KitPloit - PenTest Tools!
JSPanda - Client-Side Prototype Pullution Vulnerability Scanner

https://1.bp.blogspot.com/-uBauZSD-Bhk/YUseN81_vXI/AAAAAAAAvSM/EC84hZKBoEwOsqwKqEIWBK4gLBDaa3zKgCNcBGAsYHQ/w640-h492/jspanda_3_pollute.png JSpanda is client-side prototype pollution vulnerability scanner. It has two key features, scanning vulnerability the supplied URLs and analyzing the JavaScript libraries' source code.

However, JSpanda cannot detect advanced prototype pollution vulnerabilities. How JSPanda works?* Uses multiple payloads for prototype pollution vulnerability.
* Gathers all the links in the targets for scanning and add payloads to JSpanda-obtained URLs, navigates to each URL with headless Chromedriver.
* Scans all words in the source code of potentially vulnerable JavaScript library and it creates a simple JS PoC by finding the script gadget, helping you analyze the code manually. Requirements* Download latest version of Google Chrome and Chromedriver
* Selenium UsageScan: python3.7 jspanda.py

* Add URLs to url.txt file, for instance : example.com

Basic Source Code Analysis : python3.7 analyze.py

* Add a JavaScript library's source code to analyze.js
* Generate PoC code using analyze.py
* Execute PoC code on Chrome's console. It pollutes all the words collected from the source code and show it on the screen. So it may generate false positive results. These outputs provide additional information to researchers, do not automate everything. Demonstrationhttps://camo.githubusercontent.com/b6c5d8b24c254dcdea70d25100ce01491c28c93b9d373a2a270606ed3b38da67/68747470733a2f2f61736369696e656d612e6f72672f612f424f617a674156795736794871685545336645596343694d4c2e737667 Source code analysis - Screenshothttps://1.bp.blogspot.com/-uBauZSD-Bhk/YUseN81_vXI/AAAAAAAAvSM/EC84hZKBoEwOsqwKqEIWBK4gLBDaa3zKgCNcBGAsYHQ/w640-h492/jspanda_3_pollute.png Supporting Materials : https://twitter.com/har1sec/status/1314469278322655233 https://github.com/BlackFan/client-side-prototype-pollution https://github.com/ThePacketBender/notes/blob/01c0b834f6e3ee4d934b087b2d92c9e484dc2a50/web/prototype_pollution.txt https://habr.com/ru/company/huawei/blog/547178/ https://infosecwriteups.com/javascript-prototype-pollution-practice-of-finding-and-exploitation-f97284333b2 https://github.com/securitum/research/tree/master/r2020_prototype-pollution Learn Prototype Pollution in Series - Part 2 dwisiswant0/ppfuzz GitHub - raverrr/plution: Prototype pollution scanner using headless chrome JavaScript Prototype Poisoning Vulnerabilities in the Wild The Complete Guide to Prototype Pollution Vulnerabilities Download Jspanda

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
My Phone Randomly Started Broadcasting a Stranger's Conversation?

I don't know if this is the right place for this but I was watching a Youtube video when it suddenly got paused and I heard a man's voice in the middle of a conversation talking about healthcare (he spoke English, even though I'm in Germany). Then he said "Over." and a few moments later a woman started talking before my phone was disconnected from the conversation. I didn't have any other apps open in the background and now I'm kinda freaked out. Does anyone know how and why my phone randomly picked up the signal? (I have a Samsung Galaxy S10) And is it something I should be worried about?

submitted by /u/Bo_jelin
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Disclosure of three 0-day iOS vulnerabilities and critique of Apple Security Bounty program

https://external-preview.redd.it/QoOCgtRmAqnrs4z77DKAG_3aT1gCXVv1F7sGEbLQiCc.jpg?width=640&crop=smart&auto=webp&s=6ae650150737cf9cabefd19a2c6bb00e9f1e7343 submitted by /u/illusionofchaos
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
NSA WATCHLISTING - TOR BROWSING LEADING TO NO-TOUCH GOVERNMENT TORUTURE

Mind control still exists. And the NSA is putting Tor browsers in "No-Touch torture" and mind control programs. This is also "gangstalking".

There's articles about the NSA Watchlisting Tor browsers but I was informed from a friend who already knew.

Gangstalking - is a dragnet mass surveillance program made by the NSA in support of the police and the community. Which leads to

Radio Mind control - Literally one day after using an invalid onion link, I started hearing voices via microwave auditory (which eventually relay your thoughts). Radio hypnosis and mind control, psychotic induction, behavior modifications, and everything affecting the human body and brain through electromagnetic waves. (Which I can see daily.)

These agencies have communities of government discredited people named targeted individuals.

WATCH OUT

submitted by /u/GANJASbandcamp
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe Write-up: Daily Bugle.

https://cdn-images-1.medium.com/max/965/1*6qu9HJm24zkrR7IRCPAQDw.png
Dificultad: Difícil.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
NodeOS Node.js by usb

https://cdn-images-1.medium.com/max/1000/1*q3wY9jVXpX1aqnIDhLOd0g.jpeg
string hat = “grey”

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Does anyone know where to find old firmware updates for fitbit

I want to download fitbit firmware on my pc but having a hardtime finding any old firmware. anyone knows?

submitted by /u/dayneofarthurser
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Cain and Abel

When I was 16 I used to use it to sniff IP’s on Xbox lol. Is this software still available or I mean usable? I imagine maybe zoom calls can be ddosed? Just curious if it’s still used or is it out dated.

submitted by /u/Hearing_Excellent
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

https://b.thumbs.redditmedia.com/XmK77WKskQ7hbDhOH5bcoXsM9H8iv4anUsCfeUBDXWY.jpg submitted by /u/narcwhisperer
[link] [comments]

Hacking on Medium
The Hacking of Calendine

https://cdn-images-1.medium.com/max/700/1*VzwjA1P72Mh1EXRX60J3Gw.jpeg
A company has its security system hacked. The hacker demands the company take certain actions or face the consequences.

Continue reading on Fictitious »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Tricks Hackers Use To Steal Crypto From People On MetaMask

https://cdn-images-1.medium.com/max/1507/1*NUGPVlBdKqgv6xUr1tBoyA.png
In this article, we’ll discuss the startling mass crypto-hacks targeting MetaMask users and how you can avoid becoming the next victim

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Common Terminologies to keep in mind while attacking Kerberos

https://cdn-images-1.medium.com/max/600/1*WxYpqlnWZHHWH7ldfJ1dvQ.png
Kerberos is the default authentication service for Microsoft Windows domains.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

JSON CSRF : CSRF that none talks about
https://anonymousyogi.medium.com/json-csrf-csrf-that-none-talks-about-c2bf9a480937?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Y0gi here back again with another interesting blog .In this blog i am going to talk about JSON CSRF , something which you have might heard…Continue reading on Medium » (https://anonymousyogi.medium.com/json-csrf-csrf-that-none-talks-about-c2bf9a480937?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video