Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
No copie y pegue comandos de páginas web, puede ser pirateado
https://cdn-images-1.medium.com/max/1658/0*uRAZHB0ZKac0CqNE
PUBLICADO EN 3 ENERO, 2022POR DPAB
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
No copie y pegue comandos de páginas web, puede ser pirateado
https://cdn-images-1.medium.com/max/1658/0*uRAZHB0ZKac0CqNE
PUBLICADO EN 3 ENERO, 2022POR DPAB
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
No copie y pegue comandos de páginas web, puede ser pirateado
PUBLICADO EN 3 ENERO, 2022POR DPAB
hacking: security in practice
Is there a way to tell if an XSS vulnerability is serious or not?
Recently, I was looking for vulnerabilities on a website which I will not name. I came across a search bar through which I used inspect element to change the maxlength of the input.
When I entered a certain payload which was an alert(document.cookie) the alert came up with the cookie in it.
I submitted this vulnerability to the program and they said it’s a false positive. I’d love to know how this is since the search bar is definitely running the code.
Any guidance appreciated. I am just getting into bug bounties and hacking so I could definitely have made a mistake.
submitted by /u/Gamestonk_CEO
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Is there a way to tell if an XSS vulnerability is serious or not?
Recently, I was looking for vulnerabilities on a website which I will not name. I came across a search bar through which I used inspect element to change the maxlength of the input.
When I entered a certain payload which was an alert(document.cookie) the alert came up with the cookie in it.
I submitted this vulnerability to the program and they said it’s a false positive. I’d love to know how this is since the search bar is definitely running the code.
Any guidance appreciated. I am just getting into bug bounties and hacking so I could definitely have made a mistake.
submitted by /u/Gamestonk_CEO
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Is there a way to tell if an XSS vulnerability is serious or not?
Recently, I was looking for vulnerabilities on a website which I will not name. I came across a search bar through which I used inspect element to...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Domain Domination With Windows Shortcuts
https://cdn-images-1.medium.com/max/842/1*sOlH8WZHxVy9WBfurf1c6w.png
Wait, what? How?
Continue reading on The Mayor »
___________________________
@hacking_Attack
@Hacking_Video
Domain Domination With Windows Shortcuts
https://cdn-images-1.medium.com/max/842/1*sOlH8WZHxVy9WBfurf1c6w.png
Wait, what? How?
Continue reading on The Mayor »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Domain Domination With Windows Shortcuts
Wait, what? How?
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Bypassing Windows User Account Control: Back For More
https://cdn-images-1.medium.com/max/1920/1*_NuFad-fNy92bGfUMQmnKw.jpeg
*Note: This article was originally published by the author on June 2, 2019.
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Bypassing Windows User Account Control: Back For More
https://cdn-images-1.medium.com/max/1920/1*_NuFad-fNy92bGfUMQmnKw.jpeg
*Note: This article was originally published by the author on June 2, 2019.
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Bypassing Windows User Account Control: Back For More
*Note: This article was originally published by the author on June 2, 2019.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Bypassing Windows User Account Control
https://cdn-images-1.medium.com/max/644/0*dR6hycR6zIefFLWW
*Note: This article was originally published by the author on December 25, 2018.
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Bypassing Windows User Account Control
https://cdn-images-1.medium.com/max/644/0*dR6hycR6zIefFLWW
*Note: This article was originally published by the author on December 25, 2018.
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Bypassing Windows User Account Control
*Note: This article was originally published by the author on December 25, 2018.
OWASP-Access Control Vulnerability
This article is going to focus on Access control security and Broken Access control, it will summarize the thoughts, procedures and…
Read more...
This article is going to focus on Access control security and Broken Access control, it will summarize the thoughts, procedures and…
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
How to Track Someone’s Location
https://cdn-images-1.medium.com/max/2600/1*b836Bzql6fD9G3tIaj1xMw.jpeg
In this write-up I’m give you a best trick to track any one location with simple step’s ….
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
How to Track Someone’s Location
https://cdn-images-1.medium.com/max/2600/1*b836Bzql6fD9G3tIaj1xMw.jpeg
In this write-up I’m give you a best trick to track any one location with simple step’s ….
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
How to Track Someone’s Location
In this write-up I’m give you a best trick to track any one location with simple step’s ….
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Handbook for SQL Injection
https://cdn-images-1.medium.com/max/660/1*c1DLNC9zkVZw4MVaaEAQ4w.png
In this article, I’ll discuss what SQL Injection is and how is it works against your target website. Companies like Target, Yahoo, Zappos…
Continue reading on System Weakness »
___________________________
@hacking_Attack
@Hacking_Video
Handbook for SQL Injection
https://cdn-images-1.medium.com/max/660/1*c1DLNC9zkVZw4MVaaEAQ4w.png
In this article, I’ll discuss what SQL Injection is and how is it works against your target website. Companies like Target, Yahoo, Zappos…
Continue reading on System Weakness »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Handbook for SQL Injection
In this article, I’ll discuss what SQL Injection is and how is it works against your target website. Companies like Target, Yahoo, Zappos…
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Cookie-based vs. Cookieless Authentication: Which one the Next-gen Enterprise will opt?
https://cdn-images-1.medium.com/max/2560/1*XoZXPQ72H2145LUaU0-Ksw.png
Securing communications between a client and a server often requires credentials to identify both parties. That is where the different…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Cookie-based vs. Cookieless Authentication: Which one the Next-gen Enterprise will opt?
https://cdn-images-1.medium.com/max/2560/1*XoZXPQ72H2145LUaU0-Ksw.png
Securing communications between a client and a server often requires credentials to identify both parties. That is where the different…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Cookie-based vs. Cookieless Authentication: Which one the Next-gen Enterprise will opt?
Securing communications between a client and a server often requires credentials to identify both parties. That is where the different…
Hacking Articles Tips Tricks Videos Tutorials
Photo
Black Hat Ethical Hacking
Apple iOS vulnerable to HomeKit ‘doorLock’ denial of service bug
https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Apple iOS vulnerable to HomeKit ‘doorLock’ denial of service bugPost Views: 101 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute
A novel persistent denial of service vulnerability named ‘doorLock’ was discovered in Apple HomeKit, affecting iOS 14.7 through 15.2.
Apple HomeKit is a software framework that lets iPhone and iPad users control smart home appliances from their devices.
According to Trevor Spiniolas, the security researcher who publicly disclosed the details, Apple has known about the flaw since August 10, 2021. Yet, despite the repeated promises to fix it, the researcher says Apple has continually pushed the security update further, and it remains unresolved.
I believe this bug is being handled inappropriately as it poses a serious risk to users and many months have passed without a comprehensive fix. The public should be aware of this vulnerability and how to prevent it from being exploited, rather than being kept in the dark. – Spinolas.
See Also: Complete Offensive Security and Ethical Hacking Course Forcing a resetTo trigger ‘doorLock,’ an attacker would change the name of a HomeKit device to a string larger than 500,000 characters.
To demonstate the doorLock bug, Spinolas has released a proof-of-concept exploit in the form of an iOS app that has access to Home data and can change HomeKit device names.
Even if the target user doesn’t have any Home devices added on HomeKit, there’s still an attack pathway by forging and accepting an invitation to add one.
Upon attempting to load the large string, a device running a vulnerable iOS version will be thrown into a denial of service (DoS) state, with a forced reset being the only way out of it. However, resetting the device will cause all stored data to be removed and only recoverable if you have a backup.
See Also: Hackers start pushing malware in worldwide Log4Shell attacks
To make matters worse, once the device reboots and the user signs back into the iCloud account linked to the HomeKit device, the bug will be re-triggered.
“In iOS 15.1 (or possibly 15.0), a limit on the length of the name an app or the user can set was introduced,” explains Spiniolas in his blog post.
“The introduction of a local size limit on the renaming of HomeKit devices was a minor mitigation that ultimately fails to solve the core issue, which is the way that iOS handles the names of HomeKit devices.”
“If an attacker were to exploit this vulnerability, they would be much more likely to use Home invitations rather than an application anyways, since invitations would not require the user to actually own a HomeKit device.”
The impact of this attack ranges from having an unusable device that reboots indefinitely to not being able to take a backup of your data from iCloud as signing back to the online backup services re-triggers the flaw.
As the researcher explains, this attack could be used as a ransomware vector, locking iOS devices into an unusable state and demanding a ransom payment to set the HomeKit device back to a safe string length.
See Also: Offensive Security Tool: Spray365 How to protect yourselfIt is essential to underline that the bug can only be exploited by someone with access to your ‘Home’ or via manually accepting an invitation to one.
With that said, there’s no reliable method of regaining access to local data after ‘doorLock’ has been triggered, so users should focus all efforts on prevention.
For this, bew[...]
___________________________
@hacking_Attack
@Hacking_Video
Apple iOS vulnerable to HomeKit ‘doorLock’ denial of service bug
https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Apple iOS vulnerable to HomeKit ‘doorLock’ denial of service bugPost Views: 101 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute
A novel persistent denial of service vulnerability named ‘doorLock’ was discovered in Apple HomeKit, affecting iOS 14.7 through 15.2.
Apple HomeKit is a software framework that lets iPhone and iPad users control smart home appliances from their devices.
According to Trevor Spiniolas, the security researcher who publicly disclosed the details, Apple has known about the flaw since August 10, 2021. Yet, despite the repeated promises to fix it, the researcher says Apple has continually pushed the security update further, and it remains unresolved.
I believe this bug is being handled inappropriately as it poses a serious risk to users and many months have passed without a comprehensive fix. The public should be aware of this vulnerability and how to prevent it from being exploited, rather than being kept in the dark. – Spinolas.
See Also: Complete Offensive Security and Ethical Hacking Course Forcing a resetTo trigger ‘doorLock,’ an attacker would change the name of a HomeKit device to a string larger than 500,000 characters.
To demonstate the doorLock bug, Spinolas has released a proof-of-concept exploit in the form of an iOS app that has access to Home data and can change HomeKit device names.
Even if the target user doesn’t have any Home devices added on HomeKit, there’s still an attack pathway by forging and accepting an invitation to add one.
Upon attempting to load the large string, a device running a vulnerable iOS version will be thrown into a denial of service (DoS) state, with a forced reset being the only way out of it. However, resetting the device will cause all stored data to be removed and only recoverable if you have a backup.
See Also: Hackers start pushing malware in worldwide Log4Shell attacks
To make matters worse, once the device reboots and the user signs back into the iCloud account linked to the HomeKit device, the bug will be re-triggered.
“In iOS 15.1 (or possibly 15.0), a limit on the length of the name an app or the user can set was introduced,” explains Spiniolas in his blog post.
“The introduction of a local size limit on the renaming of HomeKit devices was a minor mitigation that ultimately fails to solve the core issue, which is the way that iOS handles the names of HomeKit devices.”
“If an attacker were to exploit this vulnerability, they would be much more likely to use Home invitations rather than an application anyways, since invitations would not require the user to actually own a HomeKit device.”
The impact of this attack ranges from having an unusable device that reboots indefinitely to not being able to take a backup of your data from iCloud as signing back to the online backup services re-triggers the flaw.
As the researcher explains, this attack could be used as a ransomware vector, locking iOS devices into an unusable state and demanding a ransom payment to set the HomeKit device back to a safe string length.
See Also: Offensive Security Tool: Spray365 How to protect yourselfIt is essential to underline that the bug can only be exploited by someone with access to your ‘Home’ or via manually accepting an invitation to one.
With that said, there’s no reliable method of regaining access to local data after ‘doorLock’ has been triggered, so users should focus all efforts on prevention.
For this, bew[...]
___________________________
@hacking_Attack
@Hacking_Video
Black Hat Ethical Hacking
Apple iOS vulnerable to HomeKit ‘doorLock’ denial of service bug | Black Hat Ethical Hacking
A novel persistent denial of service vulnerability named 'doorLock' was discovered in Apple HomeKit, affecting iOS 14.7 through 15.2.
Hacking Articles Tips Tricks Videos Tutorials
Black Hat Ethical Hacking Apple iOS vulnerable to HomeKit ‘doorLock’ denial of service bug https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Apple iOS vulnerable to HomeKit ‘doorLock’ denial of service bugPost Views:…
are of suspicious invitation messages from email addresses that resemble Apple services or HomeKit products.
If the damage has already been done, follow these three steps to restore your data from the iCloud:
1. Restore the affected device from Recovery or DFU Mode
2. Set up the device as usual, but do NOT sign back into the iCloud account
3. After setup is finished, sign in to iCloud from settings. Immediately after doing so, disable the switch labeled “Home.” The device and iCloud should now function again without access to Home data.
See Also: Hacking stories – Rafael Núñez (aka RaFa), hacking NASA with the hacking group: World of Hell
According to the researcher, Apple’s latest estimate for fixing the bug is for “early 2022,” which will be done through an upcoming security update.
We have reached out to Apple to request a comment on the above, and we will update this story as soon as we hear back from them.
Source: www.bleepingcomputer.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/exchange-90x90.png Microsoft releases emergency fix for Exchange – 2022 bug23 hours ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/maxresdefault-90x90.jpg Have I Been Pwned adds 441K accounts stolen by RedLine malware4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/1229111902.0-90x90.jpg T-Mobile says new data breach caused by SIM swap attacks5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/feature-log4j-blue-90x90.png Log4j 2.17.1 out now, fixes new remote code execution bug6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/qnap-logo-white-90x90.jpg QNAP NAS devices hit in surge of ech0raix ransomware attacks7 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/shutterstock_495927541-90x90.jpg Wireless coexistence – New attack technique exploits Bluetooth, WiFi performance features1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/apple-store-tower-90x90.jpg Apple fixes macOS security flaw behind Gatekeeper bypass2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/5157-article-201208-ms-team_body_text-90x90.jpg Microsoft Teams bug allowing phishing unpatched since March2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-6-90x90.jpg 800K WordPress sites still impacted by critical SEO plugin flaw2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-5-90x90.jpg Microsoft warns of easy Windows domain takeover via Active Directory bugs2 weeks ago
The post Apple iOS vulnerable to HomeKit ‘doorLock’ denial of service bug first appeared on Black Hat Ethical Hacking.
___________________________
@hacking_Attack
@Hacking_Video
If the damage has already been done, follow these three steps to restore your data from the iCloud:
1. Restore the affected device from Recovery or DFU Mode
2. Set up the device as usual, but do NOT sign back into the iCloud account
3. After setup is finished, sign in to iCloud from settings. Immediately after doing so, disable the switch labeled “Home.” The device and iCloud should now function again without access to Home data.
See Also: Hacking stories – Rafael Núñez (aka RaFa), hacking NASA with the hacking group: World of Hell
According to the researcher, Apple’s latest estimate for fixing the bug is for “early 2022,” which will be done through an upcoming security update.
We have reached out to Apple to request a comment on the above, and we will update this story as soon as we hear back from them.
Source: www.bleepingcomputer.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/exchange-90x90.png Microsoft releases emergency fix for Exchange – 2022 bug23 hours ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/maxresdefault-90x90.jpg Have I Been Pwned adds 441K accounts stolen by RedLine malware4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/1229111902.0-90x90.jpg T-Mobile says new data breach caused by SIM swap attacks5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/feature-log4j-blue-90x90.png Log4j 2.17.1 out now, fixes new remote code execution bug6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/qnap-logo-white-90x90.jpg QNAP NAS devices hit in surge of ech0raix ransomware attacks7 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/shutterstock_495927541-90x90.jpg Wireless coexistence – New attack technique exploits Bluetooth, WiFi performance features1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/apple-store-tower-90x90.jpg Apple fixes macOS security flaw behind Gatekeeper bypass2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/5157-article-201208-ms-team_body_text-90x90.jpg Microsoft Teams bug allowing phishing unpatched since March2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-6-90x90.jpg 800K WordPress sites still impacted by critical SEO plugin flaw2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-5-90x90.jpg Microsoft warns of easy Windows domain takeover via Active Directory bugs2 weeks ago
The post Apple iOS vulnerable to HomeKit ‘doorLock’ denial of service bug first appeared on Black Hat Ethical Hacking.
___________________________
@hacking_Attack
@Hacking_Video
hacking: security in practice
what language is most malware written in? THANKS
title
submitted by /u/th3comeup
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
what language is most malware written in? THANKS
title
submitted by /u/th3comeup
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
what language is most malware written in? THANKS
title
hacking: security in practice
Vpn used for hacking
So i recently started hacking and I don't understand how hacking with a vpn works when you connect to a vpn to get trough a network firewall so you can port scan your target, can someone explain this concept to me?
submitted by /u/Splendexz
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Vpn used for hacking
So i recently started hacking and I don't understand how hacking with a vpn works when you connect to a vpn to get trough a network firewall so you can port scan your target, can someone explain this concept to me?
submitted by /u/Splendexz
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Vpn used for hacking
So i recently started hacking and I don't understand how hacking with a vpn works when you connect to a vpn to get trough a network firewall so...