Hacking on Medium
OTP Bypass {step to step}

https://cdn-images-1.medium.com/max/900/1*-D0eLo1NNn4-Sx44N-qo1Q.jpeg
Learn how OTP can bypass and report it to company's to get bounty |

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Google Dork Series !!

I am Parshwa Bhavsar and I am starting new series of Google Dorks in which , I’ll mention some useful dorks.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The Roadmap to become an Ethical hacker

https://cdn-images-1.medium.com/max/1815/1*1fbaXSDe9h4Dtmy_ufQSWA.png
INTRODUCTION

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The curse of the p-value

https://cdn-images-1.medium.com/max/2500/0*M44NayJzFmq8pqB1
For decades, the quality of statistical results has been measured using the p-value.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

4-ZERO-3 - 403/401 Bypass Methods + Bash Automation

>_ Introduction 4-ZERO-3 Tool to bypass 403/401. This script contain all the possible techniques to do the same. NOTE : If you see multiple 200 Ok/bypasses as output, you must check the Content-Length. If the content-length is same for multiple 200 Ok/bypasses means false positive. Reason can be "301/302" or "../" Payload DON'T PANIC. Script will print cURL PAYLOAD if possible bypass found. >_ Preview >_ Help root@me_dheeraj:$ bash 403-bypass.sh -h >_ Usage / Modes Scan with specific payloads: --header Support HEADER based bypasses/payloads root@me_dheeraj:$ bash 403-bypass.sh -u https://target.com/secret --header --protocol Support PROTOCOL based bypasses/payloads root@me_dheeraj:$ bash 403-bypass.sh -u https://target.com/secret --protocol --port Support PORT based bypasses/payloads root@me_dheeraj:$ bash 403-bypass.sh -u https://target.com/secret --port --HTTPmethod Support HTTP Method based bypasses/payloads root@me_dheeraj:$ bash 403-bypass.sh -u https://target.com/secret --HTTPmethod --encode Support URL Encoded bypasses/payloads root@me_dheeraj:$ bash 403-bypass.sh -u https://target.com/secret --encode --SQLi Support MySQL mod_Security & libinjection bypasses/payloads \*\* New \*\* root@me_dheeraj:$ bash 403-bypass.sh -u https://target.com/secret --SQLi Complete Scan {includes all exploits/payloads} for an endpoint --exploit root@me_dheeraj:$ bash 403-bypass.sh -u https://target.com/secret --exploit Prerequisites apt install curl DebianDownload 4-ZERO-3
Read more...

___________________________
@hacking_Attack
@Hacking_Video

Unknown Process Running Express Server on port 49670
https://www.reddit.com/r/Pentesting/comments/r43gjp/unknown_process_running_express_server_on_port/

I found a node process running in Activity Monitor. It has the following files open cwd / txt HOME/.nvm/versions/node/v16.6.2/bin/node txt /usr/lib/dyld 0 ->0xa2975ade53f9c9ca 1 . . . 20 /dev/null 21 localhost:49670 It's parent process is java (880) which in turn was started by Code Helper (Renderer) which I think is Microsoft's visual studio. I scanned port 49670 with service discovery and got this PORT STATE SERVICE VERSION 49670/tcp open http Node.js Express framework |_http-title: Error Never noticed this process and curios if I should be worried about this or not, thanks :) submitted by /u/nova_outis (https://www.reddit.com/user/nova_outis)
[link] (https://www.reddit.com/r/Pentesting/comments/r43gjp/unknown_process_running_express_server_on_port/) [comments] (https://www.reddit.com/r/Pentesting/comments/r43gjp/unknown_process_running_express_server_on_port/)

___________________________
@hacking_Attack
@Hacking_Video

4-ZERO-3 - 403/401 Bypass Methods + Bash Automation
http://www.kitploit.com/2021/11/4-zero-3-403401-bypass-methods-bash.html

___________________________
@hacking_Attack
@Hacking_Video

>_ Introduction 4-ZERO-3 Tool to bypass 403/401. This script contain all the possible techniques to do the same. NOTE : If you see multiple [200 Ok]/bypasses as output, you must check the Content-Length. If the content-length is same for multiple [200 Ok]/bypasses means false positive. Reason can be "301/302" or "../" [Payload] DON'T PANIC. Script will print cURL PAYLOAD if possible bypass found.
>_ Preview

___________________________
@hacking_Attack
@Hacking_Video

>_ Help root@me_dheeraj:$ bash 403-bypass.sh -h

___________________________
@hacking_Attack
@Hacking_Video

>_ Usage / Modes Scan with specific payloads: [ --header ] Support HEADER based bypasses/payloads root@me_dheeraj:$ bash 403-bypass.sh -u https://target.com/secret --header [ --protocol ] Support PROTOCOL based bypasses/payloads root@me_dheeraj:$ bash 403-bypass.sh -u https://target.com/secret --protocol [ --port ] Support PORT based bypasses/payloads root@me_dheeraj:$ bash 403-bypass.sh -u https://target.com/secret --port [ --HTTPmethod ] Support HTTP Method based bypasses/payloads root@me_dheeraj:$ bash 403-bypass.sh -u https://target.com/secret --HTTPmethod [ --encode ] Support URL Encoded bypasses/payloads root@me_dheeraj:$ bash 403-bypass.sh -u https://target.com/secret --encode [ --SQLi ] Support MySQL (https://www.kitploit.com/search/label/MySQL) mod_Security & libinjection (https://www.kitploit.com/search/label/Libinjection) bypasses/payloads [** New **] root@me_dheeraj:$ bash 403-bypass.sh -u https://target.com/secret --SQLi Complete Scan (https://www.kitploit.com/search/label/Scan) {includes all exploits/payloads} for an endpoint [ --exploit ] root@me_dheeraj:$ bash 403-bypass.sh -u https://target.com/secret --exploit Prerequisites apt install curl [Debian]

Download 4-ZERO-3 (https://github.com/Dheerajmadhukar/4-ZERO-3)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
I keep getting emails stating that there was unusual sign in activities on my Microsoft account. I was skeptical at first, but now I have reason to believe the worst. Have I been "hacked"?

I've actually been receiving these emails for quite some time now, but ignored them because I thought it was phishing, or whatever. The emails look to have came from the same email address: ACCOUNT-SECURITY-NOREPLY@ACCOUNTPROTECTION.MICROSOFT(.)COM. I don't ever recall making a Microsoft account, unless it was something I needed to do when I first got my laptop and I just don't remember? I decided to go straight to the Microsoft log-in web page at login.live.com and reset my password. After password reset, I went to "recent activity" and saw that there were indeed multiple recent activities made onto the account within the past month or so, which includes: multiple unusual activity detected, multiple successful sign ins from different countries, automatic sync....like wtf? Countries ranging from the UK to Nepal to the Netherland, back to the U.S. So, what does all of this mean? Where do I go from here? What else do I need to do? I've already reset my password, as I said. Does this also mean my laptop has been hacked? I know that sounds like a silly question, but now I'm paranoid and anxious, unfortunately. I see the words "successful sign in" and "automatic sync" and makes me believe that these people (or person) were able to see my personal info and everything I was doing....

submitted by /u/wutevs-
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Directory Traversal nedir?,Nasıl bulunur?,Web Security Academyden directory traversal lab çözümü.
https://mirabbasagalarov.medium.com/directory-traversal-nedir-nas%C4%B1l-bulunur-web-security-academyden-directory-traversal-lab-%C3%A7%C3%B6z%C3%BCm%C3%BC-f25244e562bb?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Directory Traversal nedir?Continue reading on Medium » (https://mirabbasagalarov.medium.com/directory-traversal-nedir-nas%C4%B1l-bulunur-web-security-academyden-directory-traversal-lab-%C3%A7%C3%B6z%C3%BCm%C3%BC-f25244e562bb?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video