Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Subcert : Finds All The Subdomains From Certificate Transparency Logs
Subcert is a subdomain enumeration tool, that finds all the valid subdomains from certificate transparency logs. Setup Step 1: Install Python 3 apt-get install python3-pip Step 2: Clone the Repository git clone https://github.com/A3h1nt/Subcert.git Step 3: Install Dependencies pip3 install -r requirements.txt Step 4: Move the Directory to /opt mv subcert /opt/ Step 5: Add an […]
The post Subcert : Finds All The Subdomains From Certificate Transparency Logs appeared first on Kali Linux Tutorials.
Subcert : Finds All The Subdomains From Certificate Transparency Logs
Subcert is a subdomain enumeration tool, that finds all the valid subdomains from certificate transparency logs. Setup Step 1: Install Python 3 apt-get install python3-pip Step 2: Clone the Repository git clone https://github.com/A3h1nt/Subcert.git Step 3: Install Dependencies pip3 install -r requirements.txt Step 4: Move the Directory to /opt mv subcert /opt/ Step 5: Add an […]
The post Subcert : Finds All The Subdomains From Certificate Transparency Logs appeared first on Kali Linux Tutorials.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
stack overflow (bof) challenge writeup
https://cdn-images-1.medium.com/max/1366/1*d3DAtyimZsJ4EoSFHAzmPA.png
in this writeup i will demonstrate and gave explanation about a challange available here https://pwnable.kr/play.php so lets start
Continue reading on Medium »
stack overflow (bof) challenge writeup
https://cdn-images-1.medium.com/max/1366/1*d3DAtyimZsJ4EoSFHAzmPA.png
in this writeup i will demonstrate and gave explanation about a challange available here https://pwnable.kr/play.php so lets start
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
7 Hacks To Increase Your Landing Page Traffic
https://cdn-images-1.medium.com/max/2164/1*FugPvLFWU2-nPkK-gEa_Ww.png
Landing page are intended to make a conversion. Be it register number, social media followers, product buying or newsletter request…
Continue reading on Girls Kode — All About Tech & Digital »
7 Hacks To Increase Your Landing Page Traffic
https://cdn-images-1.medium.com/max/2164/1*FugPvLFWU2-nPkK-gEa_Ww.png
Landing page are intended to make a conversion. Be it register number, social media followers, product buying or newsletter request…
Continue reading on Girls Kode — All About Tech & Digital »
Question about installing Nessus Pro licensing on a dropbox vm and exporting an ova
https://www.reddit.com/r/Pentesting/comments/md0pom/question_about_installing_nessus_pro_licensing_on/
<!-- SC_OFF -->Anyone have any experience with building pentest dropboxes and installing Nessus Pro? I've already built virtual machine pentest dropboxes and integrated everything including the OpenVPN connection and ssh keys for access. Now I have some upcoming assessments that are basically validated vulnerability assessments, not true pentests. I don't want to waste a Nessus license, if after importing the virtual machine ova Nessus is no longer licensed because the NIC MAC address changed, or anything like that. Does anyone know if Nessus would remain licensed after exporting the virtual machine ova and importing into another system? I don't want to burn a license trying to find the answer. I could always fall back to using OpenVAS, but I'd prefer Nessus Pro. <!-- SC_ON --> submitted by /u/subsonic68 (https://www.reddit.com/user/subsonic68)
[link] (https://www.reddit.com/r/Pentesting/comments/md0pom/question_about_installing_nessus_pro_licensing_on/) [comments] (https://www.reddit.com/r/Pentesting/comments/md0pom/question_about_installing_nessus_pro_licensing_on/)
https://www.reddit.com/r/Pentesting/comments/md0pom/question_about_installing_nessus_pro_licensing_on/
<!-- SC_OFF -->Anyone have any experience with building pentest dropboxes and installing Nessus Pro? I've already built virtual machine pentest dropboxes and integrated everything including the OpenVPN connection and ssh keys for access. Now I have some upcoming assessments that are basically validated vulnerability assessments, not true pentests. I don't want to waste a Nessus license, if after importing the virtual machine ova Nessus is no longer licensed because the NIC MAC address changed, or anything like that. Does anyone know if Nessus would remain licensed after exporting the virtual machine ova and importing into another system? I don't want to burn a license trying to find the answer. I could always fall back to using OpenVAS, but I'd prefer Nessus Pro. <!-- SC_ON --> submitted by /u/subsonic68 (https://www.reddit.com/user/subsonic68)
[link] (https://www.reddit.com/r/Pentesting/comments/md0pom/question_about_installing_nessus_pro_licensing_on/) [comments] (https://www.reddit.com/r/Pentesting/comments/md0pom/question_about_installing_nessus_pro_licensing_on/)
Announcing Uber’s Bug Bounty April Promo Event
https://medium.com/uber-security-privacy/announcing-ubers-bug-bounty-april-promo-event-7f5f12b7b077?source=rss------bug_bounty-5
Divyashree Joshi, Senior Security Engineer, Product SecurityContinue reading on Uber Privacy & Security » (https://medium.com/uber-security-privacy/announcing-ubers-bug-bounty-april-promo-event-7f5f12b7b077?source=rss------bug_bounty-5)
https://medium.com/uber-security-privacy/announcing-ubers-bug-bounty-april-promo-event-7f5f12b7b077?source=rss------bug_bounty-5
Divyashree Joshi, Senior Security Engineer, Product SecurityContinue reading on Uber Privacy & Security » (https://medium.com/uber-security-privacy/announcing-ubers-bug-bounty-april-promo-event-7f5f12b7b077?source=rss------bug_bounty-5)
hacking: security in practice
OpenSSL Security Advisory (CVE-2021-3450, CVE-2021-3449)
CA certificate check bypass with X509_V_FLAG_X509_STRICT (CVE-2021-3450)
NULL pointer deref in signature_algorithms processing (CVE-2021-3449)
Details: https://www.openssl.org/news/secadv/20210325.txt
submitted by /u/Vulmon
[link] [comments]
OpenSSL Security Advisory (CVE-2021-3450, CVE-2021-3449)
CA certificate check bypass with X509_V_FLAG_X509_STRICT (CVE-2021-3450)
NULL pointer deref in signature_algorithms processing (CVE-2021-3449)
Details: https://www.openssl.org/news/secadv/20210325.txt
submitted by /u/Vulmon
[link] [comments]
reddit
OpenSSL Security Advisory (CVE-2021-3450, CVE-2021-3449)
CA certificate check bypass with X509\_V\_FLAG\_X509\_STRICT (CVE-2021-3450) NULL pointer deref in signature\_algorithms processing...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Dark Reading: Attacks/Breaches
6 Tips for Limiting Damage from Third-Party Attacks
The ability to protect your organization from third-party attacks will become increasingly critical as attackers try to maximize the effectiveness of their malicious campaigns.
6 Tips for Limiting Damage from Third-Party Attacks
The ability to protect your organization from third-party attacks will become increasingly critical as attackers try to maximize the effectiveness of their malicious campaigns.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles|Raj Chandel's Blog
Comprehensive Guide on FFUF
In this article, we will learn how we can use ffuf. Where ffuf states for “Fuzz Faster U Fool”, it is an interesting open-source web fuzzing tool. Since its release, many people have gravitated towards ffuf, particularly in the bug bounty scenario. So, lets dive in to this learning process. Table of Content<o:p· Introduction to ffuf<o:p
· Setup<o:p
· Input Option:<o:p
o Simple Attack<o:p
o Multiple wordlists<o:p
o Ignore Wordlist Comment and Silent<o:p
o Extensions<o:p
· Match Options:<o:p
o Match HTTP Code<o:p
o Match Lines<o:p
o Match Words<o:p
o Match Size<o:p
o Match Regular Expression<o:p
· Filter Options:<o:p
o Filter Code<o:p
o Filter Lines<o:p
o Filter Size<o:p
o Filter Words<o:p
o Filter Regular Expression<o:p
· General Options<o:p
o Custom Auto Calibration<o:p
o Color<o:p
o Maxtime For Task<o:p
o Maxtime For Job<o:p
o Delay <o:po Request Rate<o:p
o Error Functions<o:p
o Verbose Mode<o:p
· Output Options:<o:p
o Output Format in HTML<o:p
o Output Format in CSV<o:p
o All Output Format<o:p
· HTTP Options<o:p
o Timeout<o:p
o Host Header<o:p
o Recursion<o:p
o Cluster Bomb with Burp suite<o:p
o Attack with Cookie<o:p
o Proxy with Burp suite<o:p
· Conclusion<o:p Introduction to ffuf<o:pIt is a professional command-line method for web fuzzing on web server. Many people have gravitated towards ffuf since its release, especially in the bug bounty scene. While the bulk of this shift is possibly attributable to the herd mentality, a significant portion of the group has made the switch due to FFUF's tempo, versatility, and capacity to easily merge with external tooling.<o:p
It is maintained as public open-source, this ensures that everyone can contribute to ffuf as long as the maintainer (@joohoi) acknowledges and "merges" the contributions back into the main project. <o:p Setup<o:pIt is a command-line programme that runs in the Linux Terminal or the Windows Command Prompt. Upgrading from source is not any more difficult than compiling from source, with the exception of the inclusion of the -u flag. When upgrading from the source code, use the following command.<o:p go get -u github.com/ffuf/ffuf<o:pDue to that fact we are using Kali Linux, we’ll find ffuf in the apt repositories, allowing us to install by running this simple command.<o:p apt install ffuf<o:phttps://1.bp.blogspot.com/-uLJVjFrFu34/YFyqN-oZFfI/AAAAAAAAu_k/RuIGahkBoMQXvcr1vho_JJclu72mOV-mACLcBGAsYHQ/s16000/1.png After installing this tool, to get its working parameters all we need is just use [-h]parameter through this parameter we can see all of its parameters with their functionalities.<o:p ffuf -h<o:phttps://1.bp.blogspot.com/-O3EShCVijKY/YFyqUI2MM5I/AAAAAAAAu_o/FMvJaxiTUkUmHMWmtEhDvZ58rNLfm7-CwCLcBGAsYHQ/s16000/2.png Input Options<o:pThese are those parameters which help us to provide the required data for web fuzzing. Example: URL and Wordlist.<o:p Simple Attack:<o:pFor the first attack, we need to use to simple parameters [-u]for target URL and [-w]to load a wordlist. Now, let’s type this command to run our first attack with this amazing tool.<o:p ffuf -u http://testphp.vulnweb.com/FUZZ/ -w dict.txt<o:pAfter performing this command, lets focus on the resul[...]
Comprehensive Guide on FFUF
In this article, we will learn how we can use ffuf. Where ffuf states for “Fuzz Faster U Fool”, it is an interesting open-source web fuzzing tool. Since its release, many people have gravitated towards ffuf, particularly in the bug bounty scenario. So, lets dive in to this learning process. Table of Content<o:p· Introduction to ffuf<o:p
· Setup<o:p
· Input Option:<o:p
o Simple Attack<o:p
o Multiple wordlists<o:p
o Ignore Wordlist Comment and Silent<o:p
o Extensions<o:p
· Match Options:<o:p
o Match HTTP Code<o:p
o Match Lines<o:p
o Match Words<o:p
o Match Size<o:p
o Match Regular Expression<o:p
· Filter Options:<o:p
o Filter Code<o:p
o Filter Lines<o:p
o Filter Size<o:p
o Filter Words<o:p
o Filter Regular Expression<o:p
· General Options<o:p
o Custom Auto Calibration<o:p
o Color<o:p
o Maxtime For Task<o:p
o Maxtime For Job<o:p
o Delay <o:po Request Rate<o:p
o Error Functions<o:p
o Verbose Mode<o:p
· Output Options:<o:p
o Output Format in HTML<o:p
o Output Format in CSV<o:p
o All Output Format<o:p
· HTTP Options<o:p
o Timeout<o:p
o Host Header<o:p
o Recursion<o:p
o Cluster Bomb with Burp suite<o:p
o Attack with Cookie<o:p
o Proxy with Burp suite<o:p
· Conclusion<o:p Introduction to ffuf<o:pIt is a professional command-line method for web fuzzing on web server. Many people have gravitated towards ffuf since its release, especially in the bug bounty scene. While the bulk of this shift is possibly attributable to the herd mentality, a significant portion of the group has made the switch due to FFUF's tempo, versatility, and capacity to easily merge with external tooling.<o:p
It is maintained as public open-source, this ensures that everyone can contribute to ffuf as long as the maintainer (@joohoi) acknowledges and "merges" the contributions back into the main project. <o:p Setup<o:pIt is a command-line programme that runs in the Linux Terminal or the Windows Command Prompt. Upgrading from source is not any more difficult than compiling from source, with the exception of the inclusion of the -u flag. When upgrading from the source code, use the following command.<o:p go get -u github.com/ffuf/ffuf<o:pDue to that fact we are using Kali Linux, we’ll find ffuf in the apt repositories, allowing us to install by running this simple command.<o:p apt install ffuf<o:phttps://1.bp.blogspot.com/-uLJVjFrFu34/YFyqN-oZFfI/AAAAAAAAu_k/RuIGahkBoMQXvcr1vho_JJclu72mOV-mACLcBGAsYHQ/s16000/1.png After installing this tool, to get its working parameters all we need is just use [-h]parameter through this parameter we can see all of its parameters with their functionalities.<o:p ffuf -h<o:phttps://1.bp.blogspot.com/-O3EShCVijKY/YFyqUI2MM5I/AAAAAAAAu_o/FMvJaxiTUkUmHMWmtEhDvZ58rNLfm7-CwCLcBGAsYHQ/s16000/2.png Input Options<o:pThese are those parameters which help us to provide the required data for web fuzzing. Example: URL and Wordlist.<o:p Simple Attack:<o:pFor the first attack, we need to use to simple parameters [-u]for target URL and [-w]to load a wordlist. Now, let’s type this command to run our first attack with this amazing tool.<o:p ffuf -u http://testphp.vulnweb.com/FUZZ/ -w dict.txt<o:pAfter performing this command, lets focus on the resul[...]
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Hack The Box — SecNotes: Walkthrough (without Metasploit)
https://cdn-images-1.medium.com/max/600/1*mdh_NzY7qWvv50ocCGY63A.png
Hack The Box — SecNotes: Walkthrough (without Metasploit) | Windows Medium Level | SMB attack | Road to OSCP | Pentesting | Arbitrary…
Continue reading on Medium »
Hack The Box — SecNotes: Walkthrough (without Metasploit)
https://cdn-images-1.medium.com/max/600/1*mdh_NzY7qWvv50ocCGY63A.png
Hack The Box — SecNotes: Walkthrough (without Metasploit) | Windows Medium Level | SMB attack | Road to OSCP | Pentesting | Arbitrary…
Continue reading on Medium »