Hacking Articles Tips Tricks Videos Tutorials

Halo, perkenalkan nama saya Salman Rai Apriliana. Pada kesempatan kali ini saya ingin membagikan temuan celah Stored XSS di web…

Stored XSS In Cari Kos

9 viewsedited 04:48

7 views04:48

Halo, perkenalkan nama saya Salman Rai Apriliana. Pada kesempatan kali ini saya ingin membagikan temuan celah Stored XSS di web…Continue reading on Medium » (https://imhecate1337.medium.com/stored-xss-in-cari-kos-com-a615f8bd8057?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Halo, perkenalkan nama saya Salman Rai Apriliana. Pada kesempatan kali ini saya ingin membagikan temuan celah Stored XSS di web…

Stored XSS In Cari Kos

7 viewsedited 04:48

I got in an argument and posted a grabify link for the first time for me and things started flooding in like a view a secound I check everything...

hacking: security in practice
Yall I feel bad

I got in an argument and posted a grabify link for the first time for me and things started flooding in like a view a secound I check everything and it's the same guy that keeps getting redirected to his own Twitter page

submitted by /u/JaysonAnimations
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Yall I feel bad

8 viewsedited 05:31

Do I need a VPN when I’m using tails?

Deep Web
Do I need a VPN when I’m using tails?

submitted by /u/gvnsvn
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Posted in r/deepweb by u/gvnsvn • 1 point and 1 comment

10 viewsedited 05:44

Posted in r/deepweb by u/XAZAY • 0 points and 0 comments

Deep Web
Dɛɛpwɛв

https://external-preview.redd.it/Ev9MYaozaebPQE5-4ba-_RRTlhSUQF015ptadiUFIvU.jpg?width=320&crop=smart&auto=webp&s=348e396d32e93fd2b72bfe4ec318cb6555046aaf submitted by /u/XAZAY
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dɛɛpwɛв

10 viewsedited 05:44

10 views05:46

Hacking on Medium
PWNING Mr. Robot

https://cdn-images-1.medium.com/max/1280/1*dzjMgBa9GBhNY9TlDmBXcg.png
This is a walkthrough for the Mr. Robot CTF machine on TryHackMe. I am using Kali Linux, however, the TryHackMe Attack Box has the tools I…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

This is a walkthrough for the Mr. Robot CTF machine on TryHackMe. I am using Kali Linux, however, the TryHackMe Attack Box has the tools I…

PWNING Mr. Robot

15 viewsedited 05:47

13 views09:31

Free CompTIA Security+ (SY0-601) Self-study Resources with PBQs

hacking: security in practice
Free CompTIA Security+ (SY0-601) Self-study Resources with PBQs

Hi Hacking community,

We have new updates and fixes on the CompTIA Security+ (SY0-601) path, which you might find useful.
It's absolutely free to enroll.

https://examsdigest.com/comptia-learning-path/

Changelog.
[improve] Domain 2.0 Architecture and Design
[improve] Domain 3.0 Operations and Incident Response
[add] Performance-based questions

Happy learning,

Anastasia

submitted by /u/Anastasia_IT
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hi Hacking community, We have new updates and fixes on the **CompTIA Security+ (SY0-601)** path, which you might find useful. ***It's...

13 viewsedited 09:31

10 views09:47

Hacking on Medium
TryHackMe Alfred Writeup/Walkthrough

https://cdn-images-1.medium.com/max/1146/1*831yQqVjl-6CF5N2cKYTAQ.png
Hello and welcome to my Alfred walkthrough. This TryHackMe room has plenty of interesting content to cover and provides some solid…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

TryHackMe Alfred Writeup/Walkthrough

Hello and welcome to my Alfred walkthrough. This TryHackMe room has plenty of interesting content to cover and provides some solid practice…

10 viewsedited 09:47

12 views10:50

Black Hat Ethical Hacking

Black Hat Ethical Hacking
‘Trojan Source’ attack method can hide bugs into open-source code

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png ‘Trojan Source’ attack method can hide bugs into open-source codePost Views: 134
Reading Time: 2 Minutes
Academic researchers have released details about a new attack method they call “Trojan Source” that allows injecting vulnerabilities into the source code of a software project in a way that human reviewers can’t detect.
Trojan Source relies on a simple trick that does not require modifying the compiler to create vulnerable binaries.

The method works with some of the most widely used programming languages today and adversaries could use it for supply-chain attacks. Abusing text-encoding standardsResearchers from the University of Cambridge, United Kingdom, disclosed and demonstrated the “Trojan Source” class of attacks that could compromise first-party software and supply chains.

The examples they provide are for projects written in C, C++, C#, JavaScript, Java, Rust, Go, and Python where an attacker can target the encoding of source code files to inject vulnerabilities.

“The trick is to use Unicode control characters to reorder tokens in source code at the encoding level,” reveals Nicholas Boucher, one of the researchers that discovered Trojan Source.

“We have discovered ways of manipulating the encoding of source code files so that human viewers and compilers see different logic. One particularly pernicious method uses Unicode directionality override characters to display code as an anagram of its true logic,” explains Ross Anderson, the other researcher behind testing the Trojan Source attack method.
See Also: Complete Offensive Security and Ethical Hacking Course
By using control characters embedded in comments and strings, a threat actor can reorder the source code to change its logic in a way that creates an exploitable vulnerability. Bidirectional and homoglyph attackThe researchers showed that one way this can be achieved is by using Unicode controls for bidirectional text (e.g. LRI -left-to-right isolate, and RLI -right-to-left isolate) to dictate the direction in which the content is displayed. This method is now tracked as CVE-2021-42574.

The bidirectional (Bidi) controls LRI and RLI are invisible characters, and they are not the only ones. By injecting these instructions, a compiler can compile code that is completely different from what a human sees.

In the image below, using the RLI/RLI controls inside the string the second line is compiled while the human eye reads it as a comment that the compiler would ignore.
https://www.bleepstatic.com/images/news/u/1100723/2021/TrojanSourceAttack02.jpg
A destructive infectionThis particular variant of the Chaos Ransomware is configured to search the infected systems for different file types smaller than 2ΜΒ and encrypts them.

However, if the file is larger than 2MB is will inject random bytes into the files, making them unrecoverable even if a ransom is paid.

Due to the destructive nature of the attack, those who pay the[...]

___________________________
@hacking_Attack
@Hacking_Video

‘Trojan Source’ attack method can hide bugs into open-source code | Black Hat Ethical Hacking

Academic researchers have released details about a new attack method they call “Trojan Source” that allows injecting vulnerabilities into the source code of a software project in a way that human reviewers can’t detect.

16 viewsedited 10:50

Black Hat Ethical Hacking ‘Trojan Source’ attack method can hide bugs into open-source code https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png ‘Trojan Source’ attack method can hide bugs into open-source codePost Views:…

ransom can only recover smaller files.

The reason for this functionality is unclear, and it could be caused by poor coding, incorrect configuration, or to damage gamers’ files purposely.

In this particular campaign, the threat actors are promoting text files to create a false sense of security while swapping them out in the end with executables.
See Also: Offensive Security Tool: ZipExec In a homoglyph Trojan Source attack as exemplified below, the human eye will see both functions identical, while the compiler distinguishes between the Latin “H” and the Cyrillic “H” and treats the code as having two different functions, so the outcome will not be the same.
https://www.bleepstatic.com/images/news/u/1100723/2021/TrojanSourceAttack_03.jpg
In a paper [PDF] detailing the new Trojan Source attack method, the researchers highlight that the bidirectional (Bidi) override characters persist through copy/paste action on most browsers, editors, and operating systems.

The researchers tested the Trojan Source attack against multiple code editors and web-based repositories that are commonly used in programming and found that their method worked on many of them.
https://www.bleepstatic.com/images/news/u/1100723/2021/TrojanSourceAttack.jpg
Following the principle of using Bidi overrides to create code that is valid when reordered, the researchers found at least three techniques that allow exploiting of the source code:

* Early Returns – hide a genuine ‘return’ statement in a comment so that it can cause a function to return earlier than it appears to
* Commenting Out – trick human review by placing important code, such as a conditional, in a comment so that it is disregarded by the compiler or the interpreter
* Stretched Strings – reverse-order the code to make it seem to be outside a string literal

One way to defend against Trojan Source is to reject the use of control characters for text directionality in language specifications and in compilers that implement the languages.
See Also: Hacking stories – Operation Troy – How researchers linked the cyberattacks Coordintated disclosureOn July 25, the researchers informed multiple maintainers of products found to be impacted by the Trojan Source attack method and set a 99-day embargoed disclosure period.

The CERT Coordination Center also received a vulnerability report and assisted with the coordintated disclosure by providing a shared communication platform for vendors implementing defenses.

Following their report, the researchers received an average of $2,246 in bug bounties from five of the recipients, although 11 of them had a bug bounty program.

At the moment, multiple compilers are unable to stop the Trojan Source attack method, despite almost two dozen software suppliers being aware of the threat.

Since many maintainers are still to implement a patch, the two researchers recommend governments and companies identify their suppliers and pressure them into adopting the necessary defenses.
“The fact that the Trojan Source vulnerability affects almost all computer languages makes it a rare opportunity for a system-wide and ecologically valid cross-platform and crossvendor comparison of responses”
The researchers added that three companies that maintain code repositories are currently deploying defenses against Trojan Source.

In a repository on GitHub, they provide proof-of-concept (PoC) scripts that demonstrates how much of a threat the Trojan Source attack can be.
Source: www.bleepingcomputer.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.com-gif-maker-4-90x90.jpg Chaos ransomware targets gamers via fake Minecraft alt lists1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/microsoft-zero-day-vulnerabilities-800x358-1-90x90.png All Windows versions impacted by new LPE zero-day vulnerability4 days ago
* https://www.bl[...]

___________________________
@hacking_Attack
@Hacking_Video

13 viewsedited 10:50