Download SMBeagle (https://github.com/punk-security/SMBeagle)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Developing with VBA for Script Kiddies — TrustedSec

INTRODUCTION

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How secure you are when a weak password secures your hotspot? Well, you aren’t secure at all!

https://cdn-images-1.medium.com/max/1920/1*Y0mZ2Pk6DdxnhYatH_Dk-Q.jpeg
To understand what can be considered a weak password, we must learn how passwords are broken and what techniques hackers use.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What can I do with cmd without admin

Is there a way to replace the boot password with cmd without admin or can I 'hack' admin via cmd?

I can get into cmd with python, us os.system and I can use all the other standard libraries and things I can install via pip but not the admin package for example.

submitted by /u/anynoimlis
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Should I have an "index.php"? My error.log is filled with requests for this non-existent file. Should I create one that simply writes the index.html, or does that open a different vector?

My apache website is fairly simple with "index.html" defined as the home page, but I see a lot of requests in error.log for the php file. I could make an index.php that simply serves index.html - but would I be "playing" into someone's hands by doing this? Any idea why I have so many requests for index.php?

submitted by /u/moronictransgression
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
SOCKS5 Proxy Server that dumps to .pcap

Hi,

I’ve been working on some projects at work, and I was looking for a SOCKS5 Proxy server that allows me to dump any traffic travelling through the server to a capture file, so I can get a better idea of what’s going on between a smart device and the iOS app. I’ve been using Burp but I am pretty sure there’s non-HTTP traffic at play (including UDP, hence SOCKS5).

If not I could probably hack one together, but if I can do it in an easier way, why not save the time and effort.

Thanks

submitted by /u/DubbieDubbie
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
The ultimate hack to make my stupid dream come true

Long story short: there's a woocommerce shop that sells merchandise for very, very niche artist. The name of the artist includes a string of digits / a number, let's say "3000" - that will be relevant later. From what I managed to find out after short research it's not supported by a company, it's most likely amateur, with basic wp free template etc. The thing is, I just ordered a Christmas gift for myself, a t-shirt from the shop. I realized my order number is "2967" which is relatively close to the "300" mentioned earlier, but too far away to just make x orders more to get to the desired order number.

As a side note, I'm a senior backend dev with medium PHP and WordPress familiarity, but never really had interest to hack anything.

Don't ask me why, don't ask me who or where, but I really, and I mean really want to make the "300"th order. The thing is I need to somehow be able to verify, for example, when order id=299starts existing in the database of a woocommerce. I don't need any additional data, I don't want to steal anything, I don't want to break in to the database. I don't even want to create a bulk of fake orders (to rape the Auto-Increment db field and get to my number), which would be a lot easier but would also give the shop maintainer a hard time. I hope this post doesn't get deleted.

Is this possible?

submitted by /u/throwawayitjobbad
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
So can someone make an easy program? Or does it allready exist?

So i Had an idea… Whenever someone put their USB stick in PC that all Data transfers automaticaly to other USB stick that is already stuck in PC… is that possible?

submitted by /u/Mini_Bato
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
How to Stop Hackers From Turning Your Systems Against You

Cybercriminals are increasingly adopting "living-off-the-land’ techniques, leveraging commonly used tools to fly under the radar of conventional detection tools. But with AI, thousands of organizations have regained the upper hand.

Cannot connect from Kali to Metasploitable 2
https://www.reddit.com/r/Pentesting/comments/rc6q3h/cannot_connect_from_kali_to_metasploitable_2/

Hello! I have a MacBook apple m1.
I have a Kali installed on VMware fusion. I also have a Metasploitable installed on UTM. I try to use NMAP to scan ports, but I get such a message: Host discovery disabled (-Pn). All 1000 scanned ports on IP_ADDRESS are filtered. I disabled firewall on metasploitable, but the problems still exists. Can you help me please? submitted by /u/vitalib (https://www.reddit.com/user/vitalib)
[link] (https://www.reddit.com/r/Pentesting/comments/rc6q3h/cannot_connect_from_kali_to_metasploitable_2/) [comments] (https://www.reddit.com/r/Pentesting/comments/rc6q3h/cannot_connect_from_kali_to_metasploitable_2/)

___________________________
@hacking_Attack
@Hacking_Video

Questions for full-time pentesters
https://www.reddit.com/r/Pentesting/comments/rc6wkk/questions_for_fulltime_pentesters/

I'm considering a career in pentesting full-time and was hoping to pick the brain of someone already there. I'm currently handling small-scale pentesting and micro red-team exercises for my organization and generally enjoy the work. My only real hangup on that side of the job is trying to convince infra or non-IT teams to actually take issues seriously (getting better but we have a long way to go). We contract with 3rd party pentesting companies for full internal, external, and physical audits and until recently (when other paths have arisen) I envisioned my next move to be to one of these external companies. I have a few questions for those who are already in this position (feel free to PM answers if you don't want to reply publicly): What is your typical day like? Given that some orgs may have strict windows to perform tests, do you often find yourself working odd hours? What is your work/ life balance like? What do you see as the next step in your career? What do you like most about the job? What do you like the least? Thanks in advance! submitted by /u/shatnote (https://www.reddit.com/user/shatnote)
[link] (https://www.reddit.com/r/Pentesting/comments/rc6wkk/questions_for_fulltime_pentesters/) [comments] (https://www.reddit.com/r/Pentesting/comments/rc6wkk/questions_for_fulltime_pentesters/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
16 Tips to keep your code safe from hackers

https://cdn-images-1.medium.com/max/600/1*fmAauC93xDnFBvh51v7e6g.jpeg
Is your code secure?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
GoDaddy Just Got Hacked (again) — How and Why Did that Happen?

https://cdn-images-1.medium.com/max/1200/1*D8-NuNQlPIIunwBJThOXow.jpeg
GoDaddy was founded by Bob Parsons in 1997 and is an internet domain register as well as a web hosting company. GoDaddy has over 20…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
I started a cyber security club today and .

So I am freshman in my college. I leave In India so most of the people don't know how to be secure in the internet so me and 2 of my friends started a cyber security club today. We announced to students. We were not expecting. Much students to join but now there are over 65 students in the group registered. We don't know how to move forward from here. We planed to do stuff for 15 to 20 students. Please help me. Anyone.

submitted by /u/just_call_me_n_u
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Spectrum Wifi Wordlist

Doing a bit of research, I noticed that Spectrum default passwords use a very simple format: (first word)(second word)(three digit number).

I wanted to avoid a brute force attack because there would be a lot of variations that wouldn't fit the format. Instead, I downloaded the words.txt list from here, then did some manipulation to the data.

First, I want to trim down the list. There are a lot of compound words, abbreviations, and possessives that should not be included. I also want to exclude words with fewer than 4 characters or more than 9.

Next, we need to add each word to every other word, and append every possible 3-digit number to the end. This will be an exponentially longer list, but saves any masking needed later.

PowerShell is my most fluent language, so I used it here. It seems to work well. I'm sure there are much more elegant ways to get the job done, but I wanted to share with anyone else that might be able to use it.
$words = Get-Content .\words.txt foreach ($word in $words){ if (($word.contains("-")) -or $word.contains(".") -or $word.contains("'") -or ($word.length) -lt 4 -or ($word.length) -gt 9){ Write-Host Tossing $word -ForegroundColor Red } else { Write-Host Keeping $word -ForegroundColor Green $word | Out-File words2.txt -Append } } #----------------------------- $words = Get-Content .\words2.txt [int]$steps = ($words | Measure-Object).Count [int]$stepCounter = 0 $nums = (100..999) foreach ($1word in $words){ Write-Progress -Activity 'Writing' -Status "Outputting variations of $1word" -PercentComplete ((($stepCounter++) / $steps) * 100) $baseword = $1word foreach ($2word in $words){ $outword = $baseword.ToLower() + $2word.ToLower() foreach ($num in $nums){ $result = $outword + $num $result | Out-File spectrum.txt -Append } } }
The resulting spectrum.txt file should be able to crack most Spectrum default passwords.

submitted by /u/EncodingLastingOgre
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video