By default, STACS will output any findings in SARIF format directly to STDOUT and in order to keep things orderly, all log messages will be sent to STDERR. For more advanced use cases, a number of other volume mounts are provided. These allow the user to control the rule packs, ignore lists, and a cache directories to use.
PyPi
STACS can also be installed directly from Python's PyPi. This provides a stacs command which can then be used by developers to scan projects directly in their local development environments.STACS can be installed directly from PyPi using:pip install stacs
Please Note: The PyPi release of STACS does not come with any rules. These will also need to be cloned from the community rules repository (https://github.com/stacscan/stacs-rules)for STACS to work!
FAQ

Is there a hosted version of STACS?
Not yet. However, there are plans for a hosted version of STACS which can be easily integrated into existing build systems, and which contains additional prebuilt rule packs and ignore lists.
What do I do about false positives?
Unfortunately, false positives are an inevitable side effect during the detection of static credentials. If rules are too granular then rule maintenance becomes a burden and STACS may miss credentials. If rules are too coarse then STACS may generate too many false positives!In order to assist, STACS provides a number of tools to assist with reducing the number of false positives which make it into final reports.Primarily, STACS provides a mechanism which allows users to define composable ignore lists which allow a set of findings to be "ignored". These rules can be as coarse as ignoring all files based on a pattern, or as granular as a specific finding on a particular line of a file.This information is automatically propagated through into reports, so "ignored" findings will be marked as "suppressed" in SARIF output while also including the reason for the ignore in the output for tracking.
How do I view the results?
Currently, the only output format is SARIF v2.1.0. There are a number of viewers available which make this data easier to read, such as this great web based viewer from (https://microsoft.github.io/sarif-web-component/) Microsoft. An example of the findings from a Docker container image has been included below:

___________________________
@hacking_Attack
@Hacking_Video

The performance (https://www.kitploit.com/search/label/Performance) is really, really bad when running in Docker on macOS!
Unfortunately, this appears to be due to a limitation of Docker Desktop for Mac. I/O for bind mounts is really, really slow (https://github.com/docker/for-mac/issues/3677).

Download Stacs (https://github.com/stacscan/stacs)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Stacs - Static Token And Credential Scanner

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Misdirection 1: Vulnhub Walkthrough

https://cdn-images-1.medium.com/max/850/0*mLZwhwjtO015R6Ac.png
Makineyi indirebilirsiniz.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hola, soy Geoff. Robé todos tus NFT.

https://cdn-images-1.medium.com/max/2600/1*zTq72WPRLw395isFJis6UQ.png
“👋Hola, soy Geoff. Robé todos tus NFT” este es el título que puso 
Geoffrey Huntley en su repositorio de Github. Y con el que da a…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
WiFi Hacking Week Pt. 2 — Reconnaissance

https://cdn-images-1.medium.com/max/1200/1*8obgnsU6-20SaFL8WCIcjg.jpeg
This is the second part in a four (five?) part series on WiFi security and the dangers of not being aware of it. I would recommend reading…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Intigriti’s November XSS challenge: hacking with Maths and Vuejs. by pr0fessor.
https://medium.com/@pr0fessor/intigritis-november-xss-challenge-writeup-hacking-with-maths-and-vuejs-by-pr0fessor-d6f02902057?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Introduction:Continue reading on Medium » (https://medium.com/@pr0fessor/intigritis-november-xss-challenge-writeup-hacking-with-maths-and-vuejs-by-pr0fessor-d6f02902057?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Send back useful info

If I get a malicious file onto someone's computer, what's the best way to receive collected info? Email it back, store in a database, or what?

submitted by /u/theoryofbang
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Intigriti’s November XSS challenge: hacking with Maths and Vuejs. by pr0fessor.

Introduction:Continue reading on Medium »
Read more...

PAN Card Privacy Issue | Exposing Your Personal Information | Income Tax Department

Hey, Amazing Hackers! Again, Raidh Ĥere. This writeup is based on a vulnerability which leads to expose your personal information’s…Continue reading on InfoSec Write-ups »
Read more...

hacking: security in practice
File uploading -comment method not working?

Hey, so i've been testing uploading a .jpg file with a php command in the comment.

But when i upload it to the server it won't execute it i think?

But it's not like the server cleaned it, i downloaded the pic from the server and the comment data is still there, any reason it's not doing a reverse shell?

Perhaps it's just not executing code?

I'm using weeverly btw.

submitted by /u/HackerArgento
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Metasploit module OSX/local/persistence not working properly

Steps to reproduce

How'd you do it?

i used msf venom and made a payload with osx/x64/meterpreter/reverse_tcp

i ssh file transfered the file to my mac (test target) its running 10.14.6 made it an executable and ran it while running the listener and got the connection as seen below

screenshot

after i set the target to 1 being dumb i set the session to the correct session

then i ran it

and got (copied directly from terminal ) [!] SESSION may not be compatible with this module (incompatible session platform: osx) [] Started reverse TCP handler on 192.168.1.78:4444 [] Dropping backdoor executable... [-] Exploit aborted due to failure: unexpected-reply: Error dropping backdoor to /Users/brendonmac/Library/.TPXrxPfH/com.system.update [*] Exploit completed, but no session was created.

Expected behavior

a persistent reverse shell from my mac 10.14.6 to my kali virtual machine

Current behavior

[-] Exploit aborted due to failure: unexpected-reply: Error dropping backdoor to /Users/brendonmac/Library/.TPXrxPfH/com.system.update

and no session creater

Metasploit version

Framework: 6.1.4-dev Console : 6.1.4-dev

Additional Information

If your version is less than 5.0.96, please update to the latest version and ensure your issue is still present.

If the issue is encountered within msfconsole, please run the debug command using the instructions below. If the issue is encountered outisde msfconsole, or the issue causes msfconsole to crash on startup, please delete this section.

Start msfconsole Run the command set loglevel 3 Take the steps necessary recreate your issue Run the debug command Copy all the output below the ===8<===<===] Started reverse TCP handler on (my ip):4444 [] Dropping backdoor executable... [-] Exploit aborted due to failure: unexpected-reply: Error dropping backdoor to /Users/brendonmac/Library/.knPPXebK/com.system.update [*] Exploit completed, but no session was created.

submitted by /u/alotofquestionsforyk
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

[BugBounty] XSS with Markdown — Exploit & Fix on OpenSource

Finding and debugging Open Sources is a fun thing. It helps me improve my pentest and programming skills. And what’s more fun when it…Continue reading on Medium »
Read more...