hacking: security in practice
What are some things I can do to secure my personal computer?

Hi,

I want to secure documents on my personal computer.

I’m not tech savvy. What are some reasonable ways I can take my security to the next level?

Like more security than an average hacker would fail to hack.

Edit: hypotethically, let’s say some hackers were passively (or even actively) looking for me

submitted by /u/NoWayThisUserIsTaken
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
12 Benefits of Hiring a Certified Ethical Hacker

https://cdn-images-1.medium.com/max/2100/0*buBfEwrvwV8sU2x8.jpg
With the advancement of the internet, the number of cybercrimes is also progressing every year. Hence there is also an increase in the…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Brutal WordPress plugin bug allows subscribers to wipe sites

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Brutal WordPress plugin bug allows subscribers to wipe sitesPost Views: 145
Reading Time: 1 Minute
A high severity security flaw found in a WordPress plugin, known as Hashthemes Demo Importer, with more than 8,000 active installs can let authenticated attackers reset and wipe vulnerable websites.
The plugin in question, known as Hashthemes Demo Importer, is designed to help admins import demos for WordPress themes with a single, without dealing with installing any dependencies.

The security bug would allow authenticated attackers to reset WordPress sites and delete almost all database content and uploaded media.

Wordfence QA engineer and threat analyst Ram Gall explained that the plugin failed to properly perform nonce checks, leaking the AJAX nonce on vulnerable sites’ admin dashboard for all users, “including low-privileged users such as subscribers.”
See Also: Complete Offensive Security and Ethical Hacking Course As a direct consequence of this bug, logged-in subscriber-level users could abuse it to wipe all the content on sites running unpatched versions of Hashthemes Demo Importer.

“While most vulnerabilities can have destructive effects, it would be impossible to recover a site where this vulnerability was exploited unless it had been backed up,” Gall added.

Any logged-in user could trigger the hdi_install_demo AJAX function and provide a reset parameter set to true, resulting in the plugin running it’s database_reset function. This function wiped the database by truncating every database table on the site except for wp_options, wp_users, and wp_usermeta. Once the database was wiped, the plugin would then run its clear_uploads function, which deleted every file and folder in wp-content/uploads. — Ram Gall
See Also: Apple Pay with VISA lets hackers force payments on locked iPhones
Subscriber, one of the types of users who could wipe vulnerable sites, is a default WordPress user role (just as Contributor, Author, Editor, and Administrator) often enabled on WordPress sites to allow registered users to write comments on the website’s comment section.

They would typically only be able to edit their profile using the site’s dashboard without access to other admin pages.

While Wordfence reported the vulnerability the bug to the plugin’s development team on August 25, 2021, the developers did not reply to the disclosure messages for almost a month. This prompted Wordfence to reach out to the WordPress plugins team on September 20, which led to the plugin’s removal the same day and the release of a patch addressing the bug four days later, on September 24.

However, Hashthemes Demo Importer’s developer did not mention the 1.1.2 release or the update on the plugin’s changelog page despite releasing a security update.

See Also: OSINT Tool: Osintgram
See Also: Hacking stories – Operation Aurora: When China hacked Google Source: www.bleepingcomputer.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/ezgif.com-gif-maker-5-90x90.jpg Hackers used billing software zero-day to deploy ransomware1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/ezgif.com-gif-maker-4-90x90.jpg Popular NPM library hijacked to install password-stealers, miners2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/youtube-logo-90x90.jpg Massive campaign uses YouTube to push password-stealing malware5 days ago
* https://www.blackhatethicalhacking.com/wp-con[...]

___________________________
@hacking_Attack
@Hacking_Video

tent/uploads/2021/10/ezgif.com-gif-maker-3-90x90.jpg Google: YouTubers’ accounts hijacked with cookie-stealing malware6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/ezgif.com-gif-maker-2-90x90.jpg Acer hacked twice in a week by the same threat actor1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/ezgif-6-e5d8ed29a830-90x90.jpg Credit card PINs can be guessed even when covering the ATM pad1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/REVIL-headpic-90x90.jpg REvil ransomware shuts down again after Tor sites were hijacked1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/google-chrome-adblocker-uai-1440x900-1-90x90.jpg Malicious Chrome ad blocker injects ads behind the scenes2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/maxresdefault-90x90.jpg Brizy WordPress Plugin Exploit Chains Allow Full Site Takeovers2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/abstract_mysterysnail-90x90.jpg Microsoft Kills Bug Being Exploited in MysterySnail Espionage Campaign2 weeks ago
The post Brutal WordPress plugin bug allows subscribers to wipe sites first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Lorsrf - SSRF Parameter Bruteforce

Bruteforcing on Hidden parameters to find SSRF vulnerability using GET and POST MethodsNOTE Lorsrf has been added to scant3r with useful additions (multi http method , multi content-type (json , query , xml , speed , large worlist and more)) https://github.com/knassar702/scant3r/wiki/lorsrf install download it ➜ git clone https://github.com/knassar702/lorsrf➜ cd lorsrf➜ sudo pip3 install requests flask install ngrok tool Steps : Ngrok run your ngrok ./ngrok http 9090 run server.py script and add ngrok port python3 server.py 9090 run lorsrf.py and add ngrok host using -s option requestbin.com login to https://requestbin.com copy your host and add it by using -s option (without server.py file) How can i use it .? cat YOUR_LIST.txt | python3 lorsrf.py -t URL_TARGET -s YOUR_HOST -w wordlist.txt Examples : $ cat paramters.txt | python3 lorsrf.py -t http://target.com -s http://53252.ngrok.io add threads $ cat paramters.txt | python3 lorsrf.py -t http://target.com -s http://53252.ngrok.io --threads=50 add timeout $ cat paramters.txt | python3 lorsrf.py -t http://target.com -s http://53252.ngrok.io --timeout=4 add cookies $ cat paramters.txt | python3 lorsrf.py -t http://target.com -s http://53252.ngrok.io -c 'user=5&PHPSESSION=5232' add headers from text file $ cat headers.txtCookie: test=1Auth: Basic TG9yU3JmCg==$ cat parameters.txt | python3 lorsrf.py -f headers.txt -s 'http://myhost.com' -t 'http://ssrf.hack.com'---------------------GET /?parameter={YOUR_HOST} HTTP/1.1Host: targer.comCookie: test=1Auth: Basic TG9yU3JmCg== Follow redirects $ cat paramters.txt | python3 lorsrf.py -t http://target.com -s http://53252.ngrok.io -r Testing python3 lorsrf.py -t 'http://testphp.vulnweb.com/showimage.php' -s 'https://YOUR_HOST.com' -w parameters.txt Download Lorsrf
Read more...

Deep Web
How important are these extra steps?

Im a newbie and was looking to get into marketplace stuff - and I guide I saw was telling me to do a variety of things including:

Using a non personal computer

Using public wifi

Running a VM (and tails) through USB

I was just wondering how important this is for making a purchase - I was planning to use my Laptop with a VM on my own WiFi (with a VPN, Bitcoin tumbling etc etc), would I be at risk?

Any other advice would be appreciated, thanks

submitted by /u/flimdo432
[link] [comments]

Hacking on Medium
Trends shaping cybersecurity

https://cdn-images-1.medium.com/max/2440/0*jEH3H96AmaHYOAPN
What are the biggest cybersecurity threats today? What are the latest techniques for thwarting hackers’ plans? Learn about the trends…

Continue reading on Medium »

Lorsrf - SSRF Parameter Bruteforce
http://www.kitploit.com/2021/10/lorsrf-ssrf-parameter-bruteforce.html

Bruteforcing on Hidden (https://www.kitploit.com/search/label/Hidden) parameters to find SSRF (https://www.kitploit.com/search/label/SSRF) vulnerability (https://www.kitploit.com/search/label/Vulnerability) using GET and POST Methods
NOTE
Lorsrf has been added to scant3r (https://github.com/knassar702/scant3r) with useful additions (multi http method , multi content-type (json , query , xml , speed , large worlist and more)) https://github.com/knassar702/scant3r/wiki/lorsrf
install
download it ➜ git clone https://github.com/knassar702/lorsrf
➜ cd lorsrf
➜ sudo pip3 install requests flask install ngrok tool (https://www.youtube.com/watch?v=4sF1ATYwr3U)
Steps :

Ngrok
run your ngrok ./ngrok http 9090 run server.py script and add ngrok (https://www.kitploit.com/search/label/Ngrok) port python3 server.py 9090 run lorsrf.py and add ngrok host using -s option
requestbin.com
login to https://requestbin.com (https://requestbin.com/) copy your host and add it by using -s option (without server.py file)
How can i use it .?
cat YOUR_LIST.txt | python3 lorsrf.py -t URL_TARGET -s YOUR_HOST -w wordlist.txt
Examples :
$ cat paramters.txt | python3 lorsrf.py -t http://target.com -s http://53252.ngrok.io add threads $ cat paramters.txt | python3 lorsrf.py -t http://target.com -s http://53252.ngrok.io --threads=50 add timeout $ cat paramters.txt | python3 lorsrf.py -t http://target.com -s http://53252.ngrok.io --timeout=4 add cookies $ cat paramters.txt | python3 lorsrf.py -t http://target.com -s http://53252.ngrok.io -c 'user=5&PHPSESSION=5232' add headers (https://www.kitploit.com/search/label/Headers) from text file $ cat headers.txt
Cookie: test=1
Auth: Basic TG9yU3JmCg==

$ cat parameters.txt | python3 lorsrf.py -f headers.txt -s 'http://myhost.com' -t 'http://ssrf.hack.com'

---------------------
GET /?parameter={YOUR_HOST} HTTP/1.1
Host: targer.com
Cookie: test=1
Auth: Basic TG9yU3JmCg== Follow redirects $ cat paramters.txt | python3 lorsrf.py -t http://target.com -s http://53252.ngrok.io -r
Testing
python3 lorsrf.py -t 'http://testphp.vulnweb.com/showimage.php' -s 'https://YOUR_HOST.com' -w parameters.txt



Download Lorsrf (https://github.com/knassar702/lorsrf)

Dark Reading: Attacks/Breaches
ThycoticCentrify Integrates Secret Server With Privileged Access Management Platform

Combination avails Secret Server customers to a range of SaaS services.

Dark Reading: Attacks/Breaches
Avast Business Introduces Network Discovery for SMBs

Avast's Network Discovery enables network administrators to easily analyze their entire IT network and deploy Avast Business security services.