Dark Reading: Attacks/Breaches
Understanding the Human Communications Attack Surface

Companies should recognize that collaboration platforms aren't isolated, secure channels where traditional threats don't exist.

hacking: security in practice
Modern browser without any client-side security protection for pentesting?

Hello!

In the last few pentests I've been doing, I've run into an issue with website being probably vulnerable to things like CSRF or XSS, but the vulnerability was prevented by browser security mechanism of all modern browsers (SameSite cookies, anti-XSS protection etc). This has raised a discussion inside our team, if it's something that should be reported (I think it definitely is), and more importantly how to test it. I think vulnerabilities that are present in the application, but prevented by modern browsers should be reported (with severity reflecting such fact), because otherwise you're pentesting the browser and not the application. (And it's only a matter of time before someone gets hacked because an admin used wget or elinks).

However, it is something that's hard to test for. It's no always feasible to keep pentesting such issues in MS Explorer, mostly because websites tend to not work properly (or at all) when accessed using such an old browser. And when pentesting with modern browsers, it's getting harder and harder to be sure whether there is some new browser security feature that prevented the attack, or whether the website is not vulnerable. Which leads me to my question, and a whole reason of this post:

Is there any modern browser fork/config file that does not implement any standards with security in mind (so, no cross-origin blocking, SameSite cookies by default, XSS-Protection etc), but still reliably works in place of a modern browser? I feel like this should be really useful tool for pentesting, and would make reports a lot clearer and issues easier to reproduce. I know that this could be done simply by using intercepting proxy/directly sending requests i.e by Burp, but that can get pretty cubersome when dealing with multi-step workflow, viewstates and who-knows what else, which is where a simple browser would shine.

submitted by /u/Mikina
[link] [comments]

hacking: security in practice
Free sources for Hacking (Posting my comment that had so many upvotes)

​

here’s some resources that I’ve come across which might come in handy along the way.

Ahm, First try to go for the basics and fundementals of cyber security including but not limited to Linux Basics , Bash Basics , Python basics , Information Gathering , Enumeration , Vulnerability scanning , Social Engineering. Take a look at these websites : https://null-byte.wonderhowto.com/ https://overthewire.org/wargames/ https://underthewire.tech/wargames https://www.hackthebox.eu/ https://tryhackme.com/ https://ctftime.org/ https://zsecurity.org/ https://portswigger.net/web-security/ https://portswigger.net/blog/flying-high-in-the-web-security-academy https://owasp.org/www-project-juice-shop/ https://ippsec.rocks/?# https://ohmygit.org/ https://www.bugbountyhunter.com/ https://www.hacker101.com/ https://www.hacksplaining.com/ https://www.hackerrank.com/domains/shell

And Blogs Like : https://www.simplycyber.io/free-cyber-resources https://blog.g0tmi1k.com/ https://www.hackingarticles.in/ https://blog.tryhackme.com/free_path/ https://www.freecodecamp.org/news/what-is-git-learn-git-version-control/ https://www.hackingtutorials.org/ https://www.hacking-tutorial.com/ https://hacklido.com/d/85-collection-of-resources-for-oscp

This is an amazing resource, take some time to go through this https://www.netsecfocus.com/oscp/2021/05/06/The_Journey_to_Try_Harder-_TJnull-s_Preparation_Guide_for_PEN-200_PWK_OSCP_2.0.html

There’s also some books you can read to improve your understanding of certain topics

The Linux Command Line (2nd Edition): https://nostarch.com/tlcl2

Linux for Hackers: https://nostarch.com/linuxbasicsforhackers

Linux Command (Learning the Shell): http://linuxcommand.org/lc3_learning_the_shell.php

and there much more that i don't remember you have to keep searching and looking. Remember googling is a skill you’re going to have to get good at

Youtube Channels like ;

Pwnfunction

zSecurity

HackerSploit

nullbyte

CSECTutorials

LiveOverFlow

Jhon Hammond

NetworkChuck

The cyber mentor

Ippsec

Insiderphd

David bomball

Alhz4r3d

There are also discord servers for various hacking communities where you can join and ask people for advice

Here’s some I’m a part of

the cyber mentor

infosec prep

certification station

network Chuck

nahmsec

bounty hunters

The Alh4z-R3d Team

hack the box

tryhackme

hack this site

PG (proving grounds)

Getting started in security

INE Unofficial server

Offsec official server

ctf learn

submitted by /u/QuenzoO [link] [comments]

hacking: security in practice
Is it possible for my to see through a censored email when requesting a “forgot your password” on a site?

THIS IS MY EMAIL, I’m not trying to get into someone’s account. Sorry if this is the wrong sub, I have no idea about these things, but I was wondering if it would be possible for me to figure out what an email is from an old account on Wattpad.

I completely forgot the email as this was years ago, but I remember the username.

When I click “forgot my password” using the username, it gives me the email partially, only like the first two letters. Is there any way I could like, unlock the rest of the letters using inspect element or something?

If this isn’t the right sub for this, could someone point me to where this would be a more appropriate question?

submitted by /u/Akanni369
[link] [comments]

hacking: security in practice
Are there any apps that can help me prepare for the OSCP?

I'm a uni student and I plan on taking the OSCP after I graduate next May. I've deleted all of my social media apps (except reddit of course) and I'm trying to find mobile resources that can help me prepare for the cert. I just got a subscription to hack the box premium and have begun that.

During work most days in IT help desk, I'll be moving around the building where bringing a laptop with me everywhere isn't that feasible. But there will be a lot of downtime. Instead of mindlessly flipping through social media apps, I want to prepare for the exam somehow through my phone. Are there any apps or resources you'd suggest? Thanks

submitted by /u/jet_set_default
[link] [comments]

hacking: security in practice
Is there any cryptocurrency about cybersecurity?

I know this sub is not about cryptocurrency but is the best one to ask about, right?

submitted by /u/Marcus_Aguiar
[link] [comments]

hacking: security in practice
SHA1 from SHA512?

Hello! I just wanted to know, is possible to get the SHA1 equivilant of a file, if you have SHA512 of it? I don't have the original file, just the SHA512 hash of it, and I would like to know the SHA1 of it.

I guess this is not strictly "hacking" but I'm not sure where else I ask, and I expect you guys would be knowledgable about cryptography! :)))

submitted by /u/CustomSparkles
[link] [comments]

Hacking on Medium
DC-3 Vm Walkthrough

https://cdn-images-1.medium.com/max/600/0*FPyddCIT5wiRLm7s.png
Makineyi indirebilirsiniz.

Continue reading on Medium »

Hacking on Medium
Born2Root2 VM Walkthrough

https://cdn-images-1.medium.com/max/600/0*Z7_SqJMfHMpGxEf4.png
Makineyi indirebilirsiniz.

Continue reading on Medium »

Hacking on Medium
PumpkinGarden VM Walkthrough

https://cdn-images-1.medium.com/max/600/0*BTZK_h4-E22_SW9I.png
Makineyi indirebilirsiniz.

Continue reading on Medium »

Hacking on Medium
PumpkinFestival VM Walkthruogh

https://cdn-images-1.medium.com/max/600/0*RlQ2WhHRFPc_GcZo.png
Makineyi indirebilirsiniz.

Continue reading on Medium »