Dark Reading: Attacks/Breaches
Phishing Attack Blends Spoofed Amazon Order and Fraudulent Customer Service Agents

It's the latest in a series of clever brand impersonation scams that use multiple vectors to lure victims.

Dark Reading: Attacks/Breaches
Coalfire Expands Application Security Vision With Major Upgrade to Application Security Platform, ThreadFix

ThreadFix v3.1 delivers fastest speed for AppSec automation and remediation.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Ripping Off the Blindfold: Illuminating OT Environments

A security tool that monitors OT devices can't disrupt operations. This is why the Self-Learning AI acts only on information obtained by passive monitoring of the network.

Dark Reading: Attacks/Breaches
API Security Issues Hinder Application Delivery

A new survey explains why nearly all organizations experience API security problems to varying degrees.

Dark Reading: Attacks/Breaches
US Offers $10M Reward For ID, Location of DarkSide Leadership

The State Department offers multimillion-dollar rewards for information related to the leaders and members involved in DarkSide ransomware.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
How Is Zero Trust Different From Traditional Security?

Unlike traditional security approaches, the zero-trust security model verifies a user's identity each and every time they need specific system access.

hacking: security in practice
How to capture jnlp traffic with Burp?

How to inspect/capture traffic with Burp if an application running on jnlp?

To start the app
javaws https://serverA:1234/path/fileB.jnlp
However, there is nothing on Burp when the app is launched.

Tried with Wireshark and I can see all the traffic.

Weird things is there's not much traffic on port 1234, but there are a lot of communication going to different servers as well on different port numbers.

When I downloaded the jnlp file with curl, it's actually a XML file with bunch of jar href tag.

However, I'm only getting 404 response when trying to access it.
$ curl -k https://serverA:1234/path/fileC.jar Error 404
1. How this kind of app works when all the file returns 404?
2. What is the right way to forward this kind traffic to Burp?

submitted by /u/w0lfcat
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Spoofing a "virtual" Bluetooth device to my phone

Is there existing software to spoof a Bluetooth device on an Android device?

So, Call of Duty mobile has a glitch where if you connect a Bluetooth XBOX/PS controller, you can then plug in a USB controller (ala Razer Kishi) and play away. If i can spoof a virtual Bluetooth Xbox controller, the game should theoretically see that the device it's looking for is present, and i should be able to just use my Kishi, so i don't have to purchase an extra controller for a game i only play occasionally.

submitted by /u/ClimbRunOm
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
is this legit or if not is there a legit one?

i was wondering if this discord token logger was real it attached to chrome and a discord video i think and took the token https://www.youtube.com/watch?v=d6CGRGhpRc0&ab_channel=smarticaim (if you need me to delete i can)

submitted by /u/killmeplease___25
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
I use TOR in Brave. Is it necessary to use a incognito distro like Tails?

submitted by /u/UsuarioDaInternet
[link] [comments]

Hacking on Medium
This is how I bypassed Cortex XDR

https://cdn-images-1.medium.com/max/754/1*wpTx5UE1_AfRJBw39bG9-A.png
First of all, let me introduce myself, my name is Omri Baso, I'm 24 years old from Israel and I'm a red teamer and security researcher…

Continue reading on Medium »

hacking: security in practice
Challenge: How to edit a on original video and produce clips without evidence of tampering?

The Gist:

How would you create 2 clips from an original video source file and make it seem that those 2 new clips are originally from the same recording device (iPhone) and not edited and post-produced in anyway.

Scenario:

If you have a 2 minute video straight from your phone (iOS), and you need to split and trim it to produce two 30 second clips from source, how would you do it so that the videos produce seems original unedited files recorded from your phone and no one could tell it came from a single source file?

Trimming and splitting it and using file naming conventions used by IOS on the new files is not enough because it is not all just in the file name, correct?

1. I understand there is META DATA that may leave clues - right? So can we edit/spoof the meta data to make it seem as if the file was written by iOS phone and not a computer or video editing software?
2. The modified and created dates of the files will be suspicious. Say the original video was taken sept 01, 2021 between 9:00 to 9:02AM, i assume we need to alter the modified / created dates to match the original source accurately, right? Is this possible?
3. Scrub any signatures or traces of the computer and editing software used to edit and produce the clips.

I assume these are the 3 factors that needs top be covered, right? Is there any other factors to consider?

​

submitted by /u/remivato69
[link] [comments]

Hacking on Medium
My story : How I get started in Cyber Security & How can you…

https://cdn-images-1.medium.com/max/600/1*NVII6KbY6kVnXp1sPzte2Q.jpeg
Hi readers, hope everyone’s doing fine and learning something continuously. It’s been a while since I published my last article on Nmap…

Continue reading on Medium »

hacking: security in practice
How to get into ethical hacking without an IT background?

Been a dj/ techy all my life. Looking to make a couole changes, any help??

submitted by /u/Heavy_Revolution2973
[link] [comments]

hacking: security in practice
Getting better on CTFs

Hello all.

I've recently been paying more attention to Windows boxes and gaining system access on Windows as Windows machines are one of my weaker points but I want to apply my question to any system.

How do you guys learn? What makes you better? Any tips? Are reading writeups okay if you struggle?

submitted by /u/kebabogenerolas
[link] [comments]