OSCP Prep.
https://www.reddit.com/r/Pentesting/comments/me1k70/oscp_prep/

<!-- SC_OFF -->Hi, I am thinking of taking the OSCP, what kind of prerequisites do I need to get in order to pass the exam? I'm a mediumish-beginner in this topic, and over the next 1-2 years I am willing to obtain the knowledge and skills to be ready for the OSCP. I know that the Offensive Security website says that I just need some basic bash/perl/c knowledge and then tcp/ip, but I've looked around on the internet and most people say that that is not nearly enough. So, I would really appreciate it if someone could share their thoughts on what I need to learn and get good at. Thanks! <!-- SC_ON --> submitted by /u/oniono12 (https://www.reddit.com/user/oniono12)
[link] (https://www.reddit.com/r/Pentesting/comments/me1k70/oscp_prep/) [comments] (https://www.reddit.com/r/Pentesting/comments/me1k70/oscp_prep/)

KitPloit - PenTest Tools!
cve_manager_VS - A Collection Of Python Apps And Shell Scripts To Email An Xlsx Spreadsheet Of New Vulnerabilities In The NIST CVE Database And Their Associated Products On A Daily Schedule

https://1.bp.blogspot.com/-jaOqBSyroOk/YFewWJ1Dk6I/AAAAAAAAVrM/ZLkomCybkq4Kzp_amvDzXg8fotHSOgS5QCNcBGAsYHQ/w640-h326/cve_manager.png A collection of python apps and shell scripts to email an xlsx spreadsheet of new vulnerabilities in the NIST CVE database and their associated products on a daily schedule. The spreadsheet can then be manually interpreted for risk to your specific organization.

* Based off of an opensource product on github originally by Antonios Atlasis
* Syncs the NIST database for CVEs and CPEs locally and provides basic query capabilities
* Creates xlsx reports from the data and Emails those reports
File: cve_manager.py
A python script originally authored by Antonios Atlasis - aatlasis@secfu.net https://github.com/aatlasis/cve_manager

* create postgresql databases and views
* downloads the latest NIST CVE, CPE, and CWE raw data files
* unzips and loads the NIST raw data files into the database
* automates custom queries, searches and reports of the NIST data
* creates csv export reports of the data

Changes from original:
Added import of data manipulation library pandas
sudo pip3 install pandas openpyxl
Added database view that joins cve and cpe data
Modified default cpe queries and reports to include cvssv3 vector string instead of cvssv2 score
Modified default cpe queries and reports to sort by published date ASC, CVSS DESC, and CPE ASC
Modified cpe output to csv function to automatically save a copy in xlsx format for every csv saved

File: email_xlsx_attach.py
New python script, authored by Shane Lawrence
sends the xlsx reports as email attachments through a local smtp relay

File: daily.sh
a bash shell script, authored by Shane Lawrence
Puts it all together in something that cron can run daily
Automates the following uses of cve_manager.py:

* truncates the old database, deletes old datafiles
* downloads new raw datafiles for CVE data - the vulnerabilities
* downloads new raw data file for CPE - the vulnerable products
* downloads new top 1000 CWE - the code problems that cause vulnerabilities
* jams all of the above into a postgres database
* runs the searches relevant to you
* creates csv reports of the relevant searches, formatted and sorted for your preferences
* reads in the csv reports and outputs to xlsx
* deletes the csvs
Automates the usage of email_xlsx_attach.py
New server setup:
Read the original pdf at: https://github.com/aatlasis/cve_manager/blob/master/CVE%20Manager.pdf

1.
Setup python:
Requires python 3
Do yourself a favor and install pip3 also
pip3 install psycopg2, openpyxl, pandas
Required includes:
psycopg2 - data science libs
pandas - data manipulation libs (dependency on openpyxl)
sys, argparse, os, zipfile, json, requests, re, io, csv, smtplib, base64, email, datetime

2.
Setup postgres:
Install the latest postgreql database for your distribution.
as root, systemctl enable postgresql
systemctl start postgresql
then set a password for postgresql user by:
sudo -u postgres psql
\l lists databases
\du lists users
CREATE USER username WITH PASSWORD 'password';

3.
Use cve_manager to create the database:
The user must have create privlileges
./cve_manager.py -u postgres -ps $PASSWORD -server localhost -db $DB -ow $USER -cd

4.
Use cve_manager.py to create the schema
The user must have create privileges
./cve_manager.py -u postgres -ps $PASSWORD -server localhost -db $DB -ct

5.
Use cve_manager to download the CVE and CPE data
./cve_manager.py -u $user -ps $pass -host $host -db $db -d -p -csv

6.
Manually download and unzip the CWE data
wget https://cwe.mitre.org/data/csv/1000.[...]

csv.zip
unzip 1000.csv.zip

7.
Use cve_manager to import the NIST CVE and CPE data into the database
./cve_manager.py -u $user -ps $pass -host $host -db $db -idb -p

8.
Use cve_manager to import the CWE data into the database
./cve_manager.py -u $user -ps $pass -host $host -db $db -icwe 1000.csv

9.
Run an example report.
This example creates a csv and xlsx of the vulnerabilities and products they affect,
only rated severity 7.0 or greater, created or updated since 01 July 2020
./cve_manager.py -u $user -ps $password -host $host -db $db -sc 7.0 -dt 2020-07-01 -cpe cpe -csv -o $reports

10.
Email the xlsx reports
Modify email_xlsx_attach.py for your smtp relay, sender, recipients, and reports directory.
TODO:
Next iteration is to figure out how to incorperate a list of a critical product inventory,
and only create reports that apply to the CPEs on product inventory.
Shane Lawrence
Sr Advisor, Cloud Platform Security Download cve_manager_VS

Deep Web
Jail terms for two in Finland's first dark web contract killing

https://b.thumbs.redditmedia.com/oThnAZRkEzWalH_Rx7Clr-TsuvTa4XzdlY7hWeELmZM.jpg submitted by /u/Deku-shrub
[link] [comments]

hacking: security in practice
Can new hardware have malicious software on it?

What are the chances that buying something like a budget keyboard off Amazon that's made in China has malicious software already on it?

I'm guessing the chance is low, but why is that? Are there third party entities that vet hardware built in other countries? Would it be relatively easy to make batches of hardware that can be connected to consumer computers all over the world to record user inputs and then send that info back to the attackers?

Thanks!

submitted by /u/5evenThirty
[link] [comments]

hacking: security in practice
How bad is this?

https://b.thumbs.redditmedia.com/cUId1cwxA9CeDKLOBflD_ZMNEbay5FUhWDZR3sx04bc.jpg submitted by /u/GalaxyOverlord
[link] [comments]

hacking: security in practice
hide a bitcoin miner in a pc without creating "suspicions"?

yes I know you hear it from the fan but I wanted to know if you can hide the miner by disguising it in other programs etc..

submitted by /u/31tnary
[link] [comments]

Would Like Feedback on My Mock Pentest
https://www.reddit.com/r/Pentesting/comments/me20mu/would_like_feedback_on_my_mock_pentest/

<!-- SC_OFF -->Hey there I'm currently preparing for the Pentest+, CySA+ and OSCP certs and did a mock pentest to practice a bit. I would appreciate some feedback on the pentesting (eg. I noticed my lack of note taking in the beginning). You can find the entire Mock PenTest as Playlist over here: https://www.youtube.com/playlist?list=PLUqaMXbg_0-FUk23_Q2MsTZ-oy63IVVZm It consists of multiple livestreams I did on my YouTube channel. Thanks in advance! <!-- SC_ON --> submitted by /u/ninijay_ (https://www.reddit.com/user/ninijay_)
[link] (https://www.reddit.com/r/Pentesting/comments/me20mu/would_like_feedback_on_my_mock_pentest/) [comments] (https://www.reddit.com/r/Pentesting/comments/me20mu/would_like_feedback_on_my_mock_pentest/)

Dark Reading: Attacks/Breaches
SolarWinds Experimenting With New Software Build System in Wake of Breach

CISO of SolarWinds now has complete autonomy to stop product releases if security concerns exist, CEO says.
➖ Sent by @TheFeedReaderBot ➖

Deep Web
3 Men Busted with 30 Kilos of Marijuana in Germany

https://b.thumbs.redditmedia.com/l_vkhiCxQAMn8Nlsshht_ODbuR1MVirNdx3cWEjUqRs.jpg submitted by /u/DarkNetDailydotcom
[link] [comments]

hacking: security in practice
IP Logger Backfired?

I got a DM from a scammer so I decided to mess around with them. After them demanding to double my investment of $1,000 I wasted their time and registered a CashApp account to see their real name. The CashApp asked for SS$ and Debit Card to fully sign up which I didn't enter cause I have no intention of using CashApp. I used an IP Logger to find out that Everlyn, a pretty girl from New York was Ayahly Anderson from Montego Bay, Jamaica. After he realized I was messing with him he began reading out my contacts in my phone claiming to be a dark web hacker. I never clicked on any link or downloaded anything so I know that's not true, but where are my contacts available? Maybe because I used my number to register with Cash App he could see my contacts? But how would he know that the number provided is labelled as my Aunt? He claimed he used an app that gives feedback, and although I'm not worried about anything being stolen and I have nothing to hide, how could he access the names I gave my contacts? He didn't have access to anything else I'm assuming, so which application allows someone to see a minimum of contact names?

submitted by /u/rustjumper
[link] [comments]

I am stuck and looking for tips/ suggestions
https://www.reddit.com/r/Pentesting/comments/me7f8s/i_am_stuck_and_looking_for_tips_suggestions/

<!-- SC_OFF -->I was "tasked" to do a pentest (as a training) of this one modified machine that was used in the previous local pentest competition and it was the "hardest" machine. I got one of the user access, okay, I can ssh , great. but as a non-root, I cant literally do anything other than read useless files. I cant do an scp transfer, cant modified file, cant make a dir, cant do a wget because the machine seemed to have no connection to the internet (any tips on this is?). in the user home I see a userflag, but since its a modified machine, my objective is to get root access. its a linux ubuntu kernel 3.0.0 generic, and I got the username from exploiting webmin. with the obtained hash infos, Jacktheripper quickly got one of the pass, but for the other users? ETA 24 hours, the keywords is obviously not in english or a very unique one so I think it is a waste of time. I tried: mempodipper , but no permission, tried writing the mempodipper there, cant modified, tried to download (wget) mempo, no permission. in every similar case on the internet I found, they all use msf . well in this training I cannot use any of that so its all manual. however, there is one text file that I can write on but not rename (so its useless?) any tips how to approach this? keywords maybe? *ps the teacher didnt actually expect us to do this machine, he only tasked us with the previous 4 machines and I did all of them, Im just curious and annoyed with this last one. sorry, english is not first language. *EDIT: typos <!-- SC_ON --> submitted by /u/Arcyma (https://www.reddit.com/user/Arcyma)
[link] (https://www.reddit.com/r/Pentesting/comments/me7f8s/i_am_stuck_and_looking_for_tips_suggestions/) [comments] (https://www.reddit.com/r/Pentesting/comments/me7f8s/i_am_stuck_and_looking_for_tips_suggestions/)

Hacking on Medium
Instagram is (not) for Idiots! Also, what to do if your account is compromised!

https://cdn-images-1.medium.com/max/1920/1*iaqFy4_yk3QQN6805zLOXA.jpeg
By now we all know Instagram is more than a social networking site. It is a platform where a public image gets built, nurtured and then…

Continue reading on Medium »

hacking: security in practice
CTF Walk through

I've been trying to find a good person to watch as they do CTF's. There are a bunch on Youtube but, as I'm just starting to get into CTFs, I'm finding some videos are hard to follow. I was wondering if anyone could recommend someone who explains the ins and outs as they go through it? If you have a favorite person you follow I'd be happy to check them out as well. Thanks in advance!

submitted by /u/MolotovBoy
[link] [comments]

hacking: security in practice
Hey guys and girls 😅

How can I bypass a payment wall on only fans🙂🙃

submitted by /u/Careplusuk
[link] [comments]