Hacking on Medium
Is Firebase’s Firestore database secure?

https://cdn-images-1.medium.com/max/2400/1*XL5pm20d7IrO-yxfmYTQ8A.jpeg
Firestore is Firebase’s most recent form of database engine. It’s real-time, quick to integrate into Android, iOS and web apps, and very…

Continue reading on Medium »

Hacking on Medium
eLection: 1 Vulnhub Walkthorugh

https://cdn-images-1.medium.com/max/818/0*penlpeNNZI9p5O67.png
Makineyi indirebilirsiniz.

Continue reading on Medium »

AFLTriage - Tool To Triage Crashing Input Files Using A Debugger
http://www.kitploit.com/2021/12/afltriage-tool-to-triage-crashing-input.html

Usage Usage of AFLTriage is quite straightforward. You need your inputs to triage, an output directory (https://www.kitploit.com/search/label/Directory) for reports, and the binary and its arguments to triage. Example: $ afltriage -i fuzzing_directory -o reports ./target_binary --option-one @@
AFLTriage v1.0.0

[+] GDB is working (GNU gdb (Ubuntu 8.1.1-0ubuntu1) 8.1.1 - Python 3.6.9 (default, Jan 26 2021, 15:33:00))
[+] Image triage cmdline: "./target_binary --option-one @@"
[+] Reports will be output to directory "reports"
[+] Triaging AFL directory fuzzing_directory/ (41 files)
[+] Triaging 41 testcases
[+] Using 24 threads to triage
[+] Triaging [41/41 00:00:02] [####################] CRASH: ASAN detected heap-buffer-overflow in buggy_function after a READ leading to SIGABRT (si_signo=6) / SI_TKILL (si_code=-6)
[+] Triage stats [Crashes: 25 (unique 12), No crash: 16, Errored: 0]
Similar to AFL the @@ is replaced with the path of the file to be triaged. AFLTriage will take care of the rest. Building and Running You will need a working Rust build environment. Once you have cargo and rust installed, building and running is simple: Finished dev [unoptimized + debuginfo] target(s) in 0.33s Running `target/debug/afltriage --help` ... ">cd afltriage-rs/
cargo run --help



Finished dev [unoptimized + debuginfo] target(s) in 0.33s
Running `target/debug/afltriage --help`


...
Extended Usage ... -o ... OPTIONS: -i ... A list of paths to a testcase, directory of testcases, AFL directory, and/or directory of AFL directories to be triaged. Note that this arg takes multiple inputs in a row (e.g. -i input1 input2...) so it cannot be the last argument passed to AFLTriage -- this is reserved for the command. -o The output directory for triage report files. Use '-' to print entire reports to console. -t, --timeout The timeout in milliseconds for each testcase to triage. [default: 60000] -j, --jobs How many threads to use during triage. --report-formats ... The triage report output formats. Multiple values allowed: e.g. text,json. [default: text] [possible values: text, json, rawjson] --bucket-strategy The crash deduplication strategy to use. [default: afltriage] [possible values: none, afltriage, first_frame, first_frame_raw, first_5_frames, function_names, first_function_name] --child-output Include child output in triage reports. --child-output-lines How many lines of program output from the target to include in reports. Use 0 to mean unlimited lines (not recommended). [default: 25] --stdin Provide testcase input to the target via stdin instead of a file. --profile-only Perform environment checks, describe the inputs to be triaged, and profile the target binary. --skip-profile Skip target profiling before input processing. --debug Enable low-level debugging output of triage operations. -h, --help Prints help information -V, --version Prints version information ARGS: ... The binary executable and args to execute. Use '@@' as a placeholder for the path to the input file or --stdin. Optionally use -- to delimit the start of the command. ">afltriage 1.0.0
Quickly triage and summarize crashing testcases

USAGE:
afltriage -i ... -o ...

OPTIONS:
-i ...

A list of paths to a testcase, directory of testcases, AFL directory, and/or directory of AFL directories to
be triaged. Note that this arg takes multiple inputs in a row (e.g. -i input1 input2...) so it cannot be the
last argument passed to AFLTriage -- this is reserved for the command.
-o
The output directory for triage report files. Use '-' to print entire reports to console.

-t, --timeout
The timeout in milliseconds for each testcase to triage. [default: 60000]

-j, --jobs
How many threads to use during triage.

--report-formats ...
The triage report output formats. Multiple values allowed: e.g. text,json. [default: text] [possible
values: text, json, rawjson]
--bucket-strategy
The crash deduplication strategy to use. [default: afltriage] [possible values: none, afltriage,
first_frame, first_frame_raw, first_5_frames, function_names, first_function_name]
--child-output
Include child output in triage reports.

--child-output-lines
How many lines of program output from the target to include in reports. Use 0 to mean unlimited lines (not
recommended). [default: 25]
--stdin
Provide testcase input to the target via stdin instead of a file.

--profile-only
Perform environment chec ks, describe the inputs to be triaged, and profile the target binary.

--skip-profile
Skip target profiling before input processing.

--debug
Enable low-level debugging output of triage operations.

-h, --help
Prints help information

-V, --version
Prints version information


ARGS:
...
The binary executable and args to execute. Use '@@' as a placeholder for the path to the input file or
--stdin. Optionally use -- to delimit the start of the command.
Related Projects GDB Exploitable (https://github.com/jfoote/exploitable) - A big inspiration for AFLTriage Crashwalk (https://github.com/bnagy/crashwalk) afl-collect from afl-utils (https://github.com/rc0r/afl-utils)

Download AFLTriage (https://github.com/quic/AFLTriage)

hacking: security in practice
Hiding via Botnets spread all over russia, china and non friendly US/European union countries?

Is it possible to hide yourself via infecting PCs all over china, Korea or pakistan?

Will such hacker be caught?

submitted by /u/Good-Bottle7238
[link] [comments]

https://preview.redd.it/9n9939cb4k481.jpg?width=640&crop=smart&auto=webp&s=b4da0ad3e1285c448ac1a712d0ecb3e1e401a215 submitted by /u/DrinkMoreCodeMore
[link] [comments]

hacking: security in practice
CIS major, and i'm wondering if anyone here has taken this route?

It seems as its a rather broad program, and I would like to get into cybersecurity. The program only lightly touches on cybersecurity, but at my age of 41 I need to make the best decisions time wise. I guess my questions is, do i finish the 2 year CIS program, or should I bail after a year, and do the 1 year cybersecurity course?

submitted by /u/stepdad666
[link] [comments]

Dark Reading: Attacks/Breaches
Lack of Patching Leaves 300,000 Routers at Risk for Attack

A significant percentage of the 2 million consumer and small-business routers produced by a Latvian firm are vulnerable and being used by attackers, a security firm says.

Dark Reading: Attacks/Breaches
Researchers Explore Microsoft Outlook Phishing Techniques

Outlook features intended to improve collaboration and productivity may make social engineering attacks more effective, researchers find.

Dark Reading: Attacks/Breaches
One-Third of Phishing Pages Active Less Than A Day

Security experts say the first hours in a phishing page's life are the most dangerous for users.
➖ Sent by @TheFeedReaderBot ➖

Hacking on Medium
A Quick Guide to Hack private variables in Solidity

https://cdn-images-1.medium.com/max/1212/1*MxCMmnrJPFHEvRPtvUJFOw.png
For shorter interesting content, follow on twitter: https://twitter.com/polipic1

Continue reading on Coinmonks »

Hacking on Medium
Find command injection in source code

https://cdn-images-1.medium.com/max/758/0*mOzsAEevcqt86y1Z.png
Using Ocular to search for command injection in an application by tracing dataflow

Continue reading on ShiftLeft Blog »