback-machine-and-ffuf-is-not-the-answer-or-manual-analysis-ftw-d100e8f39d77?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video