Hacking on Medium
Black Kingdom Ransomware busca servidores de Microsoft Exchange sin parches.

https://cdn-images-1.medium.com/max/971/0*GeQUeP2t43sxwBY8
Más de una semana después de que Microsoft lanzara una herramienta de mitigación con un solo clic para mitigar los ataques cibernéticos…

Continue reading on Medium »

Hacking on Medium
Facebook blocca hackers con base in Cina: i malware colpiscono Uiguri attivisti e dissidenti

https://cdn-images-1.medium.com/max/2600/0*uV0BshJH49pikyJJ
Facebook ha bloccato un gruppo di hackers con sede in Cina che hanno utilizzato la piattaforma per colpire Uiguri che vivono all’estero…

Continue reading on Medium »

Imagine a world with "Hack-Back Vigilantes"
https://www.reddit.com/r/Pentesting/comments/md4lxr/imagine_a_world_with_hackback_vigilantes/

<!-- SC_OFF -->The year is 2041... Taylor Swift is president... Congress has passed laws allowing companies that have been breached to retaliate and go after their cyber assailants. After presenting some evidence to the courts, victim companies are served warrants that allow them to hire Cyber Vigilantes to hunt down and infiltrate their attackers. Hack-Back Vigilante companies are popping up everywhere, the demand for offensive cyber talent is off the charts! Nerdy computer guys are suddenly hired guns... Netflix evolves into documentaries displaying 1000s of Linux terminals for hours upon hours. You, a tall, dark, and handsome actor severely regret spending all those hours in the gym instead of learning how to throw exploits... Because now... exploiters have it all... and you have to move to Bollywood. LEARN TO HACK! Future you can thank me later. <!-- SC_ON --> submitted by /u/st1cky_bits (https://www.reddit.com/user/st1cky_bits)
[link] (https://www.reddit.com/r/Pentesting/comments/md4lxr/imagine_a_world_with_hackback_vigilantes/) [comments] (https://www.reddit.com/r/Pentesting/comments/md4lxr/imagine_a_world_with_hackback_vigilantes/)

It’s official: ethical hackers earn more than software developers.
https://zumaroc.medium.com/its-official-ethical-hackers-earn-more-than-software-developers-ae21b50acbc5?source=rss------bug_bounty-5

New to crowdsourced security?Continue reading on Medium » (https://zumaroc.medium.com/its-official-ethical-hackers-earn-more-than-software-developers-ae21b50acbc5?source=rss------bug_bounty-5)

Announcing Uber’s Bug Bounty April Promo Event

Divyashree Joshi, Senior Security Engineer, Product SecurityContinue reading on Uber Privacy & Security »
Read more...

It’s official: ethical hackers earn more than software developers.

New to crowdsourced security?Continue reading on Medium »
Read more...

hacking: security in practice
I have very little experience with IOS, are there any current exploits that bypass SSL Pinning?

I'm smashing my head against the keyboard trying to sniff these network packets on an IOS app. Android, was easy. I've tried Frida, but I can't seem to hook to any network calls.

Does anyone have experience with disabling SSL Pinning on ios apps?

submitted by /u/evohans
[link] [comments]

hacking: security in practice
US General says attacks by foreign hackers are 'clarion call'

submitted by /u/DrinkMoreCodeMore
[link] [comments]

Smogcloud - Find Cloud Assets That No One Wants Exposed
http://www.kitploit.com/2021/03/smogcloud-find-cloud-assets-that-no-one.html

Getting Started
Install and setup golang (https://www.callicoder.com/golang-installation-setup-gopath-workspace/) Install smogcloud using the following command go get -u github.com/BishopFox/smogcloud
Set up aws environment variable for the account you wish to query. We suggest utilizing a read-only Security Auditor (https://medium.com/@HorosAWSData/how-to-add-an-aws-user-with-security-audit-access-819f0aef7cee) role. The following commands can be used to set environment variables: export AWS_ACCOUNT_ID='' # Describe account
export AWS_ACCESS_KEY_ID='' # Access key for aws account
export AWS_SECRET_ACCESS_KEY='' # Secret key for aws account
Run the application smogcloud
or go run main.go
Current Services
Supported services for extracting internet exposures: * API Gateway
* CloudFront
* EC2
* Elastic Kubernetes (https://www.kitploit.com/search/label/Kubernetes) Service
* Elastic Beanstalk
* Elastic Search
* Elastic Load Balancing (https://www.kitploit.com/search/label/Load%20Balancing)
* IoT
* Lightsail
* MediaStore
* Relational Database Service
* Redshift
* Route53
* S3
AWS Patterns
From studying Open API documentation on RESTful AWS endpoints (https://www.kitploit.com/search/label/Endpoints) we determined these are the patterns of exposure URIs that you may find in AWS accounts. It is important to understand how to interact with these native services to test them for vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) and other misconfigurations. Security engineers may want to monitor Cloudtrail logs or build DNS monitoring for requests to these services. s3 https://{user_provided}.s3.amazonaws.com cloudfront https://{random_id}.cloudfront.net ec2 ec2-{ip-seperated}.compute-1.amazonaws.com es https://{user_provided}-{random_id}.{region}.es.amazonaws.com elb http://{user_provided}-{random_id}.{region}.elb.amazonaws.com:80 https://{user_provided}-{random_id}.{region}.elb.amazonaws.com:443 elbv2 https://{user_provided}-{random_id}.{region}.elb.amazonaws.com rds mysql://{user_provided}.{random_id}.{region}.rds.amazonaws.com:3306 postgres://{user_provided}.{random_id}.{region}.rds.amazonaws.com:5432 route53 {user_provided} execute-api https://{random_id}.execute-api.{region}.amazonaws.com/{user_provided} cloudsearch https://doc-{user_provided}-{random_id}.{region}.cloudsearch.amazonaws.com (https://doc-%7Buser_provided%7D-%7Brandom_id%7D.%7Bregion%7D.cloudsearch.amazonaws.com/) transfer sftp://s-{random_id}.server.transfer.{region}.amazonaws.com iot mqtt://{random_id}.iot.{region}.amazonaws.com:8883 https://{random_id}.iot.{region}.amazonaws.com:8443 https://{random_id}.iot.{region}.amazonaws.com:443 mq https://b-{random_id}-{1,2}.mq.{region}.amazonaws.com:8162 (https://b-%7Brandom_id%7D-%7B1,2%7D.mq.%7Bregion%7D.amazonaws.com:8162/) ssl://b-{random_id}-{1,2}.mq.{region}.amazonaws.com:61617 kafka b-{1,2,3,4}.{user_provided}.{random_id}.c{1,2}.kafka.{region}.amazonaws.com {user_provided}.{random_id}.c{1,2}.kafka.{region}.amazonaws.com cloud9 https://{random_id}.vfs.cloud9.{region}.amazonaws.com mediastore https://{random_id}.data.mediastore.{region}.amazonaws.com. kinesisvideo https://{random_id}.kinesisvideo.{region}.amazonaws.com mediaconvert https://{random_id}.mediaconvert.{region}.amazonaws.com mediapackage https://{random_id}.mediapackage.{region}.amazonaws.com/in/v1/{random_id}/channel elasticbeanstalk https://{random_id}.{user_provided}.elasticbeanstalk.com cognito https://{user_provided}.auth.{region}.amazoncognito.com
References
AWS SDK Go (https://docs.aws.amazon.com/sdk-for-go/api/) API-guru Open API for AWS (https://github.com/APIs-guru/openapi-directory/tree/master/APIs/amazonaws.com) aws-cli (https://github.com/aws/aws-cli)
Authors
Oscar Salazar - Initial work - Bishop Fox (https://github.com/tracertea) Rob Ragan - Initial work - Bishop Fox

(https://github.com/basicScandal)&#128270; &#9729;&#65039; (15)"> @sweepthatleg Brandon Gaudet - Initial work - Bishop Fox (https://github.com/brandondgaudet)
Contributions
We do our best to maintain our tools, but can't always keep them as up to date as we'd like. So, we always appreciate code contributions, feature requests, and bug reports.
Acknowledgments
Thank you for inspiration Cloudmapper (https://github.com/duo-labs/cloudmapper) AWS Public IPs (https://github.com/arkadiyt/aws_public_ips) John Backes & Tiros (https://aws.amazon.com/blogs/security/aws-security-profile-john-backes-senior-software-development-engineer/) IAM Access Analyzer (https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html) Cartography (https://github.com/lyft/cartography)

Download Smogcloud (https://github.com/BishopFox/smogcloud)

Hacking on Medium
Install Kali Linux On VMWARE 2021

https://cdn-images-1.medium.com/max/1400/0*U_jzlD7N5OvB_Y-K.png
Simple step installing kali linux on vmware

Continue reading on Medium »

Hacking on Medium
Photocopy or Identity theft ??

https://cdn-images-1.medium.com/max/1280/1*uzuue_A1Zd8VqZP7C_mTHg.png
When it comes to the digital era, you are nothing but a unique collection of data. Every mobile application, social platform, or any…

Continue reading on Medium »

Hacking on Medium
Ответы на 6 самых популярных вопросов хакерам

https://cdn-images-1.medium.com/max/1280/1*ARhwXatukF4c_KvyNJz-jw.jpeg
Немного о хакерах

Continue reading on Medium »