Hacking Articles Tips Tricks Videos Tutorials
ess. The user-defined build script: MUST declare all dependencies, including sources and other build steps, using immutable references in a format that the build service understands. The build service: MUST fetch all artifacts in a trusted control plane. MUST…
ucible.✓✓Dependencies completeProvenance records all build dependencies that were available while running the build steps. This includes the initial state of the machine, VM, or container of the build worker.MUST include all user-specified build steps, sources, dependencies.SHOULD include all service-provided artifacts.✓
Requirements on the contents of the provenance:
RequirementDescriptionL1L2L3L4Identifies artifactThe provenance MUST identify the output artifact via at least one cryptographic hash. The provenance MAY provide multiple identifying cryptographic hashes using different algorithms. When only one hash is provided, the RECOMMENDED algorithm is SHA-256 for cross-system compatibility. If another algorithm is used, it SHOULD be resistant to collisions and second preimages.✓✓✓✓Identifies builderThe provenance identifies the entity that performed the build and generated the provenance. This represents the entity that the consumer must trust. Examples: “GitHub Actions with a GitHub-hosted worker”, “jdoe@example.com’s machine”.✓✓✓✓Identifies sourceThe provenance identifies the source containing the top-level build script, via an immutable reference. Example: git URL + branch/tag/ref + commit ID.✓✓✓✓Identifies entry pointThe provenance identifies the “entry point” or command that was used to invoke the build script. Example:
Common Requirements
Common requirements for every trusted system involved in the supply chain (source, build, distribution, etc.)
RequirementDescriptionL1L2L3L4SecurityThe system meets some TBD baseline security standard to prevent compromise. (Patching, vulnerability scanning, user isolation, transport security, secure boot, machine identity, etc. Perhaps NIST 800-53 or a subset thereof.)✓AccessAll physical and remote access must be rare, logged, and gated behind multi-party approval.✓SuperusersOnly a small number of platform admins may override the guarantees listed here. Doing so MUST require approval of a second platform admin.✓
Example
Motivating example
Consider the example of using curl through its official docker image. What threats are we exposed to in the software supply chain? (We choose curl simply because it is a popular open-source package, not to single it out.)
The first problem is figuring out the actual supply chain. This requires significant manual effort, guesswork, and blind trust. Working backwards:
* The “latest” tag in Docker Hub points to 7.72.0.
* It claims to have come from a Docker file in the curl/curl-docker GitHub repository.
* That Docker file reads the following artifacts, assuming there are no further fetches during build time:
* Docker Hub image: registry.hub.docker.com/library/alpine:3.11.5
* Alpine packages: libssh2 libssh2-dev libssh2-static auto conf auto make build-base groff open ssl curl-dev python3 python3-dev lib tool curl stunnel perl nghttp2
* File at URL: https://curl.haxx.se/ca/cacert.pem
* Each of the dependencies has its own supply chain, but let’s look at curl-dev, which contains the actual “curl” s[...]
___________________________
@hacking_Attack
@Hacking_Video
Requirements on the contents of the provenance:
RequirementDescriptionL1L2L3L4Identifies artifactThe provenance MUST identify the output artifact via at least one cryptographic hash. The provenance MAY provide multiple identifying cryptographic hashes using different algorithms. When only one hash is provided, the RECOMMENDED algorithm is SHA-256 for cross-system compatibility. If another algorithm is used, it SHOULD be resistant to collisions and second preimages.✓✓✓✓Identifies builderThe provenance identifies the entity that performed the build and generated the provenance. This represents the entity that the consumer must trust. Examples: “GitHub Actions with a GitHub-hosted worker”, “jdoe@example.com’s machine”.✓✓✓✓Identifies sourceThe provenance identifies the source containing the top-level build script, via an immutable reference. Example: git URL + branch/tag/ref + commit ID.✓✓✓✓Identifies entry pointThe provenance identifies the “entry point” or command that was used to invoke the build script. Example:
make all.✓✓✓✓Includes all build parametersThe provenance includes all build parameters under a user’s control. See Parameterless for details. (At L3, the parameters must be listed; at L4, they must be empty.)✓✓Includes all transitive dependenciesThe provenance includes all transitive dependencies listed in Dependencies Complete.✓Includes reproducible infoThe provenance includes a boolean indicating whether build is intended to be reproducible and, if so, all information necessary to reproduce the build. See Reproducible for more details.✓Includes metadataThe provenance includes metadata to aid debugging and investigations. This SHOULD at least include start and end timestamps and a permalink to debug logs.”○” = RECOMMENDED.○○○○ Common Requirements
Common requirements for every trusted system involved in the supply chain (source, build, distribution, etc.)
RequirementDescriptionL1L2L3L4SecurityThe system meets some TBD baseline security standard to prevent compromise. (Patching, vulnerability scanning, user isolation, transport security, secure boot, machine identity, etc. Perhaps NIST 800-53 or a subset thereof.)✓AccessAll physical and remote access must be rare, logged, and gated behind multi-party approval.✓SuperusersOnly a small number of platform admins may override the guarantees listed here. Doing so MUST require approval of a second platform admin.✓
Example
Motivating example
Consider the example of using curl through its official docker image. What threats are we exposed to in the software supply chain? (We choose curl simply because it is a popular open-source package, not to single it out.)
The first problem is figuring out the actual supply chain. This requires significant manual effort, guesswork, and blind trust. Working backwards:
* The “latest” tag in Docker Hub points to 7.72.0.
* It claims to have come from a Docker file in the curl/curl-docker GitHub repository.
* That Docker file reads the following artifacts, assuming there are no further fetches during build time:
* Docker Hub image: registry.hub.docker.com/library/alpine:3.11.5
* Alpine packages: libssh2 libssh2-dev libssh2-static auto conf auto make build-base groff open ssl curl-dev python3 python3-dev lib tool curl stunnel perl nghttp2
* File at URL: https://curl.haxx.se/ca/cacert.pem
* Each of the dependencies has its own supply chain, but let’s look at curl-dev, which contains the actual “curl” s[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
ucible.✓✓Dependencies completeProvenance records all build dependencies that were available while running the build steps. This includes the initial state of the machine, VM, or container of the build worker.MUST include all user-specified build steps, sources…
ource code.
* The package, like all Alpine packages, has its build script defined in an APKBUILD in the Alpine git repo. There are several build dependencies:
* File at URL: https://curl.haxx.se/download/curl-7.72.0.tar.xz.
* The APKBUILD includes a sha256 hash of this file. It is not clear where that hash came from.
* Alpine packages: openssl-dev nghttp2-dev zlib-dev brotli-dev autoconf automake groff libtool perl
* The source tarball was presumably built from the actual upstream GitHub repository curl/curl@curl-7_72_0, by running the commands
* Finally, there are the systems that actually ran the builds above. We have no indication about their software, configuration, or runtime state whatsoever.
Suppose some developer’s machine is compromised. What attacks could potentially be performed unilaterally with only that developer’s credentials? (None of these are confirmed.)
* Directly upload a malicious image to Docker Hub.
* Point the CI/CD system to build from an unofficial Dockerfile.
* Upload a malicious Dockerfile (or other file) in the curl/curl-docker git repo.
* Upload a malicious https://curl.haxx.se/ca/cacert.pem.
* Upload a malicious APKBUILD in Alpine’s git repo.
* Upload a malicious curl-dev Alpine package to the Alpine repository. (Not sure if this is possible.)
* Upload a malicious https://curl.haxx.se/download/curl-7.72.0.tar.xz. (Won’t be detected by APKBUILD’s hash if the upload happens before the hash is computed.)
* Upload a malicious change to the curl/curl git repo.
* Attack any of the systems involved in the supply chain, as in the SolarWinds attack.
SLSA intends to cover all of these threats. When all artifacts in the supply chain have a sufficient SLSA level, consumers can gain confidence that most of these attacks are mitigated, first via self-certification and eventually through automated verification.
Finally, note that all of this is just for curl’s own first-party supply chain steps. The dependencies, namely the Alpine base image and packages, have their own similar threats. And they too have dependencies, which have other dependencies, and so on. Each dependency has its own SLSA level and the composition of SLSA levels describes the entire supply chain’s security.
For another look at Docker supply chain security, see Who’s at the Helm? For a much broader look at open source security, including these issues and many more, see Threats, Risks, and Mitigations in the Open Source Ecosystem.
Vision: Case Study
Let’s consider how we might secure curlimages/curl from the motivating example using the SLSA framework.
Incrementally reaching SLSA 4
Let’s start by incrementally applying the SLSA principles to the final Docker image.
SLSA 0: Initial state
Initially the Docker image is SLSA 0. There is no provenance. It is difficult to determine who built the artifact and what sources and dependencies were used.
The diagram shows that the (mutable) locator
SLSA 1: Provenance
We can reach SLSA 1 by scripting the build and generating provenance. The build script was already automated via
In the updated diagram, the provenance attestation says that the artifact
___________________________
@hacking_Attack
@Hacking_Video
* The package, like all Alpine packages, has its build script defined in an APKBUILD in the Alpine git repo. There are several build dependencies:
* File at URL: https://curl.haxx.se/download/curl-7.72.0.tar.xz.
* The APKBUILD includes a sha256 hash of this file. It is not clear where that hash came from.
* Alpine packages: openssl-dev nghttp2-dev zlib-dev brotli-dev autoconf automake groff libtool perl
* The source tarball was presumably built from the actual upstream GitHub repository curl/curl@curl-7_72_0, by running the commands
./buildconf && ./configure && make && ./maketgz 7.72.0. That command has a set of dependencies, but those are not well documented.* Finally, there are the systems that actually ran the builds above. We have no indication about their software, configuration, or runtime state whatsoever.
Suppose some developer’s machine is compromised. What attacks could potentially be performed unilaterally with only that developer’s credentials? (None of these are confirmed.)
* Directly upload a malicious image to Docker Hub.
* Point the CI/CD system to build from an unofficial Dockerfile.
* Upload a malicious Dockerfile (or other file) in the curl/curl-docker git repo.
* Upload a malicious https://curl.haxx.se/ca/cacert.pem.
* Upload a malicious APKBUILD in Alpine’s git repo.
* Upload a malicious curl-dev Alpine package to the Alpine repository. (Not sure if this is possible.)
* Upload a malicious https://curl.haxx.se/download/curl-7.72.0.tar.xz. (Won’t be detected by APKBUILD’s hash if the upload happens before the hash is computed.)
* Upload a malicious change to the curl/curl git repo.
* Attack any of the systems involved in the supply chain, as in the SolarWinds attack.
SLSA intends to cover all of these threats. When all artifacts in the supply chain have a sufficient SLSA level, consumers can gain confidence that most of these attacks are mitigated, first via self-certification and eventually through automated verification.
Finally, note that all of this is just for curl’s own first-party supply chain steps. The dependencies, namely the Alpine base image and packages, have their own similar threats. And they too have dependencies, which have other dependencies, and so on. Each dependency has its own SLSA level and the composition of SLSA levels describes the entire supply chain’s security.
For another look at Docker supply chain security, see Who’s at the Helm? For a much broader look at open source security, including these issues and many more, see Threats, Risks, and Mitigations in the Open Source Ecosystem.
Vision: Case Study
Let’s consider how we might secure curlimages/curl from the motivating example using the SLSA framework.
Incrementally reaching SLSA 4
Let’s start by incrementally applying the SLSA principles to the final Docker image.
SLSA 0: Initial state
Initially the Docker image is SLSA 0. There is no provenance. It is difficult to determine who built the artifact and what sources and dependencies were used.
The diagram shows that the (mutable) locator
curlimages/curl:7.72.0 points to (immutable) artifact sha256:3c3ff….SLSA 1: Provenance
We can reach SLSA 1 by scripting the build and generating provenance. The build script was already automated via
make, so we use simple tooling to generate the provenance on every release. Provenance records the output artifact hash, the builder (in this case, our local machine), and the top-level source containing the build script.In the updated diagram, the provenance attestation says that the artifact
sha256:3c3ff… was built from curl/curl-docker@d6525…[...]___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
ource code. * The package, like all Alpine packages, has its build script defined in an APKBUILD in the Alpine git repo. There are several build dependencies: * File at URL: https://curl.haxx.se/download/curl-7.72.0.tar.xz. * The APKBUILD includes a sha256…
.
At SLSA 1, the provenance does not protect against tampering or forging but may be useful for vulnerability management.
SLSA 2 and 3: Build service
To reach SLSA 2 (and later SLSA 3), we must switch to a hosted build service that generates provenance for us. This updated provenance should also include dependencies on a best-effort basis. SLSA 3 additionally requires the source and build platforms to implement additional security controls, which might need to be enabled.
In the updated diagram, the provenance now lists some dependencies, such as the base image (
At SLSA 3, the provenance is significantly more trustworthy than before. Only highly skilled adversaries are likely able to forge it.
SLSA 4: Hermeticity and two-person review
SLSA 4 requires two-party source control and hermetic builds. Hermeticity in particular guarantees that the dependencies are complete. Once these controls are enabled, the Docker image will be SLSA 4.
In the updated diagram, the provenance now attests to its hermeticity and includes the
At SLSA 4, we have high confidence that the provenance is complete and trustworthy and that no single person can unilaterally change the top-level source.
We can recursively apply the same steps above to lock down dependencies. Each non-source dependency gets its own provenance, which in turns lists more dependencies, and so on.
The final diagram shows a subset of the graph, highlighting the path to the upstream source repository (curl/curl) and the certificate file (cacert.pem).
In reality, the graph is intractably large due to the fanout of dependencies. There will need to be some way to trim the graph to focus on the most important components. While this can reasonably be done by hand, we do not yet have a solid vision for how best to do this in an scalable, generic, automated way. One idea is to use ecosystem-specific heuristics. For example, Debian packages are built and organized in a very uniform way, which may allow Debian-specific heuristics.
Composition of SLSA levels
An artifact’s SLSA level is not transitive, so some aggregate measure of security risk across the whole supply chain is necessary. In other words, each node in our graph has its own, independent SLSA level. Just because an artifact’s level is N does not imply anything about its dependencies’ levels.
In our example, suppose that the final curl images/curl Docker image were SLSA 4 but its curl-dev dependency were SLSA 0. Then this would imply a significant security risk: an adversary could potentially introduce malicious behavior into the final image by modifying the source code found in the curl-dev package. That said, even being able to identify that it has a SLSA 0 dependency has tremendous value because it can help focus efforts.
Formation of this aggregate risk measure is left for future work. It is perhaps too early to develop such a measure without real-world data. Once SLSA becomes more widely adopted, we expect patterns to emerge and the task to get a bit easier.
Accreditation and delegation
Accreditation and delegation will play a large role in the SLSA framework. It is not practical for every software consumer to fully vet every platform and fully walk the entire graph of every artifact. Auditors and/or accreditation bodies can verify and assert that a platform or vendor meets the SLSA requirements when configured in a certain way. Similarly, there may be some way to “trust” an artifact without analyzing its dependencies. This may be particularly valuable for closed source software.
Download
___________________________
@hacking_Attack
@Hacking_Video
At SLSA 1, the provenance does not protect against tampering or forging but may be useful for vulnerability management.
SLSA 2 and 3: Build service
To reach SLSA 2 (and later SLSA 3), we must switch to a hosted build service that generates provenance for us. This updated provenance should also include dependencies on a best-effort basis. SLSA 3 additionally requires the source and build platforms to implement additional security controls, which might need to be enabled.
In the updated diagram, the provenance now lists some dependencies, such as the base image (
alpine:3.11.5) and apk packages (e.g. curl-dev).At SLSA 3, the provenance is significantly more trustworthy than before. Only highly skilled adversaries are likely able to forge it.
SLSA 4: Hermeticity and two-person review
SLSA 4 requires two-party source control and hermetic builds. Hermeticity in particular guarantees that the dependencies are complete. Once these controls are enabled, the Docker image will be SLSA 4.
In the updated diagram, the provenance now attests to its hermeticity and includes the
cacert.pem dependency, which was absent before.At SLSA 4, we have high confidence that the provenance is complete and trustworthy and that no single person can unilaterally change the top-level source.
We can recursively apply the same steps above to lock down dependencies. Each non-source dependency gets its own provenance, which in turns lists more dependencies, and so on.
The final diagram shows a subset of the graph, highlighting the path to the upstream source repository (curl/curl) and the certificate file (cacert.pem).
In reality, the graph is intractably large due to the fanout of dependencies. There will need to be some way to trim the graph to focus on the most important components. While this can reasonably be done by hand, we do not yet have a solid vision for how best to do this in an scalable, generic, automated way. One idea is to use ecosystem-specific heuristics. For example, Debian packages are built and organized in a very uniform way, which may allow Debian-specific heuristics.
Composition of SLSA levels
An artifact’s SLSA level is not transitive, so some aggregate measure of security risk across the whole supply chain is necessary. In other words, each node in our graph has its own, independent SLSA level. Just because an artifact’s level is N does not imply anything about its dependencies’ levels.
In our example, suppose that the final curl images/curl Docker image were SLSA 4 but its curl-dev dependency were SLSA 0. Then this would imply a significant security risk: an adversary could potentially introduce malicious behavior into the final image by modifying the source code found in the curl-dev package. That said, even being able to identify that it has a SLSA 0 dependency has tremendous value because it can help focus efforts.
Formation of this aggregate risk measure is left for future work. It is perhaps too early to develop such a measure without real-world data. Once SLSA becomes more widely adopted, we expect patterns to emerge and the task to get a bit easier.
Accreditation and delegation
Accreditation and delegation will play a large role in the SLSA framework. It is not practical for every software consumer to fully vet every platform and fully walk the entire graph of every artifact. Auditors and/or accreditation bodies can verify and assert that a platform or vendor meets the SLSA requirements when configured in a certain way. Similarly, there may be some way to “trust” an artifact without analyzing its dependencies. This may be particularly valuable for closed source software.
Download
___________________________
@hacking_Attack
@Hacking_Video
How I Earned $400 IN 8min On Private H1 Program
Hi everyone, Calogero here, this is going to be a short write-up about a vuln that only took 8 minutes to find. So it has taken me a very…Continue reading on Medium »
Read more...
Hi everyone, Calogero here, this is going to be a short write-up about a vuln that only took 8 minutes to find. So it has taken me a very…Continue reading on Medium »
Read more...
$3133.70 Google Dialogflow IDOR Vulnerability
https://asterfiester.medium.com/3133-70-google-dialogflow-idor-vulnerability-7a72771678dd?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://asterfiester.medium.com/3133-70-google-dialogflow-idor-vulnerability-7a72771678dd?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
$3133.70 Google Dialogflow IDOR Vulnerability
Hey, Amazing Hackers, am Raidh Ĥere, Hope, you all are doing well.
Hey, Amazing Hackers, am Raidh Ĥere, Hope, you all are doing well.Continue reading on Medium » (https://asterfiester.medium.com/3133-70-google-dialogflow-idor-vulnerability-7a72771678dd?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
$3133.70 Google Dialogflow IDOR Vulnerability
Hey, Amazing Hackers, am Raidh Ĥere, Hope, you all are doing well.
How I Earned $400 IN 8min On Private H1 Program
https://y0sum3x.medium.com/how-i-earned-400-in-8min-on-private-h1-program-47766af4f2f2?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://y0sum3x.medium.com/how-i-earned-400-in-8min-on-private-h1-program-47766af4f2f2?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
HOW I EARNED $400 IN 8min ON PRIVATE H1 PROGRAM
Hi everyone, Calogero here, this is going to be a short write-up about a vuln that only took 8 minutes to find. So it has taken me a very…
Hi everyone, Calogero here, this is going to be a short write-up about a vuln that only took 8 minutes to find. So it has taken me a very…Continue reading on Medium » (https://y0sum3x.medium.com/how-i-earned-400-in-8min-on-private-h1-program-47766af4f2f2?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
HOW I EARNED $400 IN 8min ON PRIVATE H1 PROGRAM
Hi everyone, Calogero here, this is going to be a short write-up about a vuln that only took 8 minutes to find. So it has taken me a very…
hacking: security in practice
Any good Bluetooth / ble hacking tutorial?
Hey guys! I'm trying to learn more about Bluetooth pentest & hacking. Tutorials I can found are quite confusing, do you have anything good to advice?
Thanks!
submitted by /u/RAZ0RP
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖
___________________________
@hacking_Attack
@Hacking_Video
Any good Bluetooth / ble hacking tutorial?
Hey guys! I'm trying to learn more about Bluetooth pentest & hacking. Tutorials I can found are quite confusing, do you have anything good to advice?
Thanks!
submitted by /u/RAZ0RP
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖
___________________________
@hacking_Attack
@Hacking_Video
reddit
Any good Bluetooth / ble hacking tutorial?
Hey guys! I'm trying to learn more about Bluetooth pentest & hacking. Tutorials I can found are quite confusing, do you have anything good to...
https://b.thumbs.redditmedia.com/MWZiS3rWlAM0Oo_35JpzEvjKFxIDRYA-7e3cNI5v16s.jpg Dear hackers,
I'm doing an assignment where i have to find a flag in a remote system (I already got acces using metasploit). The only hint I have is that I have to find password files and crack the hashes. The host machine is running on Windows 10 and I'm not quite used to it. I have extracted the SAM and SYSTEM files and I was able to find this:
https://preview.redd.it/elvuq4003wm71.png?width=837&format=png&auto=webp&s=0358b706969b0cb943e7b631c20869e7f2bea22b
I noticed that all the hashes are the same and that they mean NULL. I did some research and this could be because Windows 10 doesn't store things at SAM anymore (?? not sure), however, i haven't been able to find any other hashed passwords in the system. Any idea of WHAT or WHERE should I search? I'm misunderstanding something?
Any help will be really apreciated, Thank you so much!
submitted by /u/FreeRaider1
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖
___________________________
@hacking_Attack
@Hacking_Video
I'm doing an assignment where i have to find a flag in a remote system (I already got acces using metasploit). The only hint I have is that I have to find password files and crack the hashes. The host machine is running on Windows 10 and I'm not quite used to it. I have extracted the SAM and SYSTEM files and I was able to find this:
https://preview.redd.it/elvuq4003wm71.png?width=837&format=png&auto=webp&s=0358b706969b0cb943e7b631c20869e7f2bea22b
I noticed that all the hashes are the same and that they mean NULL. I did some research and this could be because Windows 10 doesn't store things at SAM anymore (?? not sure), however, i haven't been able to find any other hashed passwords in the system. Any idea of WHAT or WHERE should I search? I'm misunderstanding something?
Any help will be really apreciated, Thank you so much!
submitted by /u/FreeRaider1
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖
___________________________
@hacking_Attack
@Hacking_Video
reddit
Windows Password Hashes
Posted in r/hacking by u/FreeRaider1 • 1 point and 0 comments
Switched Bug Bounty Platforms To See If The Hype Was True.
https://y0sum3x.medium.com/switched-bug-bounty-platforms-to-see-if-the-hype-was-true-1616726a25d4?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://y0sum3x.medium.com/switched-bug-bounty-platforms-to-see-if-the-hype-was-true-1616726a25d4?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
Switched Bug Bounty Platforms To See If The Hype Was True.
Hi InfoSec Community and fellow Hackers. I just wanted to share a quick story about coming out of your comfort zone, maybe someone else is…
Hi InfoSec Community and fellow Hackers. I just wanted to share a quick story about coming out of your comfort zone, maybe someone else is…Continue reading on Medium » (https://y0sum3x.medium.com/switched-bug-bounty-platforms-to-see-if-the-hype-was-true-1616726a25d4?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
Switched Bug Bounty Platforms To See If The Hype Was True.
Hi InfoSec Community and fellow Hackers. I just wanted to share a quick story about coming out of your comfort zone, maybe someone else is…
Deep Web
The DW isn’t as scary and exciting as it seems..
Although all those horror stories paint the dark web as some forum filled with gore and live videos of torture and such, dw does have this but it’s mainly a slightly worse 4chan. To get to an actual criminal site in the dw, you have to have certain URLs and even then the host is able to deny you access. Yes there’s ways to bypass those but with feds cracking down on the dw, it’s not as exhilarating anymore..
Edit - And as bone chilling as those horror stories sound, let’s be honest, they’re all BS.
submitted by /u/SCRXVM_
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
The DW isn’t as scary and exciting as it seems..
Although all those horror stories paint the dark web as some forum filled with gore and live videos of torture and such, dw does have this but it’s mainly a slightly worse 4chan. To get to an actual criminal site in the dw, you have to have certain URLs and even then the host is able to deny you access. Yes there’s ways to bypass those but with feds cracking down on the dw, it’s not as exhilarating anymore..
Edit - And as bone chilling as those horror stories sound, let’s be honest, they’re all BS.
submitted by /u/SCRXVM_
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Reddit
reddit.com: over 18?
Reddit gives you the best of the internet in one place. Get a constantly updating feed of breaking news, fun stories, pics, memes, and videos just for you. Passionate about something niche? Reddit has thousands of vibrant communities with people that share…