Kali Linux Tutorials
Databases Worldwide are Full of Security Holes

Data security is a big deal. Lapses in data security aren’t just a minor mistake; they can violate regulatory compliance rules, fail to protect customers who have agreed to share personal information, and risk losing companies their competitive advantage.

The risks associated with database security are enormous. Fines for improper database security have stretched into the hundreds of millions of dollars. That’s before you even start to factor in the reputational damage such breaches can cause, and the long-term impact it could potentially have on customers, whose personally identifiable information (PII) could be exposed. While data undoubtedly drives some of the world’s most powerful technologies, it’s also an asset that needs to be safeguarded to the highest of levels. Unfortunately, that is not always the case.

According to a recent study, a scan of 27,000 on-prem databases around the world over a period of five years found that, on average, they each contained 26 vulnerabilities. More than half of these — 56 percent — were vulnerabilities classed in the two top levels of severity (“High” or “Critical”) of NIST guidelines. That means that, should they be exploited, it could lead to serious data compromise. It’s a reminder of just why database security is so essential. The vulnerability of databasesOne of the big issues involving database security is that organizations have failed to take the right precautions. In many cases, they have assumed that endpoint and perimeter-based security options are enough to protect data. They also failed to maintain regular patching of databases, meaning that even vulnerabilities that have been fixed were not protected against.

The problem was at its worst in France, China, and Singapore, where the percentage of vulnerabilities were in excess of the global average. For example, France has/had an average of 72 vulnerabilities per database in a massive 84 percent of databases. Even countries such as Germany, one of the lower-ranking countries on the list, had vulnerabilities in an average of 19 percent of its databases. Make no mistake, though: This is a global problem. Addressing security concernsWhen it comes to database security, there are multiple factors that organizations need to consider that can help them to better stay on top of the potential threats and other risks that they face.

The first of these is making sure that they have a culture and focus that prioritizes security. Patching vulnerabilities is critically important, but it’s unrealistic to think that a security team will be able to patch every possible vulnerability the moment it’s announced. It’s therefore important that security teams prioritize their efforts, with awareness of both which vulnerabilities are most potentially serious (and should be taken care of the soonest), and also the sensitive data that they hold — and where it is held.

Understanding the challenges means appreciating the risks associated with different approaches to databases, not just the current trend of migrating to the cloud, but also the considerable challenges that remain (as seen by this report) with on-prem databases.

Having full knowledge of this can help guide security teams when it comes to ensuring that their efforts are directed where they need to be. A supportive company culture that emphasizes security will only make these efforts more effective. It is essential that organizations have a cohesive, crystal clear strategy that they can employ when it comes to protecting databases. Not only can this make response to vulnerabilities and possible threats more efficient; it can additionally ensure that compliance regulations are met and that security can be handled in a proactive, rather than reactive, manner.

One crucial step that[...]

___________________________
@hacking_Attack
@Hacking_Video

organizations should employ involves the use of cutting-edge technology to help them. Real-time database monitoring tools work by continually scanning databases for attempted breaches so that you can react quickly. Meanwhile, web application and database firewalls can protect against a variety of threats which affect databases, such as SQL injection. There are also file integrity protection (FIM) and file security tools, designed to protect sensitive files against threats from both malicious insiders and cyber criminals alike. The modern bank vaultDatabases remain the bank vaults of the modern world: a trove of valuables that need to be protected at all costs. Not every data breach is always the malicious actions of a hacker or aggrieved employee. In some, it could be simply an error that results in a database being made accessible to the world. But regardless of the cause of the breach, organizations are increasingly aware of the risks associated with compromised databases or database vulnerabilities. It’s essential that they act to practice good data hygiene practices so that these risks are negated.

Failing to do so may have ramifications that could, in a worst-case scenario, bring down an entire company. There’s no excuse not to exhibit the right behavior when it comes to database security.

Especially in a world where the tools to help you are so readily available.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Importance of SSL

Let's say I log into a http website and my credentials are sent as a plain text. Who can actually see my credentials, other than people connected to my network and the website's network? Everyone mentions "malicious actors" but I can't imagine how could a random hacker sniff on my traffic when he doesn't have access to both networks.

submitted by /u/k3rn3t
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
Question

How do i find the dark forest video of that dog on the dark web i heard it's some violent shi btw I'm using my phone

submitted by /u/cligey_
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Ding dong

https://cdn-images-1.medium.com/max/700/0*XI4zFmNmIyeb8dSA.png
Several weeks passed by while I lay low. Merely waiting for things to settle down again. Anyway, I need to be busy with my study. One day…

Continue reading on Oops, I did it again. »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Come funziona il Green Pass?

https://cdn-images-1.medium.com/max/746/1*4osfT_5vudMmZb2OaCPvOw.png
In questo articolo esploro il funzionamento tecnico del Green Pass, conosciuto all’estero anche come Green Certificate o COVID19 Digital…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Google rastrea 270+ actores de amenazas esponsoreados por 50+ Estados

https://cdn-images-1.medium.com/max/1241/0*0boNHkN63L0c6ZJL
PUBLICADO EN 15 OCTUBRE, 2021POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Bluetooth WarDriving with the nRF52

https://cdn-images-1.medium.com/max/963/0*Ea4dGXYpCjbX0MND
I am an open source advocate that loves working on embedded systems. I own and operate a small consulting company: Interrupt Labs. If you…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
VirusTotal publica un informe de ransomware basado en el análisis de 80 millones de muestras

https://cdn-images-1.medium.com/max/1555/0*7WIyBJ97JUqHgcCY
PUBLICADO EN 15 OCTUBRE, 2021 POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Crawlergo - A Powerful Browser Crawler For Web Vulnerability Scanners
http://www.kitploit.com/2021/10/crawlergo-powerful-browser-crawler-for.html

___________________________
@hacking_Attack
@Hacking_Video

crawlergo is a browser crawler that uses chrome headless mode for URL collection. It hooks key positions of the whole web page with DOM rendering stage, automatically fills and submits forms, with intelligent JS event triggering, and collects as many entries exposed by the website as possible. The built-in URL de-duplication module filters out a large number of pseudo-static URLs, still maintains a fast parsing and crawling speed for large websites, and finally gets a high-quality collection of request results. crawlergo currently supports the following features: chrome browser environment rendering Intelligent form filling, automated submission Full DOM event collection with automated triggering Smart URL de-duplication to remove most duplicate requests Intelligent analysis of web pages and collection of URLs, including javascript file content, page comments, robots.txt (https://www.kitploit.com/search/label/Robots.txt) files and automatic Fuzz of common paths Support Host binding, automatically fix and add Referer Support browser request proxy Support pushing the results to passive web vulnerability scanners
Installation
Please read and confirm disclaimer (https://github.com/Qianlitp/crawlergo/blob/master/Disclaimer.md) carefully before installing and using。 Build cd crawlergo/cmd/crawlergo
go build crawlergo_cmd.go crawlergo relies only on the chrome environment to run, go to download (https://www.chromium.org/getting-involved/download-chromium) for the new version of chromium, or just click to download Linux version 79 (https://storage.googleapis.com/chromium-browser-snapshots/Linux_x64/706915/chrome-linux.zip). Go to download page (https://github.com/0Kee-Team/crawlergo/releases) for the latest version of crawlergo and extract it to any directory. If you are on linux or macOS, please give crawlergo executable permissions (+x). Or you can modify the code and build it yourself. If you are using a linux system and chrome prompts you with missing dependencies, please see TroubleShooting below
Quick Start

Go！
Assuming your chromium installation directory is /tmp/chromium/, set up 10 tabs open at the same time and crawl the testphp.vulnweb.com: ./crawlergo -c /tmp/chromium/chrome -t 10 http://testphp.vulnweb.com/
Using Proxy
./crawlergo -c /tmp/chromium/chrome -t 10 --request-proxy socks5://127.0.0.1:7891 http://testphp.vulnweb.com/
Calling crawlergo with python
By default, crawlergo prints the results directly on the screen. We next set the output mode to json, and the sample code for calling it using python is as follows: #!/usr/bin/python3
# coding: utf-8

import simplejson
import subprocess


def main():
target = "http://testphp.vulnweb.com/"
cmd = ["./crawlergo", "-c", "/tmp/chromium/chrome", "-o", "json", target]
rsp = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
output, error = rsp.communicate()
# "--[Mission Complete]--" is the end-of-task separator string
result = simplejson.loads(output.decode().split("--[Mission Complete]--")[1])
req_list = result["req_list"]
print(req_list[0])


if __name__ == '__main__':
main()
Crawl Results
When the output mode is set to json, the returned result, after JSON deserialization, contains four parts: all_req_list： All requests found during this crawl task, containing any resource type from other domains. req_list：Returns the current domain results of this crawl task, pseudo-statically de-duplicated, without static resource links. It is a subset of all_req_list . all_domain_list：List of all domains found. sub_domain_list：List of subdomains found.
Examples
crawlergo returns the full request and URL, which can be used in a variety of ways: Used in conjunction with other passive web vulnerability scanners First, start a passive scanner (https://www.kitploit.com/search/label/Passive%20scanner) and set the listening address to: http://127.0.0.1:1234/ Next, assuming

___________________________
@hacking_Attack
@Hacking_Video

crawlergo is on the same machine as the scanner, start crawlergo and set the parameters: --push-to-proxy http://127.0.0.1:1234/ Host binding (not available for high version chrome) (example) (https://github.com/0Kee-Team/crawlergo/blob/master/examples/host_binding.py) Custom Cookies (example) (https://github.com/0Kee-Team/crawlergo/blob/master/examples/request_with_cookie.py) Regularly clean up zombie processes generated by crawlergo (example) (https://github.com/0Kee-Team/crawlergo/blob/master/examples/zombie_clean.py) , contributed by @ring04h
Bypass headless detect
crawlergo can bypass headless mode detection by default. https://intoli.com/blog/not-possible-to-block-chrome-headless/chrome-headless-test.html

___________________________
@hacking_Attack
@Hacking_Video

TroubleShooting
'Fetch.enable' wasn't found Fetch is a feature supported by the new version of chrome, if this error occurs, it means your version is too low, please upgrade the chrome version. chrome runs with missing dependencies such as xxx.so // Ubuntu
apt-get install -yq --no-install-recommends \
libasound2 libatk1.0-0 libc6 libcairo2 libcups2 libdbus-1-3 \
libexpat1 libfontconfig1 libgcc1 libgconf-2-4 libgdk-pixbuf2.0-0 libglib2.0-0 libgtk-3-0 libnspr4 \
libpango-1.0-0 libpangocairo-1.0-0 libstdc++6 libx11-6 libx11-xcb1 libxcb1 \
libxcursor1 libxdamage1 libxext6 libxfixes3 libxi6 libxrandr2 libxrender1 libxss1 libxtst6 libnss3

// CentOS 7
sudo yum install pango.x86_64 libXcomposite.x86_64 libXcursor.x86_64 libXdamage.x86_64 libXext.x86_64 libXi.x86_64 \
libXtst.x86_64 cups-libs.x86_64 libXScrnSaver.x86_64 libXrandr.x86_64 GConf2.x86_64 alsa-lib.x86_64 atk.x86_64 gtk3.x86_64 \
ipa-gothic-fonts xorg-x11-fonts-100dpi xorg-x11-fonts-75dpi xorg-x11-utils xorg-x11-fonts-cyrillic xorg-x11-fonts-Type1 xorg-x11-fonts-misc -y

sudo yum update nss -y Run prompt Navigation timeout / browser not found / don't know correct browser executable path Make sure the browser executable path is configured correctly, type: chrome://version in the address bar, and find the executable file path:

___________________________
@hacking_Attack
@Hacking_Video