hacking: security in practice
How is that possible ?

I was wondering. Why books about hacking are legal if with that knowledge you can do lots of harm ? Is that possible that books about hacking that are on the market are bullshit ? And real knowledge is prohibited ? Plz answer

submitted by /u/Iproman
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Arbswap Announces Testnet Launch and Bug Bounty Event

Arbswap is launching its testnet platform on the Arbitrum Network. This marks a huge milestone for the team and the community, who’ll be…Continue reading on Medium »
Read more...

What is an IDOR Vulnerability?

And How to Find One!Continue reading on Medium »
Read more...

Exploit Collector
CA Network Flow Analysis SQL Injection

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Android vold Unsafe Mounting

https://4.bp.blogspot.com/-dyIqvjR3K84/WWlvfXt5NkI/AAAAAAAAIQA/Fvmwfk3J4TgcxqdY3USv0_rN_ZW9VtW1ACLcBGAs/s1600/h85.png
Android's vold's incremental-fs APIs trust paths from system_server for mounting. There is supposed to be privilege separation between vold (TCB) and system_server (privileged process). However, vold's IPC handlers related to incremental-fs (mountIncFs, unmountIncFs, bindMount) allow system_server to specify semi-arbitrary paths, allowing system_server to trigger mounting on directories that shouldn't be under system_server control.

MD5 | 28fb6ce55ef07cbdb3ed3c6e2997f68d

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Learning pen testing as fast as possible
https://www.reddit.com/r/Pentesting/comments/r7bs2o/learning_pen_testing_as_fast_as_possible/

Pen testing something I have always wanted to do ever since I got into cyber security. Recently went for a junior role and realised I knew a decent amount of technical detail but miss some of the nuances and find detail that used pick up in the full time role. I have a solid cyber security background although it is in a security engineer role and I am wanting to move over to the red team side. My background; - Cyber security degree - Comptia Security + (through work) - Comptia Pentest + (upcoming this month at work) -AWS Technical training Could anyone help what is the best way to up my knowledge to the point of transitioning over in the next six months? (not for any exam I just learn better through intense periods of learning) Willing to do any amount of time a week to reach this goal. Any suggestions appreciated submitted by /u/NoRepresentative7731 (https://www.reddit.com/user/NoRepresentative7731)
[link] (https://www.reddit.com/r/Pentesting/comments/r7bs2o/learning_pen_testing_as_fast_as_possible/) [comments] (https://www.reddit.com/r/Pentesting/comments/r7bs2o/learning_pen_testing_as_fast_as_possible/)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Breaking the Black Mirror and Other Lessons From Day of Shecurity

Diversity brings more varied solutions to major challenges in cybersecurity, just as it does in every other industry.

Dark Reading: Attacks/Breaches
When Will a Cloud Infrastructure Heavyweight Launch a SASE?

There's been a veritable gold rush of security vendors getting into secure access service edge. Now will any of the major IaaS vendors enter the market? Rik Turner makes the case.

Dark Reading: Attacks/Breaches
Key Characteristics of Malicious Domains: Report

Newer top-level domains and certain hosting providers are frequent sources of malicious content, while newly registered domains and free SSL certificates are not any more likely than average to be risky, new research shows.

Kerberoast - Kerberoast Attack -Pure Python-

Kerberos attack toolkit -pure python- Install pip3 install kerberoast Prereqirements Python 3.6 See requirements.txt For the impatient IMPORTANT: the accepted target url formats for LDAP and Kerberos are the following : +://\:@/?= : +://\:@/?= Steps -with SSPI-: kerberoast auto Steps -SSPI not used-: Look for vulnerable users via LDAP kerberoast ldap all -o ldapenum Use ASREP roast against users in the ldapenum_asrep_users.txt file kerberoast asreproast -t ldapenum_asrep_users.txt Use SPN roast against users in the ldapenum_spn_users.txt file kerberoast spnroast -t ldapenum_spn_users.txt Crack SPN roast and ASPREP roast output with hashcat Commands ldap This command group is for enumerating potentially vulnerable users via LDAP. Command structure kerberoast ldap Type: It supports three types of users to be enumerated spn Enumerates users with servicePrincipalName attribute set. asrep Enumerates users with DONT_REQ_PREAUTH flag set in their UAC attribute. all Startes all the above mentioned enumerations. ldap_connection_url: Specifies the usercredential and the target server in the msldap url format (see help) options: -o: Output file base name brute This command is to perform username enumeration by brute-forcing the kerberos service with possible username candidates Command structure kerberoast brute realm: The kerberos realm usually looks like COMPANY.corp dc_ip: IP or hostname of the domain controller targets: Path to the file which contains the possible username candidates options: -o: Output file base name asreproast This command is to perform ASREProast attack Command structure kerberoast asreproast dc_ip: IP or hostname of the domain controller options: -r: Specifies the kerberos realm to be used. It overrides all other realm info. -o: Output file base name -t: Path to the file which contains the usernames to perform the attack on -u: Specifies the user to perform the attack on. Format is either or @ but in the first case, the -r option must be used to specify the realm spnroast This command is to perform SPNroast (AKA kerberoast) attack. Command structure kerberoast spnroast kerberos_connection_url: Specifies the usercredential and the target server in the kerberos URL format (see help) options: -r: Specifies the kerberos realm to be used. It overrides all other realm info. -o: Output file base name -t: Path to the file which contains the usernames to perform the attack on -u: Specifies the user to perform the attack on. Format is either or @ but in the first case, the -r option must be used to specify the realm Download Kerberoast
Read more...

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Binary exploitation

https://cdn-images-1.medium.com/max/1360/1*1J6HpE3ZD20fnzopBo0r4A.png
I admit im not the best at binary exploitation and this is a writeup for those who want to get somewhat started.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
FBI confiscó U$S 2,3m relacionado al ransomware REvil/Sodinokibi y Gandcrab

https://cdn-images-1.medium.com/max/1434/0*fIH8H0bWWY4sIPXu
PUBLICADO EN 2 DICIEMBRE, 2021 POR DPAB

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Error crítico en la biblioteca criptográfica NSS de Mozilla que potencialmente afecta a varios…

https://cdn-images-1.medium.com/max/1471/0*hSSbnXCphNLBMXyo
PUBLICADO EN 2 DICIEMBRE, 2021POR DPAB

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How does one attain hashes?

Hello,

​

I have read numerous articles on how to crack passwords and that's always done via hashes. Where does one even get hashes from? Wouldn't that require admin access inside a domain controller or website database to even get the hashes?

submitted by /u/Super-Indication4151
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is getting etc/passwd printed a vulnerability?

I was using a website which can be used to test and run Javascript snippets, I tried running nodejs with fs on it and was able to access the etc/passwd file. I was also able to run Linux commands like whoami and pwd. Would this be considered a vulnerability or is this normal?

submitted by /u/MdTaseen
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Crawpy - Yet Another Content Discovery Tool
http://www.kitploit.com/2021/12/crawpy-yet-another-content-discovery.html

___________________________
@hacking_Attack
@Hacking_Video