Hacking on Medium
"Powerdir" — A macOS Bug That Could Allow Attackers to Snoop On You.

https://cdn-images-1.medium.com/max/2048/1*28CR7yrZaaBJxEaY1r9XPg.jpeg
The Flaw Could Allow Attackers to Bypass Privacy Preferences, Giving Apps With No Right to Access Files, Microphones, or Cameras the…

Continue reading on Technology Hits »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Securing Semiconductors and the Future of the Semiconductor Ecosystem

https://cdn-images-1.medium.com/max/1280/0*6o2pwdRTsCJxmLXx
PK Tsung, Co-Founder & CSO of CyCraft Technology, spoke at SEMICON TAIWAN on the dangers of, and the solutions to, four common pain points…

Continue reading on CyCraft »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Can't crack a VMK encrypted with TPM

I'm trying to help a friend that forgot her password to her windows 10 laptop. There is another account on it, but sadly no other admin accounts. I was able to image the drive, But i'm getting errors from bitlocker2john about VMKs encrypted with TPM being unsupported.

I do get two hashes at the end, but they are $bitlocker$2 and $bitlocker$3 hashes that I can't get to do anything with hashcat.

Is there anything left for me to try, or is her data gone?

​

I feel like this should be simple. She thinks her password was just a 4 digit number.

submitted by /u/Enphyniti
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Lastpass

Would lastpass be regarded as safe in the hacking community

submitted by /u/Interesting_Stop_935
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is email header "FROM" and "Return-Path" block spoofing possible?

I know the sender can spoof the email so that it looks like it was sent from somebody you may know, however, I thought that the email header information shows the actual sender information? Is it possible that the sender was able to forge the email header "FROM" and "Return-Path" blocks as well? As they are reflecting the actual spoofed email in the email header fields.

submitted by /u/Unknown_Mando
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Newark Academy CTF (NACTF) 2021 — Challenge Writeups

https://cdn-images-1.medium.com/max/809/1*dRk5j3j1K8Np4vamCYTb9Q.png
This post contains writeups for some challenges in this CTF.

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
First Blog….! How To Become Anonymous in Cyber World

https://cdn-images-1.medium.com/max/1061/1*0s4EznMGOBjeDZv9mbh2gw.png
Hello Everyone,

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
ARP Poisoning to become MITM and intercept traffic

https://external-preview.redd.it/pH0eLHUFRqkIgvxp3qN7TnSv6kcpfXNCUpofADjYkrU.jpg?width=320&crop=smart&auto=webp&s=a61ad037a423df4de05888655e847a1dd0392f6e submitted by /u/Bellagio_Sampler
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

How to Analyze Malicious Microsoft Office Files
https://www.reddit.com/r/redteamsec/comments/s6rjto/how_to_analyze_malicious_microsoft_office_files/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://www.intezer.com/blog/malware-analysis/analyze-malicious-microsoft-office-files/) [comments] (https://www.reddit.com/r/redteamsec/comments/s6rjto/how_to_analyze_malicious_microsoft_office_files/)

___________________________
@hacking_Attack
@Hacking_Video

How I Escalated a Time-Based SQL Injection to RCE

Good day everyone! I hope all of you are doing well.
Read more...

Authentication Bypass -TryHackMe

Writeup
Read more...

Cross Site Port Attack in Wild
https://thehemdeep.medium.com/cross-site-port-attack-in-wild-9d2f6af36455?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello Hunter, Sorry for the delay of post and this is my first post in this year, I hope you’re all doing well and happy. So without…Continue reading on Medium » (https://thehemdeep.medium.com/cross-site-port-attack-in-wild-9d2f6af36455?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Cross Site Port Attack in Wild

Hello Hunter, Sorry for the delay of post and this is my first post in this year, I hope you’re all doing well and happy. So without…Continue reading on Medium »
Read more...

Black Hat Ethical Hacking
Same-origin violation vulnerability in Safari 15 could leak a user’s website history and identity

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Same-origin violation vulnerability in Safari 15 could leak a user’s website history and identityPost Views: 95 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute
A vulnerability affecting the Safari browser can leak a user’s identity and their website history, researchers have warned.
The issue was introduced in Safari’s implementation of the IndexedDB API in its latest offering, version 15. IndexedDB is a browser API for client-side storage designed to hold significant amounts of data.

To prevent data leaks from cross-site scripting (XSS) attacks, IndexedDB follows the same-origin policy, controlling which resources can access each piece of data.
Same-origin policy restricts how documents or scripts loaded from one origin can interact with resources from other origins. It also prevents malicious script on one page from obtaining access to sensitive data on another web page.

A blog post from researchers at FingerprintJS who discovered the bug, have revealed that in Safari 15 on macOS, and in all browsers on iOS and iPadOS 15, the IndexedDB API is violating same-origin policy in the WebKit implementation, leading to users’ information being made accessible.

“It lets arbitrary websites learn what websites the user visits in different tabs or windows,” the blog post explains. “This is possible because database names are typically unique and website-specific.
See Also: Complete Offensive Security and Ethical Hacking Course ‘Precisely identified’“Moreover, we observed that in some cases, websites use unique user-specific identifiers in database names. This means that authenticated users can be uniquely and precisely identified.

“Some popular examples would be YouTube, Google Calendar, or Google Keep. All of these websites create databases that include the authenticated Google User ID and in case the user is logged into multiple accounts, databases are created for all these accounts.”

Not only can untrusted or malicious websites therefore potentially learn a user’s identity, this could also allow the linking together of multiple separate accounts used by the same user.

The researchers noted that these leaks do not require any specific user action. A tab or window that runs in the background and continually queries the IndexedDB API for available databases can learn what other websites a user visits in real-time, they explained.

Alternatively, websites can open any website in an iframe or popup window in order to trigger an IndexedDB-based leak for that specific site.

FingerprintJS claims that more than 30 of the Alexa Top 1000 sites use indexed databases directly on their homepage, potentially leaving them exposed to the bug, though they “expect the number to be significantly higher in real-world scenarios”.
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
See Also: Microsoft: New critical Windows HTTP vulnerability is wormable Fix incoming?A proof-of-concept can be found in FingerprintJS’ blog post. Apple has been made aware of the problem and, according to researchers, engineers confirmed they [...]

___________________________
@hacking_Attack
@Hacking_Video