Hacking on Medium
How to secure your social media accounts from getting hacked?


Securing social media account from a hacker is very important. Hackers hack social media to phish other people. Many famous people get…

Continue reading on Medium »

How I Found 7 XSS Vulnerabilities in Filename Reflecting

in one of HackerOne public programsContinue reading on Medium »
Read more...

Exposing Millions of IRCTC Passengers' ticket details.
https://renganathanofficial.medium.com/exposing-millions-of-irctc-passengers-ticket-details-53338280fb9e?source=rss------bug_bounty-5

Hi There,Continue reading on Medium » (https://renganathanofficial.medium.com/exposing-millions-of-irctc-passengers-ticket-details-53338280fb9e?source=rss------bug_bounty-5)

Deep Web
[HELP] payment still waiting ????

i used bitcoin to buy something and it’s still on waiting payment ?

submitted by /u/OTX4life
[link] [comments]

Exposing Millions of IRCTC Passengers' ticket details.

Hi There,Continue reading on InfoSec Write-ups »
Read more...

ODBParser - OSINT Tool To Search, Parse And Dump Only The Open Elasticsearch And MongoDB Directories That Have The Data You Care About Exposing
http://www.kitploit.com/2021/09/odbparser-osint-tool-to-search-parse.html

___________________________
@hacking_Attack
@Hacking_Video

Customization
See the odbconfig.py file to specify your parameters, because really name of the game is exposing (https://www.kitploit.com/search/label/Exposing) the data YOU are interested in. I provided some examples in the config file. Play around with them! You can: specify what index or collection names you want to collect by specifying substrings in config file. For example, if have the term "client", script will pull index called "clients" or "client_data." I recommend you keep these lists blank as you never know what databases you care about will be called and instead specify the fields you care about. specify what fields you care about: if you only want to grab ES indices that have "email" in a field name, e.g."user_emails", you can do that. If you want to make sure the index has at least 2 fields you care about, you can do that too. Or if you just want to grab everything no matter what fields are in there, you can do that too. specify what indices you DON'T want e.g., system index names and others that are generally used for basic logging. Examples provided in config file. override config and grab everything on a server specify output (default is JSON, can choose CSV) set minimum and maximum size database script will dump by default and you can set flag to override (https://www.kitploit.com/search/label/OverRide) max docs on case by case basis.
Installation and Requirements
Clone or download to machine Get API keys for Shodan and/or BinaryEdge configure parameters in ODBconfig.py file install requirements (https://www.kitploit.com/search/label/Requirements) from file I suggest creating virtual environment for ODBParser so have no issues with incorrect module versions. Note: Tested ONLY on Python 3.7.3 and on Windows 10. PLEASE USE RESPONSIBLY
Next Steps and Known Issues
clean up code a bit more multithread various processes. expand to other db types add other open directory search engines (Zoomeye, etc.) unable to scroll past first page for certain ES instances due to way ES Pretty sure fixed this. Open issue if get scrollid errors
Usage
Examples: python ODBParser.py -cn US -p 8080 -t users --elastic --shodan --csv --limit 100
python ODBParser.py -ip 192.168.2:8080 --mongo --ignorelogs --nosizelimits

Damage to-date: 0 servers parsed | 0 databases dumped | 0 records pulled
_____________________________________________________________________________


optional arguments:
-h, --help show this help message and exit

Query Options:
--shodan, -sh Add this flag if using Shodan. Specify ES or MDB w/
flags.
--binary, -be Add this flag if using BinaryEdge. Specify ES or MDB
w/ flags.
--ip , -ip Query one server. Add port like so '192.165.2.1:8080'
or will use default ports for each db type. Add ES or
MDB flags to specify parser.
--file , -f Load line-separated IPs from file. Add port or will
assume default ports for each db type. Add ES or MDB
flags to specify parser.
--paste, -v Query line-separated IPs from clipboard. Add port or
will assume default ports for each db type, e.g. 9200
for ES. Add ES or MDB flags to specify parser.

Shodan/BinaryEdge Options:
--limit , -l Max number of results per query. Default is
500.
--port , -p Filter by port.
--country , -cn Filter by country (two-letter country code).
--terms , -t Enter any additional query terms you want here, e.g.
'users'

Dump Options:
--mongo, -mdb Use for IP, Shodan, BinaryEdge & Paste methods to
specify parser.
--elastic, -es Use for IP, Shodan, BinaryEdge & Paste me thods to

___________________________
@hacking_Attack
@Hacking_Video

specify parser.
--properjson, -pj Add this flag if would like out put to be proper JSON
file. Default is one JSON string object per line.
--database , -db Specify database you want to grab. For MDB must be in
format format 'db:collection'. Use with IP arg & 'es'
or 'mdb' flag
--getall, -g Get all indices regardless of fields and
collection/index names (overrides selections in config
file).
--ignorelogs Connect to a server you've already checked out.
--nosizelimits, -n Dump index no matter how big it is. Default max doc
count is 800,000.
--csv Convert JSON dumps into CSV format on the fly. (Puts
JSON files in backup folder in case there is issue
with coversion)

CSV/Post-processing Options:
--convertToCSV , -c Convert JSON file or folder of JSON dumps to CSVs
after the fact. Enter full path or folder name in
current working directory
--dontflatten Use if run into memory issues converting JSON files to
CSV during post-processing.
--basic Use with --convertToCSV flag if your JSON dumps are
not true JSON files, but rather line separated JSON
objects that you got from other sources.
--dontclean, -dc Choose if want to keep useless data when convert to
CSV. See docs for more info.


Download ODBParser (https://github.com/citcheese/ODBParser)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Would it be possible to latch on to the Bluetooth connection from AirPods and somebody’s phone

I have though for a while now how I could piss people off by playing annoying songs but then I realised that people could just walk away so I wondered how long would it take professional hackers( some of you) to make the program so as I am typing this I am writing ideas on how I can do it, good luck

submitted by /u/Burst151
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What is the real job of an Incident Responder?


An Incident responder, also known as an Incident handler, is someone who investigates, analyzes, and responds to cyber incidents within…

Continue reading on rootissh »

Hacking on Medium
HackTheBox — Knife Walkthrough


This is a write-up for a fairly easy windows machine from hackthebox.eu named knife. This box is a great first box to pwn.

Continue reading on Medium »

Hacking on Medium
How Election Riggers Modify Electronic Voting Machines (EVMs)


Mini research based article over a hot modification technique used by election riggers to turned the defeat of a candidate into his…

Continue reading on Medium »

KitPloit - PenTest Tools!ODBParser - OSINT Tool To Search, Parse And Dump Only The Open Elasticsearch And MongoDB Directories That Have The Data You Care About Exposing





ODBParser is a tool to search for PII being exposed in open databases.

ONLY to be used to identify exposed PII and warn server owners of irresponsible database maintenance
OR to query databases you have permission to access!

PLEASE USE RESPONSIBLY



What is this?

Wrote this as wanted to create one-stop OSINT tool for searching, parsing and analyzing open databases in order to identify leakages of PII on third-party servers. Other tools seem to either only search for open databases or dump them once you've identified them and then will grab data indiscriminately. Grew from function or two into what's in this repo, so code isn't as clean and pretty as it could be.

Features

To identify open databases you can:

* query Shodanand BinaryEdgeusing all possible parameters (filter by country, port number, whatever)
* specify single IP address
* load up file that has list of IP addresses
* paste list of IP addresses from clipboard

Dumping options:

* parses all databases/collections to identify data you specify
* grab everything hosted on server
* grab just one index/collection
* Use ctrl+c to skip dumping certain index

Post-Processing:

* convert JSON dumps to CSV
* remove useless columns from CSV

Other features:

* keeps track of all the IP addresses and databases you have queried along with info about each server.
* maintains stats file with number of IP's you've queried, number of databases you've parsed and number of records you've dumped
* convert JSON dumps you already have to CSV
* for every database that has total number of records above your limit, script will create an entry in a special file along with 5 sample records so you can review and decide whether the database is worth grabbing
* Default output is line-separated JSON file with a JSON object on each line. You can choose to have it output a "proper JSON" file by using the "properjson" flag
* You can convert the files to CSV on the fly or you can convert only certain files after run is complete (I recommend latter). Converted JSON files will be moved to folder called "JSON backups" in same directory. NOTE:When converting to CSV, script drops exact duplicate rows and drops columns and rows where all values are NaN, because that's what I wanted to do. Feel free to edit function if you'd rather have exact copy of JSON file.
* Windows ONLYIf script pulls back huge number of indices that have field you care about, script will list names of the dbs, pause and give you ten seconds to decide whether you want to go ahead and pull all the data from every index as I've found if you get too many databases returned even after you've specified fields you want, there is a good chance data is fake or useless logs and you can usually tell from name whether either possibility is the case. If you don't act within 10 seconds, script will go ahead and dump every index.
* as you may have noticed, lot of people have been scanning for MongoDB databases and holding them hostage, often changing name to something like "TO_RESTORE_EMAIL_XXXRESTORE.COM." The MongoDb scraper will ignore all databases and collections that have been pwned by checking name of DB/collection against list of strings that indicate pwnage
* script is pretty verbose (maybe too verbose) but I like seeing what's going on. Feel free to silence print statements if you prefer.

Customization

See the odbconfig.py file to specify your parameters, because really name of the game is exposing the data YOU are interested in. I provided some examples in the config file. Play around with them!

You can:

* specify what index or collection names you want to collect by specifying substrings in config file. For exam[...]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
ODBParser - OSINT Tool To Search, Parse And Dump Only The Open Elasticsearch And MongoDB Directories That Have The Data You Care About Exposing


https://1.bp.blogspot.com/-48RWt9wOaPM/YTq6Kfx-jEI/AAAAAAAAul0/Aa1E2Q3fFzAJdW_gygsTlaGB1HcPInqpgCNcBGAsYHQ/w400-h400/ODBParser_1_glassdb.png
ODBParser is a tool to search for PII being exposed in open databases.

ONLY to be used to identify exposed PII and warn server owners of irresponsible database maintenance
OR to query databases you have permission to access!

PLEASE USE RESPONSIBLY
What is this?

Wrote this as wanted to create one-stop OSINT tool for searching, parsing and analyzing open databases in order to identify leakages of PII on third-party servers. Other tools seem to either only search for open databases or dump them once you've identified them and then will grab data indiscriminately. Grew from function or two into what's in this repo, so code isn't as clean and pretty as it could be.

Features

To identify open databases you can:

* query Shodanand BinaryEdgeusing all possible parameters (filter by country, port number, whatever)
* specify single IP address
* load up file that has list of IP addresses
* paste list of IP addresses from clipboard

Dumping options:

* parses all databases/collections to identify data you specify
* grab everything hosted on server
* grab just one index/collection
* Use ctrl+c to skip dumping certain index

Post-Processing:

* convert JSON dumps to CSV
* remove useless columns from CSV

Other features:

* keeps track of all the IP addresses and databases you have queried along with info about each server.
* maintains stats file with number of IP's you've queried, number of databases you've parsed and number of records you've dumped
* convert JSON dumps you already have to CSV
* for every database that has total number of records above your limit, script will create an entry in a special file along with 5 sample records so you can review and decide whether the database is worth grabbing
* Default output is line-separated JSON file with a JSON object on each line. You can choose to have it output a "proper JSON" file by using the "properjson" flag
* You can convert the files to CSV on the fly or you can convert only certain files after run is complete (I recommend latter). Converted JSON files will be moved to folder called "JSON backups" in same directory. NOTE:When converting to CSV, script drops exact duplicate rows and drops columns and rows where all values are NaN, because that's what I wanted to do. Feel free to edit function if you'd rather have exact copy of JSON file.
* Windows ONLYIf script pulls back huge number of indices that have field you care about, script will list names of the dbs, pause and give you ten seconds to decide whether you want to go ahead and pull all the data from every index as I've found if you get too many databases returned even after you've specified fields you want, there is a good chance data is fake or useless logs and you can usually tell from name whether either possibility is the case. If you don't act within 10 seconds, script will go ahead and dump every index.
* as you may have noticed, lot of people[...]

___________________________
@hacking_Attack
@Hacking_Video

IDOR THE HARD WAY (IDOR TO ACCOUNT TAKEOVER)

Hello My name hazem yaser, I’m a Junior Penetration Tester, Bug Hunter, Computer Science Student As I want To share my Findings with the…Continue reading on Medium »
Read more...

IDOR THE HARD WAY (IDOR TO ACCOUNT TAKEOVER)
https://medium.com/@hazeemyasseer/idor-the-hard-way-idor-to-account-takeover-3f0176bd7d8a?source=rss------bug_bounty-5