Hello everyone, my name is Alp Keskin and I am a student and jr. cyber security researcher from Turkey.Continue reading on Medium » (https://medium.com/@alpkeskin/no-rate-limit-on-database-providers-website-44b68a46fb57?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

NICKEL targeting government organizations across Latin America and Europe - Microsoft Security Blog
https://www.reddit.com/r/redteamsec/comments/razhch/nickel_targeting_government_organizations_across/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe/) [comments] (https://www.reddit.com/r/redteamsec/comments/razhch/nickel_targeting_government_organizations_across/)

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Whispers : Identify Hardcoded Secrets In Static Structured Text

Whispers is a static code analysis tool designed for parsing various common data formats in search of hardcoded credentials and dangerous functions. Whispers can run in the CLI or you can integrate it in your CI/CD pipeline.

Detects

* Passwords
* API tokens
* AWS keys
* Private keys
* Hashed credentials
* Authentication tokens
* Dangerous functions
* Sensitive files

Supported Formats

Whispers is intended to be a structured text parser, not a code parser.

The following commonly used formats are currently supported:

* YAML
* JSON
* XML
* .npmrc
* .pypirc
* .htpasswd
* .properties
* pip.conf
* conf / ini
* Dockerfile
* Dockercfg
* Shell scripts
* Python3

Python3 files are parsed as ASTs because of native language support.

Declaration & Assignment Formats

The following language files are parsed as text, and checked for common variable declaration and assignment patterns:

* JavaScript
* Java
* Go
* PHP

Special Formats

* AWS credentials files
* JDBC connection strings
* Jenkins config files
* SpringFramework Beans config files
* Java Properties files
* Dockercfg private registry auth files
* Github tokens

Installation

From PyPI

pip3 install whispers

From GitHub

git clone https://github.com/Skyscanner/whispers
cd whispers
make install

Usage

CLI
whispers --help
whispers --info
whispers source/code/fileOrDir
whispers --config config.yml source/code/fileOrDir
whispers --output /tmp/secrets.yml source/code/fileOrDir
whispers --rules aws-id,aws-secret source/code/fileOrDir
whispers --severity BLOCKER,CRITICAL source/code/fileOrDir
whispers --exitcode 7 source/code/fileOrDir
Python
from whispers.cli import parse_args
from whispers.core import run

src = "tests/fixtures"
configfile = "whispers/config.yml"
args = parse_args(["-c", configfile, src])
for secret in run(args):
print(secret)
Config

There are several configuration options available in Whispers. It’s possible to include/exclude results based on file path, key, or value. File path specifications are interpreted as globs. Keys and values accept regular expressions and several other parameters. There is a default configuration file built-in that will be used if you don’t provide a custom one. config.ymlshould have the following structure:
include:
files:
- "**/*.yml"

exclude:
files:
- "**/test/**/*"
- "**/tests/**/*"
keys:
- ^foo
values:
- bar$

rules:
starks:
message: Whispers from the North
severity: CRITICAL
value:
regex: (Aria|Ned) Stark
ignorecase: True
The fastest way to tweak detection (ie: remove false positives and unwanted results) is to copy the default config.yml into a new file, adapt it, and pass it as an argument to Whispers. whispers --config config.yml --rules starks src/file/or/dirCustom Rules

Rules specify the actual things that should be pulled out from key-value pairs. There are several common ones that come built-in, such as AWS keys and passwords, but the tool is made to be easily expandable with new rules.

* Custom rules can be defined in the main config file under rules:* Custom rules can be added to whispers/rules
rule-id: # unique rule name
description: Values formatted like AWS Session Token
message: AWS Session Token # report will show this message
severity: BLOCKER # one of BLOCKER, CRITICAL, MAJOR, MINOR, INFO

key: # specify key format
regex: (aws.?session.?token)?
ignorecase: True # case-insensitive matching

value: # specify value format
regex: ^(?=.*[a-z])(?=.*[A-Z])[A-Za-z0-9\+\/]{270,450}$
ignorecase: False # case-sensitive matching
minlen: 270 # value is at least this long
isBase64: True # value is base64-encoded
[...]

___________________________
@hacking_Attack
@Hacking_Video

isAscii: False # value is binary data when decoded
isUri: False # value is not formatted like a URI

similar: 0.35 # maximum allowed similarity between key and value
# (1.0 being exactly the same)
Plugins

All parsing functionality is implemented via plugins. Each plugin implements a class with the pairs()method that runs through files and returns the key-value pairs to be checked with rules.
class PluginName:
def pairs(self, file):
yield "key", "value" Download

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Sumo: 1 Vulnhub Walkthrough

https://cdn-images-1.medium.com/max/697/0*m9qsqhBtE_m7oDZE.png
Makineyi indirebilirsiniz.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Multiple Vulnerabilities in AWS and Other Major Cloud Services

https://external-preview.redd.it/oWUpA6AevnXbfMpuPJYSe7O8MLkRy-2FZ1vsUG7xbjM.jpg?width=640&crop=smart&auto=webp&s=9e597152363e407923737d1a30706ac5fd0414a0 submitted by /u/GHIDRAdev
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Multiple Vulnerabilities in AWS and Other Major Cloud Services

https://external-preview.redd.it/oWUpA6AevnXbfMpuPJYSe7O8MLkRy-2FZ1vsUG7xbjM.jpg?width=640&crop=smart&auto=webp&s=9e597152363e407923737d1a30706ac5fd0414a0 submitted by /u/GHIDRAdev
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
RFID token cloning

For context, what is written below is what I posted to another sub a while back, got no answers and then I bit the bullet and bought some chinese RFID scanner which didnt work

I am currently trying to clone an RFID token made by Maxell, I have no idea how cloning RFID tokens works or really anything about what I am trying to do.

Basically the token works as a key in order to get an arcade machine to work and it comes with a certain amount of uses, Id like to clone it so I can keep cycling it out and have infinite plays for when the support for the arcade becomes non existent.

The arcade is Dinosaur King, not sure if that makes any difference.

In my research I've found that Maxell made the RFID reader and the tokens which are commonly known as Managment Chips.

Ive seen it under 2 product names

Maxell Picochet Reader/Writer ME-U1000-U (this is the main one I've seen)

DKT06214 RFID Reader/Writer (this name is seen along side Maxell and Sega)

The main goal is to obtain one of the two products mentioned above but that's pretty much impossible as they were manufactured in like 2006 and seemed to have been for commercial use.

So I figured the best method is to get my own modern RFID reader/writer and just clone the new token with the full uses onto my old token with none. Does anyone have any suggestions for the best product that can do this?

Another little question I had, is there a chance trying to clone the token I have will just wipe it or something? Or maybe the arcade would refuse to read one Ive cloned? Just worried because I spent a fair bit to obtain a fresh token and a fair bit to get the arcade in perfect working order

So i tried the Chinese RFID reader/writer and it didn't work. Well it read everything else, just not this chip. I figured maybe the chip needed to be closer so I took the thing apart and placed it straight on the PCB and still nothing.

Anyone know what I can do here?

submitted by /u/JCInnes
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Cybersecurity Takes the Wheel as Auto Industry's Top Priority

Part mainframe, part mobile device, cars will increasingly become targets for cyberattackers.

Dark Reading: Attacks/Breaches
Defending Against the Use of Deepfakes for Cyber Exploitation

Deepfakes are increasingly concerning because they use AI to imitate human activities and can be used to augment social engineering attacks.

Another Admin panel
https://rizwansiddiqu1.medium.com/another-admin-panel-e0489dc76678?source=rss------bug_bounty-5

As-Salaam-Alaikum.(Peace be upon you).Continue reading on Medium » (https://rizwansiddiqu1.medium.com/another-admin-panel-e0489dc76678?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Bug Bounty and Response to SPL Lending Vulnerability
https://blog.solend.fi/bug-bounty-and-response-to-spl-lending-vulnerability-f4c8874342d0?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Neodyme recently disclosed a vulnerability in the SPL token-lending library that Solend and others use, which caused an estimated $350M in…Continue reading on Solend » (https://blog.solend.fi/bug-bounty-and-response-to-spl-lending-vulnerability-f4c8874342d0?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

The Graph is offering a record $2.5M bug bounty program in partnership with Immunefi
https://medium.com/graphprotocol/the-graph-is-offering-a-record-2-5m-bug-bounty-program-in-partnership-with-immunefi-eda50eb59f6c?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

The Graph Foundation is offering a record $2.5 million bug bounty to incentivize developers and ethical hackers to recognize…Continue reading on The Graph » (https://medium.com/graphprotocol/the-graph-is-offering-a-record-2-5m-bug-bounty-program-in-partnership-with-immunefi-eda50eb59f6c?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video