Hacking on Medium
Blizzard’s Bug Bounty Program on Immunefi

https://cdn-images-1.medium.com/max/1920/1*lXvEARFUx3vxjC-bfVR8kQ.jpeg
Pleased to announce Blizzard is doing a bug bounty program on Immunefi.com, DeFi’s leading bug bounty platform! Ethical hackers can review…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Command Injection — All in one Blog

https://cdn-images-1.medium.com/max/1200/1*DBDo8776nRpqhn3EX6O6WA.jpeg
Everything about command injection

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Command Injection — All in one Blog
https://infosecwriteups.com/command-injection-all-in-one-blog-52591ad750df?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Everything about command injectionContinue reading on InfoSec Write-ups » (https://infosecwriteups.com/command-injection-all-in-one-blog-52591ad750df?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Command Injection — All in one Blog

Everything about command injectionContinue reading on InfoSec Write-ups »
Read more...

KitPloit - PenTest Tools!
GC2 - A Command And Control Application That Allows An Attacker To Execute Commands On The Target Machine Using Google Sheet And Exfiltrate Data Using Google Drive

https://blogger.googleusercontent.com/img/a/AVvXsEgB9k7xplESeVf5vz9e3NpOvY6G5Bhysh1xwg1KPH3SxfOa1gRBKTrjrldHkB_shT1Y7XGmaNNhvrb7lGI90FDbmkp0ni9nMtHQC47Q9VDf2Ku1gsHF0AFuoLehMm5ziKP8tjxhaygMRf_zURKiO0OSGwRmwYNyJgRg3FUU3GiOzkXadC1WRD_Ddc547A=s320 GC2 (Google Command and Control) is a Command and Control application that allows an attacker to execute commands on the target machine using Google Sheet and exfiltrates data using Google Drive. WhyThis program has been developed in order to provide a command and control that does not require any particular set up (like: a custom domain, VPS, CDN, ...) during Red Teaming activities.

Furthermore, the program will interact only with Google's domains (*.google.com) to make detection more difficult.

PS: Please don't upload the compiled binary on VirusTotal :) Set up1.
Build executable git clone https://github.com/looCiprian/GC2-sheet
cd GC2-sheet
go build gc2-sheet.go2.
Create a new google "service account"

Create a new google "service account" using https://console.cloud.google.com/, create a .json key file for the service account

3.
Enable Google Sheet API and Google Drive API

Enable Google Drive API https://developers.google.com/drive/api/v3/enable-drive-api and Google Sheet API https://developers.google.com/sheets/api/quickstart/go

4.
5.
Set up Google Sheet and Google Drive

Create a new Google Sheet and add the service account to the editor group of the spreadsheet (to add the service account use its email) https://blogger.googleusercontent.com/img/a/AVvXsEh_qx_XUSd1Qdd89JCnK9vI_wb4NxJbCSvLLquAAyudcr2_Fpb_OUOv_m_hRJpXua0K3WRB5Qdd1cRkNqgMlWFFc99RiKSbBQYgYiDo3sbWdwiJXTfH3crIMkJYv7hiQI0VHdGScUEaZFJT3a7MQvh0vRx8aJsOf0NNn8yHlqmp6ihCbVe8ufkl_r-M_w=w640-h334 Create a new Google Drive folder and add the service account to the editor group of the folder (to add the service account use its email) https://blogger.googleusercontent.com/img/a/AVvXsEgAxJt6B24D_aAmGzMjQY1VZWD1dwTXg4COAXnmiNiwgPdapFI2EAHPZHaItydrBhvB9xEK4cED8Gms92PFw3swu8lam8ZXHmBv1UkZZ-b_SAgiMdSBip0OdRG5QZGfbNNKX5UivFDxRs1SfUcHZLcChF2eYnjoJVP88HwZBtQkbra5Jk6sPXJG3AsEcA=w640-h420 6.
Start the C2 gc2-sheet --key PS: you can also hardcode the parameters in the code, so you will upload only the executable on the target machine (look at comments in root.go and authentication.go) Features* Command execution using Google Sheet as a console
* Download files on the target using Google Drive
* Data exfiltration using Google Drive
* Exit Command executionThe program will perform a request to the spreedsheet every 5 sec to check if there are some new commands. Commands must be inserted in the column "A", and the output will be printed in the column "B". Data exfiltration fileSpecial commands are reserved to perform the upload and download to the target machine From Target to Google Drive
upload;Download fileSpecial commands are reserved to perform the upload and download to the target machine From Google Drive to Target
download;ExitBy sending the command exit, the program will delete itself from the target and kill its process

PS: From os documentation: If a symlink was used to start the process, depending on the operating system, the result might be the symlink or the path it pointed to. In this case the symlink is deleted. WorkFlowhttps://blogger.googleusercontent.com/img/a/AVvXsEhiiS4LsDVuTIsZxLUxn2kYyNbUoJUFLjeDGaChnspXZfkiQNmUtA5AmfxbUXcVRPR[...]

___________________________
@hacking_Attack
@Hacking_Video

yJXZchwLOWBIvazUbrMZgA_tNdoseStHrx9aZ3v5ULSry2ssV2mMDvFzrzqvStbXfe-hxYYt44-X1SjawNUc4n9KVTs4IXUnh2qWo87tYXIz71Gm-8NvpPDg8jQ=w640-h360 DemoDownload GC2-sheet

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Enterprises Allocating More IT Dollars on Cybersecurity

Enterprises are allocating more IT dollars towards implementing a multilayered approach to securing data and applications against new threats, data shows.

hacking: security in practice
sickOS v1.1 Walkthrough

I just published sickOS v1.1, check it out!!

https://medium.com/@sarangiprateek80/sickos-v1-1-e6e3ce9c99e2

submitted by /u/psarangi112
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe - Jr Penetration Tester

https://cdn-images-1.medium.com/max/600/1*qBueI4Upr5BTAWF98OZp2A.jpeg
“Hello, friend?” That’s lame. Maybe I should give you a name.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Welcome to alpha2phi!

https://cdn-images-1.medium.com/max/640/1*KU975Lb3cxiRIV1-b2p8oA.jpeg
All articles by category.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hacking a collge portal

My semester is fucked up and I need to know if it is even possible to hack a college portal like https://lms.uet.edu.pk/web/login or portal accounts of some teachers? Seen lots of people on reddit claim to do it but they seem scammy. What would be the best way to go about this by hiring a hacker?

submitted by /u/Sad_Narutard
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
anyway to get an ip address on recroom

little shits keep saying the n word

submitted by /u/Its_squidward
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
anyway to get someone’s exact location lol

please don’t down vote just curiou i know there are no actual ways but eh

submitted by /u/Its_squidward
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video