Hacking Articles Tips Tricks Videos Tutorials
Photo
KitPloit - PenTest Tools!
Swurg - Parse OpenAPI Documents Into Burp Suite For Automating OpenAPI-based APIs Security Assessments
http://4.bp.blogspot.com/-4RcNwKJcde4/YZ3UYZ2LCsI/AAAAAAAA4Ws/Q3pwWh_Ht_UhFRXY63sBBTxsO_GBmrMUACK4BGAYYCw/w640-h172/swurg_1_logo3-765142.png Swurg is a Burp Suite extension designed for OpenAPI testing.The OpenAPI Specification (OAS) defines a standard, programming language-agnostic interface description for REST APIs, which allows both humans and computers to discover and understand the capabilities of a service without requiring access to source code, additional documentation, or inspection of network traffic. When properly defined via OpenAPI, a consumer can understand and interact with the remote service with a minimal amount of implementation logic. Similar to what interface descriptions have done for lower-level programming, the OpenAPI Specification removes guesswork in calling a service.
Use cases for machine-readable API definition documents include, but are not limited to: interactive documentation; code generation for documentation, clients, and servers; and automation of test cases. OpenAPI documents describe an API's services and are represented in either YAML or JSON formats. These documents may either be produced and served statically or be generated dynamically from an application.
- OpenAPI Initiative
Performing security assessment of OpenAPI-based APIs can be a tedious task due to Burp Suite (industry standard) lacking native OpenAPI parsing capabilities. A solution to this situation, is to use third-party tools (e.g.
Swurg is an OpenAPI parser that aims to streamline this entire process by allowing security professionals to use Burp Suite as a standalone tool for security assessment of OpenAPI-based APIs. Supported Features* OpenAPI documents can be parsed either from a supplied file or URL. The extension can fetch OpenAPI documents directly from a URL using the
* Parse OpenAPI documents, formerly known as the
* Requests can be directly viewed/edited within the extension prior to sending them to other Burp tools.
* Requests can be sent to the
* Requests matching specific criterias (detailed in the 'Parameters' tab) can be intercepted to automatically match and replace the parsed parameters default values defined in the 'Parameters' tab. This feature allows for fine-tuning of the requests prior to sending them to other Burp tools (e.g., scanner). Edited requests can be viewed within the 'Modified Request (OpenAPI Parser)' tab of Burp's message editor.
* Row highlighting allowing pentesters to highlight "interesting" API calls and/or colour code them for reporting purposes.
* Supports both JSON and YAML formats. InstallationCompilationWindows & Linux1. Install gradle (https://gradle.org/)
2. Download the repository.
* Deep parsing of OpenAPI schemas to collect all nested parameters along with their example/type.
* Code simplification/refactoring.
* Enable cells editing to ch[...]
___________________________
@hacking_Attack
@Hacking_Video
Swurg - Parse OpenAPI Documents Into Burp Suite For Automating OpenAPI-based APIs Security Assessments
http://4.bp.blogspot.com/-4RcNwKJcde4/YZ3UYZ2LCsI/AAAAAAAA4Ws/Q3pwWh_Ht_UhFRXY63sBBTxsO_GBmrMUACK4BGAYYCw/w640-h172/swurg_1_logo3-765142.png Swurg is a Burp Suite extension designed for OpenAPI testing.The OpenAPI Specification (OAS) defines a standard, programming language-agnostic interface description for REST APIs, which allows both humans and computers to discover and understand the capabilities of a service without requiring access to source code, additional documentation, or inspection of network traffic. When properly defined via OpenAPI, a consumer can understand and interact with the remote service with a minimal amount of implementation logic. Similar to what interface descriptions have done for lower-level programming, the OpenAPI Specification removes guesswork in calling a service.
Use cases for machine-readable API definition documents include, but are not limited to: interactive documentation; code generation for documentation, clients, and servers; and automation of test cases. OpenAPI documents describe an API's services and are represented in either YAML or JSON formats. These documents may either be produced and served statically or be generated dynamically from an application.
- OpenAPI Initiative
Performing security assessment of OpenAPI-based APIs can be a tedious task due to Burp Suite (industry standard) lacking native OpenAPI parsing capabilities. A solution to this situation, is to use third-party tools (e.g.
SOAP-UI) or to implement custom scripts (often on a per engagement basis) to handle the parsing of OpenAPI documents and integrate/chain the results to Burp Suite to use its first class scanning capabilities.Swurg is an OpenAPI parser that aims to streamline this entire process by allowing security professionals to use Burp Suite as a standalone tool for security assessment of OpenAPI-based APIs. Supported Features* OpenAPI documents can be parsed either from a supplied file or URL. The extension can fetch OpenAPI documents directly from a URL using the
Send to Swagger Parserfeature under the Target -> Site mapcontext menu.* Parse OpenAPI documents, formerly known as the
Swagger specification, fully compliant with OpenAPI 2.0/3.0 Specifications (OAS).* Requests can be directly viewed/edited within the extension prior to sending them to other Burp tools.
* Requests can be sent to the
Comparer, Intruder, Repeater, Scanner, Site map and ScopeBurp tools.* Requests matching specific criterias (detailed in the 'Parameters' tab) can be intercepted to automatically match and replace the parsed parameters default values defined in the 'Parameters' tab. This feature allows for fine-tuning of the requests prior to sending them to other Burp tools (e.g., scanner). Edited requests can be viewed within the 'Modified Request (OpenAPI Parser)' tab of Burp's message editor.
* Row highlighting allowing pentesters to highlight "interesting" API calls and/or colour code them for reporting purposes.
* Supports both JSON and YAML formats. InstallationCompilationWindows & Linux1. Install gradle (https://gradle.org/)
2. Download the repository.
$ git clone https://github.com/AresS31/swurg
$ cd .\swurg\1. Create the swurg jarfile: $ gradle fatJarBurp Suite settingsIn Burp Suite, under the Extender/Optionstab, click on the Addbutton and load the swurg-alljarfile. Possible Improvements* Beautify the graphical user interface.* Deep parsing of OpenAPI schemas to collect all nested parameters along with their example/type.
* Code simplification/refactoring.
* Enable cells editing to ch[...]
___________________________
@hacking_Attack
@Hacking_Video
Kitploit
Kitploit – Maintenance in Progress
Kitploit is temporarily under maintenance. We’ll be back shortly with improvements.
Hacking Articles Tips Tricks Videos Tutorials
KitPloit - PenTest Tools! Swurg - Parse OpenAPI Documents Into Burp Suite For Automating OpenAPI-based APIs Security Assessments http://4.bp.blogspot.com/-4RcNwKJcde4/YZ3UYZ2LCsI/AAAAAAAA4Ws/Q3pwWh_Ht_UhFRXY63sBBTxsO_GBmrMUACK4BGAYYCw/w640-h172/swurg_1_logo3…
ange API calls directly from the GUI.
* Further optimise the source code.
* Implement support for authenticated testing (via user-supplied API-keys).
* Improve the Param column by adding the type of parameters (e.g. inquery, inbody, etc.).
* Implement the tables and context menus.
* Increase the extension verbosity (via the bottom panel). DependenciesThird-party librariesSwagger Parser:The Swagger Parser library is required and automatically imported in this project. Project informationIn July 2016, after posting a request for improvement on the PortSwigger support forum, I decided to take the initiative and to implement a solution myself.
The extension is still in development, feedback, comments and contributions are therefore much appreciated. One-time donation* Donate via Bitcoin : 15aFaQaW9cxa4tRocax349JJ7RKyj7YV1p
* Donate via Bitcoin Cash : qqez5ed5wjpwq9znyuhd2hdg86nquqpjcgkm3t8mg3
* Donate via Ether : 0x70bC178EC44500C17B554E62BC31EA2B6251f64B LicenseCopyright (C) 2016 - 2021 Alexandre Teyar
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. Download Swurg
___________________________
@hacking_Attack
@Hacking_Video
* Further optimise the source code.
* Implement support for authenticated testing (via user-supplied API-keys).
* Improve the Param column by adding the type of parameters (e.g. inquery, inbody, etc.).
* Implement the tables and context menus.
* Increase the extension verbosity (via the bottom panel). DependenciesThird-party librariesSwagger Parser:The Swagger Parser library is required and automatically imported in this project. Project informationIn July 2016, after posting a request for improvement on the PortSwigger support forum, I decided to take the initiative and to implement a solution myself.
The extension is still in development, feedback, comments and contributions are therefore much appreciated. One-time donation* Donate via Bitcoin : 15aFaQaW9cxa4tRocax349JJ7RKyj7YV1p
* Donate via Bitcoin Cash : qqez5ed5wjpwq9znyuhd2hdg86nquqpjcgkm3t8mg3
* Donate via Ether : 0x70bC178EC44500C17B554E62BC31EA2B6251f64B LicenseCopyright (C) 2016 - 2021 Alexandre Teyar
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. Download Swurg
___________________________
@hacking_Attack
@Hacking_Video
No Rate Limit on Database Provider’s Website
Hello everyone, my name is Alp Keskin and I am a student and jr. cyber security researcher from Turkey.Continue reading on Medium »
Read more...
Hello everyone, my name is Alp Keskin and I am a student and jr. cyber security researcher from Turkey.Continue reading on Medium »
Read more...
No Rate Limit on Database Provider’s Website
https://medium.com/@alpkeskin/no-rate-limit-on-database-providers-website-44b68a46fb57?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://medium.com/@alpkeskin/no-rate-limit-on-database-providers-website-44b68a46fb57?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
No Rate Limit on Database Provider’s Website
Hello everyone, my name is Alp Keskin and I am a student and jr. cyber security researcher from Turkey.
Hello everyone, my name is Alp Keskin and I am a student and jr. cyber security researcher from Turkey.Continue reading on Medium » (https://medium.com/@alpkeskin/no-rate-limit-on-database-providers-website-44b68a46fb57?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
No Rate Limit on Database Provider’s Website
Hello everyone, my name is Alp Keskin and I am a student and jr. cyber security researcher from Turkey.
NICKEL targeting government organizations across Latin America and Europe - Microsoft Security Blog
https://www.reddit.com/r/redteamsec/comments/razhch/nickel_targeting_government_organizations_across/
submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe/) [comments] (https://www.reddit.com/r/redteamsec/comments/razhch/nickel_targeting_government_organizations_across/)
___________________________
@hacking_Attack
@Hacking_Video
https://www.reddit.com/r/redteamsec/comments/razhch/nickel_targeting_government_organizations_across/
submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe/) [comments] (https://www.reddit.com/r/redteamsec/comments/razhch/nickel_targeting_government_organizations_across/)
___________________________
@hacking_Attack
@Hacking_Video
reddit
NICKEL targeting government organizations across Latin America and...
Posted in r/redteamsec by u/dmchell • 5 points and 0 comments
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Whispers : Identify Hardcoded Secrets In Static Structured Text
Whispers is a static code analysis tool designed for parsing various common data formats in search of hardcoded credentials and dangerous functions. Whispers can run in the CLI or you can integrate it in your CI/CD pipeline.
Detects
* Passwords
* API tokens
* AWS keys
* Private keys
* Hashed credentials
* Authentication tokens
* Dangerous functions
* Sensitive files
Supported Formats
Whispers is intended to be a structured text parser, not a code parser.
The following commonly used formats are currently supported:
* YAML
* JSON
* XML
* .npmrc
* .pypirc
* .htpasswd
* .properties
* pip.conf
* conf / ini
* Dockerfile
* Dockercfg
* Shell scripts
* Python3
Python3 files are parsed as ASTs because of native language support.
Declaration & Assignment Formats
The following language files are parsed as text, and checked for common variable declaration and assignment patterns:
* JavaScript
* Java
* Go
* PHP
Special Formats
* AWS credentials files
* JDBC connection strings
* Jenkins config files
* SpringFramework Beans config files
* Java Properties files
* Dockercfg private registry auth files
* Github tokens
Installation
From PyPI
pip3 install whispers
From GitHub
git clone https://github.com/Skyscanner/whispers
cd whispers
make install
Usage
CLI
whispers --help
whispers --info
whispers source/code/fileOrDir
whispers --config config.yml source/code/fileOrDir
whispers --output /tmp/secrets.yml source/code/fileOrDir
whispers --rules aws-id,aws-secret source/code/fileOrDir
whispers --severity BLOCKER,CRITICAL source/code/fileOrDir
whispers --exitcode 7 source/code/fileOrDir
Python
from whispers.cli import parse_args
from whispers.core import run
src = "tests/fixtures"
configfile = "whispers/config.yml"
args = parse_args(["-c", configfile, src])
for secret in run(args):
print(secret)
Config
There are several configuration options available in Whispers. It’s possible to include/exclude results based on file path, key, or value. File path specifications are interpreted as globs. Keys and values accept regular expressions and several other parameters. There is a default configuration file built-in that will be used if you don’t provide a custom one.
include:
files:
- "**/*.yml"
exclude:
files:
- "**/test/**/*"
- "**/tests/**/*"
keys:
- ^foo
values:
- bar$
rules:
starks:
message: Whispers from the North
severity: CRITICAL
value:
regex: (Aria|Ned) Stark
ignorecase: True
The fastest way to tweak detection (ie: remove false positives and unwanted results) is to copy the default config.yml into a new file, adapt it, and pass it as an argument to Whispers.
Rules specify the actual things that should be pulled out from key-value pairs. There are several common ones that come built-in, such as AWS keys and passwords, but the tool is made to be easily expandable with new rules.
* Custom rules can be defined in the main config file under
rule-id: # unique rule name
description: Values formatted like AWS Session Token
message: AWS Session Token # report will show this message
severity: BLOCKER # one of BLOCKER, CRITICAL, MAJOR, MINOR, INFO
key: # specify key format
regex: (aws.?session.?token)?
ignorecase: True # case-insensitive matching
value: # specify value format
regex: ^(?=.*[a-z])(?=.*[A-Z])[A-Za-z0-9\+\/]{270,450}$
ignorecase: False # case-sensitive matching
minlen: 270 # value is at least this long
isBase64: True # value is base64-encoded
[...]
___________________________
@hacking_Attack
@Hacking_Video
Whispers : Identify Hardcoded Secrets In Static Structured Text
Whispers is a static code analysis tool designed for parsing various common data formats in search of hardcoded credentials and dangerous functions. Whispers can run in the CLI or you can integrate it in your CI/CD pipeline.
Detects
* Passwords
* API tokens
* AWS keys
* Private keys
* Hashed credentials
* Authentication tokens
* Dangerous functions
* Sensitive files
Supported Formats
Whispers is intended to be a structured text parser, not a code parser.
The following commonly used formats are currently supported:
* YAML
* JSON
* XML
* .npmrc
* .pypirc
* .htpasswd
* .properties
* pip.conf
* conf / ini
* Dockerfile
* Dockercfg
* Shell scripts
* Python3
Python3 files are parsed as ASTs because of native language support.
Declaration & Assignment Formats
The following language files are parsed as text, and checked for common variable declaration and assignment patterns:
* JavaScript
* Java
* Go
* PHP
Special Formats
* AWS credentials files
* JDBC connection strings
* Jenkins config files
* SpringFramework Beans config files
* Java Properties files
* Dockercfg private registry auth files
* Github tokens
Installation
From PyPI
pip3 install whispers
From GitHub
git clone https://github.com/Skyscanner/whispers
cd whispers
make install
Usage
CLI
whispers --help
whispers --info
whispers source/code/fileOrDir
whispers --config config.yml source/code/fileOrDir
whispers --output /tmp/secrets.yml source/code/fileOrDir
whispers --rules aws-id,aws-secret source/code/fileOrDir
whispers --severity BLOCKER,CRITICAL source/code/fileOrDir
whispers --exitcode 7 source/code/fileOrDir
Python
from whispers.cli import parse_args
from whispers.core import run
src = "tests/fixtures"
configfile = "whispers/config.yml"
args = parse_args(["-c", configfile, src])
for secret in run(args):
print(secret)
Config
There are several configuration options available in Whispers. It’s possible to include/exclude results based on file path, key, or value. File path specifications are interpreted as globs. Keys and values accept regular expressions and several other parameters. There is a default configuration file built-in that will be used if you don’t provide a custom one.
config.ymlshould have the following structure:include:
files:
- "**/*.yml"
exclude:
files:
- "**/test/**/*"
- "**/tests/**/*"
keys:
- ^foo
values:
- bar$
rules:
starks:
message: Whispers from the North
severity: CRITICAL
value:
regex: (Aria|Ned) Stark
ignorecase: True
The fastest way to tweak detection (ie: remove false positives and unwanted results) is to copy the default config.yml into a new file, adapt it, and pass it as an argument to Whispers.
whispers --config config.yml --rules starks src/file/or/dirCustom RulesRules specify the actual things that should be pulled out from key-value pairs. There are several common ones that come built-in, such as AWS keys and passwords, but the tool is made to be easily expandable with new rules.
* Custom rules can be defined in the main config file under
rules:* Custom rules can be added to whispers/rulesrule-id: # unique rule name
description: Values formatted like AWS Session Token
message: AWS Session Token # report will show this message
severity: BLOCKER # one of BLOCKER, CRITICAL, MAJOR, MINOR, INFO
key: # specify key format
regex: (aws.?session.?token)?
ignorecase: True # case-insensitive matching
value: # specify value format
regex: ^(?=.*[a-z])(?=.*[A-Z])[A-Za-z0-9\+\/]{270,450}$
ignorecase: False # case-sensitive matching
minlen: 270 # value is at least this long
isBase64: True # value is base64-encoded
[...]
___________________________
@hacking_Attack
@Hacking_Video
Kali Linux Tutorials
Whispers : Identify Hardcoded Secrets In Static Structured Text
Whispers is a static code analysis tool designed for parsing various common data formats in search of hardcoded credentials
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials Whispers : Identify Hardcoded Secrets In Static Structured Text Whispers is a static code analysis tool designed for parsing various common data formats in search of hardcoded credentials and dangerous functions. Whispers can run in the…
isAscii: False # value is binary data when decoded
isUri: False # value is not formatted like a URI
similar: 0.35 # maximum allowed similarity between key and value
# (1.0 being exactly the same)
Plugins
All parsing functionality is implemented via plugins. Each plugin implements a class with the
class PluginName:
def pairs(self, file):
yield "key", "value" Download
___________________________
@hacking_Attack
@Hacking_Video
isUri: False # value is not formatted like a URI
similar: 0.35 # maximum allowed similarity between key and value
# (1.0 being exactly the same)
Plugins
All parsing functionality is implemented via plugins. Each plugin implements a class with the
pairs()method that runs through files and returns the key-value pairs to be checked with rules.class PluginName:
def pairs(self, file):
yield "key", "value" Download
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Sumo: 1 Vulnhub Walkthrough
https://cdn-images-1.medium.com/max/697/0*m9qsqhBtE_m7oDZE.png
Makineyi indirebilirsiniz.
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Sumo: 1 Vulnhub Walkthrough
https://cdn-images-1.medium.com/max/697/0*m9qsqhBtE_m7oDZE.png
Makineyi indirebilirsiniz.
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Sumo: 1 Vulnhub Walkthrough
Makineyi indirebilirsiniz.
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Multiple Vulnerabilities in AWS and Other Major Cloud Services
https://external-preview.redd.it/oWUpA6AevnXbfMpuPJYSe7O8MLkRy-2FZ1vsUG7xbjM.jpg?width=640&crop=smart&auto=webp&s=9e597152363e407923737d1a30706ac5fd0414a0 submitted by /u/GHIDRAdev
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Multiple Vulnerabilities in AWS and Other Major Cloud Services
https://external-preview.redd.it/oWUpA6AevnXbfMpuPJYSe7O8MLkRy-2FZ1vsUG7xbjM.jpg?width=640&crop=smart&auto=webp&s=9e597152363e407923737d1a30706ac5fd0414a0 submitted by /u/GHIDRAdev
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Multiple Vulnerabilities in AWS and Other Major Cloud Services
Posted in r/hacking by u/GHIDRAdev • 1 point and 0 comments
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Multiple Vulnerabilities in AWS and Other Major Cloud Services
https://external-preview.redd.it/oWUpA6AevnXbfMpuPJYSe7O8MLkRy-2FZ1vsUG7xbjM.jpg?width=640&crop=smart&auto=webp&s=9e597152363e407923737d1a30706ac5fd0414a0 submitted by /u/GHIDRAdev
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Multiple Vulnerabilities in AWS and Other Major Cloud Services
https://external-preview.redd.it/oWUpA6AevnXbfMpuPJYSe7O8MLkRy-2FZ1vsUG7xbjM.jpg?width=640&crop=smart&auto=webp&s=9e597152363e407923737d1a30706ac5fd0414a0 submitted by /u/GHIDRAdev
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Multiple Vulnerabilities in AWS and Other Major Cloud Services
Posted in r/hacking by u/GHIDRAdev • 1 point and 0 comments
hacking: security in practice
RFID token cloning
For context, what is written below is what I posted to another sub a while back, got no answers and then I bit the bullet and bought some chinese RFID scanner which didnt work
I am currently trying to clone an RFID token made by Maxell, I have no idea how cloning RFID tokens works or really anything about what I am trying to do.
Basically the token works as a key in order to get an arcade machine to work and it comes with a certain amount of uses, Id like to clone it so I can keep cycling it out and have infinite plays for when the support for the arcade becomes non existent.
The arcade is Dinosaur King, not sure if that makes any difference.
In my research I've found that Maxell made the RFID reader and the tokens which are commonly known as Managment Chips.
Ive seen it under 2 product names
Maxell Picochet Reader/Writer ME-U1000-U (this is the main one I've seen)
DKT06214 RFID Reader/Writer (this name is seen along side Maxell and Sega)
The main goal is to obtain one of the two products mentioned above but that's pretty much impossible as they were manufactured in like 2006 and seemed to have been for commercial use.
So I figured the best method is to get my own modern RFID reader/writer and just clone the new token with the full uses onto my old token with none. Does anyone have any suggestions for the best product that can do this?
Another little question I had, is there a chance trying to clone the token I have will just wipe it or something? Or maybe the arcade would refuse to read one Ive cloned? Just worried because I spent a fair bit to obtain a fresh token and a fair bit to get the arcade in perfect working order
So i tried the Chinese RFID reader/writer and it didn't work. Well it read everything else, just not this chip. I figured maybe the chip needed to be closer so I took the thing apart and placed it straight on the PCB and still nothing.
Anyone know what I can do here?
submitted by /u/JCInnes
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
RFID token cloning
For context, what is written below is what I posted to another sub a while back, got no answers and then I bit the bullet and bought some chinese RFID scanner which didnt work
I am currently trying to clone an RFID token made by Maxell, I have no idea how cloning RFID tokens works or really anything about what I am trying to do.
Basically the token works as a key in order to get an arcade machine to work and it comes with a certain amount of uses, Id like to clone it so I can keep cycling it out and have infinite plays for when the support for the arcade becomes non existent.
The arcade is Dinosaur King, not sure if that makes any difference.
In my research I've found that Maxell made the RFID reader and the tokens which are commonly known as Managment Chips.
Ive seen it under 2 product names
Maxell Picochet Reader/Writer ME-U1000-U (this is the main one I've seen)
DKT06214 RFID Reader/Writer (this name is seen along side Maxell and Sega)
The main goal is to obtain one of the two products mentioned above but that's pretty much impossible as they were manufactured in like 2006 and seemed to have been for commercial use.
So I figured the best method is to get my own modern RFID reader/writer and just clone the new token with the full uses onto my old token with none. Does anyone have any suggestions for the best product that can do this?
Another little question I had, is there a chance trying to clone the token I have will just wipe it or something? Or maybe the arcade would refuse to read one Ive cloned? Just worried because I spent a fair bit to obtain a fresh token and a fair bit to get the arcade in perfect working order
So i tried the Chinese RFID reader/writer and it didn't work. Well it read everything else, just not this chip. I figured maybe the chip needed to be closer so I took the thing apart and placed it straight on the PCB and still nothing.
Anyone know what I can do here?
submitted by /u/JCInnes
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
RFID token cloning
For context, what is written below is what I posted to another sub a while back, got no answers and then I bit the bullet and bought some chinese...
Another Admin panel
https://rizwansiddiqu1.medium.com/another-admin-panel-e0489dc76678?source=rss------bug_bounty-5
As-Salaam-Alaikum.(Peace be upon you).Continue reading on Medium » (https://rizwansiddiqu1.medium.com/another-admin-panel-e0489dc76678?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
https://rizwansiddiqu1.medium.com/another-admin-panel-e0489dc76678?source=rss------bug_bounty-5
As-Salaam-Alaikum.(Peace be upon you).Continue reading on Medium » (https://rizwansiddiqu1.medium.com/another-admin-panel-e0489dc76678?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
Medium
Another Admin panel
As-Salaam-Alaikum.(Peace be upon you).