Hi InfoSec Community and fellow Hackers. I just wanted to share a quick story about coming out of your comfort zone, maybe someone else is…Continue reading on Medium » (https://y0sum3x.medium.com/switched-bug-bounty-platforms-to-see-if-the-hype-was-true-1616726a25d4?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
The DW isn’t as scary and exciting as it seems..

Although all those horror stories paint the dark web as some forum filled with gore and live videos of torture and such, dw does have this but it’s mainly a slightly worse 4chan. To get to an actual criminal site in the dw, you have to have certain URLs and even then the host is able to deny you access. Yes there’s ways to bypass those but with feds cracking down on the dw, it’s not as exhilarating anymore..

Edit - And as bone chilling as those horror stories sound, let’s be honest, they’re all BS.

submitted by /u/SCRXVM_
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Switched Bug Bounty Platforms To See If The Hype Was True.

Hi InfoSec Community and fellow Hackers. I just wanted to share a quick story about coming out of your comfort zone, maybe someone else is…Continue reading on Medium »
Read more...

Pollenisator - Collaborative Pentest Tool With Highly Customizable Tools

Pollenisator is a tool aiming to assist pentesters and auditor automating the use of some tools/scripts and keep track of them. Written in python 3 Provides a modelisation of "pentest objects" : Scope, Hosts, Ports, Commands, Tools etc. Tools/scripts are separated into 4 categories : wave, Network/domain, IP, Port Objects are stored in a NoSQL DB (Mongo) Keep links between them to allow queries Objects can be created through parsers / manual input Business logic can be implemented (auto vuln referencing, item triggers, etc.) Many tools/scripts launch conditions are availiable to avoid overloading the target or the scanner. A GUI based on tcl/tkDocumentation Everything is the wiki, including installation Features Register your own tools Add command line options in your database. Create your own light plugin to parse your tool output. Use the objects Models to add, update or delete objects to the pentest inside plugins. Limit the number of parallel execution of noisy/heavy tools Define a recon/fingerprinting procedure with custom tools Choose a period to start and stop the tools Define your scope with domains and network IP ranges. Custom settings to include new hosts in the scope Keep results of all files generated through tools executions Start the given docker to implement numerous tools for LAN and Web pentest Collaborative pentests Split the work between your machines by starting one worker by computer you want to use. Tags ip or tools to show your team mates that you powned it. Take notes on every object to keep trace of your discoveries Follow tools status live Search in all your objects properties with the fitler bar. have a quick summary of all hosts and their open ports and check if some are powned. Reporting Create security defects on IPs and ports Make your plugins create defects directly so you don't have to Generate a Word report of security defects found. You can use your own template with extra work. Generate a Powerpoint report of security defects found. You can use your own template with extra work. Currently integrated tools IP / port recon : Nmap (Quick nmaps followed by thorough scan) Domain enumeration : Knockpy, Sublist3r, dig reverse, crtsh Web : WhatWeb, Nikto, http methods, Dirsearch LAN : Crackmapexec, eternalblue and bluekeep scan, smbmap, anonymous ftp, enum4linux Unknown ports : amap, nmap scripts Misc : ikescan, ssh_scan, openrelay Roadmap Change the architecture to an API based one Get rid of Celery Add flexibity for commands Improve UX Add more plugin and improve existing ones Add real support for users / authenticated commands Download Pollenisator
Read more...

___________________________
@hacking_Attack
@Hacking_Video

Pollenisator - Collaborative Pentest Tool With Highly Customizable Tools
http://www.kitploit.com/2021/09/pollenisator-collaborative-pentest-tool.html

___________________________
@hacking_Attack
@Hacking_Video

Pollenisator is a tool aiming to assist pentesters (https://www.kitploit.com/search/label/Pentesters) and auditor automating the use of some tools/scripts and keep track of them. Written in python 3 Provides a modelisation of "pentest objects" : Scope, Hosts, Ports, Commands, Tools etc. Tools/scripts are separated into 4 categories : wave, Network/domain, IP, Port Objects are stored in a NoSQL DB (Mongo) Keep links between them to allow queries Objects can be created through parsers / manual input Business logic can be implemented (auto vuln referencing, item triggers, etc.) Many tools/scripts launch conditions are availiable to avoid overloading the target or the scanner. A GUI based on tcl/tk
Documentation
Everything is the wiki (https://github.com/AlgoSecure/Pollenisator/wiki/_Sidebar), including installation (https://github.com/Algosecure/Pollenisator/wiki/Overview)
Features
Register your own tools Add command line (https://www.kitploit.com/search/label/Command%20Line) options in your database. Create your own light plugin to parse your tool output. Use the objects Models to add, update or delete objects to the pentest inside plugins. Limit the number of parallel execution of noisy/heavy tools Define a recon/fingerprinting procedure with custom tools Choose a period to start and stop the tools Define your scope with domains and network IP ranges. Custom settings to include new hosts in the scope Keep results of all files generated through tools executions Start the given docker to implement numerous tools for LAN and Web pentest Collaborative pentests Split the work between your machines by starting one worker by computer you want to use. Tags ip or tools to show your team mates that you powned it. Take notes on every object to keep trace of your discoveries Follow tools status live Search in all your objects properties with the fitler bar. have a quick summary of all hosts and their open ports (https://www.kitploit.com/search/label/Open%20Ports) and check if some are powned. Reporting Create security defects on IPs and ports Make your plugins create defects directly so you don't have to Generate a Word report of security defects found. You can use your own template with extra work. Generate a Powerpoint report of security defects found. You can use your own template with extra work. Currently integrated tools IP / port recon : Nmap (Quick nmaps followed by thorough scan) Domain enumeration (https://www.kitploit.com/search/label/Enumeration) : Knockpy, Sublist3r, dig reverse, crtsh Web : WhatWeb, Nikto, http methods, Dirsearch LAN : Crackmapexec, eternalblue (https://www.kitploit.com/search/label/Eternalblue) and bluekeep scan, smbmap, anonymous ftp, enum4linux Unknown ports : amap, nmap scripts Misc : ikescan, ssh_scan, openrelay
Roadmap
Change the architecture to an API based one Get rid of Celery Add flexibity for commands Improve UX Add more plugin and improve existing ones Add real support for users / authenticated commands

Download Pollenisator (https://github.com/AlgoSecure/Pollenisator)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Play preinstalled pc games on a burned bluray disc.

I was wondering would it be possible to burn a game on a bluray disc and play it from there with auto start?

It's nice to put something on a disc and make yourself a collection, that way it would also save allot of HDD space.

Also don't want to waste money on a bluray burner and it won't even be possible.

submitted by /u/Morenob1
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How did you learn hacking?

I personaly learned from hackthebox and tryhackme, but david nombal and network chuck videos helped a lot too. I wonder how other people learned.

submitted by /u/Puzzleheaded-Pea-683
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Switched Bug Bounty Platforms To See If The Hype Was True.


Hi InfoSec Community and fellow Hackers. I just wanted to share a quick story about coming out of your comfort zone, maybe someone else is…

Continue reading on Medium »

Hacking on Medium
Included has been Pwned!


Ok this was a really fun box despite a frustrating ending. This box is fairly simple to start off with provided you notice everything that…

Continue reading on Medium »

Hacking on Medium
How I De-Beeped my AC


A guide to permanently mute your disruptive electronic appliances

Continue reading on Geek Culture »

Hacking on Medium
HackTheBox — Schooled


As always, we start with nmap to discover open ports/services.

Continue reading on Medium »

KitPloit - PenTest Tools!Pollenisator - Collaborative Pentest Tool With Highly Customizable Tools





Pollenisator is a tool aiming to assist pentesters and auditor automating the use of some tools/scripts and keep track of them.

* Written in python 3
* Provides a modelisation of "pentest objects" : Scope, Hosts, Ports, Commands, Tools etc.
* Tools/scripts are separated into 4 categories : wave, Network/domain, IP, Port
* Objects are stored in a NoSQL DB (Mongo)
* Keep links between them to allow queries
* Objects can be created through parsers / manual input
* Business logic can be implemented (auto vuln referencing, item triggers, etc.)
* Many tools/scripts launch conditions are availiable to avoid overloading the target or the scanner.
* A GUI based on tcl/tk



Documentation

Everything is the wiki, including installation

Features

*
Register your own tools

* Add command line options in your database.
* Create your own light plugin to parse your tool output.
* Use the objects Models to add, update or delete objects to the pentest inside plugins.
* Limit the number of parallel execution of noisy/heavy tools

*
Define a recon/fingerprinting procedure with custom tools

* Choose a period to start and stop the tools
* Define your scope with domains and network IP ranges.
* Custom settings to include new hosts in the scope
* Keep results of all files generated through tools executions
* Start the given docker to implement numerous tools for LAN and Web pentest

*
Collaborative pentests

* Split the work between your machines by starting one worker by computer you want to use.
* Tags ip or tools to show your team mates that you powned it.
* Take notes on every object to keep trace of your discoveries
* Follow tools status live
* Search in all your objects properties with the fitler bar.
* have a quick summary of all hosts and their open ports and check if some are powned.

*
Reporting

* Create security defects on IPs and ports
* Make your plugins create defects directly so you don't have to
* Generate a Word report of security defects found. You can use your own template with extra work.
* Generate a Powerpoint report of security defects found. You can use your own template with extra work.

*
Currently integrated tools

* IP / port recon : Nmap (Quick nmaps followed by thorough scan)
* Domain enumeration : Knockpy, Sublist3r, dig reverse, crtsh
* Web : WhatWeb, Nikto, http methods, Dirsearch
* LAN : Crackmapexec, eternalblue and bluekeep scan, smbmap, anonymous ftp, enum4linux
* Unknown ports : amap, nmap scripts
* Misc : ikescan, ssh_scan, openrelay


Roadmap

* Change the architecture to an API based one
* Get rid of Celery
* Add flexibity for commands
* Improve UX
* Add more plugin and improve existing ones
* Add real support for users / authenticated commands



Download Pollenisator

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
source
photo
Making a Team

Hello everyone. A big thing that people don't take into account when pursuing a career and or pursuing this hobby is that its crucial to surround yourself with likeminded people. A big thing I've noticed in popular communities is the total disconnect I get with the people there. Thats why I've decided to make a server to address this issue. Im planning on doing ctf's as a team, hosting events, and just providing a place for people in the industry to chill. If you're interested join up.

https://discord.gg/wKnHMprfEP

submitted by /u/TotallyNotaCTF
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Can a app from a defunct company be re-activated?

Hello everyone,

TL;DR: Is it possible to reactivate a program if I have the activation code and receipt even if the company just suddenly stopped "existing".

A little context. I recently switched from a HDD to a SSD to add a few more years to my laptop, this was done at a official service shop. It's for a T430 Thinkpad. Anyway, the hard drive was cloned in order to keep everything the same.

Now, I used a video editing program called TrakAx, I had the licence and activation done on the HDD and everything worked great. Upon trying to use the software on the SSD I had a message that the trial version had expired (it was a 14 days trial).

About 4 years ago I had activated the software and I worked fine for the past few years, it worked on the HDD but I had to switch the hard drive in the laptop in order to use it, also the HDD has started to fail to load windows upon bootup.

I still have the activation code but when I input it I get an error code, it seems that the program needs a server authentication in order to be activated. This seems to be the main problem.

​

What can be done in order to use the program again?

​

The reason I still want to use this software is that I pretty much learned all the tools and buttons, also its really stable, easy and covers my editing needs.

The company that distributed this software was called HighAndes and was based on Ireland, but suddenly they seemed to just shutdown, their twitter and youtube channels just end in 2016 with no warning.

Here are some links to the tweeter and youtube channel if anyone is curious of how the program was an stuff.

https://twitter.com/trakax?lang=es

https://www.youtube.com/user/trakAxPC/videos

Thanks in advance.

submitted by /u/Teyarual
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
source
photo
John gives up without attempting to crack password.

I'm doing the introductory "Blue" lesson on TryHackMe, which requires cracking a Windows password hash. I've used John before, but I have no clue what's going on here.

So, I have the formatted password hash extracted:
Jon:1000:aad3b435b51404eeaad3b435b51404ee:ffb43f0de35be4d9917ac0cc8ad57f8d:::
I redirect this to a file:
echo -n "Jon:1000:aad3b435b51404eeaad3b435b51404ee:ffb43f0de35be4d9917ac0cc8ad57f8d:::" > jon_hash
Then load it and rockyou.txtinto john:
john -w /usr/share/wordlists/rockyou.txt --format=nt jon_hash
The output though isn't encouraging. It finishes instantly, and shows this:
Created directory: /home/name/.john Using default input encoding: UTF-8 Loaded 52 password hashes with no different salts (NT [MD4 256/256 AVX2 8x3]) Warning: no OpenMP support for this hash type, consider --fork=8 Press 'q' or Ctrl-C to abort, almost any other key for status 0g 0:00:00:00 DONE (2021-09-11 17:11) 0g/s 7708p/s 7708c/s 400852C/s !@#$%..sss Session completed
Then, if I try to show cracked passwords:
$ john --show jon_hash 0 password hashes cracked, 1 left
I kept at it for awhile, then looked up a guide. It shows essentially the procedure I already did though, and they were able to get it cracked. And yes, I checked my copy of rockyou.txt, and it does contain the expected password.

Does anyone know why it isn't attempting to crack it?

Thank you

submitted by /u/carcigenicate
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Expiration of SSL handshake

After physically obtaining (pre)master key, which was generated in SSL handshake - how long can one use it to decrypt HTTPS traffic? For session? To next reboot? Or maybe it has to be manually deleted on client side to force making next SSL handshake with generating new master key?

submitted by /u/Dry_Equal_9398
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video