Here’s how programmers can earn extra money via Google bug bounty
https://techgigdotcom.medium.com/heres-how-programmers-can-earn-extra-money-via-google-bug-bounty-4fc4cb27f817?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Google will be paying 1.87 crores to programmers in the Android bug bounty program. See all details here.Continue reading on Medium » (https://techgigdotcom.medium.com/heres-how-programmers-can-earn-extra-money-via-google-bug-bounty-4fc4cb27f817?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Here’s how programmers can earn extra money via Google bug bounty

Google will be paying 1.87 crores to programmers in the Android bug bounty program. See all details here.Continue reading on Medium »
Read more...

hacking: security in practice
FBI Raids Chinese Point-of-Sale Giant PAX Technology

https://external-preview.redd.it/1ImgM34AT-InNKDe__NzQTWS_LuLdHc44W1bce7VLiA.jpg?width=640&crop=smart&auto=webp&s=5ba6b1fe10b63400cde1c68d1c8c0e56ae079c4f submitted by /u/lotsofsweat
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Willing to pay to reset and unlock admin password that is also locked at the firmware level

Looking for help to unlock a macbook A2141 version, I'll be willing to pay to reset the macbook. Is this possible at all if the laptop is locked at the firmware level as well ?

I would assume the highest level of security.

I'm asking for a friend because the laptop is given by a company that shutdown. They just requested that my friend dispose the computer directly since they are shut down now.

so wondering if its possible to use it for personal use by resetting it as a new laptop for personal use

submitted by /u/putsandcalls
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What are some things I can do to secure my personal computer?

Hi,

I want to secure documents on my personal computer.

I’m not tech savvy. What are some reasonable ways I can take my security to the next level?

Like more security than an average hacker would fail to hack.

Edit: hypotethically, let’s say some hackers were passively (or even actively) looking for me

submitted by /u/NoWayThisUserIsTaken
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
12 Benefits of Hiring a Certified Ethical Hacker

https://cdn-images-1.medium.com/max/2100/0*buBfEwrvwV8sU2x8.jpg
With the advancement of the internet, the number of cybercrimes is also progressing every year. Hence there is also an increase in the…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Brutal WordPress plugin bug allows subscribers to wipe sites

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Brutal WordPress plugin bug allows subscribers to wipe sitesPost Views: 145
Reading Time: 1 Minute
A high severity security flaw found in a WordPress plugin, known as Hashthemes Demo Importer, with more than 8,000 active installs can let authenticated attackers reset and wipe vulnerable websites.
The plugin in question, known as Hashthemes Demo Importer, is designed to help admins import demos for WordPress themes with a single, without dealing with installing any dependencies.

The security bug would allow authenticated attackers to reset WordPress sites and delete almost all database content and uploaded media.

Wordfence QA engineer and threat analyst Ram Gall explained that the plugin failed to properly perform nonce checks, leaking the AJAX nonce on vulnerable sites’ admin dashboard for all users, “including low-privileged users such as subscribers.”
See Also: Complete Offensive Security and Ethical Hacking Course As a direct consequence of this bug, logged-in subscriber-level users could abuse it to wipe all the content on sites running unpatched versions of Hashthemes Demo Importer.

“While most vulnerabilities can have destructive effects, it would be impossible to recover a site where this vulnerability was exploited unless it had been backed up,” Gall added.

Any logged-in user could trigger the hdi_install_demo AJAX function and provide a reset parameter set to true, resulting in the plugin running it’s database_reset function. This function wiped the database by truncating every database table on the site except for wp_options, wp_users, and wp_usermeta. Once the database was wiped, the plugin would then run its clear_uploads function, which deleted every file and folder in wp-content/uploads. — Ram Gall
See Also: Apple Pay with VISA lets hackers force payments on locked iPhones
Subscriber, one of the types of users who could wipe vulnerable sites, is a default WordPress user role (just as Contributor, Author, Editor, and Administrator) often enabled on WordPress sites to allow registered users to write comments on the website’s comment section.

They would typically only be able to edit their profile using the site’s dashboard without access to other admin pages.

While Wordfence reported the vulnerability the bug to the plugin’s development team on August 25, 2021, the developers did not reply to the disclosure messages for almost a month. This prompted Wordfence to reach out to the WordPress plugins team on September 20, which led to the plugin’s removal the same day and the release of a patch addressing the bug four days later, on September 24.

However, Hashthemes Demo Importer’s developer did not mention the 1.1.2 release or the update on the plugin’s changelog page despite releasing a security update.

See Also: OSINT Tool: Osintgram
See Also: Hacking stories – Operation Aurora: When China hacked Google Source: www.bleepingcomputer.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/ezgif.com-gif-maker-5-90x90.jpg Hackers used billing software zero-day to deploy ransomware1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/ezgif.com-gif-maker-4-90x90.jpg Popular NPM library hijacked to install password-stealers, miners2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/youtube-logo-90x90.jpg Massive campaign uses YouTube to push password-stealing malware5 days ago
* https://www.blackhatethicalhacking.com/wp-con[...]

___________________________
@hacking_Attack
@Hacking_Video

tent/uploads/2021/10/ezgif.com-gif-maker-3-90x90.jpg Google: YouTubers’ accounts hijacked with cookie-stealing malware6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/ezgif.com-gif-maker-2-90x90.jpg Acer hacked twice in a week by the same threat actor1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/ezgif-6-e5d8ed29a830-90x90.jpg Credit card PINs can be guessed even when covering the ATM pad1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/REVIL-headpic-90x90.jpg REvil ransomware shuts down again after Tor sites were hijacked1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/google-chrome-adblocker-uai-1440x900-1-90x90.jpg Malicious Chrome ad blocker injects ads behind the scenes2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/maxresdefault-90x90.jpg Brizy WordPress Plugin Exploit Chains Allow Full Site Takeovers2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/abstract_mysterysnail-90x90.jpg Microsoft Kills Bug Being Exploited in MysterySnail Espionage Campaign2 weeks ago
The post Brutal WordPress plugin bug allows subscribers to wipe sites first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Lorsrf - SSRF Parameter Bruteforce

Bruteforcing on Hidden parameters to find SSRF vulnerability using GET and POST MethodsNOTE Lorsrf has been added to scant3r with useful additions (multi http method , multi content-type (json , query , xml , speed , large worlist and more)) https://github.com/knassar702/scant3r/wiki/lorsrf install download it ➜ git clone https://github.com/knassar702/lorsrf➜ cd lorsrf➜ sudo pip3 install requests flask install ngrok tool Steps : Ngrok run your ngrok ./ngrok http 9090 run server.py script and add ngrok port python3 server.py 9090 run lorsrf.py and add ngrok host using -s option requestbin.com login to https://requestbin.com copy your host and add it by using -s option (without server.py file) How can i use it .? cat YOUR_LIST.txt | python3 lorsrf.py -t URL_TARGET -s YOUR_HOST -w wordlist.txt Examples : $ cat paramters.txt | python3 lorsrf.py -t http://target.com -s http://53252.ngrok.io add threads $ cat paramters.txt | python3 lorsrf.py -t http://target.com -s http://53252.ngrok.io --threads=50 add timeout $ cat paramters.txt | python3 lorsrf.py -t http://target.com -s http://53252.ngrok.io --timeout=4 add cookies $ cat paramters.txt | python3 lorsrf.py -t http://target.com -s http://53252.ngrok.io -c 'user=5&PHPSESSION=5232' add headers from text file $ cat headers.txtCookie: test=1Auth: Basic TG9yU3JmCg==$ cat parameters.txt | python3 lorsrf.py -f headers.txt -s 'http://myhost.com' -t 'http://ssrf.hack.com'---------------------GET /?parameter={YOUR_HOST} HTTP/1.1Host: targer.comCookie: test=1Auth: Basic TG9yU3JmCg== Follow redirects $ cat paramters.txt | python3 lorsrf.py -t http://target.com -s http://53252.ngrok.io -r Testing python3 lorsrf.py -t 'http://testphp.vulnweb.com/showimage.php' -s 'https://YOUR_HOST.com' -w parameters.txt Download Lorsrf
Read more...

Deep Web
How important are these extra steps?

Im a newbie and was looking to get into marketplace stuff - and I guide I saw was telling me to do a variety of things including:

Using a non personal computer

Using public wifi

Running a VM (and tails) through USB

I was just wondering how important this is for making a purchase - I was planning to use my Laptop with a VM on my own WiFi (with a VPN, Bitcoin tumbling etc etc), would I be at risk?

Any other advice would be appreciated, thanks

submitted by /u/flimdo432
[link] [comments]

Hacking on Medium
Trends shaping cybersecurity

https://cdn-images-1.medium.com/max/2440/0*jEH3H96AmaHYOAPN
What are the biggest cybersecurity threats today? What are the latest techniques for thwarting hackers’ plans? Learn about the trends…

Continue reading on Medium »

Lorsrf - SSRF Parameter Bruteforce
http://www.kitploit.com/2021/10/lorsrf-ssrf-parameter-bruteforce.html

Bruteforcing on Hidden (https://www.kitploit.com/search/label/Hidden) parameters to find SSRF (https://www.kitploit.com/search/label/SSRF) vulnerability (https://www.kitploit.com/search/label/Vulnerability) using GET and POST Methods
NOTE
Lorsrf has been added to scant3r (https://github.com/knassar702/scant3r) with useful additions (multi http method , multi content-type (json , query , xml , speed , large worlist and more)) https://github.com/knassar702/scant3r/wiki/lorsrf
install
download it ➜ git clone https://github.com/knassar702/lorsrf
➜ cd lorsrf
➜ sudo pip3 install requests flask install ngrok tool (https://www.youtube.com/watch?v=4sF1ATYwr3U)
Steps :

Ngrok
run your ngrok ./ngrok http 9090 run server.py script and add ngrok (https://www.kitploit.com/search/label/Ngrok) port python3 server.py 9090 run lorsrf.py and add ngrok host using -s option
requestbin.com
login to https://requestbin.com (https://requestbin.com/) copy your host and add it by using -s option (without server.py file)
How can i use it .?
cat YOUR_LIST.txt | python3 lorsrf.py -t URL_TARGET -s YOUR_HOST -w wordlist.txt
Examples :
$ cat paramters.txt | python3 lorsrf.py -t http://target.com -s http://53252.ngrok.io add threads $ cat paramters.txt | python3 lorsrf.py -t http://target.com -s http://53252.ngrok.io --threads=50 add timeout $ cat paramters.txt | python3 lorsrf.py -t http://target.com -s http://53252.ngrok.io --timeout=4 add cookies $ cat paramters.txt | python3 lorsrf.py -t http://target.com -s http://53252.ngrok.io -c 'user=5&PHPSESSION=5232' add headers (https://www.kitploit.com/search/label/Headers) from text file $ cat headers.txt
Cookie: test=1
Auth: Basic TG9yU3JmCg==

$ cat parameters.txt | python3 lorsrf.py -f headers.txt -s 'http://myhost.com' -t 'http://ssrf.hack.com'

---------------------
GET /?parameter={YOUR_HOST} HTTP/1.1
Host: targer.com
Cookie: test=1
Auth: Basic TG9yU3JmCg== Follow redirects $ cat paramters.txt | python3 lorsrf.py -t http://target.com -s http://53252.ngrok.io -r
Testing
python3 lorsrf.py -t 'http://testphp.vulnweb.com/showimage.php' -s 'https://YOUR_HOST.com' -w parameters.txt



Download Lorsrf (https://github.com/knassar702/lorsrf)