Curently gathered info
Windows credentials (Taskscheduled credentials & a lot more) Windows Vaults Windows RDP credentials AdConnect (still require a manual operation) Wifi key Intenet explorer Creentials Chrome cookies & credentials Firefox cookies & credentials VNC passwords mRemoteNG password (with default config)
Check for a bit of compliance
SMB signing status OS/Domain/Hostname/Ip of the audited scope
Operational use
With local admin account on a host, we can : Gather machine protected DPAPI secrets ScheduledTask that will contain cleartext login/password of the account configured to run the task Wi-Fi passwords Extract Masterkey's hash value for every user profiles (masterkeys beeing protected by the user's password, let's try to crack them with Hashcat) Identify who is connected from where, in order to identify admin's personal computers. Extract other non-dpapi protected secrets (VNC/Firefox/mRemoteNG) Gather protected secrets from IE, Chrome, Firefox and start reaching the Azure tenant. With a user password, or the domain PVK we can unprotect the user's DPAPI secrets.
Examples
Dump all secrets of the target machine with an admin account : DonPAPI.py domain/user:passw0rd@target Using user's hash : domain/user@target ">DonPAPI.py --hashes : domain/user@target Using kerberos (-k) and local auth (-local_auth) DonPAPI.py -k domain/user@target
DonPAPI.py -local_auth user@target Using a user with LAPS password reading rights DonPAPI.py -laps domain/user:passw0rd@target It is also possible to provide the tool with a list of credentials that will be tested on the target. DonPAPI will try to use them to decipher masterkeys. This credential file must have the following syntax: user1:pass1 user2:pass2 ... user1:pass1
user2:pass2
...
When a domain admin user is available, it is possible to dump the domain backup key using impacket dpapi.py tool. DonPAPI.py -credz credz_file.txt domain/user:passw0rd@target This backup key can then be used to dump all domain user's secrets! python DonPAPI.py -pvk domain_backupkey.pvk domain/user:passw0rd@domain_network_list Target can be an IP, IP range, CIDR, file containing list targets (one per line)
Opsec consideration
The RemoteOps part can be spoted by some EDR. It can be disabled using --no_remoteops flag, but then the machine DPAPI key won't be retrieved, and scheduled task credentials/Wi-Fi passwords (https://www.kitploit.com/search/label/Passwords) won't be harvested.
Installation
dpapi.py backupkey --export
Credits
All the credits goes to these great guys for doing the hard research & coding : Benjamin Delpy (@gentilkiwi (https://twitter.com/gentilkiwi)) for most of the DPAPI research (always greatly commented, Alberto Solino (@agsolino (https://twitter.com/agsolino)) for the tremendous work of Impacket (https://www.kitploit.com/search/label/Impacket) (https://github.com/SecureAuthCorp/impacket). Almost everything we do here comes from impacket. Alesandro Z (https://github.com/AlessandroZ) & everyone who worked on Lazagne (https://github.com/AlessandroZ/LaZagne/wiki) for the VNC & Firefox modules, and most likely for a lots of other ones in the futur. dirkjanm @_dirkjan (https://twitter.com/_dirkjan) for the base code of adconnect dump (https://github.com/fox-it/adconnectdump) & every research he ever did. I learned so much on so many subjects thanks to you. @byt3bl33d3r (https://twitter.com/byt3bl33d3r) for CME (lots of inspiration and code comes from CME : https://github.com/byt3bl33d3r/CrackMapExec ) All the Team at @LoginSecurite (https://twitter.com/LoginSecurite) for their help in debugging (https://www.kitploit.com/search/label/Debugging) my shity code (special thanks to @layno (https://github.com/clayno) & @HackAndDo (https://twitter.com/HackAndDo) for that)
Todo
___________________________
@hacking_Attack
@Hacking_Video
Windows credentials (Taskscheduled credentials & a lot more) Windows Vaults Windows RDP credentials AdConnect (still require a manual operation) Wifi key Intenet explorer Creentials Chrome cookies & credentials Firefox cookies & credentials VNC passwords mRemoteNG password (with default config)
Check for a bit of compliance
SMB signing status OS/Domain/Hostname/Ip of the audited scope
Operational use
With local admin account on a host, we can : Gather machine protected DPAPI secrets ScheduledTask that will contain cleartext login/password of the account configured to run the task Wi-Fi passwords Extract Masterkey's hash value for every user profiles (masterkeys beeing protected by the user's password, let's try to crack them with Hashcat) Identify who is connected from where, in order to identify admin's personal computers. Extract other non-dpapi protected secrets (VNC/Firefox/mRemoteNG) Gather protected secrets from IE, Chrome, Firefox and start reaching the Azure tenant. With a user password, or the domain PVK we can unprotect the user's DPAPI secrets.
Examples
Dump all secrets of the target machine with an admin account : DonPAPI.py domain/user:passw0rd@target Using user's hash : domain/user@target ">DonPAPI.py --hashes : domain/user@target Using kerberos (-k) and local auth (-local_auth) DonPAPI.py -k domain/user@target
DonPAPI.py -local_auth user@target Using a user with LAPS password reading rights DonPAPI.py -laps domain/user:passw0rd@target It is also possible to provide the tool with a list of credentials that will be tested on the target. DonPAPI will try to use them to decipher masterkeys. This credential file must have the following syntax: user1:pass1 user2:pass2 ... user1:pass1
user2:pass2
...
When a domain admin user is available, it is possible to dump the domain backup key using impacket dpapi.py tool. DonPAPI.py -credz credz_file.txt domain/user:passw0rd@target This backup key can then be used to dump all domain user's secrets! python DonPAPI.py -pvk domain_backupkey.pvk domain/user:passw0rd@domain_network_list Target can be an IP, IP range, CIDR, file containing list targets (one per line)
Opsec consideration
The RemoteOps part can be spoted by some EDR. It can be disabled using --no_remoteops flag, but then the machine DPAPI key won't be retrieved, and scheduled task credentials/Wi-Fi passwords (https://www.kitploit.com/search/label/Passwords) won't be harvested.
Installation
dpapi.py backupkey --export
Credits
All the credits goes to these great guys for doing the hard research & coding : Benjamin Delpy (@gentilkiwi (https://twitter.com/gentilkiwi)) for most of the DPAPI research (always greatly commented, Alberto Solino (@agsolino (https://twitter.com/agsolino)) for the tremendous work of Impacket (https://www.kitploit.com/search/label/Impacket) (https://github.com/SecureAuthCorp/impacket). Almost everything we do here comes from impacket. Alesandro Z (https://github.com/AlessandroZ) & everyone who worked on Lazagne (https://github.com/AlessandroZ/LaZagne/wiki) for the VNC & Firefox modules, and most likely for a lots of other ones in the futur. dirkjanm @_dirkjan (https://twitter.com/_dirkjan) for the base code of adconnect dump (https://github.com/fox-it/adconnectdump) & every research he ever did. I learned so much on so many subjects thanks to you. @byt3bl33d3r (https://twitter.com/byt3bl33d3r) for CME (lots of inspiration and code comes from CME : https://github.com/byt3bl33d3r/CrackMapExec ) All the Team at @LoginSecurite (https://twitter.com/LoginSecurite) for their help in debugging (https://www.kitploit.com/search/label/Debugging) my shity code (special thanks to @layno (https://github.com/clayno) & @HackAndDo (https://twitter.com/HackAndDo) for that)
Todo
___________________________
@hacking_Attack
@Hacking_Video
Kitploit
Kitploit – Maintenance in Progress
Kitploit is temporarily under maintenance. We’ll be back shortly with improvements.
Finish ADSync/ADConnect password extraction CREDHISTORY full extraction Extract windows Certificates Further analysis (https://www.kitploit.com/search/label/Analysis) ADAL/msteams Implement Chrome Find a way to implement Lazagne's great modules
Changelog
git clone https://github.com/login-securite/DonPAPI.git
cd DonPAPI
python3 -m pip install -r requirements.txt
python3 DonPAPI.py
Download DonPAPI (https://github.com/login-securite/DonPAPI)
___________________________
@hacking_Attack
@Hacking_Video
Changelog
git clone https://github.com/login-securite/DonPAPI.git
cd DonPAPI
python3 -m pip install -r requirements.txt
python3 DonPAPI.py
Download DonPAPI (https://github.com/login-securite/DonPAPI)
___________________________
@hacking_Attack
@Hacking_Video
Kitploit
Kitploit – Maintenance in Progress
Kitploit is temporarily under maintenance. We’ll be back shortly with improvements.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Covert-Tube : Youtube As Covert-Channel – Control Systems Remotely And Execute Commands By Uploading Videos To Youtube
Covert-Tube is a program to control systems remotely by uploading videos to Youtube using Python to create the videos and the listener, emulating some malware I was reading about. It allows to create videos with frames formed of simple text, QR codes with cleartext or QR codes using AES encryption.
Create A Video
The videos can be created using generate_video.py: enter the commands and generate the video writing “exit”. The video generated is called by default output.avi (can be updated in config.py):
python3 generate_video.py
https://blogger.googleusercontent.com/img/a/AVvXsEiZfWLWnijr25g6LxqO9tVlFUxm3Bo9Anf1oMDYZY2pa7Qmb8fmMIecNitcrWecbTjVfuyHA4haOyvbNI2dh67Y3zc-FzCIdhZpSSv1qMaVM-32aR-n26qB_u5B75E5E5_nJfN2Pn2uzCtgY3Si2Wvy07CiIbDQ9OyYQIQ1cB7NTLFqXBElMTIlX5ye=s762
Run the listener and upload the video to Youtube
python3 main.py
The listener will check the Youtube channel every 300 seconds by default (can be updated in config.py). First the video is uploaded:
https://blogger.googleusercontent.com/img/a/AVvXsEg62SFLdUnJkUq_Dd3_HIMmJ-gCtMFQ5gbr_1AxObary_4Q-6uoyg-qZvkET9akcLaWfxAMKXngJg1456QiEKTLytTLbKzNEfdsefZRuVabQgdkaZcBkEAjunT_1vkGsZbsE7WOWPUqOJ8Ffso9cptgYIalFmdk1Pen3Vi6hEjb8h9EqHTroQV_xoot=s463
After finding there is a new video in the channel, it is downloaded and the commands are executed:
https://blogger.googleusercontent.com/img/a/AVvXsEhwriT696LFBPvKl8YHPXrJ1M_QJ6dcnJ8rDxU4HChbc-wmJs8QS5ZWA0-dauipND_soyiJJmMB88Lp1Db8gD7yzetAYGDXrngPynr8-7Jr3DxinonhHpca4vR21nmG2gA6VS7ejrN1Vv2ekRX0B7-Pj3o0PcS-bfqztVyxscYrwPDyjF10T-4DTPby=s662
We can see the output from the commands:
https://blogger.googleusercontent.com/img/a/AVvXsEgMvI-MegjSOa3qQxQNhrb1trN5S4fpUe6vCVo4Dd2C4vfjsZKEYy58BNQqCrJ8A9BnVQA3mY6SFtPzgp0KIK0sgAp5tXbXtxbF1NciWSYgcCdBLCmwsxDvE0fGk6Cullud10zzjzylStAVUCtUSFIlsjfFvgWGYV_mW80mJtgCr9SXzZXSJRDWQjKF=s571
Configuration
Update the config.py file:
* channel_id (Mandatory!!!): Get your Youtube channel ID from here.
* api_key (Mandatory!!!): To get the API key create an application and generate the key from here.
* image_type (Optional. Default: “qr_aes”): Different types of images for the video.
* “cleartext” creates images with the words of the commands.
* “qr” creates QR codes with the commands.
* “qr_aes” creates QR codes with the commands encrypted with AES.
* upload_seconds_delay (Optional. Default: 300): Seconds delay until checking if a new video has been uploaded.
* debug (Optional. Default: True): Print messages or not.
* aes_key (Optional. Default: “covert-tube_2021”): Key for AES encryption, used in the “qr_aes” option.
* generated_video_path (Optional. Default: “output.avi”): Path of video generated with generate_video.py.
* downloaded_video_path (Optional. Default: “/tmp/test.mp4”): Path where the new video will be downloaded.
* temp_folder (Optional. Default: “/tmp/”): Path where images of every frame from the video are stored, with the format image_X.png.
Installation
For all the project:
sudo apt install libzbar0
pip3 install Pillow opencv-python youtube_dl pytesseract pyqrcode pypng pyzbar pycrypto
git clone https://github.com/ricardojoserf/covert-tube
Creating a standalone binary
pyinstaller –onefile main.py
cp dist/main covert-tube
rm -rf dist build
rm main.spec
Download
___________________________
@hacking_Attack
@Hacking_Video
Covert-Tube : Youtube As Covert-Channel – Control Systems Remotely And Execute Commands By Uploading Videos To Youtube
Covert-Tube is a program to control systems remotely by uploading videos to Youtube using Python to create the videos and the listener, emulating some malware I was reading about. It allows to create videos with frames formed of simple text, QR codes with cleartext or QR codes using AES encryption.
Create A Video
The videos can be created using generate_video.py: enter the commands and generate the video writing “exit”. The video generated is called by default output.avi (can be updated in config.py):
python3 generate_video.py
https://blogger.googleusercontent.com/img/a/AVvXsEiZfWLWnijr25g6LxqO9tVlFUxm3Bo9Anf1oMDYZY2pa7Qmb8fmMIecNitcrWecbTjVfuyHA4haOyvbNI2dh67Y3zc-FzCIdhZpSSv1qMaVM-32aR-n26qB_u5B75E5E5_nJfN2Pn2uzCtgY3Si2Wvy07CiIbDQ9OyYQIQ1cB7NTLFqXBElMTIlX5ye=s762
Run the listener and upload the video to Youtube
python3 main.py
The listener will check the Youtube channel every 300 seconds by default (can be updated in config.py). First the video is uploaded:
https://blogger.googleusercontent.com/img/a/AVvXsEg62SFLdUnJkUq_Dd3_HIMmJ-gCtMFQ5gbr_1AxObary_4Q-6uoyg-qZvkET9akcLaWfxAMKXngJg1456QiEKTLytTLbKzNEfdsefZRuVabQgdkaZcBkEAjunT_1vkGsZbsE7WOWPUqOJ8Ffso9cptgYIalFmdk1Pen3Vi6hEjb8h9EqHTroQV_xoot=s463
After finding there is a new video in the channel, it is downloaded and the commands are executed:
https://blogger.googleusercontent.com/img/a/AVvXsEhwriT696LFBPvKl8YHPXrJ1M_QJ6dcnJ8rDxU4HChbc-wmJs8QS5ZWA0-dauipND_soyiJJmMB88Lp1Db8gD7yzetAYGDXrngPynr8-7Jr3DxinonhHpca4vR21nmG2gA6VS7ejrN1Vv2ekRX0B7-Pj3o0PcS-bfqztVyxscYrwPDyjF10T-4DTPby=s662
We can see the output from the commands:
https://blogger.googleusercontent.com/img/a/AVvXsEgMvI-MegjSOa3qQxQNhrb1trN5S4fpUe6vCVo4Dd2C4vfjsZKEYy58BNQqCrJ8A9BnVQA3mY6SFtPzgp0KIK0sgAp5tXbXtxbF1NciWSYgcCdBLCmwsxDvE0fGk6Cullud10zzjzylStAVUCtUSFIlsjfFvgWGYV_mW80mJtgCr9SXzZXSJRDWQjKF=s571
Configuration
Update the config.py file:
* channel_id (Mandatory!!!): Get your Youtube channel ID from here.
* api_key (Mandatory!!!): To get the API key create an application and generate the key from here.
* image_type (Optional. Default: “qr_aes”): Different types of images for the video.
* “cleartext” creates images with the words of the commands.
* “qr” creates QR codes with the commands.
* “qr_aes” creates QR codes with the commands encrypted with AES.
* upload_seconds_delay (Optional. Default: 300): Seconds delay until checking if a new video has been uploaded.
* debug (Optional. Default: True): Print messages or not.
* aes_key (Optional. Default: “covert-tube_2021”): Key for AES encryption, used in the “qr_aes” option.
* generated_video_path (Optional. Default: “output.avi”): Path of video generated with generate_video.py.
* downloaded_video_path (Optional. Default: “/tmp/test.mp4”): Path where the new video will be downloaded.
* temp_folder (Optional. Default: “/tmp/”): Path where images of every frame from the video are stored, with the format image_X.png.
Installation
For all the project:
sudo apt install libzbar0
pip3 install Pillow opencv-python youtube_dl pytesseract pyqrcode pypng pyzbar pycrypto
git clone https://github.com/ricardojoserf/covert-tube
Creating a standalone binary
pyinstaller –onefile main.py
cp dist/main covert-tube
rm -rf dist build
rm main.spec
Download
___________________________
@hacking_Attack
@Hacking_Video
Kali Linux Tutorials
Covert-Tube : Youtube As Covert-Channel - Control Systems Remotely
Covert-Tube is a program to control systems remotely by uploading videos to Youtube using Python to create the videos and the listener.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
AF-ShellHunter : Auto Shell Lookup
AF-ShellHunter its a script designed to automate the search of WebShell’s in AF Team
How To
pip3 install -r requirements.txt
python3 shellhunter.py –help
Basic Usage
You can run shellhunter in two modes
* –url -u When scanning a single url
* –file -f Scanning multiple URLs at once
Example searching webshell with burpsuite proxy, hiding string “404” with a size between 100 and 1000 chars
┌──(blueudp㉿xxxxxxxx)-[~/AF-ShellHunter]
└─$ python3 shellhunter.py -u https://xxxxxxxxxx -hs “404” -p burp –greater-than 100 –smaller-than 1000
Running AF-Team ShellHunt 1.1.0
URL: https://xxxxxxxxxx
Showing only: 200, 302
Threads: 20
Not showing coincidence with: 404
Proxy: burp
Greater than: 100
Smaller than: 1000
Found https://xxxxxxxxxx/system.php len: 881
File Configuration For Multiple Sites
phishing_list
#How to?
#set country block with [country], please read user_files/config.txt
#’show-response-code “option1” “option2″‘ -> show responses with those status codes, as -sc
#’show-string’ -> show match with that string, as -ss
#’show-regex’ -> show match with regex, as -sr
#use ‘not’ for not showing X in above options, as -h[option]
#’greater-than’ -> Show response greater than X, as -gt ( –greater-than )
#’smaller-than’ -> Show responses smaller than X, as -st ( –smaller-than )
#Example searching webshell with BurpSuite proxy. 302, 200 status code, not showing results w/ ‘página en mantenimiento’ with size between 100 and 1000 chars
[burp]
https://banco.phishing->show-response-code “302” “200”, not show-string “página en mantenimiento”, greater-than 100, smaller-than 1000
[noproxy]
banco.es-> # ShellHunt will add ‘http://
Setting Your Proxies And Custom Headers
config.txt
[HEADERS] # REQUESTS CUSTOM HEADERS, ADD ‘OPTION: VALUE’
User-Agent? Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36
Referer? bit.ly/THIS_is_PHISHING # Bypass referer protection
[PROXIES]
burp? https://127.0.0.1:8080,http://127.0.0.1:8080
Other Features
* Filter by regex
* Filter by string
* Filter by HTTP Status code
* Filter by length
* Custom Headers
* Custom proxy or proxy block for URL file
* Multithreading ( custom workers number )
Download
___________________________
@hacking_Attack
@Hacking_Video
AF-ShellHunter : Auto Shell Lookup
AF-ShellHunter its a script designed to automate the search of WebShell’s in AF Team
How To
pip3 install -r requirements.txt
python3 shellhunter.py –help
Basic Usage
You can run shellhunter in two modes
* –url -u When scanning a single url
* –file -f Scanning multiple URLs at once
Example searching webshell with burpsuite proxy, hiding string “404” with a size between 100 and 1000 chars
┌──(blueudp㉿xxxxxxxx)-[~/AF-ShellHunter]
└─$ python3 shellhunter.py -u https://xxxxxxxxxx -hs “404” -p burp –greater-than 100 –smaller-than 1000
Running AF-Team ShellHunt 1.1.0
URL: https://xxxxxxxxxx
Showing only: 200, 302
Threads: 20
Not showing coincidence with: 404
Proxy: burp
Greater than: 100
Smaller than: 1000
Found https://xxxxxxxxxx/system.php len: 881
File Configuration For Multiple Sites
phishing_list
#How to?
#set country block with [country], please read user_files/config.txt
#’show-response-code “option1” “option2″‘ -> show responses with those status codes, as -sc
#’show-string’ -> show match with that string, as -ss
#’show-regex’ -> show match with regex, as -sr
#use ‘not’ for not showing X in above options, as -h[option]
#’greater-than’ -> Show response greater than X, as -gt ( –greater-than )
#’smaller-than’ -> Show responses smaller than X, as -st ( –smaller-than )
#Example searching webshell with BurpSuite proxy. 302, 200 status code, not showing results w/ ‘página en mantenimiento’ with size between 100 and 1000 chars
[burp]
https://banco.phishing->show-response-code “302” “200”, not show-string “página en mantenimiento”, greater-than 100, smaller-than 1000
[noproxy]
banco.es-> # ShellHunt will add ‘http://
Setting Your Proxies And Custom Headers
config.txt
[HEADERS] # REQUESTS CUSTOM HEADERS, ADD ‘OPTION: VALUE’
User-Agent? Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36
Referer? bit.ly/THIS_is_PHISHING # Bypass referer protection
[PROXIES]
burp? https://127.0.0.1:8080,http://127.0.0.1:8080
Other Features
* Filter by regex
* Filter by string
* Filter by HTTP Status code
* Filter by length
* Custom Headers
* Custom proxy or proxy block for URL file
* Multithreading ( custom workers number )
Download
___________________________
@hacking_Attack
@Hacking_Video
Kali Linux Tutorials
AF-ShellHunter : Auto Shell Lookup !!! Kali Linux Tutorials
AF-ShellHunter its a script designed to automate the search of WebShell's in AF Team. You can run shellhunter in two modes.
SQL Injection JR. Pentester -TryHackMe Part 2
Hi folks, welcome back to part 2 of SQL injection in JR. Pentester path.Continue reading on Medium »
Read more...
Hi folks, welcome back to part 2 of SQL injection in JR. Pentester path.Continue reading on Medium »
Read more...
Analyzing Java Heap dumps via OQL queries
Java heap dumps contain sensitive data like Environment files, Passwords, Secret keys. This head dump is exposed by the Spring boot…Continue reading on Defmax »
Read more...
Java heap dumps contain sensitive data like Environment files, Passwords, Secret keys. This head dump is exposed by the Spring boot…Continue reading on Defmax »
Read more...
hacking: security in practice
hack this site? It's up check it's code
submitted by /u/Inevitable_Will_9378
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
hack this site? It's up check it's code
submitted by /u/Inevitable_Will_9378
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
hack this site? It's up check it's code
Posted in r/hacking by u/Inevitable_Will_9378 • 0 points and 0 comments
hacking: security in practice
What are the different ways to hack into a static Wordpress website?
Hackers in mid 2000s used to hack static websites and completely change the CSS and pages. I was wondering how hackers used to do that and if those vulnerabilities are still present?
submitted by /u/Yellow_KingX
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
What are the different ways to hack into a static Wordpress website?
Hackers in mid 2000s used to hack static websites and completely change the CSS and pages. I was wondering how hackers used to do that and if those vulnerabilities are still present?
submitted by /u/Yellow_KingX
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
What are the different ways to hack into a static Wordpress website?
Hackers in mid 2000s used to hack static websites and completely change the CSS and pages. I was wondering how hackers used to do that and if...
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Sensitive data of 400,000 German students exposed by API flaw
https://external-preview.redd.it/XpI8Yewz5tFzlMqeScj58O1_k2fgaUPLdYDEMhxBd_c.jpg?width=640&crop=smart&auto=webp&s=9ce2e581badbd83c1c726168649e92cc56d3b863 submitted by /u/CodePerfect
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Sensitive data of 400,000 German students exposed by API flaw
https://external-preview.redd.it/XpI8Yewz5tFzlMqeScj58O1_k2fgaUPLdYDEMhxBd_c.jpg?width=640&crop=smart&auto=webp&s=9ce2e581badbd83c1c726168649e92cc56d3b863 submitted by /u/CodePerfect
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Sensitive data of 400,000 German students exposed by API flaw
Posted in r/hacking by u/CodePerfect • 1 point and 0 comments
hacking: security in practice
Chack, Hacker Chess
submitted by /u/InformalGhost
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Chack, Hacker Chess
submitted by /u/InformalGhost
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Chack, Hacker Chess
Posted in r/hacking by u/InformalGhost • 0 points and 0 comments
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Forced OAuth profile linking
https://cdn-images-1.medium.com/max/1268/1*Lfijo7MBe5VnCydnBU4dPg.png
xigtadaan waxa ay la socotaa article kii kan ka horeeyey ee aan uga hadlayney…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Forced OAuth profile linking
https://cdn-images-1.medium.com/max/1268/1*Lfijo7MBe5VnCydnBU4dPg.png
xigtadaan waxa ay la socotaa article kii kan ka horeeyey ee aan uga hadlayney…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Forced OAuth profile linking
xigtadaan waxa ay la socotaa article kii kan ka horeeyey ee aan uga hadlayney…
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Cream Hacked Analysis，US $130 Million Hacked
https://cdn-images-1.medium.com/max/1000/1*VS55YxfS-VBpFMoD9QZu3A.png
On October 27, 2021, Cream Finance suffered another attack loss of approximately US$130 million.
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Cream Hacked Analysis，US $130 Million Hacked
https://cdn-images-1.medium.com/max/1000/1*VS55YxfS-VBpFMoD9QZu3A.png
On October 27, 2021, Cream Finance suffered another attack loss of approximately US$130 million.
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Cream Hacked Analysis，US $130 Million Hacked
On October 27, 2021, Cream Finance suffered another attack loss of approximately US$130 million.