Hacking Articles Tips Tricks Videos Tutorials
hacking: security in practice Is there a way to decrypt this log file? This is the log file text, does anyone know how to decrypt it or read it for what it is? ZjbikSF1l5Jse0NcDPf/PNe1SYpT/28np1wjeCLk62tHLyOC+kckySFEeR5pbnPJZPuFNkK9oVnGSCJZ92uuirx2QDhG…
1cI5TNsXK0AaH6056CnKjh3enjBCEEI+ejC20rNu3iejNYlJ31ppz4o1NyW/gCjlkpwHIO3rD/yaddWh6GKkxIz5+RAqXyPM6OIX9Z7bhXXWFxFK8Oe7QSgDHCJo/JNI863cvSXVgsB4Qod9W2QFqVcbogiWkIUnYLfy0iogVYQ41GSClviBZvy3iSsiDIojRZvpvF3Q4MRREiN0FaoUa4w0cvabW3YwkFcoKh6Qk8HIGkbRIDmqGdwkiiUMINZcZLH9OU58p7T9ljB+tHn/ed4qp2VE4XIK3U5sE5NRqNAIKzUUFvQcN0TuU3J00A0rZp2Pas9Z3bfKzQLmhTTxueB3/7C9SjhRIiJcUmHc/OSY0D2swF4rEGju5UAXKVPHjSxoeGbm2B0dvaf+7n45A+bFmjNk6
+df32p4tVImgIWHm5xtVLBXJPRqQ4aCH6XZ3KHyFKzosIhzL8u4LPMJ3njJoLQhR2JKug+v5KxKzJaLLdnXaz32F+QtqUY1liGUHeGmkI+k=
submitted by /u/juastin [link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
+df32p4tVImgIWHm5xtVLBXJPRqQ4aCH6XZ3KHyFKzosIhzL8u4LPMJ3njJoLQhR2JKug+v5KxKzJaLLdnXaz32F+QtqUY1liGUHeGmkI+k=
submitted by /u/juastin [link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
hacking: security in practice
Are there any tools in kali linux that can be used the identify the front and back end langauges used for a website
I'm a student and I was given an assignment to find out vulnerabilities of a website. One of the task was to find the front and back end langauges used and also the database. Do I have to manually check by opening the website or is there any tool for it?
submitted by /u/djsyj777
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Are there any tools in kali linux that can be used the identify the front and back end langauges used for a website
I'm a student and I was given an assignment to find out vulnerabilities of a website. One of the task was to find the front and back end langauges used and also the database. Do I have to manually check by opening the website or is there any tool for it?
submitted by /u/djsyj777
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Are there any tools in kali linux that can be used the identify...
I'm a student and I was given an assignment to find out vulnerabilities of a website. One of the task was to find the front and back end langauges...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Black Hat Ethical Hacking
Apache Kafka Cloud Clusters Expose Sensitive Data for Large Companies
https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Apache Kafka Cloud Clusters Expose Sensitive Data for Large CompaniesPost Views: 81 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 2 Minutes
The culprit is misconfigured Kafdrop interfaces, used for centralized management of the open-source platform.
Some of the world’s largest companies have exposed reams of sensitive information from the cloud, researchers said – thanks to misconfigured Kafdrop instances.
Kafdrop is a management interface for Apache Kafka, which is an open-source, cloud-native platform for collecting, analyzing, storing and managing data streams. Kafka has several common use cases; for instance, in the finance sector it’s often used for real-time data processing in order to catch and block fraudulent transactions as they occur. It the internet of things world, it can support “just-in-time” resource allocation for smart-grid applications and the like. Other uses include tracking application activity (user clicks, registrations, time spent on certain pages or features, orders, etc.); and event logging or real-time monitoring.
We want to know what your biggest cloud security concerns and challenges are, and how your company is dealing with them. Weigh in with our exclusive, anonymous Threatpost Poll!
Kafka is tailored for large companies, and is in use by 60 percent of the Fortune 100, it says, including Box, Cisco, Goldman Sachs, Intuit, Target and others, plus eight of 10 of the world’s largest banks, the 10 largest global insurance companies and eight of the 10 key world telecom providers, among thousands of others. https://media.threatpost.com/wp-content/uploads/sites/103/2021/12/06110345/Kafka-use-cases-1024x503.png Apache Kafka use cases. Source: Spectral.
See Also: Complete Offensive Security and Ethical Hacking Course As such, a vulnerable or exposed management tool for the platform makes for “a perfect target for attackers who can infiltrate and exfiltrate data and take over cluster management,” according to researchers at Spectral. Kafdrop: A Central Hub and TargetOne such “perfect target” is Kafdrop, a popular open-source user interface that can be deployed as a Docker container.
It connects and maps existing Kafka clusters automatically, Spectral researchers explained, allowing users to manage topic creation and removal, as well as “understand the topology and layout of a cluster, drilling into hosts, topics, partitions, and consumers. It also allows you to sample and download live data from all topics and partitions, acting as a legitimate Kafka consumer.”
Unfortunately, Spectral researchers also discovered multiple instances of misconfigured Kafdrop interfaces exposing complete Kafka clusters to the public internet.
“These clusters expose customer data, transactions, medical records and internal system traffic: providing an inside look into the complete nervous system, all public,” according to the firm’s analysis, released Monday. “We found exposed clusters from companies across a multitude of industries, including insurance, healthcare, IoT, media and social networks.”
Researchers added, “Also exposed was real-time traffic revealing secrets, authentication tokens, and other access details that allow hackers to infiltrate the companies’ cloud activities on AWS, IBM, Oracle and others.”
See Also: New Windows zero-day with public exploit lets you become an admin They warned that the impact on affected companies could be sig[...]
___________________________
@hacking_Attack
@Hacking_Video
Apache Kafka Cloud Clusters Expose Sensitive Data for Large Companies
https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Apache Kafka Cloud Clusters Expose Sensitive Data for Large CompaniesPost Views: 81 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 2 Minutes
The culprit is misconfigured Kafdrop interfaces, used for centralized management of the open-source platform.
Some of the world’s largest companies have exposed reams of sensitive information from the cloud, researchers said – thanks to misconfigured Kafdrop instances.
Kafdrop is a management interface for Apache Kafka, which is an open-source, cloud-native platform for collecting, analyzing, storing and managing data streams. Kafka has several common use cases; for instance, in the finance sector it’s often used for real-time data processing in order to catch and block fraudulent transactions as they occur. It the internet of things world, it can support “just-in-time” resource allocation for smart-grid applications and the like. Other uses include tracking application activity (user clicks, registrations, time spent on certain pages or features, orders, etc.); and event logging or real-time monitoring.
We want to know what your biggest cloud security concerns and challenges are, and how your company is dealing with them. Weigh in with our exclusive, anonymous Threatpost Poll!
Kafka is tailored for large companies, and is in use by 60 percent of the Fortune 100, it says, including Box, Cisco, Goldman Sachs, Intuit, Target and others, plus eight of 10 of the world’s largest banks, the 10 largest global insurance companies and eight of the 10 key world telecom providers, among thousands of others. https://media.threatpost.com/wp-content/uploads/sites/103/2021/12/06110345/Kafka-use-cases-1024x503.png Apache Kafka use cases. Source: Spectral.
See Also: Complete Offensive Security and Ethical Hacking Course As such, a vulnerable or exposed management tool for the platform makes for “a perfect target for attackers who can infiltrate and exfiltrate data and take over cluster management,” according to researchers at Spectral. Kafdrop: A Central Hub and TargetOne such “perfect target” is Kafdrop, a popular open-source user interface that can be deployed as a Docker container.
It connects and maps existing Kafka clusters automatically, Spectral researchers explained, allowing users to manage topic creation and removal, as well as “understand the topology and layout of a cluster, drilling into hosts, topics, partitions, and consumers. It also allows you to sample and download live data from all topics and partitions, acting as a legitimate Kafka consumer.”
Unfortunately, Spectral researchers also discovered multiple instances of misconfigured Kafdrop interfaces exposing complete Kafka clusters to the public internet.
“These clusters expose customer data, transactions, medical records and internal system traffic: providing an inside look into the complete nervous system, all public,” according to the firm’s analysis, released Monday. “We found exposed clusters from companies across a multitude of industries, including insurance, healthcare, IoT, media and social networks.”
Researchers added, “Also exposed was real-time traffic revealing secrets, authentication tokens, and other access details that allow hackers to infiltrate the companies’ cloud activities on AWS, IBM, Oracle and others.”
See Also: New Windows zero-day with public exploit lets you become an admin They warned that the impact on affected companies could be sig[...]
___________________________
@hacking_Attack
@Hacking_Video
Black Hat Ethical Hacking
Apache Kafka Cloud Clusters Expose Sensitive Data for Large Companies | Black Hat Ethical Hacking
Some of the world’s largest companies have exposed reams of sensitive information from the cloud, researchers said – thanks to misconfigured Kafdrop instances.
Hacking Articles Tips Tricks Videos Tutorials
Black Hat Ethical Hacking Apache Kafka Cloud Clusters Expose Sensitive Data for Large Companies https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Apache Kafka Cloud Clusters Expose Sensitive Data for Large CompaniesPost…
nificant, with several attack outcomes possible, including:
* Sensitive information compromise/data theft
* Deletion of Kafka topics and data sources, wreaking havoc in internal systems and leading to potential denial-of-service (DoS)
* Exposure of log and transactional data – everything from sensitive traffic records to financial transactions, and internal database records to sensitive app payloads
* Additional access to other parts of the corporate cloud/network by injecting specially crafted messages into Kafka; Kafka can connect to external systems for data import/export
* Regulatory non-compliance
“Since Kafka serves as a data hub and central processing system for mission-critical data, an exposed cluster risks every facet of the organization,” researcher noted. “By understanding the topology of a cluster, a hacker can efficiently connect and impersonate a legitimate consumer, injecting or pulling data at will.”
In one of the exposed clusters, Spectral observed live traffic at “one of the largest news outlets in the world,” containing service tokens, secrets, cookies and more. In another case, researchers were able to see email traffic, containing message content, tokens and private cookies carried as parameters within email URLs.
One of the large medical organizations had “complete topology for handling requests, processing, and inventory of medication as well as customer prescription transactions,” researchers added, while another exposed cluster held insurance claims, transactions and interactions between agents and customers.
Affected companies were notified, researchers said.
See Also: Offensive Security Tool: GoMapEnum Preventing Cloud MisconfigurationsCloud misconfigurations are increasingly common, with data leaks nearly endemic among public cloud storage buckets. But Spectral’s research shows that there are other common cloud misconfigurations to worry about.
To avoid exposing the corporate crown jewels, Kafdrop should be redeployed behind an app server, with an active and configured authentication module, researchers noted.
“With only one connected access point, you can now add an authentication module to [something like] Nginx and use it as an authentication layer,” they explained.
Also, Spectral contributed authentication code into the open-source code base in the wake of its findings.
“Kafdrop is based on the Spring-Boot framework, which supports security as a first-class citizen and includes a wide range of built-in authentication mechanisms,” according to the writeup. “As such, we at Spectral have contributed an authentication code addition back into Kafdrop using a simple username-password authentication. Though this is pretty basic methodology, it is better than not having any authentication at all.”
See Also: Hacking stories – Operation Troy – How researchers linked the cyberattacks Other remediation and mitigation strategies include encrypting data at rest in Kafka, and configuring applications to always encrypt when reading or writing data to and from Kafka; and, employing advanced misconfiguration scanners to help detect broken authentication, input sanitation problems and encryption errors.
Source: threatpost.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/Excel-als-Malware-Schleuder-Gefahr-durch-XLL-Dateien-Twitter-90x90.png Malicious Excel XLL add-ins push RedLine password-stealing malware1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-1-90x90.jpg New malware hides as legit nginx process on e-commerce servers4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-90x90.jpg Microsoft Exchange servers hacked to deploy BlackByte ransomware5 days ago
* https://www.blackhatethicalhacking[...]
___________________________
@hacking_Attack
@Hacking_Video
* Sensitive information compromise/data theft
* Deletion of Kafka topics and data sources, wreaking havoc in internal systems and leading to potential denial-of-service (DoS)
* Exposure of log and transactional data – everything from sensitive traffic records to financial transactions, and internal database records to sensitive app payloads
* Additional access to other parts of the corporate cloud/network by injecting specially crafted messages into Kafka; Kafka can connect to external systems for data import/export
* Regulatory non-compliance
“Since Kafka serves as a data hub and central processing system for mission-critical data, an exposed cluster risks every facet of the organization,” researcher noted. “By understanding the topology of a cluster, a hacker can efficiently connect and impersonate a legitimate consumer, injecting or pulling data at will.”
In one of the exposed clusters, Spectral observed live traffic at “one of the largest news outlets in the world,” containing service tokens, secrets, cookies and more. In another case, researchers were able to see email traffic, containing message content, tokens and private cookies carried as parameters within email URLs.
One of the large medical organizations had “complete topology for handling requests, processing, and inventory of medication as well as customer prescription transactions,” researchers added, while another exposed cluster held insurance claims, transactions and interactions between agents and customers.
Affected companies were notified, researchers said.
See Also: Offensive Security Tool: GoMapEnum Preventing Cloud MisconfigurationsCloud misconfigurations are increasingly common, with data leaks nearly endemic among public cloud storage buckets. But Spectral’s research shows that there are other common cloud misconfigurations to worry about.
To avoid exposing the corporate crown jewels, Kafdrop should be redeployed behind an app server, with an active and configured authentication module, researchers noted.
“With only one connected access point, you can now add an authentication module to [something like] Nginx and use it as an authentication layer,” they explained.
Also, Spectral contributed authentication code into the open-source code base in the wake of its findings.
“Kafdrop is based on the Spring-Boot framework, which supports security as a first-class citizen and includes a wide range of built-in authentication mechanisms,” according to the writeup. “As such, we at Spectral have contributed an authentication code addition back into Kafdrop using a simple username-password authentication. Though this is pretty basic methodology, it is better than not having any authentication at all.”
See Also: Hacking stories – Operation Troy – How researchers linked the cyberattacks Other remediation and mitigation strategies include encrypting data at rest in Kafka, and configuring applications to always encrypt when reading or writing data to and from Kafka; and, employing advanced misconfiguration scanners to help detect broken authentication, input sanitation problems and encryption errors.
Source: threatpost.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/Excel-als-Malware-Schleuder-Gefahr-durch-XLL-Dateien-Twitter-90x90.png Malicious Excel XLL add-ins push RedLine password-stealing malware1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-1-90x90.jpg New malware hides as legit nginx process on e-commerce servers4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-90x90.jpg Microsoft Exchange servers hacked to deploy BlackByte ransomware5 days ago
* https://www.blackhatethicalhacking[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
nificant, with several attack outcomes possible, including: * Sensitive information compromise/data theft * Deletion of Kafka topics and data sources, wreaking havoc in internal systems and leading to potential denial-of-service (DoS) * Exposure of log and…
.com/wp-content/uploads/2021/12/80-percent-e-commerce-android-apps-leak-personal-data-765x383-1-90x90.jpg Android banking malware infects 300,000 Google Play users6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/PKM201070290_resize-90x90.jpg Panasonic discloses data breach after network hack1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/0_Windows-headpic-90x90.jpg New Windows 10 zero-day gives admin rights, gets unofficial patch1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/1_pD_YMyWDg8A2grOrbaNS6g-90x90.jpg New Linux malware hides in cron jobs with invalid dates2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Microsoft-Vulnerability-RCE-MSHTML-90x90.jpg Hackers exploit Microsoft MSHTML bug to steal Google, Instagram creds2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/windows-hacking-90x90.jpg Malware now trying to exploit new Windows Installer zero-day2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/https___specials-images.forbesimg.com_imageserve_503493618_Green-binary-code-on-screen-with-Zero-Day-highlighted-in-red-as-viewed-under-a_960x0-90x90.jpg New Windows zero-day with public exploit lets you become an admin2 weeks ago
The post Apache Kafka Cloud Clusters Expose Sensitive Data for Large Companies first appeared on Black Hat Ethical Hacking.
___________________________
@hacking_Attack
@Hacking_Video
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/PKM201070290_resize-90x90.jpg Panasonic discloses data breach after network hack1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/0_Windows-headpic-90x90.jpg New Windows 10 zero-day gives admin rights, gets unofficial patch1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/1_pD_YMyWDg8A2grOrbaNS6g-90x90.jpg New Linux malware hides in cron jobs with invalid dates2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Microsoft-Vulnerability-RCE-MSHTML-90x90.jpg Hackers exploit Microsoft MSHTML bug to steal Google, Instagram creds2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/windows-hacking-90x90.jpg Malware now trying to exploit new Windows Installer zero-day2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/https___specials-images.forbesimg.com_imageserve_503493618_Green-binary-code-on-screen-with-Zero-Day-highlighted-in-red-as-viewed-under-a_960x0-90x90.jpg New Windows zero-day with public exploit lets you become an admin2 weeks ago
The post Apache Kafka Cloud Clusters Expose Sensitive Data for Large Companies first appeared on Black Hat Ethical Hacking.
___________________________
@hacking_Attack
@Hacking_Video
TALE OF A VULNERABILITY WHICH LEADS TO ACCOUNT TAKEOVER OF GOVERNMENT ANDROID APPLICATION
AGENDA:
Read more...
AGENDA:
Read more...
Suspected Russian Activity Targeting Government and Business Entities Around the Globe
https://www.reddit.com/r/redteamsec/comments/raus5w/suspected_russian_activity_targeting_government/
submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://www.mandiant.com/resources/russian-targeting-gov-business) [comments] (https://www.reddit.com/r/redteamsec/comments/raus5w/suspected_russian_activity_targeting_government/)
___________________________
@hacking_Attack
@Hacking_Video
https://www.reddit.com/r/redteamsec/comments/raus5w/suspected_russian_activity_targeting_government/
submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://www.mandiant.com/resources/russian-targeting-gov-business) [comments] (https://www.reddit.com/r/redteamsec/comments/raus5w/suspected_russian_activity_targeting_government/)
___________________________
@hacking_Attack
@Hacking_Video
reddit
Suspected Russian Activity Targeting Government and Business...
Posted in r/redteamsec by u/dmchell • 3 points and 0 comments
I have a few problems with mitmproxy...
https://www.reddit.com/r/Pentesting/comments/ravq0z/i_have_a_few_problems_with_mitmproxy/
1) is there a way to edit the whole request at once? possibly in vim ? i have looked it up and it seems not but can it be done in a plugins perhaps? i don't have experience with the project so i do not know how hard it is to achieve something like this. 2) is there a way to highlight the certain line i am on when viewing the requests in the main panel ? maybe a plugin that changes the background ? submitted by /u/watermelonSoundsNice (https://www.reddit.com/user/watermelonSoundsNice)
[link] (https://www.reddit.com/r/Pentesting/comments/ravq0z/i_have_a_few_problems_with_mitmproxy/) [comments] (https://www.reddit.com/r/Pentesting/comments/ravq0z/i_have_a_few_problems_with_mitmproxy/)
___________________________
@hacking_Attack
@Hacking_Video
https://www.reddit.com/r/Pentesting/comments/ravq0z/i_have_a_few_problems_with_mitmproxy/
1) is there a way to edit the whole request at once? possibly in vim ? i have looked it up and it seems not but can it be done in a plugins perhaps? i don't have experience with the project so i do not know how hard it is to achieve something like this. 2) is there a way to highlight the certain line i am on when viewing the requests in the main panel ? maybe a plugin that changes the background ? submitted by /u/watermelonSoundsNice (https://www.reddit.com/user/watermelonSoundsNice)
[link] (https://www.reddit.com/r/Pentesting/comments/ravq0z/i_have_a_few_problems_with_mitmproxy/) [comments] (https://www.reddit.com/r/Pentesting/comments/ravq0z/i_have_a_few_problems_with_mitmproxy/)
___________________________
@hacking_Attack
@Hacking_Video
reddit
I have a few problems with mitmproxy...
1) is there a way to edit the whole request at once? possibly in vim ? i have looked it up and it seems not but can it be done in a plugins...
Has anyone had these issues with Attack Forge?
https://www.reddit.com/r/Pentesting/comments/rawdj1/has_anyone_had_these_issues_with_attack_forge/
After purchasing the pro plan, everything was running smoothly. I created a project and began importing vulnerabilities. The first issue I found was selecting vulnerabilities. I couldn't mass select a specific vulnerability so I had to manually go one by one (over 100 individual vulnerabilities). I contacted their support and they added/fixed a feature to mass select vulnerabilities. Once this is done I then imported the vulnerabilities. I couldn't. There were too many vulnerabilities to import (it doesn't say the limit), so I had to remove a bunch to import and then add the ones I removed later on in a different import. I continue to import vulnerabilities in the same project because the infrastructure pentest I'm conducting is pretty big. After spending some time importing, I then find that each project is limited to 500 vulnerabilities. That may sound like a lot, but they sort each vulnerability per IP address. This means that there are a bunch of duplicates of the same vulnerability under a different IP address listed. I reached the maximum of 500 vulnerabilities when in actuality there should only be around 100 if they were simply grouped. If the developers don't extend the number of vulnerabilities that can be imported and make the project vulnerability capacity unlimited, I don't see myself recommending this to anyone! I've emailed the support and they simply said: "upgrade to Attack Forge Core", which is 18K a year! The least they could've done is warn users that this limit is present! I just thought to warn people that this site is a disaster. An alternative is cyver.io (https://cyver.io/) but they seem to plaster their URL all over their reports, which is a no go for me. They're working on adding a 'remove all links' option, so when they do I'll probably start using them for report generation. They're a little more expensive per month, but its worth it, if I don't have to deal with all the issues Attack Forge, is giving me. submitted by /u/LiterallyBlah (https://www.reddit.com/user/LiterallyBlah)
[link] (https://www.reddit.com/r/Pentesting/comments/rawdj1/has_anyone_had_these_issues_with_attack_forge/) [comments] (https://www.reddit.com/r/Pentesting/comments/rawdj1/has_anyone_had_these_issues_with_attack_forge/)
___________________________
@hacking_Attack
@Hacking_Video
https://www.reddit.com/r/Pentesting/comments/rawdj1/has_anyone_had_these_issues_with_attack_forge/
After purchasing the pro plan, everything was running smoothly. I created a project and began importing vulnerabilities. The first issue I found was selecting vulnerabilities. I couldn't mass select a specific vulnerability so I had to manually go one by one (over 100 individual vulnerabilities). I contacted their support and they added/fixed a feature to mass select vulnerabilities. Once this is done I then imported the vulnerabilities. I couldn't. There were too many vulnerabilities to import (it doesn't say the limit), so I had to remove a bunch to import and then add the ones I removed later on in a different import. I continue to import vulnerabilities in the same project because the infrastructure pentest I'm conducting is pretty big. After spending some time importing, I then find that each project is limited to 500 vulnerabilities. That may sound like a lot, but they sort each vulnerability per IP address. This means that there are a bunch of duplicates of the same vulnerability under a different IP address listed. I reached the maximum of 500 vulnerabilities when in actuality there should only be around 100 if they were simply grouped. If the developers don't extend the number of vulnerabilities that can be imported and make the project vulnerability capacity unlimited, I don't see myself recommending this to anyone! I've emailed the support and they simply said: "upgrade to Attack Forge Core", which is 18K a year! The least they could've done is warn users that this limit is present! I just thought to warn people that this site is a disaster. An alternative is cyver.io (https://cyver.io/) but they seem to plaster their URL all over their reports, which is a no go for me. They're working on adding a 'remove all links' option, so when they do I'll probably start using them for report generation. They're a little more expensive per month, but its worth it, if I don't have to deal with all the issues Attack Forge, is giving me. submitted by /u/LiterallyBlah (https://www.reddit.com/user/LiterallyBlah)
[link] (https://www.reddit.com/r/Pentesting/comments/rawdj1/has_anyone_had_these_issues_with_attack_forge/) [comments] (https://www.reddit.com/r/Pentesting/comments/rawdj1/has_anyone_had_these_issues_with_attack_forge/)
___________________________
@hacking_Attack
@Hacking_Video
reddit
Has anyone had these issues with Attack Forge?
After purchasing the pro plan, everything was running smoothly. I created a project and began importing vulnerabilities. The first issue I found...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
HTB-Backdoor Write-up | HackTheBox Machine Backdoor Walkthrough | Backdoor.htb|10.10.11.125
https://cdn-images-1.medium.com/max/600/1*zp7WhdDozycoqXAhksQfSQ.png
Information gathering
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
HTB-Backdoor Write-up | HackTheBox Machine Backdoor Walkthrough | Backdoor.htb|10.10.11.125
https://cdn-images-1.medium.com/max/600/1*zp7WhdDozycoqXAhksQfSQ.png
Information gathering
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
HTB-Backdoor Write-up | HackTheBox Machine Backdoor Walkthrough | Backdoor.htb|10.10.11.125
Information gathering
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Exploiting AWS Cross-Account access
https://cdn-images-1.medium.com/max/1081/1*o7RM_RcZfo3s79xls8tGnA.png
Your S3 Bucket might be exposed to the latest cross-account vulnerability
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Exploiting AWS Cross-Account access
https://cdn-images-1.medium.com/max/1081/1*o7RM_RcZfo3s79xls8tGnA.png
Your S3 Bucket might be exposed to the latest cross-account vulnerability
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Exploiting AWS Cross-Account access
Your S3 Bucket might be exposed to the latest cross-account vulnerability
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
“Cyber Intelligence” — The Definite Cybercrime Research and Web 2.0 Memoir
https://cdn-images-1.medium.com/max/600/1*hcbPy595Kr_rRsmq1NKUSw.jpeg
Learn more about the basics of Cyber Intelligence by reading Dancho Danchev’s Personal Hacker/Cybercrime/Security Blogging and OSINT…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
“Cyber Intelligence” — The Definite Cybercrime Research and Web 2.0 Memoir
https://cdn-images-1.medium.com/max/600/1*hcbPy595Kr_rRsmq1NKUSw.jpeg
Learn more about the basics of Cyber Intelligence by reading Dancho Danchev’s Personal Hacker/Cybercrime/Security Blogging and OSINT…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
“Cyber Intelligence” — The Definite Cybercrime Research and Web 2.0 Memoir
Learn more about the basics of Cyber Intelligence by reading Dancho Danchev’s Personal Hacker/Cybercrime/Security Blogging and OSINT…
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
No Rate Limit on Database Provider’s Website
https://cdn-images-1.medium.com/max/1320/1*8vhsWTYO1rq5FWzNkUYg8A.png
Hello everyone, my name is Alp Keskin and I am a student and jr. cyber security researcher from Turkey.
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
No Rate Limit on Database Provider’s Website
https://cdn-images-1.medium.com/max/1320/1*8vhsWTYO1rq5FWzNkUYg8A.png
Hello everyone, my name is Alp Keskin and I am a student and jr. cyber security researcher from Turkey.
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
No Rate Limit on Database Provider’s Website
Hello everyone, my name is Alp Keskin and I am a student and jr. cyber security researcher from Turkey.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Social engineering: the art of hacking in words
https://cdn-images-1.medium.com/max/800/0*Ucp_5Pp1X5QMgtrp.jpg
Social engineering is free for hackers but fraught with danger for regular users
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Social engineering: the art of hacking in words
https://cdn-images-1.medium.com/max/800/0*Ucp_5Pp1X5QMgtrp.jpg
Social engineering is free for hackers but fraught with danger for regular users
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Social engineering: the art of hacking in words
Social engineering is free for hackers but fraught with danger for regular users
Swurg - Parse OpenAPI Documents Into Burp Suite For Automating OpenAPI-based APIs Security Assessments
http://www.kitploit.com/2021/12/swurg-parse-openapi-documents-into-burp.html
___________________________
@hacking_Attack
@Hacking_Video
http://www.kitploit.com/2021/12/swurg-parse-openapi-documents-into-burp.html
___________________________
@hacking_Attack
@Hacking_Video
Kitploit
Kitploit – Maintenance in Progress
Kitploit is temporarily under maintenance. We’ll be back shortly with improvements.