Hacking on Medium
Pegasus — The Humanitarian Costs of Insecure Code

https://cdn-images-1.medium.com/max/2600/0*gjNcJdXaLfPI_Hxs
A look at the nature and effect of advanced spyware on application security

Continue reading on ShiftLeft Blog »

___________________________
@hacking_Attack
@Hacking_Video

Belt Finance Logic Error Bug Fix Postmortem

SummaryContinue reading on Immunefi »
Read more...

Announcing the BugBounty program

HUMAN Protocol is inviting ethical hackers to find (and fix) bugs! Hackers will be asked to “attack” our website.Continue reading on HUMAN Protocol »
Read more...

Dark Reading: Attacks/Breaches
The New Security Basics: 10 Most Common Defensive Actions

Companies now commonly collect security metrics from their software development life cycle, implement basic security measures, and define their obligations to protect user data as part of a basic security strategy.

Dark Reading: Attacks/Breaches
SecZetta Announces $20.5M Series B Funding

Oversubscribed round led by SYN Ventures, with participation from MassMutual Ventures and existing investors ClearSky and Rally Ventures.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
You're Going to Be the Victim of a Ransomware Attack

That's not admitting defeat. It's preparing for success.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
call spoofing : i've been attacked

Hey everybody, i'm running a small marketing company using google ads as business model for making benefits. Recently i received calls from real people who thought we had a missed call with them, which is was not the case.

So i'm receiving 10 calls like this from genuine people who thought i've done a missed call to them. I'm suspecting a hacker faking my own caller ID to send automatically missed calls to genuine people.

Could you please give me more informations about that, is it costly to run a hacking like this, is it hard to do it, are there only good hackers for knowing to do that. Help me please.

submitted by /u/loungeclaus
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
#scriptlife

I’m was stumbling around on GitHub when I come across Mr. Nihad Abbasov.

I was just curious if y’all had any cool stories like this one or if y’all had any cool scripts you’d be willing to share..

Hacker-Scripts

submitted by /u/Arlo_Jenkins
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Fire stick can they watch me?

So my dad got a fire stick from a guy that already has all the channels free ppv and etc cool of course I have to connect it to the WiFi.. no problem. So then I go to my computer and go to Google chrome cast and it says “ (name) firestick tv” it’s already clicked to tab the other is files or desktop I think tab is the safest.. so my question now is can they see what I’m seeing on my computer I never said allow or view my screen… or do I see there screen instead of them seeing mine because it’s the firestick thing itself. Also can they use my network now that I put my wifi in it and monitor me? Like from home can they monitor me from far away?

submitted by /u/theheadbanders
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Reconky : A Great Content Discovery Bash Script For Bug Bounty Hunters Which Automate Lot Of Task And Organized It

Reconky is a script written in bash to automate the task of recon and information gathering. This Bash Script allows you to collect some information that will help you identify what to do next and where to look for the required target. Main-Features

* It will Gathers Subdomains with assetfinder and Sublist3r
* Duplex check for subdomains using amass
* Enumerates subdomains on a target domain through dictionary attack using knockpy
* searchs for alive domains using Httprobe
* Investigates for feasible subdomain takeover
* Scans for open ports using nmap
* Pulls and Assembls all possible parameters found in wayback_url data
* Pulls and compilis json/js/php/aspx/ files from wayback output
* Runs eyewitness against all the compiled(alive) domains

Installation & Requirements

* Download the install script from https://github.com/ShivamRai2003/Reconky-Automated_Bash_Script/blob/main/reconky.sh
#!/usr/bin/bash#Author:Shivam Rai/#Date:18/06/2021#Description:Automated Recon toolecho “——— _______ _______ _______ _______ _ _( ____ )( ____ \( ____ \( ___ )( ( /|| \ /\|\ /|| ( )|| ( \/| ( \/| ( ) || \ ( || \ / /( \ / )| (____)|| (__ | | | | | || \ | || (_/ / \ (_) /| __)| __) | | | | | || (\ \) || _ ( \ /| (\ ( | ( | | | | | || | \ || ( \ \ ) (| ) \ \__| (____/\| (____/\| (___) || ) \ || / \ \ | ||/ \__/(_______/(_______/(_______)|/ )_)|_/ \/ \_/“if [[ $(id -u) != 0 ]]; thenecho -e “\n[!] Install.sh requires root privileges”exit 0fitarget=$1if [ ! -d “$target” ];thenmkdir $targetfiif [ ! -d “$target/reconky” ];thenmkdir $target/reconkyfiif [ ! -d ‘$target/reconky/sublist3r’ ];thenmkdir $target/reconky/sublist3rtouch $target/reconky/sublist3r/subdomains.txtfiif [ ! -d ‘$tagget/reconky/httprobe’ ]; thenmkdir $target/reconky/httprobefiif [ ! -d ‘$target/reconky/assetfinder’ ];thenmkdir $target/reconky/assetfindertouch $target/reconky/assetfinder/subdomains1.txtfiif [ ! -d ‘$target/reconky/Subdomain_Takeover’ ]; thenmkdir $target/reconky/Subdomain_Takeoverfiif [ ! -d ‘$target/reconky/scans’ ]; thenmkdir $target/reconky/scansfiif [ ! -d ‘$target/reconky/wayback_urls’ ]; thenmkdir $target/reconky/wayback_urlsmkdir $target/reconky/wayback_urls/paramstouch $target/reconky/wayback_urls/params/params.txtmkdir $target/reconky/wayback_urls/extensionsfiif [ ! -d ‘$target/reconky/amass’ ]; thenmkdir $target/reconky/amasstouch $target/reconky/amass/subdomains2.txtfiif [ ! -d ‘$target/reconky/witness’ ]; thenmkdir $target/reconky/eyewitnessfiif [ ! -d ‘$target/reconky/knockpy’ ]; thenmkdir $target/reconky/knockpytouch $target/reconky/knockpy/subdomains3.txtfiif [ ! -f “$target/reconky/httprobe/alivee.txt” ];thentouch $target/reconky/httprobe/alivee.txtfired=`tput setaf 1`green=`tput setaf 2`yellow=`tput setaf 3`echoecho ${yellow}”Welcome to the Reconky Script-An Excellent Automation Script For Bug Bounty/Pentesting”${yellow}echoecho ${red}”[+++] Gatherings subdomains with assetfinder and Sublist3r…[+++]”${red}echoecho ${red}”[+++] Duplex checking for subdomains with amass…[+++]”${red}echoecho ${red}”[+++] Enumerating subdomains on a target domain through dictionary attack…[+++]”${red}echoecho ${red}”[+++] Searching for alive domains using Httprobe…[+++]”${red}echoecho ${red}”[+++] Investigating for feasible subdomain takeover…[+++]”${red}echoecho ${green}”[+++] Scanning for open ports using nmap…[+++]”${green}echoecho ${green}”[+++] Pulling and Assembling all possible params found in wayback_url data…[+++]”${green}echoecho ${green}”[+++] Pulling and compiling json/js/php/aspx/ files from wayback output…[+++]”${green}echoecho ${green}”[+++] Running gowtiness(eyewitness) against all the compiled(alive) domains…[+++]”${green}echoecho ${yellow}”[+++]Recon is in Progress Take A Cofee or Tea ;)[+++]”${yellow}echoassetfinder $target >> $t[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Haklistgen : Turns Any Junk Text Into A Usable Wordlist For Brute-Forcing

Haklistgen turns any junk text into a usable wordlist for brute-forcing.

Installation

go install github.com/hakluke/haklistgen@latest

Usage Examples

Scrape all words out of an HTTP response to build a directory bruteforce wordlist:

curl https://wikipedia.org | haklistgen

Pipe a list of subdomains to it to generate a wordlist for bruteforcing more subdomains:

subfinder -silent -d example.com | haklistgen

Piping in a custom JavaScript file could yield some interesting results:

curl https://example.com/app.js | haklistgen

You could create a great custom wordlist for a large-scope target doing something like this:

subfinder -silent -d hakluke.com | anew subdomains.txt | httpx -silent | anew urls.txt | hakrawler | anew endpoints.txt | while read url; do curl $url –insecure | haklistgen | anew wordlist.txt; done
cat subdomains.txt urls.txt endpoints.txt | haklistgen | anew wordlist.txt;

This would save subdomains to subdomains.txt, then save httpx output to urls.txt, then crawl each url and save the hakrawler output to endpoints.txt, then fetch every URL in endpoints.txtand make a wordlist out of it, concatenating all of the wordlists to wordlist.txt. Then it takes all of the subdomains and urls, and adds words out of the words in those too.
Download

___________________________
@hacking_Attack
@Hacking_Video

arget/reconky/assetfinder/subdomains1.txtcat $target/reconky/assetfinder/subdomains1.txt | grep $1 >> $target/reconky/Subdomain_final.txtechosublist3r -d $target -v -t 100 -o $target/reconky/sublist3r/subdomains.txtcat $target/reconky/sublist3r/subdomains.txt | grep $1 >> $target/reconky/Subdomain_final.txtechoamass enum -d $target -o $target/reconky/amass/subdomains2.txtcat $target/reconky/amass/subdomains2.txt | grep $1 >> $target/reconky/Subdomain_final.txtechoknockpy $target >> $target/reconky/knockpy/subdomains3.txtawk ‘/$target/ {print}’ $target/reconky/knockpy/subdomains3.txt | cut -d ” ” -f 9 >> $target/reconky/Subdomain_final.txtechocat $target/reconky/Subdomain_final.txt | sort -u | httprobe | sed -E ‘s/^\s*.*:\/\///g’ >> $target/reconky/httprobe/alivee.txtechoif [ ! -f “$target/reconky/Subdomain_Takeover/Subdomain_Takeover.txt” ];thentouch $target/reconky/Subdomain_Takeover/Subdomain_Takeover.txtfisubjack -w $target/reconky/Subdomain_final.txt -t 70 -timeout 25 -ssl -c /root/go/src/github.com/haccer/subjack/fingerprints.json -v 3 -o $target/reconky/Subdomain_Takeover/Subdomain_Takeover.txtechonmap -iL $target/reconky/httprobe/alivee.txt -T4 -oA $target/reconky/scans/scanned.txtechoif [ ! -f “$target/reconky/wayback_urls/wayback_output.txt” ];thentouch $target/reconky/wayback_urls/wayback_output.txtficat $target/reconky/Subdomain_final.txt | waybackurls >> $target/reconky/wayback_urls/wayback_output.txtsort -u $target/reconky/wayback_urls/wayback_output.txtcat $target/reconky/wayback_urls/wayback_output.txt | grep ‘?*=’ | cut -d ‘=’ -f 1 | sort -u >> $target/reconky/wayback_urls/params/params.txtfor i in $(cat $target/reconky/wayback_urls/params/params.txt);do echo $i’=’;doneechofor i in $(cat $target/reconky/wayback_urls/wayback_output.txt);doext=”${i##*.}”if [[ “ext”==”php” ]];thenecho $i >> $target/reconky/wayback_urls/extensions/php1.txtsort -u $target/reconky/wayback_urls/extensions/php1.txt >> $target/reconky/wayback_urls/extensions/php.txtrm $target/reconky/wayback_urls/extensions/php1.txtfiif [[ “ext”==”js” ]];thenecho $i >> $target/reconky/wayback_urls/extensions/js1.txtsort -u $target/reconky/wayback_urls/extensions/js1.txt >> $target/reconky/wayback_urls/extensions/js.txtrm $target/reconky/wayback_urls/extensions/js1.txtfiif [[ “ext”==”html” ]];thenecho $i >> $target/reconky/wayback_urls/extensions/html1.txtsort -u $target/reconky/wayback_urls/extensions/html1.txt >> $target/reconky/wayback_urls/extensions/html.txtrm $target/reconky/wayback_urls/extensions/html1.txtfiif [[ “ext”==”json” ]];thenecho $i >> $target/reconky/wayback_urls/extensions/json1.txtsort -u $target/reconky/wayback_urls/extensions/json1.txt >> $target/reconky/wayback_urls/extensions/json.txtrm $target/reconky/wayback_urls/extensions/json1.txtfiif [[ “ext”==”aspx” ]];thenecho $i >> $target/reconky/wayback_urls/extensions/aspx1.txtsort -u $target/reconky/wayback_urls/extensions/aspx1.txt >> $target/reconky/wayback_urls/extensions/aspx.txtrm $target/reconky/wayback_urls/extensions/aspx1.txtfidoneeyewitness -f $target/reconky/httprobe/alivee.txt –web -d $target/
reconky/eyewitness –resolve
DEMO
https://1.bp.blogspot.com/-qfoKp9aFc2A/YU3EYQda_ZI/AAAAAAAAK8o/ux-Y5PYJAIEfNGY6NY9NhbN1iPGUdE1twCLcBGAsYHQ/s1056/Recon.gif Download

___________________________
@hacking_Attack
@Hacking_Video

Is there a comprehensive wordlist for the MD5 hash?
https://www.reddit.com/r/Pentesting/comments/pypmi7/is_there_a_comprehensive_wordlist_for_the_md5_hash/

Hello, I have 5 MD5 hashes. 7ccf202cfc65d0d1fc84ed2a730bd4f7
114c5ae96195a14b0e41359cb019cf53
654a2f6ad82df19903384b4ccffbf4a8
14ce2ef347b7e0c9838aea58705b7ddd
1ef9ccb08e1fbcba6863644ffade7bca I want to crack this hash using hascat but I don't have enough word list. Can you provide a list of words to crack the hash value? submitted by /u/Kayasoft (https://www.reddit.com/user/Kayasoft)
[link] (https://www.reddit.com/r/Pentesting/comments/pypmi7/is_there_a_comprehensive_wordlist_for_the_md5_hash/) [comments] (https://www.reddit.com/r/Pentesting/comments/pypmi7/is_there_a_comprehensive_wordlist_for_the_md5_hash/)

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
need my money back

my ex own me 70 euros but refuses to give them to me how can I get them please I have to buy my medications

submitted by /u/disisbeyondscience
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Si tienes un teléfono hecho en China, tal vez te interese leer esto. ¿Censura y espionaje?

https://cdn-images-1.medium.com/max/600/0*z0TU5ac01qmDrX4N.jpg
¿Recordáis el micrófono que unos hackers encontraron en el robot de cocina de Lidl en 2019? ¿Qué hacía ahí?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
DownUnderCTF 2021 — Get over it!

https://cdn-images-1.medium.com/max/600/1*tG75IgipWVXORxbNvrsuEw.png
This challenge is an OSINT challenge.

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video