Try at Playground
You can try Shisho at our playground (https://play.shisho.dev/).
Try with Docker
You can try shisho in your machine as follows: echo "func test(v []string) int { return len(v) + 1; }" | docker run -i ghcr.io/flatt-security/shisho-cli:latest find "len(:[...])" --lang=go file.go docker run -i -v $(PWD):/workspace ghcr.io/flatt-security/shisho-cli:latest find "len(:[...])" --lang=go /workspace/file.go '>echo "func test(v []string) int { return len(v) + 1; }" > file.go
docker run -i -v $(PWD):/workspace ghcr.io/flatt-security/shisho-cli:latest find "len(:[...])" --lang=go /workspace/file.go
Install with pre-built binaries
When you'd like to run shisho outside docker containers, please follow the instructions below:
Linux / macOS
Run the following command(s): # Linux
wget https://github.com/flatt-security/shisho/releases/latest/download/build-x86_64-unknown-linux-gnu.zip -O shisho.zip
unzip shisho.zip
chmod +x ./shisho
mv ./shisho /usr/local/bin/shisho

# macOS
wget https://github.com/flatt-security/shisho/releases/latest/download/build-x86_64-apple-darwin.zip -O shisho.zip
unzip shisho.zip
chmod +x ./shisho
mv ./shisho /usr/local/bin/shisho Then you'll see a shisho's executable in /usr/local/bin.
Windows
Download the prebuild binary (https://www.kitploit.com/search/label/Binary) from releases (https://github.com/flatt-security/shisho/releases) and put it into your %PATH% directory. If you're using Windows Subsystem for Linux (https://docs.microsoft.com/en-us/windows/wsl/install-win10), you can install shisho with the above instructions.
More
We're also building Shisho as a Service (https://shisho.dev/) to make Security-as-Code more accessible. If you need direct support, you can contact us at contact@flatt.tech.

Download Shisho (https://github.com/flatt-security/shisho)

___________________________
@hacking_Attack
@Hacking_Video

Shisho - Lightweight Static Analyzer For Several Programming Languages

Shisho is a lightweight static analyzer for developers. Please see the usage documentation for further information. Try at Playground You can try Shisho at our playground. Try with Docker You can try shisho in your machine as follows: echo "func test(v string) int { return len(v) + 1; }" | docker run -i ghcr.io/flatt-security/shisho-cli:latest find "len(:...)" --lang=go echo "func test(v string) int { return len(v) + 1; }" > file.godocker run -i -v $(PWD):/workspace ghcr.io/flatt-security/shisho-cli:latest find "len(:...)" --lang=go /workspace/file.go Install with pre-built binaries When you'd like to run shisho outside docker containers, please follow the instructions below: Linux / macOS Run the following command(s): # Linuxwget https://github.com/flatt-security/shisho/releases/latest/download/build-x86_64-unknown-linux-gnu.zip -O shisho.zipunzip shisho.zipchmod +x ./shishomv ./shisho /usr/local/bin/shisho# macOSwget https://github.com/flatt-security/shisho/releases/latest/download/build-x86_64-apple-darwin.zip -O shisho.zipunzip shisho.zipchmod +x ./shishomv ./shisho /usr/local/bin/shisho Then you'll see a shisho's executable in /usr/local/bin. Windows Download the prebuild binary from releases and put it into your %PATH% directory. If you're using Windows Subsystem for Linux, you can install shisho with the above instructions. More We're also building Shisho as a Service to make Security-as-Code more accessible. If you need direct support, you can contact us at contact@flatt.tech. Download Shisho
Read more...

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
IoT Hacking and Rickrolling My High School District

https://external-preview.redd.it/Nide3enGx8hGAq08hp8Z5QSMKbXckD8EQtpH32_lmUw.jpg?width=640&crop=smart&auto=webp&s=80fbafd75f3d99c0f3baec44cd1b051fb993e57d submitted by /u/CrankyBear
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
So I got my virtual lab up… where to from here?

Hello all,

I recently set up a virtual lab based on the Tony Robinson book, building a virtual lab. The guide was amazing, and it took me nearly a year because I wanted to study and understand how the lab works (had to learn networking, a lot of Linux commands, etc)

Now that I have this setup for pentesting, where do I begin? Are there any good courses or books to go through? How do I know when I’m ready for a CTF? I don’t want to be a script kiddie, I want to learn how this stuff works. Just not sure where to start, as there’s so much area to cover.

Any suggestions would be amazing, and redirect me to other posts if someone’s already answered this question please!

Thank you all, A noob hacker

submitted by /u/antrov2468
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Background on my laptop randomly changed to someone from my school

Was reading something then my laptop froze and when I forced closed the windows the background on my laptop was a random girl from my school.

This is far past school hours and she's in uniform in the pic genuinely don't have a clue what's happening.

Any advice

submitted by /u/Lukeyboii00
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
SnykCon CTF 2021 — Random Flag Generator

https://cdn-images-1.medium.com/max/1040/1*YbwB2nysUeHO0f3dURxcDA.png
Attacking insecure random generators

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How I easily found Blind XSS

https://cdn-images-1.medium.com/max/2600/1*nU84AZJkL7OGw7vZt-wIsQ.png
One day I was scrolling through Twitter and saw a post about a vulnerability called “Blind XSS”. I was still reasonably new to bug bounty…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hack This Site: Realistic Web Mission — Level 13

https://cdn-images-1.medium.com/max/1600/0*GYx-QxjRq9FDedmA
Hello, today we’re looking at Hack This Site Realistic Web Mission 13. This is a fun challenge that requires you to gather information…

Continue reading on Geek Culture »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Phishing que invita a descargar copia de seguridad de WhatsApp descarga el troyano Grandoreiro

https://cdn-images-1.medium.com/max/1419/0*FZevFN92inRSFFBg
PUBLICADO EN 12 OCTUBRE, 2021POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Microsoft Fixes Zero-Day Flaw in Win32 Driver

A previously known threat actor is using the flaw in a broad cyber-espionage campaign, security vendor warns.

Dark Reading: Attacks/Breaches
Former Director of IT and Cybersecurity for Warren Presidential Campaign Launches Personified

Founder and CEO Mike Marotti will lead experts in campaign security to help progressive politicians and organizations with cybersecurity and IT needs.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How to start

How do i start hacking? Basics

submitted by /u/zankvlol
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Getting high on baud

I am not sure where to begin, To make this a fictional story, I will add that I once beat a steam drilling machine while building the rail…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Microsoft Kills Bug Being Exploited in MysterySnail Espionage Campaign

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft Kills Bug Being Exploited in MysterySnail Espionage CampaignPost Views: 115
Reading Time: 3 Minutes
Microsoft’s October 2021 Patch Tuesday included security fixes for 74 vulnerabilities, one of which is a zero-day being used to deliver the MysterySnail RAT to Windows servers.
Today is Microsoft’s October 2021 Patch Tuesday, and it delivers fixes for four zero-day vulnerabilities, one of which is being exploited in a far-reaching espionage campaign that delivers the new MysterySnail RAT malware to Windows servers. Microsoft reported a total of 74 vulnerabilities, three of which are rated critical. MysterySnail Exploits Win32K BugSecurity researchers pointed to CVE-2021-40449, an elevation of privilege vulnerability in Win32k, as standing out from the crowd of patches, given that It’s been exploited in the wild as a zero-day.

This summer, Kaspersky researchers discovered that the exploit was being used to elevate privileges and take over Windows servers as part of a Chinese-speaking advanced persistent threat (APT) campaign from the APT IronHusky.

The exploit chain ended with a freshly discovered remote access trojan (RAT) dubbed MysterySnail being installed on compromised servers, with the goal of stealing data.

Bharat Jogi, Qualsys senior manager of vulnerability and threat research, told Threatpost on Tuesday that if left unpatched, “MysterySnail has the potential to collect and exfiltrate system information from compromised hosts, in addition to other malicious users having the ability to gain complete control of the affected system and launch further attacks.”

Jay Goodman, Automox director of product marketing, told Threatpost via email that these kinds of privilege elevation attacks “can be used to access beyond what the current user context of the device would allow, enabling attackers to perform unauthorized action, delete or move data, view private information, or install malicious software.”

This bug, rated Important, is found in all supported versions of Windows.

Greg Wiseman, Rapid7 senior security researcher, told Threatpost that this vulnerability is “likely being used alongside Remote Code Execution (RCE) and/or social engineering attacks to gain more complete control of targeted systems.”

Satnam Narang, staff research engineer at Tenable, noted that elevation of privilege flaws “are most valuable in post-compromise scenarios once an attacker has gained access to a target system through other means, in order to execute code with elevated privileges.”
See Also: Complete Offensive Security and Ethical Hacking Course Immersive Labs’ Kevin Breen, director of cyber threat research, said that this all points to prioritizing this patch, particularly given how common these vulnerabilities are in ransomware attack chains: “Gaining this level of access on a compromised host is the first step towards becoming a domain admin – and securing full access to a network,” he told Threastpost. “Almost every ransomware attack reported this year has included the use of one or more privilege escalation vulnerabilities as part of the attacker’s workflow, so this is serious stuff indeed.” A PrintNightmare Fix to Fix the Other PrintNightmare FixOther fixes released in the October Patch Tuesday batch include those that address what was a summer’s full of Print Spooler-related patches. There’s been a steady stream of these patches for flaws in Windows Print Spooler following June’s disclosure of the PrintNightmare vulnerability – a bu[...]

___________________________
@hacking_Attack
@Hacking_Video