Discovering File Inclusion Vulnerabilities
https://medium.com/@kaorrosi/discovering-file-inclusion-vulnerabilities-91aa9aede6d8?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Covering what I’ve learned completing TryHackMe’s file inclusion room in their Junior Penetration Tester learning path and their 6th…Continue reading on Medium » (https://medium.com/@kaorrosi/discovering-file-inclusion-vulnerabilities-91aa9aede6d8?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Exploiting S3 bucket with path folder to Access PII info of A BANK
https://notifybugme.medium.com/exploiting-s3-bucket-with-path-folder-to-access-pii-info-of-a-bank-91d8563cb45?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hi, everyoneContinue reading on Medium » (https://notifybugme.medium.com/exploiting-s3-bucket-with-path-folder-to-access-pii-info-of-a-bank-91d8563cb45?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Discovering File Inclusion Vulnerabilities

Covering what I’ve learned completing TryHackMe’s file inclusion room in their Junior Penetration Tester learning path and their 6th…Continue reading on Medium »
Read more...

Exploiting S3 bucket with path folder to Access PII info of A BANK

Hi, everyoneContinue reading on Medium »
Read more...

Hacking on Medium
Discovering File Inclusion Vulnerabilities

https://cdn-images-1.medium.com/max/680/1*fzGTb9dHR4qlf4_MZlNdpw.jpeg
Covering what I’ve learned completing TryHackMe’s file inclusion room in their Junior Penetration Tester learning path and their 6th…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Reverse Tab-nabbing — Links and Its Security loops

https://cdn-images-1.medium.com/max/1920/0*KDo1T81j6jPtUMDk.jpg
All the webpages in the web became cool because we could link one page to another right ? Well, let’s discuss all the dark sides of it.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
월패드 해킹의 해결방법은 망분리?

https://cdn-images-1.medium.com/max/979/1*gLD3ScG180wG0ybH-bbh2w.png
망분리가 홈네트워크의 해답일까?

Continue reading on StealthSolution »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Secure your workstation / first

Prior to getting into all his “ethical hacking” good stuff, its best to make your workstation hardened. Your goal is in a perfect world…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Gamehacking tips.

I've always been really intersted in gamehacking. When I was a kid I was doing pokemon ROM hacks off the internet etc.

I've been going through game-hacking by Nick Cano. From what I've read, the main points are to know assembly and how memory works. I can kinda use Cheatengine and Ollydb now, and understand how to insert shellcode into toy games. I figure it'd be a good way to brush up on these for other areas of CS as well.

From my understanding, bots like those in runescape are written with java libraries. Did the manufacturer of those libraries inject assembly shellcode, and then make it so it's accessible by java?

I also read that LUA is the main coding language used in CheatEngine. I'm playing on learning the basics, but is it used widely anywhere else?

Is there any hacking use for anti-cheat rootkits that companies deploy? Have these been used in hacks?

Finally, any other decent books to read?

Disclaimer: I'm not actually going to use any of this, I just want to know exactly how people are doing stuff like aimbots etc and if I work in gaming in the future I'll be able to adress it.

submitted by /u/eht_amgine_enihcam
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
A man with no coding experience but interested in Hacking, and I’d like to hear your stories of how you got it in to it.

As the title suggest. I’ve got no coding experience but I’m keen to get in to hacking as a hobby.

I’d like to hear your stories of how you came in to this profession/hobby etc.

I feel like hearing others journeys will help better inform mine. All stories welcome, no matter how experiences or inexperienced, I’d appreciate it.

submitted by /u/PI3M3I
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Looking for an old hacking news website. Can't remember the name.

Hello all,

​

I am looking for an old hacker blog / news site. Unfortunately I can't think of the name anymore.

​

I'll try to describe the site once:

It is quite old, if not one of the oldest hacker news/blog sites out there. There were in former times more hacker stories posted but in the last 10 years they became less. The site was kept very simple and in l33t style. Definitely more in the direction of Grey Hat / Black Hat.

​

Can someone help me find the site?

submitted by /u/liketop33
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Hackers infect random WordPress plugins to steal credit cards

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Hackers infect random WordPress plugins to steal credit cardsPost Views: 181 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 2 Minutes
Credit card swipers are being injected into random plugins of e-commerce WordPress sites, hiding from detection while stealing customer payment details.
With the Christmas shopping season in full swing, card-stealing threat actors raise their efforts to infect online shops with stealthy skimmers, so administrators ought to remain vigilant.

The latest trend is injecting card skimmers into WordPress plugin files, avoiding the closely-monitored ‘wp-admin’ and ‘wp-includes’ core directories where most injections are short-lived. Hiding in plain sightAccording to a new report by Sucuri, hackers performing credit card theft are first hacking into WordPress sites and injecting a backdoor into the website for persistence.

These backdoors allow the hackers to retain access to the site, even if the administrator installs the latest security updates for WordPress and installed plugins.

When the attackers use the backdoor in the future, it will scan for a list of administrator users and use their authorization cookie and current user login to access the site.
https://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/backdoor_injection.png
get_defined_vars()‘, Sucuri was able to find out that one of these undefined variables references a domain hosted on an Alibaba server in Germany.

This domain had no link to the compromised website they were looking into, which is conducting business in North America.

The same site had a second injection on the 404-page plugin, which held the actual credit card skimmer using the same approach of hidden variables in unobfuscated code.
See Also: New Windows zero-day with public exploit lets you become an admin In this case, it’s ‘$thelist' and ‘$message' variables were used to support the credit card skimming malware, with the former referencing the receiving URL and the latter using ‘file_get_contents()' to grab the payment details.

https://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/variable.png
How to protect against card skimmers Administrators can follow several protective measures to keep their sites skimmer-free or minimize the infection times as much as possible.

First, the wp-admin area should be restricted to only specific IP addresses. Then, even if a backdoor is injected, the actors could not access the site even if they stole administrator cookies.

Secondly, file integrity monitoring through active server-side scanners should be implemented on [...]

___________________________
@hacking_Attack
@Hacking_Video