hacking: security in practice
XSS how-to covering: Absolute basics, types of XSS, contexts, discovery methods, polyglots, basic filter bypasses, event attributes, escalation methods, short payloads, bypassing SOP and edge cases

https://b.thumbs.redditmedia.com/2WDW_gegTpowqzy3QOsGV4TcZahglvbl2trEAYmTWok.jpg submitted by /u/hakluke
[link] [comments]

hacking: security in practice
Hackathon: Golem (the Ethereum Sleepin Giant) + Gitcoin GR9 Hackathon, up to 30k USDC in prizes. There's also a special category where you get to work on some dope projects from MIT Solve

https://b.thumbs.redditmedia.com/77lxOJPHc0XNeZno0PwbxpVWxYeaEk_ogHZnkjM9JOo.jpg submitted by /u/costgallo
[link] [comments]

hacking: security in practice
Restricted Environment IoT Hacking All You N33d Is a Remote Shell

https://b.thumbs.redditmedia.com/5TIKmj8R2MrTUc07_Muat_0-1ABXRTODl59VMlKTxlI.jpg submitted by /u/_Z_
[link] [comments]

Gitrecon - OSINT Tool To Get Information From A Github Profile And Find GitHub User'S Email Addresses Leaked On Commits

OSINT tool to get information from a github profile and find GitHub user's email addresses leaked on commits.How does this work? GitHub uses the email address associated with a GitHub account to link commits and other activity to a GitHub profile. When a user makes commits to public repos their email address is usually published in the commit and becomes publicly accessible, if you know where to look. GitHub provide some instructions on how to prevent this from happening, but it seems that most GitHub users either don't know or don't care that their email address may be exposed. Finding a GitHub user's email address is often as simple as looking at their recent events via the GitHub API. Idea and text from Nick Drewe. Source: https://thedatapack.com/tools/find-github-user-email/ Prerequisites Python 3 Installation git clone https://github.com/GONZOsint/gitrecon.gitcd gitrecon/python3 -m pip install -r requirements.txt It is possible to use a Github access token by editing line 23 of the gitrecon.py file token = '<Access token here>' Usage usage: gitrecon.py -h -a -o usernamepositional arguments: usernameoptional arguments: -h, --help show this help message and exit -a, --avatar download avatar pic -o, --output save output as json Features Profile info Username Name User ID Avatar url Email Location Bio Company Blog Gravatar ID Twitter username Followers Following Created at Updated at Extract Orgs Search for leaked emails on commits Prevention To avoid this type of leaks, certain configurations can be made on Github: Settings url: https://github.com/settings/emails ✔️ Keep my email addresses private ✔️ Block command line pushes that expose my email Download Gitrecon
Read more...

Kali Linux Tutorials
Subcert : Finds All The Subdomains From Certificate Transparency Logs

Subcert is a subdomain enumeration tool, that finds all the valid subdomains from certificate transparency logs. Setup Step 1: Install Python 3 apt-get install python3-pip Step 2: Clone the Repository git clone https://github.com/A3h1nt/Subcert.git Step 3: Install Dependencies pip3 install -r requirements.txt Step 4: Move the Directory to /opt mv subcert /opt/ Step 5: Add an […]

The post Subcert : Finds All The Subdomains From Certificate Transparency Logs appeared first on Kali Linux Tutorials.

Hacking on Medium
stack overflow (bof) challenge writeup

https://cdn-images-1.medium.com/max/1366/1*d3DAtyimZsJ4EoSFHAzmPA.png
in this writeup i will demonstrate and gave explanation about a challange available here https://pwnable.kr/play.php so lets start

Continue reading on Medium »

Hacking on Medium
TryHackMe:VulNet

https://cdn-images-1.medium.com/max/1920/1*jajR6JZu7F-JrMwVqlD_0Q.png
Content:

Continue reading on Medium »

Hacking on Medium
7 Hacks To Increase Your Landing Page Traffic

https://cdn-images-1.medium.com/max/2164/1*FugPvLFWU2-nPkK-gEa_Ww.png
Landing page are intended to make a conversion. Be it register number, social media followers, product buying or newsletter request…

Continue reading on Girls Kode — All About Tech & Digital »

Question about installing Nessus Pro licensing on a dropbox vm and exporting an ova
https://www.reddit.com/r/Pentesting/comments/md0pom/question_about_installing_nessus_pro_licensing_on/

<!-- SC_OFF -->Anyone have any experience with building pentest dropboxes and installing Nessus Pro? I've already built virtual machine pentest dropboxes and integrated everything including the OpenVPN connection and ssh keys for access. Now I have some upcoming assessments that are basically validated vulnerability assessments, not true pentests. I don't want to waste a Nessus license, if after importing the virtual machine ova Nessus is no longer licensed because the NIC MAC address changed, or anything like that. Does anyone know if Nessus would remain licensed after exporting the virtual machine ova and importing into another system? I don't want to burn a license trying to find the answer. I could always fall back to using OpenVAS, but I'd prefer Nessus Pro. <!-- SC_ON --> submitted by /u/subsonic68 (https://www.reddit.com/user/subsonic68)
[link] (https://www.reddit.com/r/Pentesting/comments/md0pom/question_about_installing_nessus_pro_licensing_on/) [comments] (https://www.reddit.com/r/Pentesting/comments/md0pom/question_about_installing_nessus_pro_licensing_on/)

Announcing Uber’s Bug Bounty April Promo Event
https://medium.com/uber-security-privacy/announcing-ubers-bug-bounty-april-promo-event-7f5f12b7b077?source=rss------bug_bounty-5

Divyashree Joshi, Senior Security Engineer, Product SecurityContinue reading on Uber Privacy & Security » (https://medium.com/uber-security-privacy/announcing-ubers-bug-bounty-april-promo-event-7f5f12b7b077?source=rss------bug_bounty-5)

hacking: security in practice
OpenSSL Security Advisory (CVE-2021-3450, CVE-2021-3449)

CA certificate check bypass with X509_V_FLAG_X509_STRICT (CVE-2021-3450)

NULL pointer deref in signature_algorithms processing (CVE-2021-3449)

Details: https://www.openssl.org/news/secadv/20210325.txt

submitted by /u/Vulmon
[link] [comments]

Dark Reading: Attacks/Breaches
6 Tips for Limiting Damage from Third-Party Attacks

The ability to protect your organization from third-party attacks will become increasingly critical as attackers try to maximize the effectiveness of their malicious campaigns.