Hacking on Medium
El Hackeo que Cambió al Mundo

Siguiendo uno de los eventos más importantes del año pasado en el mundo digital, el hackeo conocido popularmente como SolarWinds demostró…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
“Un millón de dólares a cambio de infectar las redes de tu propia empresa”


PUBLICADO EN 13 SEPTIEMBRE, 2021POR EHACKING

Continue reading on Medium »

Hacking on Medium
Fool me once


This is the story of how my Outlook account got hacked, what was demanded, and how I rectified my mistake.

Continue reading on Geek Culture »

Deep Web
Need help creating a pgp key

Need help creating pgp key

Hello, I need help creating a pgp key. What I have researched is that the best software to use is kleopatra. However, I couldn’t find where to download it to windows. I tried downloading GPG4WIN and I get an error saying that my computer is unable to run that program. I have a Lenovo computer with windows 10. Can anybody help me please?

submitted by /u/No_Original7180
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
Where can I go to find porn in the darkweb?

I'm having a hard time finding any porn at all on the dark web. Which direction should I go to?

submitted by /u/zinzudo
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
AWID key use

I have an AWID key to get into my apartment but they charge 100 bucks in my building to replace them and I want to have two on me at all times because I often lose things. Any ideas on how to do this.

submitted by /u/littlemanbigdream
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
WiFi password

Hi I didn’t know which subreddit I could use for this but I am currently trying to get my neighbors WiFi password because I do not have WiFi myself currently but the name of the WiFi name is “Potter House” any ideas on what the password could be? Lol

submitted by /u/Ju5tin26
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How do I figure out a Bluetooth protocol?

This darn Bluetooth printer needs a FANCY APP to run, but I'd rather create my own app, or print stuff directly using a desktop (or Arduino) https://www.amazon.com/dp/B08YJXLZN1 It uses some "iprint" app that seems super sketchy...

And extremely aggravating that I can't just use any device.

submitted by /u/MasonP13
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Finding a scammer?

My dear old mom is going through a really rough patch right now, so much so that she’s been a bit spacey these past couple of weeks. Which is why, in a rush to pay off her credit card, she locked herself out of her account and just googled & called the first number she saw. The guy claimed to be a bank associate and went through a series of getting her to add him on Zelle, send him $300, then created a MoonBase account to buy himself crypto.

I know it’s likely an L, but I have the phone number she called, the name and email of the person (probably fake).

Is there a way to reverse search a phone number/email to see who the scammer was?

submitted by /u/zawati_
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
PROTECTING YOURSELF ON FACEBOOK, KEEPING YOURSELF SAFE FROM OSINT INVESTIGATORS AND FRAUD ACTORS


Social media is a one-stop-shop where you can really find much personal information about people. You can find information like siblings…

Continue reading on Medium »

Hacking on Medium
Who is on your WiFi/Network? Find out now!! Only in 3 min. | Netdiscover| Linux| Windows


A. For Linux —

Continue reading on Medium »

Hacking on Medium
What are the Five Things you need to focus on, for a Career in Cyber Security as a beginner?


Basically everyone is noob for starting a new thing..we need to be strong with our basics…Cyber Security is a field which we should know…

Continue reading on Medium »

Deep Web
I keep hearing about dark web sites where you can watch real people stuck in escape rooms and stuff...

But how do people even watch stuff on the dark web if their Javascript is disabled on their Tor browser?

Sorry if this is a dumb question.

Also is it illegal to wach those real danger escape rooms if they exist?

submitted by /u/oxydiethylamide
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Ctf-Screenshotter : A CTF Web Challenge About Making Screenshots

Ctf-Screenshotter is a CTF web challenge about making screenshots. It is inspired by a bug found in real life. The challenge was created by @LiveOverflow for https://cscg.de/.

Watch the video writeup here: https://www.youtube.com/watch?v=FCjMoPpOPYI

Run The Challenge

To run the challenge you have to install docker-compose:

docker-compose up

Once the servicses are running, you should be able to access http://127.0.0.1:5000.

Solution

The DO_NOT_ACCESS folder contains the solution when you checkout the solution branch with git checkout solution.


Download

how I was able to use service like Netflix for free

Hi guys I’m beya this is my second write-up in case you want the first one here is the link chaining bugs from self XSS to account…Continue reading on Medium »
Read more...

Story of my first bounty by a low hanging fruit

Hello People🙌,Continue reading on Medium »
Read more...

Black Hat Ethical Hacking
Apple Issues Emergency Fix for NSO Zero-Click Zero Day

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Apple Issues Emergency Fix for NSO Zero-Click Zero DayPost Views: 103
Reading Time: 2 Minutes
Apple users should immediately update all their devices – iPhones, iPads, Macs and Apple Watches – to install an emergency patch for a zero-click zero-day exploited by NSO Group to install spyware.
Citizen Lab urges Apple users to update immediately. The new zero-click zero-day ForcedEntry flaw affects all things Apple: iPhones, iPads, Macs and Watches.
The security updates, pushed out by Apple on Monday, include iOS 14.8 for iPhones and iPads, as well as new updates for Apple Watch and macOS. The patches will fix at least one vulnerability that the tech behemoth said “may have been actively exploited.”

Citizen Lab first discovered the never-before-seen, zero-click exploit, which it detected targeting iMessaging, last month. It’s allegedly been used to illegally spy on Bahraini activists with NSO Group’s Pegasus spyware, according to the cybersecurity watchdog.

The digital researchers dubbed the new iMessaging exploit ForcedEntry.

Citizen Group said in August that they had identified nine Bahraini activists whose iPhones were inflicted with Pegasus spyware between June 2020 and February 2021. Some of the activists’ phones suffered zero-click iMessage attacks that, besides ForcedEntry, also included the 2020 KISMET exploit.

The activists included three members of Waad (a secular Bahraini political society), three members of the Bahrain Center for Human Rights, two exiled Bahraini dissidents, and one member of Al Wefaq (a Shiite Bahraini political society), Citizen Lab wrote.
See Also: Complete Offensive Security and Ethical Hacking Course The ForcedEntry exploit was particularly notable in that it was successfully deployed against the latest iOS versions – 14.4 & 14.6 – blowing past Apple’s new BlastDoor sandboxing feature to install spyware on the iPhones of the Bahraini activists.

Citizen Lab first observed NSO Group deploying ForcedEntry in February 2021. Apple had just introduced BlastDoor, a structural improvement in iOS 14 meant to block message-based, zero-click exploits like these NSO Group-associated attacks – the month before. BlastDoor was supposed to prevent this type of Pegasus attack by acting as what Google Project Zero’s Samuel Groß called a “tightly sandboxed” service responsible for “almost all” of the parsing of untrusted data in iMessages.

In a post on Monday, Citizen Lab researchers said that in March 2021, they had examined the phone of a Saudi activist who requested anonymity and determined that the phone had been infected with NSO Group’s Pegasus spyware. Last Tuesday, Sept. 7, Citizen Lab forwarded artifacts from two types of crashes on another phone that had been infected with Pegasus, suspecting that both infections showed parts of the ForcedEntry exploit chain.

Citizen Lab forwarded the artifacts to Apple on Tuesday, Sept. 7. On Monday, Sept. 13, Apple confirmed that the files included a zero-day exploit against iOS and MacOS. Apple has designated the ForcedEntry exploit CVE-2021-30860: an as-yet-unrated flaw that Apple describes as “processing a maliciously crafted PDF may lead to arbitrary code execution.”
See Also: Windows MSHTML zero-day defenses bypassed as new info emerges Sniffing out NSO Group’s TracksCitizen Lab described several distinct elements that gives researchers high confidence that the exploit can be tied to the secretive Israeli spyware maker NSO Group, including a forensic artifact called CascadeFail.

CascadeFail is a bug whereby “evidence i[...]

___________________________
@hacking_Attack
@Hacking_Video

s incompletely deleted from the phone’s DataUsage.sqlite file,” according to Citizen Lab. In CascadeFail, “an entry from the file’s ZPROCESS table is deleted, but not entries in the ZLIVEUSAGE table that refer to the deleted ZPROCESS entry,” they described.

That has NSO Group’s fingerprints, they said: “We have only ever seen this type of incomplete deletion associated with NSO Group’s Pegasus spyware, and we believe that the bug is distinctive enough to point back to NSO.”

Another telltale sign: multiple process names installed by the ForcedEntry exploit, including the name “setframed”. That process name was used in an attack with NSO Group’s Pegasus spyware on an Al Jazeera journalist in July 2020, according to Citizen Lab: a detail that the watchdog didn’t reveal at the time.

Zero click remote exploits such as the novel method used by Pegasus spyware to invisibly infect an Apple device without the victim’s knowledge or the need for the victim to click on anything at all were used to infect one victim for as long as six months. They’re pure gold to governments, mercenaries and criminals who want to secretly surveil targets’ devices without being detected.

Pegasus is a powerful spyware: it can turn on a target’s camera and microphone so as to record messages, texts, emails, and calls, even if they’re sent via encrypted messaging apps such as Signal.
See Also: Offensive Security Tool: Jenkins Attack Framework Pegasus’s Threadbare NarrativeNSO has long maintained that it only sells its spyware to a handful of intelligence communities within countries that have been thoroughly vetted for human rights violations. The company has repeatedly tried to keep up that narrative, taking the tactic of questioning Citizen Lab’s methods and motives.

But, as pointed out by Hank Schless, Senior Manager of security solutions at endpoint-to-cloud security company Lookout, the narrative is now pretty threadbare. “The recent exposure of 50,000 phone numbers linked to targets of NSO Group customers was all people needed to see right through what NSO claims,” he told Threatpost on Monday.

“Since Lookout and The Citizen Lab first discovered Pegasus back in 2016, it has continued to evolve and take on new capabilities,” he elaborated. “It can now be deployed as a zero-click exploit, which means that the target user doesn’t even have to tap a malicious link for the surveillanceware to be installed.

While the malware has adjusted its delivery methods, the basic exploit chain remains the same, Schless continued. “Pegasus is delivered via a malicious link that’s been socially engineered to the target, the vulnerability is exploited and the device is compromised, then the malware communicated back to a command-and-control (C2) server that gives the attacker free reign over the device. Many apps will automatically create a preview or cache of links in order to improve the user experience. Pegasus takes advantage of this functionality to silently infect the device.”

Schless said that this is an example of how important it is for both individuals and enterprise organizations to have visibility into the risks their mobile devices present, Pegasus being just onei “extreme, but easily understandable example.

“There are countless pieces of malware out there that can easily exploit known device and software vulnerabilities to gain access to your most sensitive data,” he continued. “From an enterprise perspective, leaving mobile devices out of the greater security strategy can represent a major gap in the ability to protect the entire infrastructure from malicious actors. Once the attacker has control of a mobile device or even compromises the user’s credentials, they have free access to your entire infrastructure. Once they enter your cloud or on-prem apps, they can move laterally and identify sensitive assets to encrypt for a ransomware attack or exfiltrate to sell to the highest bidder.”

Kevin Dunne, president at [...]

___________________________
@hacking_Attack
@Hacking_Video

unified access orchestration provider Pathlock, noted that the Pegasus infections point to the need for businesses to look beyond securing servers and workstations as primary targets for cyberattacks and espionage. “Mobile devices are now used broadly and contain sensitive information that needs to be protected,” he explained. See Also: Hacking Stories: Andrian Lamo – The ‘homeless’ HackerTo protect themselves against spyware, businesses should look at their mobile device security strategy, Dunne said – particularly when threats come in forms that are far more insidious than suspicious SMS messages or phishy links that security teams can train users to avoid.

“Spyware attackers have now engineered zero click attacks which are able to get full access to a phone’s data and microphone/camera by using vulnerabilities in third party apps or even built-in applications,” Dunne said. “Organizations need to make sure they have control over what applications users download on to their phones, and can ensure they are up to date so any vulnerabilities are patched.”
Source: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/zeroday-90x90.png Windows MSHTML zero-day exploits shared on hacking forums1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/microsoft-zero-day-vulnerabilities-800x358-1-90x90.png Windows MSHTML zero-day defenses bypassed as new info emerges4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Malware-90x90.jpg Microsoft shares temp fix for ongoing Office 365 zero-day attacks5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Jenkins-90x90.jpg Jenkins project’s Confluence server hacked to mine Monero6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/unnamed-e1630998483665-90x90.jpg Critical Auth Bypass Bug Affect NETGEAR Smart Switches1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/loyalty-card-90x90.jpg Brute-Force Attacks Target Inboxes for Gift Card Data1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Braktooth-New-Bluetooth-gaps-threaten-countless-devices-1024x576-1-90x90.jpg Bluetooth Bugs Open Billions of Devices to DoS, Code Execution2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/wordpress_plugin_vuln-90x90.jpg Gutenberg Template Library & Redux Framework Bugs Plague WordPress Sites2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/ransomware-cpu-90x90.jpg LockFile Ransomware Uses Never-Before Seen Encryption to Avoid Detection2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Windows-Abstract-90x90.jpg Microsoft Exchange ‘ProxyToken’ Bug Allows Email Snooping2 weeks ago
style="display:block; text-align:center;"
data-ad-layout="in-article"
data-ad-format="fluid"
data-ad-client="ca-pub-6620833063853657"
data-ad-slot="4517761481">
The post Apple Issues Emergency Fix for NSO Zero-Click Zero Day first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video