hacking: security in practice
Audit Node Module folder with YARA rules

Audit Node Module folder with YARA rules

(New rules, PRs, feedbacks are highly appreciated)

GitHub Repo: https://github.com/rpgeeganage/audit-node-modules-with-yara

Purpose:

* The purpose of this tool is to run a given set of YARA rules against the given node_module
folder.
* Help to detect supplier chain attacks
* With this approach, We can define YARA rules to identify suspicious scripts which are injected into node packages.
* This package can be added to the CI/CD
pipeline

submitted by /u/geeganage
[link] [comments]

hacking: security in practice
crashing school pcs (video for details)

https://b.thumbs.redditmedia.com/qiIZnDUJyyNEbilPgR1dcRioGseVVDiiRmQft_W6wGU.jpg submitted by /u/Crockie28
[link] [comments]

issue in a pentesting report
https://www.reddit.com/r/Pentesting/comments/mds22r/issue_in_a_pentesting_report/

<!-- SC_OFF -->Hi, Hi Martin, I have a lot of high vulnerable components (js, jar, lib, etc.) is it correct to place these in the same table with other high vulnerabilities such as weak token implementation, XSS, weak password policy for example? <!-- SC_ON --> submitted by /u/micheal6584 (https://www.reddit.com/user/micheal6584)
[link] (https://www.reddit.com/r/Pentesting/comments/mds22r/issue_in_a_pentesting_report/) [comments] (https://www.reddit.com/r/Pentesting/comments/mds22r/issue_in_a_pentesting_report/)

Hacking on Medium
Netdiscover

https://cdn-images-1.medium.com/max/2600/1*jBFdm_g0FTQ_oyhyZfjMbA.jpeg
As you most likely are aware, ARP is utilized to map MAC addresses to IP addresses on an internal system. The router and switches send out…

Continue reading on Dev Genius »

Hacking on Medium
Angry IP Scanner

https://cdn-images-1.medium.com/max/1033/1*-GN4_oeRtw5ThubhrZxzKg.jpeg
Angry IP scanner is a quick and well-disposed network scanner for Windows, Linux, and Mac operating systems. It is entirely extensible…

Continue reading on Dev Genius »

Hacking on Medium
Scan the Network with Armitage

https://cdn-images-1.medium.com/max/1109/1*8Le82inZrl6gbd0T6dIb4g.jpeg
Armitage is a scriptable apparatus for Metasploit that visualizes targets, suggests exploits, and exposes the advanced post-exploitation…

Continue reading on Dev Genius »

Hacking on Medium
Unicornscan

https://cdn-images-1.medium.com/max/2600/1*yiuD8gPv1KiuqdTthxjcWQ.jpeg
Unicornscan is expected to give a specialist a powerful interface for bringing an upgrade into and estimating a response from a TCP/IP…

Continue reading on Dev Genius »

Hacking on Medium
Взлом WiFi для новичков

https://cdn-images-1.medium.com/max/1280/1*BsUkjw4-9S5krALURM89Yw.jpeg
Использование Airgeddon

Continue reading on Medium »

Hacking on Medium
How to configure the internet on a fresh server

https://cdn-images-1.medium.com/max/600/0*QQ0sYqU84AI0dH7q.jpg
So your network team stays up-all-night for few days in the DC/server room and sets up all the beautiful connections. The wires are strong…

Continue reading on Medium »

Hacking on Medium
Is EC Council Ethical Hacker Certification (CEH) worth it?

CEH (Certified Ethical Hacker) is a wholly offensive course hosted by EC-COUNCIL. If you have the experience and understanding of ethical…

Continue reading on Medium »

CVE-2021-23888 - McAfee ePolicy Orchestrator HTML Injection
https://www.reddit.com/r/redteamsec/comments/mdwijl/cve202123888_mcafee_epolicy_orchestrator_html/

submitted by /u/v1brio (https://www.reddit.com/user/v1brio)
[link] (https://ricardojba.github.io/CVE-2021-23888-McAfee-ePolicy-Orchestrator-HTML-Injection/) [comments] (https://www.reddit.com/r/redteamsec/comments/mdwijl/cve202123888_mcafee_epolicy_orchestrator_html/)

hacking: security in practice
SSL Security

My trainer corrected me with my analogy about lack of security but having an SSL, can still put visitors at risk.

I was under the impression that SSL can only do so much when it comes to user data coming in and out, but that info can still be breached and obtained if not protected with something like web security.

Thoughts?

submitted by /u/Aurawhisperer
[link] [comments]

hacking: security in practice
Mysql dump

Hey i just dump mysql hashes but i dont know how to crack it and i am having troubles trying to identify it with john and even cyberchef does not recognize the hash (it's not hex btw), here is the example:

"fooadmin:0x02007a3452af0a2beaa4f2c9deb12b4e59e9cc1f4dace265ea5adf687f442650fbbd1a395ad01a9f26c9be147c0144607734af54d6eed32e6598759d3161adf7f5ec9682bc80"

​

Can anyone help me with that?

submitted by /u/Alexis201249
[link] [comments]