.com/wp-content/uploads/2021/12/80-percent-e-commerce-android-apps-leak-personal-data-765x383-1-90x90.jpg Android banking malware infects 300,000 Google Play users6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/PKM201070290_resize-90x90.jpg Panasonic discloses data breach after network hack1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/0_Windows-headpic-90x90.jpg New Windows 10 zero-day gives admin rights, gets unofficial patch1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/1_pD_YMyWDg8A2grOrbaNS6g-90x90.jpg New Linux malware hides in cron jobs with invalid dates2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Microsoft-Vulnerability-RCE-MSHTML-90x90.jpg Hackers exploit Microsoft MSHTML bug to steal Google, Instagram creds2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/windows-hacking-90x90.jpg Malware now trying to exploit new Windows Installer zero-day2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/https___specials-images.forbesimg.com_imageserve_503493618_Green-binary-code-on-screen-with-Zero-Day-highlighted-in-red-as-viewed-under-a_960x0-90x90.jpg New Windows zero-day with public exploit lets you become an admin2 weeks ago
The post Apache Kafka Cloud Clusters Expose Sensitive Data for Large Companies first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

TALE OF A VULNERABILITY WHICH LEADS TO ACCOUNT TAKEOVER OF GOVERNMENT ANDROID APPLICATION

AGENDA:
Read more...

Suspected Russian Activity Targeting Government and Business Entities Around the Globe
https://www.reddit.com/r/redteamsec/comments/raus5w/suspected_russian_activity_targeting_government/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://www.mandiant.com/resources/russian-targeting-gov-business) [comments] (https://www.reddit.com/r/redteamsec/comments/raus5w/suspected_russian_activity_targeting_government/)

___________________________
@hacking_Attack
@Hacking_Video

I have a few problems with mitmproxy...
https://www.reddit.com/r/Pentesting/comments/ravq0z/i_have_a_few_problems_with_mitmproxy/

1) is there a way to edit the whole request at once? possibly in vim ? i have looked it up and it seems not but can it be done in a plugins perhaps? i don't have experience with the project so i do not know how hard it is to achieve something like this. 2) is there a way to highlight the certain line i am on when viewing the requests in the main panel ? maybe a plugin that changes the background ? submitted by /u/watermelonSoundsNice (https://www.reddit.com/user/watermelonSoundsNice)
[link] (https://www.reddit.com/r/Pentesting/comments/ravq0z/i_have_a_few_problems_with_mitmproxy/) [comments] (https://www.reddit.com/r/Pentesting/comments/ravq0z/i_have_a_few_problems_with_mitmproxy/)

___________________________
@hacking_Attack
@Hacking_Video

Has anyone had these issues with Attack Forge?
https://www.reddit.com/r/Pentesting/comments/rawdj1/has_anyone_had_these_issues_with_attack_forge/

After purchasing the pro plan, everything was running smoothly. I created a project and began importing vulnerabilities. The first issue I found was selecting vulnerabilities. I couldn't mass select a specific vulnerability so I had to manually go one by one (over 100 individual vulnerabilities). I contacted their support and they added/fixed a feature to mass select vulnerabilities. Once this is done I then imported the vulnerabilities. I couldn't. There were too many vulnerabilities to import (it doesn't say the limit), so I had to remove a bunch to import and then add the ones I removed later on in a different import. I continue to import vulnerabilities in the same project because the infrastructure pentest I'm conducting is pretty big. After spending some time importing, I then find that each project is limited to 500 vulnerabilities. That may sound like a lot, but they sort each vulnerability per IP address. This means that there are a bunch of duplicates of the same vulnerability under a different IP address listed. I reached the maximum of 500 vulnerabilities when in actuality there should only be around 100 if they were simply grouped. If the developers don't extend the number of vulnerabilities that can be imported and make the project vulnerability capacity unlimited, I don't see myself recommending this to anyone! I've emailed the support and they simply said: "upgrade to Attack Forge Core", which is 18K a year! The least they could've done is warn users that this limit is present! I just thought to warn people that this site is a disaster. An alternative is cyver.io (https://cyver.io/) but they seem to plaster their URL all over their reports, which is a no go for me. They're working on adding a 'remove all links' option, so when they do I'll probably start using them for report generation. They're a little more expensive per month, but its worth it, if I don't have to deal with all the issues Attack Forge, is giving me. submitted by /u/LiterallyBlah (https://www.reddit.com/user/LiterallyBlah)
[link] (https://www.reddit.com/r/Pentesting/comments/rawdj1/has_anyone_had_these_issues_with_attack_forge/) [comments] (https://www.reddit.com/r/Pentesting/comments/rawdj1/has_anyone_had_these_issues_with_attack_forge/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
HTB-Backdoor Write-up | HackTheBox Machine Backdoor Walkthrough | Backdoor.htb|10.10.11.125

https://cdn-images-1.medium.com/max/600/1*zp7WhdDozycoqXAhksQfSQ.png
Information gathering

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Exploiting AWS Cross-Account access

https://cdn-images-1.medium.com/max/1081/1*o7RM_RcZfo3s79xls8tGnA.png
Your S3 Bucket might be exposed to the latest cross-account vulnerability

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
“Cyber Intelligence” — The Definite Cybercrime Research and Web 2.0 Memoir

https://cdn-images-1.medium.com/max/600/1*hcbPy595Kr_rRsmq1NKUSw.jpeg
Learn more about the basics of Cyber Intelligence by reading Dancho Danchev’s Personal Hacker/Cybercrime/Security Blogging and OSINT…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
No Rate Limit on Database Provider’s Website

https://cdn-images-1.medium.com/max/1320/1*8vhsWTYO1rq5FWzNkUYg8A.png
Hello everyone, my name is Alp Keskin and I am a student and jr. cyber security researcher from Turkey.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Social engineering: the art of hacking in words

https://cdn-images-1.medium.com/max/800/0*Ucp_5Pp1X5QMgtrp.jpg
Social engineering is free for hackers but fraught with danger for regular users

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Swurg - Parse OpenAPI Documents Into Burp Suite For Automating OpenAPI-based APIs Security Assessments
http://www.kitploit.com/2021/12/swurg-parse-openapi-documents-into-burp.html

___________________________
@hacking_Attack
@Hacking_Video

Swurg is a Burp Suite (https://www.kitploit.com/search/label/Burp%20Suite) extension designed for OpenAPI testing. The OpenAPI Specification (OAS) defines a standard, programming language-agnostic interface description for REST APIs, which allows both humans and computers to discover and understand the capabilities of a service without requiring access to source code, additional documentation, or inspection of network traffic. When properly defined via OpenAPI, a consumer can understand and interact with the remote service with a minimal amount of implementation logic. Similar to what interface descriptions have done for lower-level programming, the OpenAPI Specification removes guesswork in calling a service. Use cases for machine-readable API definition documents include, but are not limited to: interactive documentation; code generation for documentation, clients, and servers; and automation (https://www.kitploit.com/search/label/Automation) of test cases. OpenAPI documents describe an API's services and are represented in either YAML or JSON formats. These documents may either be produced and served statically or be generated dynamically from an application. - OpenAPI Initiative (https://github.com/OAI/OpenAPI-Specification) Performing security assessment of OpenAPI-based APIs can be a tedious task due to Burp Suite (industry standard) lacking native OpenAPI parsing capabilities. A solution to this situation, is to use third-party tools (e.g. SOAP-UI) or to implement custom scripts (often on a per engagement basis) to handle the parsing of OpenAPI documents and integrate/chain the results to Burp Suite to use its first class scanning capabilities. Swurg is an OpenAPI parser that aims to streamline this entire process by allowing security professionals to use Burp Suite as a standalone tool for security assessment of OpenAPI-based APIs.
Supported Features OpenAPI documents can be parsed either from a supplied file or URL. The extension can fetch OpenAPI documents directly from a URL using the Send to Swagger Parser feature under the Target -> Site map context menu. Parse OpenAPI documents, formerly known as the Swagger specification, fully compliant with OpenAPI 2.0/3.0 Specifications (OAS). Requests can be directly viewed/edited within the extension prior to sending them to other Burp tools. Requests can be sent to the Comparer, Intruder, Repeater, Scanner, Site map and Scope Burp tools. Requests matching specific criterias (detailed in the 'Parameters' tab) can be intercepted to automatically match and replace the parsed parameters default values defined in the 'Parameters' tab. This feature allows for fine-tuning of the requests prior to sending them to other Burp tools (e.g., scanner). Edited requests can be viewed within the 'Modified Request (OpenAPI Parser)' tab of Burp's message editor. Row highlighting allowing pentesters to highlight "interesting" API calls and/or colour code them for reporting purposes. Supports both JSON and YAML formats. Installation Compilation Windows & Linux Install gradle (https://gradle.org/) Download the repository. $ git clone https://github.com/AresS31/swurg
$ cd .\swurg\ Create the swurg jarfile: $ gradle fatJar Burp Suite settings In Burp Suite, under the Extender/Options tab, click on the Add button and load the swurg-all jarfile. Possible Improvements Beautify the graphical user interface. Deep parsing of OpenAPI schemas to collect all nested parameters along with their example/type. Code simplification/refactoring. Enable cells editing to change API calls directly from the GUI. Further optimise the source code. Implement support for authenticated testing (via user-supplied API-keys). Improve the Param column by adding the type of parameters (e.g. inquery, inbody, etc.). Implement the tables and context menus. Increase the extension verbosity (via the bottom panel). Dependencies Third-party libraries Swagger Parser:

___________________________
@hacking_Attack
@Hacking_Video

The Swagger Parser (https://mvnrepository.com/artifact/io.swagger.parser.v3/swagger-parser) library is required and automatically imported in this project. Project information In July 2016, after posting a request for improvement on the PortSwigger support forum (https://support.portswigger.net/customer/portal/questions/16358278-swagger-parser-and-wsdler-improvement), I decided to take the initiative and to implement a solution myself. The extension is still in development, feedback, comments and contributions are therefore much appreciated. One-time donation Donate via Bitcoin : 15aFaQaW9cxa4tRocax349JJ7RKyj7YV1p Donate via Bitcoin Cash : qqez5ed5wjpwq9znyuhd2hdg86nquqpjcgkm3t8mg3 Donate via Ether : 0x70bC178EC44500C17B554E62BC31EA2B6251f64B License Copyright (C) 2016 - 2021 Alexandre Teyar Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance (https://www.kitploit.com/search/label/Compliance) with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed (https://www.kitploit.com/search/label/Distributed) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Download Swurg (https://github.com/aress31/swurg)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Swurg - Parse OpenAPI Documents Into Burp Suite For Automating OpenAPI-based APIs Security Assessments

http://4.bp.blogspot.com/-4RcNwKJcde4/YZ3UYZ2LCsI/AAAAAAAA4Ws/Q3pwWh_Ht_UhFRXY63sBBTxsO_GBmrMUACK4BGAYYCw/w640-h172/swurg_1_logo3-765142.png Swurg is a Burp Suite extension designed for OpenAPI testing.The OpenAPI Specification (OAS) defines a standard, programming language-agnostic interface description for REST APIs, which allows both humans and computers to discover and understand the capabilities of a service without requiring access to source code, additional documentation, or inspection of network traffic. When properly defined via OpenAPI, a consumer can understand and interact with the remote service with a minimal amount of implementation logic. Similar to what interface descriptions have done for lower-level programming, the OpenAPI Specification removes guesswork in calling a service.

Use cases for machine-readable API definition documents include, but are not limited to: interactive documentation; code generation for documentation, clients, and servers; and automation of test cases. OpenAPI documents describe an API's services and are represented in either YAML or JSON formats. These documents may either be produced and served statically or be generated dynamically from an application.

- OpenAPI Initiative

Performing security assessment of OpenAPI-based APIs can be a tedious task due to Burp Suite (industry standard) lacking native OpenAPI parsing capabilities. A solution to this situation, is to use third-party tools (e.g. SOAP-UI) or to implement custom scripts (often on a per engagement basis) to handle the parsing of OpenAPI documents and integrate/chain the results to Burp Suite to use its first class scanning capabilities.

Swurg is an OpenAPI parser that aims to streamline this entire process by allowing security professionals to use Burp Suite as a standalone tool for security assessment of OpenAPI-based APIs. Supported Features* OpenAPI documents can be parsed either from a supplied file or URL. The extension can fetch OpenAPI documents directly from a URL using the Send to Swagger Parserfeature under the Target -> Site mapcontext menu.
* Parse OpenAPI documents, formerly known as the Swagger specification, fully compliant with OpenAPI 2.0/3.0 Specifications (OAS).
* Requests can be directly viewed/edited within the extension prior to sending them to other Burp tools.
* Requests can be sent to the Comparer, Intruder, Repeater, Scanner, Site map and ScopeBurp tools.
* Requests matching specific criterias (detailed in the 'Parameters' tab) can be intercepted to automatically match and replace the parsed parameters default values defined in the 'Parameters' tab. This feature allows for fine-tuning of the requests prior to sending them to other Burp tools (e.g., scanner). Edited requests can be viewed within the 'Modified Request (OpenAPI Parser)' tab of Burp's message editor.
* Row highlighting allowing pentesters to highlight "interesting" API calls and/or colour code them for reporting purposes.
* Supports both JSON and YAML formats. InstallationCompilationWindows & Linux1. Install gradle (https://gradle.org/)
2. Download the repository. $ git clone https://github.com/AresS31/swurg
$ cd .\swurg\1. Create the swurg jarfile: $ gradle fatJarBurp Suite settingsIn Burp Suite, under the Extender/Optionstab, click on the Addbutton and load the swurg-alljarfile. Possible Improvements* Beautify the graphical user interface.
* Deep parsing of OpenAPI schemas to collect all nested parameters along with their example/type.
* Code simplification/refactoring.
* Enable cells editing to ch[...]

___________________________
@hacking_Attack
@Hacking_Video