Hacking on Medium
Extremely Simple Security — How to Stop Cyber Threats, Attacks, and Vulnerabilities in Plain…

https://cdn-images-1.medium.com/max/600/1*TLpyh05pngs46Xc98P9Kvw.png
Trying to pass your CompTIA Security+ exam but just spent your last $5 on a fast-food burrito and get overwhelmed by big words? Then this…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Authorization bypass — Gmail

https://cdn-images-1.medium.com/max/1280/1*24iHDmeJc4o2AiOdYiKpQw.jpeg
About the vulnerability

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
8 AppSec Metrics You Should Be Monitoring

https://cdn-images-1.medium.com/max/2600/0*MoYpoUEsM1j90Gxo
We take a look at 3 important AppSec tools and 8 metrics you should track over time.

Continue reading on ShiftLeft Blog »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Suppose I have only one computer. One of my friend gave me pendrive which i asked for due to very urgent work. I'm aware of all the infosec facts to not plugin pendrives in your personal computer. What should I do now so in order to keep my computer safe.

Question

submitted by /u/Neelesh_Patel_03
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is there a way to find which IP address am I sending packets to?

Used to do this on my ubuntu pc with no problems, but having some troubles on Win10.

submitted by /u/Jesoo_
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Why does all recent malwares rely on .dll instead on .exe ?

Hi, Recently, I have the feeling that most exploit chains rely on dropping DLLs instead of regular EXEs. Is there a specific reason ? (AV bypass, ease to develop, ...).

submitted by /u/StrawAwayAccount
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Log4J-Detect - Script To Detect The "Log4j" Java Library Vulnerability (CVE-2021-44228) For A List Of URLs With Multithreading

http://4.bp.blogspot.com/-8HJ_6FpTFUw/YdaIHTEKYpI/AAAAAAAA6lo/NMnXOCh-ZUEfbXBMB3AjoPwOGWFCVHkWACK4BGAYYCw/w640-h264/log4j-detect_1-788604.png
Simple Python 3 script to detect the "Log4j" Java library vulnerability (CVE-2021-44228) for a list of URL with multithreading
The script "log4j-detect.py" developed in Python 3 is responsible for detecting whether a list of URLs are vulnerable to CVE-2021-44228.

To do so, it sends a GET request using threads (higher performance) to each of the URLs in the specified list. The GET request contains a payload that on success returns a DNS request to Burp Collaborator / interactsh. This payload is sent in a test parameter and in the "User-Agent" / "Referer" / "X-Forwarded-For" / "Authentication" headers. Finally, if a host is vulnerable, an identification number will appear in the subdomain prefix of the Burp Collaborator / interactsh payload and in the output of the script, allowing to know which host has responded via DNS.

It should be noted that this script only handles DNS detection of the vulnerability and does not test remote command execution.

Downloading log4j-detect.py

wget https://github.com/takito1812/log4j-detect/raw/main/log4j-detect.py

Running log4j-detect.py

python3 log4j-detect.py
Download Log4J-Detect

___________________________
@hacking_Attack
@Hacking_Video

My First Bug Bounty Report | POST-based XSS
https://medium.com/@vflexo/my-first-bug-bounty-report-post-based-xss-96c301a0cea6?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello Ninjas!!!! I am Vishal Barot aka vFlexo and today I decided to publish a write-up on how I got first bounty through my first ever…Continue reading on Medium » (https://medium.com/@vflexo/my-first-bug-bounty-report-post-based-xss-96c301a0cea6?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Hybrid Multicloud Strategies Are Keeping the Public Sector at the Forefront of Threat Mitigation

Zero trust, DevSecOps, and agile methodologies are critical in bridging the power of commercial multicloud environments and the security of private data centers.

Authorization bypass — Gmail

About the vulnerabilityContinue reading on InfoSec Write-ups »
Read more...

My First Bug Bounty Report | POST-based XSS

Hello Ninjas!!!! I am Vishal Barot aka vFlexo and today I decided to publish a write-up on how I got first bounty through my first ever…Continue reading on Medium »
Read more...

Utilizando BBRF com foco em Reconnaissance #bugbounty

Olá tudo bem?Continue reading on Medium »
Read more...

Utilizando BBRF com foco em Reconnaissance #bugbounty
https://medium.com/@ataidejunior/utilizando-bbrf-com-foco-em-reconnaissance-bugbounty-affc99663bc1?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Olá tudo bem?Continue reading on Medium » (https://medium.com/@ataidejunior/utilizando-bbrf-com-foco-em-reconnaissance-bugbounty-affc99663bc1?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video