Hi, everyoneContinue reading on Medium » (https://notifybugme.medium.com/exploiting-s3-bucket-with-path-folder-to-access-pii-info-of-a-bank-91d8563cb45?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Discovering File Inclusion Vulnerabilities

Covering what I’ve learned completing TryHackMe’s file inclusion room in their Junior Penetration Tester learning path and their 6th…Continue reading on Medium »
Read more...

Exploiting S3 bucket with path folder to Access PII info of A BANK

Hi, everyoneContinue reading on Medium »
Read more...

Hacking on Medium
Discovering File Inclusion Vulnerabilities

https://cdn-images-1.medium.com/max/680/1*fzGTb9dHR4qlf4_MZlNdpw.jpeg
Covering what I’ve learned completing TryHackMe’s file inclusion room in their Junior Penetration Tester learning path and their 6th…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Reverse Tab-nabbing — Links and Its Security loops

https://cdn-images-1.medium.com/max/1920/0*KDo1T81j6jPtUMDk.jpg
All the webpages in the web became cool because we could link one page to another right ? Well, let’s discuss all the dark sides of it.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
월패드 해킹의 해결방법은 망분리?

https://cdn-images-1.medium.com/max/979/1*gLD3ScG180wG0ybH-bbh2w.png
망분리가 홈네트워크의 해답일까?

Continue reading on StealthSolution »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Secure your workstation / first

Prior to getting into all his “ethical hacking” good stuff, its best to make your workstation hardened. Your goal is in a perfect world…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Gamehacking tips.

I've always been really intersted in gamehacking. When I was a kid I was doing pokemon ROM hacks off the internet etc.

I've been going through game-hacking by Nick Cano. From what I've read, the main points are to know assembly and how memory works. I can kinda use Cheatengine and Ollydb now, and understand how to insert shellcode into toy games. I figure it'd be a good way to brush up on these for other areas of CS as well.

From my understanding, bots like those in runescape are written with java libraries. Did the manufacturer of those libraries inject assembly shellcode, and then make it so it's accessible by java?

I also read that LUA is the main coding language used in CheatEngine. I'm playing on learning the basics, but is it used widely anywhere else?

Is there any hacking use for anti-cheat rootkits that companies deploy? Have these been used in hacks?

Finally, any other decent books to read?

Disclaimer: I'm not actually going to use any of this, I just want to know exactly how people are doing stuff like aimbots etc and if I work in gaming in the future I'll be able to adress it.

submitted by /u/eht_amgine_enihcam
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
A man with no coding experience but interested in Hacking, and I’d like to hear your stories of how you got it in to it.

As the title suggest. I’ve got no coding experience but I’m keen to get in to hacking as a hobby.

I’d like to hear your stories of how you came in to this profession/hobby etc.

I feel like hearing others journeys will help better inform mine. All stories welcome, no matter how experiences or inexperienced, I’d appreciate it.

submitted by /u/PI3M3I
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Looking for an old hacking news website. Can't remember the name.

Hello all,

​

I am looking for an old hacker blog / news site. Unfortunately I can't think of the name anymore.

​

I'll try to describe the site once:

It is quite old, if not one of the oldest hacker news/blog sites out there. There were in former times more hacker stories posted but in the last 10 years they became less. The site was kept very simple and in l33t style. Definitely more in the direction of Grey Hat / Black Hat.

​

Can someone help me find the site?

submitted by /u/liketop33
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Hackers infect random WordPress plugins to steal credit cards

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Hackers infect random WordPress plugins to steal credit cardsPost Views: 181 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 2 Minutes
Credit card swipers are being injected into random plugins of e-commerce WordPress sites, hiding from detection while stealing customer payment details.
With the Christmas shopping season in full swing, card-stealing threat actors raise their efforts to infect online shops with stealthy skimmers, so administrators ought to remain vigilant.

The latest trend is injecting card skimmers into WordPress plugin files, avoiding the closely-monitored ‘wp-admin’ and ‘wp-includes’ core directories where most injections are short-lived. Hiding in plain sightAccording to a new report by Sucuri, hackers performing credit card theft are first hacking into WordPress sites and injecting a backdoor into the website for persistence.

These backdoors allow the hackers to retain access to the site, even if the administrator installs the latest security updates for WordPress and installed plugins.

When the attackers use the backdoor in the future, it will scan for a list of administrator users and use their authorization cookie and current user login to access the site.
https://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/backdoor_injection.png
get_defined_vars()‘, Sucuri was able to find out that one of these undefined variables references a domain hosted on an Alibaba server in Germany.

This domain had no link to the compromised website they were looking into, which is conducting business in North America.

The same site had a second injection on the 404-page plugin, which held the actual credit card skimmer using the same approach of hidden variables in unobfuscated code.
See Also: New Windows zero-day with public exploit lets you become an admin In this case, it’s ‘$thelist' and ‘$message' variables were used to support the credit card skimming malware, with the former referencing the receiving URL and the latter using ‘file_get_contents()' to grab the payment details.

https://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/variable.png
How to protect against card skimmers Administrators can follow several protective measures to keep their sites skimmer-free or minimize the infection times as much as possible.

First, the wp-admin area should be restricted to only specific IP addresses. Then, even if a backdoor is injected, the actors could not access the site even if they stole administrator cookies.

Secondly, file integrity monitoring through active server-side scanners should be implemented on [...]

___________________________
@hacking_Attack
@Hacking_Video

the website, ensuring that no code changes will go unnoticed for long.

Finally, make a habit of reading logs and looking deeply into the details. For example, file changes, themes, or plugin updates are always reflected in logs.
See Also: Offensive Security Tool: GoMapEnum See Also: Hacking stories – Operation Troy – How researchers linked the cyberattacks Source: www.bleepingcomputer.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-2-90x90.jpg 27 flaws in USB-over-network SDK affect millions of cloud users1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/5fdb9e7105edc00d5378b856_kafkalogo-90x90.jpg Apache Kafka Cloud Clusters Expose Sensitive Data for Large Companies2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/Excel-als-Malware-Schleuder-Gefahr-durch-XLL-Dateien-Twitter-90x90.png Malicious Excel XLL add-ins push RedLine password-stealing malware3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-1-90x90.jpg New malware hides as legit nginx process on e-commerce servers6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-90x90.jpg Microsoft Exchange servers hacked to deploy BlackByte ransomware1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/80-percent-e-commerce-android-apps-leak-personal-data-765x383-1-90x90.jpg Android banking malware infects 300,000 Google Play users1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/PKM201070290_resize-90x90.jpg Panasonic discloses data breach after network hack1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/0_Windows-headpic-90x90.jpg New Windows 10 zero-day gives admin rights, gets unofficial patch1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/1_pD_YMyWDg8A2grOrbaNS6g-90x90.jpg New Linux malware hides in cron jobs with invalid dates2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Microsoft-Vulnerability-RCE-MSHTML-90x90.jpg Hackers exploit Microsoft MSHTML bug to steal Google, Instagram creds2 weeks ago
The post Hackers infect random WordPress plugins to steal credit cards first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

O365Spray - Username Enumeration And Password Spraying Tool Aimed At Microsoft O365
http://www.kitploit.com/2021/12/o365spray-username-enumeration-and.html

___________________________
@hacking_Attack
@Hacking_Video

For educational, authorized and/or research purposes only. o365spray a username enumeration (https://www.kitploit.com/search/label/Enumeration) and password spraying tool aimed at Microsoft Office 365 (O365). This tool reimplements a collection of enumeration and spray techniques researched and identified by those mentioned in Acknowledgments (https://github.com/0xZDH/o365spray/#Acknowledgments). WARNING: The oAuth2 module for user enumeration (https://www.kitploit.com/search/label/User%20Enumeration) is performed by submitting a single authentication (https://www.kitploit.com/search/label/Authentication) attempt per user. If the module is run in conjunction with password spraying in a single execution, o365spray will automatically reset the lockout timer prior to performing the password spray -- if enumeration is run alone, the user should be aware of how many and when each authentication attempt was made and manually reset the lockout timer before performing any password spraying. If any bugs/errors are encountered, please open an Issue with the details (or a Pull Request with the proposed fix). See the section below (https://github.com/0xZDH/o365spray/#using-previous-versions) for more information about using previous versions.
Usage Validate a domain is using O365:
o365spray --validate --domain test.com Perform username enumeration against a given domain:
o365spray --enum -U usernames.txt --domain test.com Perform password spraying against a given domain:
o365spray --spray -U usernames.txt -P passwords.txt --count 2 --lockout 5 --domain test.com credentials in username:password format. -c COUNT, --count COUNT Number of password attempts to run per user before resetting the lockout account timer. Default: 1 -l LOCKOUT, --lockout LOCKOUT Lockout policy's reset time (in minutes). Default: 15 minutes --enum-module {office,onedrive,oauth2} Specify which enumeration module to run. Default: office --spray-module {oauth2,activesync,autodiscover,reporting,adfs} Specify which password spraying module to run. Default: oauth2 --adfs-url ADFS_URL AuthURL of the target domain's ADFS login page for password spraying. --sleep [-1, 0-120] Throttle HTTP requests every `N` seconds. This can be randomized by passing the value `-1` (between 1 sec and 2 mins). Default: 0 --jitter [0-100] Jitter extends --sleep period by percentage given (0-100). Default: 0 --rate RATE Number of concurrent connections (attempts) during enumeration and spraying. Default: 10 --safe SAFE Terminate password spraying run if `N` locked accounts are observed. Default: 10 --timeout TIMEOUT HTTP request timeout in seconds. Default: 25 --proxy PROXY HTTP/S proxy to pass traffic through (e.g. http://127.0.0.1:8080). --output OUTPUT Output directory for results and test case files. Default: current directory -v, --version Print the tool version. --debug Enable debug output. ">usage: o365spray [-h] [-d DOMAIN] [--validate] [--enum] [--spray]
[-u USERNAME] [-p PASSWORD] [-U USERFILE] [-P PASSFILE]
[--paired PAIRED] [-c COUNT] [-l LOCKOUT]
[--enum-module {office,onedrive,oauth2}]
[--spray-module {oauth2,activesync,autodiscover,reporting,adfs}]
[--adfs-url ADFS_URL] [--rate RATE] [--safe SAFE]
[--timeout TIMEOUT] [--proxy PROXY] [--output OUTPUT]
[-v] [--debug]

___________________________
@hacking_Attack
@Hacking_Video