tent/uploads/2021/10/ezgif.com-gif-maker-3-90x90.jpg Google: YouTubers’ accounts hijacked with cookie-stealing malware6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/ezgif.com-gif-maker-2-90x90.jpg Acer hacked twice in a week by the same threat actor1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/ezgif-6-e5d8ed29a830-90x90.jpg Credit card PINs can be guessed even when covering the ATM pad1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/REVIL-headpic-90x90.jpg REvil ransomware shuts down again after Tor sites were hijacked1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/google-chrome-adblocker-uai-1440x900-1-90x90.jpg Malicious Chrome ad blocker injects ads behind the scenes2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/maxresdefault-90x90.jpg Brizy WordPress Plugin Exploit Chains Allow Full Site Takeovers2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/abstract_mysterysnail-90x90.jpg Microsoft Kills Bug Being Exploited in MysterySnail Espionage Campaign2 weeks ago
The post Brutal WordPress plugin bug allows subscribers to wipe sites first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Lorsrf - SSRF Parameter Bruteforce

Bruteforcing on Hidden parameters to find SSRF vulnerability using GET and POST MethodsNOTE Lorsrf has been added to scant3r with useful additions (multi http method , multi content-type (json , query , xml , speed , large worlist and more)) https://github.com/knassar702/scant3r/wiki/lorsrf install download it ➜ git clone https://github.com/knassar702/lorsrf➜ cd lorsrf➜ sudo pip3 install requests flask install ngrok tool Steps : Ngrok run your ngrok ./ngrok http 9090 run server.py script and add ngrok port python3 server.py 9090 run lorsrf.py and add ngrok host using -s option requestbin.com login to https://requestbin.com copy your host and add it by using -s option (without server.py file) How can i use it .? cat YOUR_LIST.txt | python3 lorsrf.py -t URL_TARGET -s YOUR_HOST -w wordlist.txt Examples : $ cat paramters.txt | python3 lorsrf.py -t http://target.com -s http://53252.ngrok.io add threads $ cat paramters.txt | python3 lorsrf.py -t http://target.com -s http://53252.ngrok.io --threads=50 add timeout $ cat paramters.txt | python3 lorsrf.py -t http://target.com -s http://53252.ngrok.io --timeout=4 add cookies $ cat paramters.txt | python3 lorsrf.py -t http://target.com -s http://53252.ngrok.io -c 'user=5&PHPSESSION=5232' add headers from text file $ cat headers.txtCookie: test=1Auth: Basic TG9yU3JmCg==$ cat parameters.txt | python3 lorsrf.py -f headers.txt -s 'http://myhost.com' -t 'http://ssrf.hack.com'---------------------GET /?parameter={YOUR_HOST} HTTP/1.1Host: targer.comCookie: test=1Auth: Basic TG9yU3JmCg== Follow redirects $ cat paramters.txt | python3 lorsrf.py -t http://target.com -s http://53252.ngrok.io -r Testing python3 lorsrf.py -t 'http://testphp.vulnweb.com/showimage.php' -s 'https://YOUR_HOST.com' -w parameters.txt Download Lorsrf
Read more...

Deep Web
How important are these extra steps?

Im a newbie and was looking to get into marketplace stuff - and I guide I saw was telling me to do a variety of things including:

Using a non personal computer

Using public wifi

Running a VM (and tails) through USB

I was just wondering how important this is for making a purchase - I was planning to use my Laptop with a VM on my own WiFi (with a VPN, Bitcoin tumbling etc etc), would I be at risk?

Any other advice would be appreciated, thanks

submitted by /u/flimdo432
[link] [comments]

Hacking on Medium
Trends shaping cybersecurity

https://cdn-images-1.medium.com/max/2440/0*jEH3H96AmaHYOAPN
What are the biggest cybersecurity threats today? What are the latest techniques for thwarting hackers’ plans? Learn about the trends…

Continue reading on Medium »

Lorsrf - SSRF Parameter Bruteforce
http://www.kitploit.com/2021/10/lorsrf-ssrf-parameter-bruteforce.html

Bruteforcing on Hidden (https://www.kitploit.com/search/label/Hidden) parameters to find SSRF (https://www.kitploit.com/search/label/SSRF) vulnerability (https://www.kitploit.com/search/label/Vulnerability) using GET and POST Methods
NOTE
Lorsrf has been added to scant3r (https://github.com/knassar702/scant3r) with useful additions (multi http method , multi content-type (json , query , xml , speed , large worlist and more)) https://github.com/knassar702/scant3r/wiki/lorsrf
install
download it ➜ git clone https://github.com/knassar702/lorsrf
➜ cd lorsrf
➜ sudo pip3 install requests flask install ngrok tool (https://www.youtube.com/watch?v=4sF1ATYwr3U)
Steps :

Ngrok
run your ngrok ./ngrok http 9090 run server.py script and add ngrok (https://www.kitploit.com/search/label/Ngrok) port python3 server.py 9090 run lorsrf.py and add ngrok host using -s option
requestbin.com
login to https://requestbin.com (https://requestbin.com/) copy your host and add it by using -s option (without server.py file)
How can i use it .?
cat YOUR_LIST.txt | python3 lorsrf.py -t URL_TARGET -s YOUR_HOST -w wordlist.txt
Examples :
$ cat paramters.txt | python3 lorsrf.py -t http://target.com -s http://53252.ngrok.io add threads $ cat paramters.txt | python3 lorsrf.py -t http://target.com -s http://53252.ngrok.io --threads=50 add timeout $ cat paramters.txt | python3 lorsrf.py -t http://target.com -s http://53252.ngrok.io --timeout=4 add cookies $ cat paramters.txt | python3 lorsrf.py -t http://target.com -s http://53252.ngrok.io -c 'user=5&PHPSESSION=5232' add headers (https://www.kitploit.com/search/label/Headers) from text file $ cat headers.txt
Cookie: test=1
Auth: Basic TG9yU3JmCg==

$ cat parameters.txt | python3 lorsrf.py -f headers.txt -s 'http://myhost.com' -t 'http://ssrf.hack.com'

---------------------
GET /?parameter={YOUR_HOST} HTTP/1.1
Host: targer.com
Cookie: test=1
Auth: Basic TG9yU3JmCg== Follow redirects $ cat paramters.txt | python3 lorsrf.py -t http://target.com -s http://53252.ngrok.io -r
Testing
python3 lorsrf.py -t 'http://testphp.vulnweb.com/showimage.php' -s 'https://YOUR_HOST.com' -w parameters.txt



Download Lorsrf (https://github.com/knassar702/lorsrf)

Dark Reading: Attacks/Breaches
ThycoticCentrify Integrates Secret Server With Privileged Access Management Platform

Combination avails Secret Server customers to a range of SaaS services.

Dark Reading: Attacks/Breaches
Avast Business Introduces Network Discovery for SMBs

Avast's Network Discovery enables network administrators to easily analyze their entire IT network and deploy Avast Business security services.

Dark Reading: Attacks/Breaches
Onfido Acquires EYN to Provide Acoustic-Based Liveness Detection

Technology will be incorporated into Onfido’s Real Identity Platform.

Dark Reading: Attacks/Breaches
Identity-Focused Security Controls Prevail

How identity and access management strategies held up during the pandemic and tips for putting together an identity security road map.

Dark Reading: Attacks/Breaches
Cynerio Launches IoT Attack Detection and Response Module for Healthcare IoT Devices

Module helps hospitals identify, contain, and mitigate threats on devices exhibiting malicious or suspicious behavior.

Dark Reading: Attacks/Breaches
Cyber Readiness Institute Names Karen S. Evans as New Managing Director

Former assistant secretary for cybersecurity, energy security, and emergency response at US Department of Energy and Homeland Security CIO to lead strategic vision and day-to-day operations.