Road Map
pwnSpoof is built to produce to authentic web attack logs and it does this really well. Right now we are focused on refactoring the code, building out our testing suite (https://www.kitploit.com/search/label/Testing%20Suite) and getting the first push to PyPi but we have huge ambitions for pwnSpoof.
Coming soon
Adding extra webapps beyond banking to provide extra variety to the logsSocial mediaWordpressE-CommerceAdding additional and more dynamic web attacksFull OWASP TOP 10Customisable payload encodingMulti-session attacksObfuscation
Unscheduled aspirations
Training Videos!pwnSpoof was built to be a great tool for training the blue team (https://www.kitploit.com/search/label/Blue%20Team) so it only makes sense to produce some training materials to show it off.How to ingest logs in to various log analyser (Splunk, Elastic, Open Disto, Sentinel)How to use the power of REGEX to pivot around the dataNot just weblogsWe would love to see pwnSpoof generating all kinds of threat hunting logs such as Office365 audit logs for Sharepoint, Onedrive and AzureADBlackhat ArsenalWe have submitted pwnSpoof to Blackhat Arsenal for consideration and it would be AWESOME to demo it at Blackhat London this year (2021).Why not contact us with some extra ideas, or add to the project
Contact
Simon Gurney - simon.gurney@punksecurity.co.uk (mailto:simon.gurney@punksecurity.co.uk)Daniel Oates-Lee - daniel.oates-lee@punksecurity.co.uk (mailto:daniel.oates-lee@punksecurity.co.uk)
Credit
ip2location : We make use of the IP2Location LITE Country database to provide geographically relevant IP addresses.This product includes IP2Location LITE data available from https://lite.ip2location.com (https://lite.ip2location.com/)
Download Pwnspoof (https://github.com/punk-security/pwnspoof)
___________________________
@hacking_Attack
@Hacking_Video
pwnSpoof is built to produce to authentic web attack logs and it does this really well. Right now we are focused on refactoring the code, building out our testing suite (https://www.kitploit.com/search/label/Testing%20Suite) and getting the first push to PyPi but we have huge ambitions for pwnSpoof.
Coming soon
Adding extra webapps beyond banking to provide extra variety to the logsSocial mediaWordpressE-CommerceAdding additional and more dynamic web attacksFull OWASP TOP 10Customisable payload encodingMulti-session attacksObfuscation
Unscheduled aspirations
Training Videos!pwnSpoof was built to be a great tool for training the blue team (https://www.kitploit.com/search/label/Blue%20Team) so it only makes sense to produce some training materials to show it off.How to ingest logs in to various log analyser (Splunk, Elastic, Open Disto, Sentinel)How to use the power of REGEX to pivot around the dataNot just weblogsWe would love to see pwnSpoof generating all kinds of threat hunting logs such as Office365 audit logs for Sharepoint, Onedrive and AzureADBlackhat ArsenalWe have submitted pwnSpoof to Blackhat Arsenal for consideration and it would be AWESOME to demo it at Blackhat London this year (2021).Why not contact us with some extra ideas, or add to the project
Contact
Simon Gurney - simon.gurney@punksecurity.co.uk (mailto:simon.gurney@punksecurity.co.uk)Daniel Oates-Lee - daniel.oates-lee@punksecurity.co.uk (mailto:daniel.oates-lee@punksecurity.co.uk)
Credit
ip2location : We make use of the IP2Location LITE Country database to provide geographically relevant IP addresses.This product includes IP2Location LITE data available from https://lite.ip2location.com (https://lite.ip2location.com/)
Download Pwnspoof (https://github.com/punk-security/pwnspoof)
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
TIPS TO SECURE YOUR MOBILE PHONE
https://cdn-images-1.medium.com/max/693/1*z39s9138TKJNZAZ0rIWBig.png
1) KEEP YOUR PHONE LOCKED
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
TIPS TO SECURE YOUR MOBILE PHONE
https://cdn-images-1.medium.com/max/693/1*z39s9138TKJNZAZ0rIWBig.png
1) KEEP YOUR PHONE LOCKED
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
TIPS TO SECURE YOUR MOBILE PHONE
1) KEEP YOUR PHONE LOCKED
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Hacking Apple Security Report System
https://cdn-images-1.medium.com/max/1016/1*yT6mWqPzjW0n6NdJGD6lkw.png
Hacking apple security report system
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Hacking Apple Security Report System
https://cdn-images-1.medium.com/max/1016/1*yT6mWqPzjW0n6NdJGD6lkw.png
Hacking apple security report system
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Hacking Apple Security Report System
Hacking apple security report system
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Tryhackme: RootMe by ReddyyZ
https://cdn-images-1.medium.com/max/2600/0*61Gcw7bYXDMVbCtp
An easy box that showcases file upload vulnerability and basic privilege escalation methods.
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Tryhackme: RootMe by ReddyyZ
https://cdn-images-1.medium.com/max/2600/0*61Gcw7bYXDMVbCtp
An easy box that showcases file upload vulnerability and basic privilege escalation methods.
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
RootMe by ReddyyZ
An easy box that showcases file upload vulnerability and basic privilege escalation methods.
Hacking Apple Security Report System
Hacking apple security report systemContinue reading on Medium »
Read more...
Hacking apple security report systemContinue reading on Medium »
Read more...
hacking: security in practice
My school's servers and software are storing passwords in plain-text. How do I convince the school to update things?
Hey all,
Not sure if this is the right place to post but...
Our school has the default "admin" password on their servers which are being hosted from our school that I discovered by just looking at the devices connected to the school. After running a port scan I found out that they had random ports opened and when trying to log in with SSH the password admin with the username admin worked.
I checked with the wayback machine and the school's website didn't have an update since 2010. Even for 2010 standards the website sucked. Both technically and performance wise.
Our personal details (phone numbers, addresses, etc) are all stored on their webservers in plain-text, including our passwords from the school portals for our teachers and students.
After sending 4 emails to the school district's head I got no response. But I could see they read my email.
Does anyone has advice on how to tell the school to update their webservers and start securing things up?
submitted by /u/Racingteamsam
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
My school's servers and software are storing passwords in plain-text. How do I convince the school to update things?
Hey all,
Not sure if this is the right place to post but...
Our school has the default "admin" password on their servers which are being hosted from our school that I discovered by just looking at the devices connected to the school. After running a port scan I found out that they had random ports opened and when trying to log in with SSH the password admin with the username admin worked.
I checked with the wayback machine and the school's website didn't have an update since 2010. Even for 2010 standards the website sucked. Both technically and performance wise.
Our personal details (phone numbers, addresses, etc) are all stored on their webservers in plain-text, including our passwords from the school portals for our teachers and students.
After sending 4 emails to the school district's head I got no response. But I could see they read my email.
Does anyone has advice on how to tell the school to update their webservers and start securing things up?
submitted by /u/Racingteamsam
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
My school's servers and software are storing passwords in...
Hey all, Not sure if this is the right place to post but... Our school has the default "admin" password on their servers which are being hosted...
hacking: security in practice
Stolen iPhone
Hey guys, I have a bunch of questions and I'm surrounded by confusion.
Last night I came home from clubbing and I lost my phone in the early hours of the morning. I went to sleep because I thought I had left it at my friends house, then when I woke up I still couldn't find it. I went into the Find My application and noticed it pinged on my driveway in the early hours of the morning (way after I had gone to bed). So I knew it was probably outside somewhere. After looking for hours, I got a notification on my computer from my iPhone that was in French. My neighbours are French, so of course I went around there and pushed for my phone back.
To cut a long story short, after going to the police and filing it as stolen, they returned it. The neighbour who returned it said his friend took it. When I got it back, it was unlocked, the phone was in French and I have a few screenshots of them going through my phone and them trying to get into my Facebook.
My question is, how is this possible? I have a passcode and Face ID, I did not reset the phone and Face ID was somehow disabled by them. How were they able to get into my phone? I thought this stuff was near impossible now.
submitted by /u/PerthPilot
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Stolen iPhone
Hey guys, I have a bunch of questions and I'm surrounded by confusion.
Last night I came home from clubbing and I lost my phone in the early hours of the morning. I went to sleep because I thought I had left it at my friends house, then when I woke up I still couldn't find it. I went into the Find My application and noticed it pinged on my driveway in the early hours of the morning (way after I had gone to bed). So I knew it was probably outside somewhere. After looking for hours, I got a notification on my computer from my iPhone that was in French. My neighbours are French, so of course I went around there and pushed for my phone back.
To cut a long story short, after going to the police and filing it as stolen, they returned it. The neighbour who returned it said his friend took it. When I got it back, it was unlocked, the phone was in French and I have a few screenshots of them going through my phone and them trying to get into my Facebook.
My question is, how is this possible? I have a passcode and Face ID, I did not reset the phone and Face ID was somehow disabled by them. How were they able to get into my phone? I thought this stuff was near impossible now.
submitted by /u/PerthPilot
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Stolen iPhone
Hey guys, I have a bunch of questions and I'm surrounded by confusion. Last night I came home from clubbing and I lost my phone in the early...
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
'My hunt for the world's most wanted hackers'. BBC news goes in search of Maksim Yakubets and ‘Evil Corp’ living like millionaires in Russia.
https://external-preview.redd.it/F1bD7pg8HA3HnDGZ6_FEBIrJfNPw7E94Ur-VM-eWj7s.jpg?width=320&crop=smart&auto=webp&s=f492ac1a77c09eabf34ed016968d22d9602e3bc8 submitted by /u/tides977
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
'My hunt for the world's most wanted hackers'. BBC news goes in search of Maksim Yakubets and ‘Evil Corp’ living like millionaires in Russia.
https://external-preview.redd.it/F1bD7pg8HA3HnDGZ6_FEBIrJfNPw7E94Ur-VM-eWj7s.jpg?width=320&crop=smart&auto=webp&s=f492ac1a77c09eabf34ed016968d22d9602e3bc8 submitted by /u/tides977
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
'My hunt for the world's most wanted hackers'. BBC news goes in...
Posted in r/hacking by u/tides977 • 3 points and 0 comments
Peeping through a Web-Socket
https://cirius.medium.com/peeping-through-a-web-socket-936ed55a2c31?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://cirius.medium.com/peeping-through-a-web-socket-936ed55a2c31?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
Peeping through a Web-Socket
Recently, I had found a bug related to web sockets through which I was able to view all the messages being sent to the victim user.
Recently, I had found a bug related to web sockets through which I was able to view all the messages being sent to the victim user.Continue reading on Medium » (https://cirius.medium.com/peeping-through-a-web-socket-936ed55a2c31?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
Peeping through a Web-Socket
Recently, I had found a bug related to web sockets through which I was able to view all the messages being sent to the victim user.
Hacking Apple Security Report System
https://hackrzvijay.medium.com/hacking-apple-security-report-system-db84850002fb?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://hackrzvijay.medium.com/hacking-apple-security-report-system-db84850002fb?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
Hacking Apple Security Report System
Hacking apple security report system