hacking: security in practice
Looking for a project/resources that tracks most exploited vulnerabilities
There are many resources that are build around vulnerabilities (NVD, vulnmon, vulndbd, attackerkb) but only few focus on exploitable CVE. Have you come across a good database that tracks exploitable CVEs (other than exploitdb, rapid7)
submitted by /u/bawlachora
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Looking for a project/resources that tracks most exploited vulnerabilities
There are many resources that are build around vulnerabilities (NVD, vulnmon, vulndbd, attackerkb) but only few focus on exploitable CVE. Have you come across a good database that tracks exploitable CVEs (other than exploitdb, rapid7)
submitted by /u/bawlachora
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Looking for a project/resources that tracks most exploited...
There are many resources that are build around vulnerabilities (NVD, vulnmon, vulndbd, attackerkb) but only few focus on exploitable CVE. Have you...
hacking: security in practice
Sites like z shadow
Hello guys. Is there any site like z shadow?
submitted by /u/TElemelons
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Sites like z shadow
Hello guys. Is there any site like z shadow?
submitted by /u/TElemelons
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Sites like z shadow
Hello guys. Is there any site like z shadow?
hacking: security in practice
XSS in 500 Internal Server Error HTTP Response?
When a site return 500 Internal Server Error with the whole headers in it including User-Agent
HTTP Response
Does this consider as a valid XSS finding? Burp Suite Pro says this is certain, however I did not get any popup though with this payload on web browser. All I get is bunch of error message with complete HTTP HEADERS at the bottow of the browser.
submitted by /u/w0lfcat
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
XSS in 500 Internal Server Error HTTP Response?
When a site return 500 Internal Server Error with the whole headers in it including User-Agent
HTTP Response
HEADERS ======= ... User-Agent: Mozilla ... Does this consider as a valid XSS finding? Burp Suite Pro says this is certain, however I did not get any popup though with this payload on web browser. All I get is bunch of error message with complete HTTP HEADERS at the bottow of the browser.
submitted by /u/w0lfcat
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
XSS in 500 Internal Server Error HTTP Response?
When a site return 500 Internal Server Error with the whole headers in it including User-Agent HTTP Response HEADERS ======= ... ...
XSS in 500 Internal Server Error HTTP Response?
https://www.reddit.com/r/Pentesting/comments/s6uq9w/xss_in_500_internal_server_error_http_response/
When a site return 500 Internal Server Error with the whole headers in it including User-Agent HTTP Response HEADERS ======= ... User-Agent: Mozilla 1 ... Does this consider as a valid XSS finding? Burp Suite Pro says this is certain, however I did not get any popup though with this payload on web browser. All I get is bunch of error message with complete HTTP HEADERS at the bottow of the browser. submitted by /u/w0lfcat (https://www.reddit.com/user/w0lfcat)
[link] (https://www.reddit.com/r/Pentesting/comments/s6uq9w/xss_in_500_internal_server_error_http_response/) [comments] (https://www.reddit.com/r/Pentesting/comments/s6uq9w/xss_in_500_internal_server_error_http_response/)
___________________________
@hacking_Attack
@Hacking_Video
https://www.reddit.com/r/Pentesting/comments/s6uq9w/xss_in_500_internal_server_error_http_response/
When a site return 500 Internal Server Error with the whole headers in it including User-Agent HTTP Response HEADERS ======= ... User-Agent: Mozilla 1 ... Does this consider as a valid XSS finding? Burp Suite Pro says this is certain, however I did not get any popup though with this payload on web browser. All I get is bunch of error message with complete HTTP HEADERS at the bottow of the browser. submitted by /u/w0lfcat (https://www.reddit.com/user/w0lfcat)
[link] (https://www.reddit.com/r/Pentesting/comments/s6uq9w/xss_in_500_internal_server_error_http_response/) [comments] (https://www.reddit.com/r/Pentesting/comments/s6uq9w/xss_in_500_internal_server_error_http_response/)
___________________________
@hacking_Attack
@Hacking_Video
reddit
XSS in 500 Internal Server Error HTTP Response?
When a site return 500 Internal Server Error with the whole headers in it including User-Agent HTTP Response HEADERS ======= ... ...
Driftwood - Private Key Usage Verification
http://www.kitploit.com/2022/01/driftwood-private-key-usage-verification.html
___________________________
@hacking_Attack
@Hacking_Video
http://www.kitploit.com/2022/01/driftwood-private-key-usage-verification.html
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
Driftwood - Private Key Usage Verification
Driftwood is a tool that can enable you to lookup whether a private key is used for things like TLS (https://www.kitploit.com/search/label/TLS) or as a GitHub SSH (https://www.kitploit.com/search/label/SSH) key for a user. Driftwood performs lookups with the computed public key, so the private key never leaves where you run the tool. Additionally it supports some basic password cracking (https://www.kitploit.com/search/label/Cracking) for encrypted keys.
Installation Three easy ways to get started. Run with Docker cat private.key | docker run --rm -i trufflesecurity/driftwood --pretty-json - Run pre-built binary Download the binary (https://www.kitploit.com/search/label/Binary) from the releases page (https://github.com/trufflesecurity/driftwood/releases) and run it. Build yourself go install github.com/trufflesecurity/driftwood@latest Usage Minimal usage is $ driftwood path/to/privatekey.pem Run with --help to see more options. Library Usage Packages under pkg/ are libraries that can be used for external consumption. Packages under pkg/exp/ are considered to be experimental status and may have breaking changes.
Download Driftwood (https://github.com/trufflesecurity/driftwood)
___________________________
@hacking_Attack
@Hacking_Video
Installation Three easy ways to get started. Run with Docker cat private.key | docker run --rm -i trufflesecurity/driftwood --pretty-json - Run pre-built binary Download the binary (https://www.kitploit.com/search/label/Binary) from the releases page (https://github.com/trufflesecurity/driftwood/releases) and run it. Build yourself go install github.com/trufflesecurity/driftwood@latest Usage Minimal usage is $ driftwood path/to/privatekey.pem Run with --help to see more options. Library Usage Packages under pkg/ are libraries that can be used for external consumption. Packages under pkg/exp/ are considered to be experimental status and may have breaking changes.
Download Driftwood (https://github.com/trufflesecurity/driftwood)
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.
The New King “Broken Access Control”
The King (Injection Bug) who was ruling the bug world for more than a decade is now conquered by the New King known as “Broken Access…Continue reading on Medium »
Read more...
The King (Injection Bug) who was ruling the bug world for more than a decade is now conquered by the New King known as “Broken Access…Continue reading on Medium »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Cybersecurity for Students
With technology being such a huge part of student life, it’s alarming how many students ignore or don’t pay attention to cybersecurity threats. Sometimes, it’s better to ask for some thesis help at reliable services than looking for the information for your assignment all over the suspicious websites of the Internet.
So, here are some basic cybersecurity tips that all students (and non-students) must know in order to protect themselves! Use licensed softwareRemember that if you use stolen software you can never be sure that it is safe because you don’t know who hacked it. Besides, who told you that the hacker of your software only wants to make money on you once? Be careful of using free Wi-FiOf course, it’s convenient to sit and work in a cafe with free Wi-Fi. It’s comfy, and you don’t have to pay for the Internet. But admit it, you have a guarantee that the visitor at the next table is not listening to the same access point? And you pass your personal information. What to do? There are really two options – use mobile Internet or use a VPN (Virtual Private Network). In this case, the transmitted and received information will be encrypted and, therefore, it is more difficult for an intruder to eavesdrop on your communication channel. Use HTTPS websitesStudying requires students to switch between lots of websites every day – but how often do you actually check the URL search bar?
Make sure you check that every Web site you visit uses HTTPS (secure HTTP, where the address bar has a padlock) rather than plain old HTTP.
Most students polled did not know the difference between HTTPS and HTTP.
Fortunately, if an insecure Web page asks for passwords or other personal information, most browsers will warn you not to enter it, because data in unsecured Web traffic can easily be tracked as it moves across the Internet.
However, it is important that you yourself know the difference between HTTPS and HTTP to ensure that all communications are encrypted from being intercepted in transit between your browser and the sites you visit.
When you need some help with your assignments, feel free to look for some good services on reddit as you’ll be able to read customer feedback before going to the website and putting your data in danger. Warning – phishingUniversity students regularly receive many e-mails a day with information about lectures, seminars, newsletters, student union activities, and other university-related information.
Despite the flood of emails, you need to stay on alert and read emails carefully, especially if they ask you to do something on your computer, such as click a link, download a file, install a new application, or change your system settings.
To prevent phishing, it’s important to make sure that the sender is really who they say they are.
If you’re not careful, you could end up exposing information and details that should remain private, including credit card numbers, details from identification documents such as your driver’s license or passport, or your home address.
When it comes to personal information, use the mantra, “When in doubt, don’t open it”. Lock down your computerMany students use the library to study, but even in the library there are many distractions.
Leaving your laptop for just two minutes to go to the vending machine can be potentially dangerous if you don’t “bother” to log out or lock your computer before leaving it unattended.
While it’s unlikely that someone will hide and wait for you to leave your account open and be able to use it for a while, it’s better to be reassured than sorry.
It’s better to spend a few seconds unlocking your screen or logging in again than to let someone mess up your settings, view your files, or install some malicious application that will spy on you.
Worry[...]
___________________________
@hacking_Attack
@Hacking_Video
Cybersecurity for Students
With technology being such a huge part of student life, it’s alarming how many students ignore or don’t pay attention to cybersecurity threats. Sometimes, it’s better to ask for some thesis help at reliable services than looking for the information for your assignment all over the suspicious websites of the Internet.
So, here are some basic cybersecurity tips that all students (and non-students) must know in order to protect themselves! Use licensed softwareRemember that if you use stolen software you can never be sure that it is safe because you don’t know who hacked it. Besides, who told you that the hacker of your software only wants to make money on you once? Be careful of using free Wi-FiOf course, it’s convenient to sit and work in a cafe with free Wi-Fi. It’s comfy, and you don’t have to pay for the Internet. But admit it, you have a guarantee that the visitor at the next table is not listening to the same access point? And you pass your personal information. What to do? There are really two options – use mobile Internet or use a VPN (Virtual Private Network). In this case, the transmitted and received information will be encrypted and, therefore, it is more difficult for an intruder to eavesdrop on your communication channel. Use HTTPS websitesStudying requires students to switch between lots of websites every day – but how often do you actually check the URL search bar?
Make sure you check that every Web site you visit uses HTTPS (secure HTTP, where the address bar has a padlock) rather than plain old HTTP.
Most students polled did not know the difference between HTTPS and HTTP.
Fortunately, if an insecure Web page asks for passwords or other personal information, most browsers will warn you not to enter it, because data in unsecured Web traffic can easily be tracked as it moves across the Internet.
However, it is important that you yourself know the difference between HTTPS and HTTP to ensure that all communications are encrypted from being intercepted in transit between your browser and the sites you visit.
When you need some help with your assignments, feel free to look for some good services on reddit as you’ll be able to read customer feedback before going to the website and putting your data in danger. Warning – phishingUniversity students regularly receive many e-mails a day with information about lectures, seminars, newsletters, student union activities, and other university-related information.
Despite the flood of emails, you need to stay on alert and read emails carefully, especially if they ask you to do something on your computer, such as click a link, download a file, install a new application, or change your system settings.
To prevent phishing, it’s important to make sure that the sender is really who they say they are.
If you’re not careful, you could end up exposing information and details that should remain private, including credit card numbers, details from identification documents such as your driver’s license or passport, or your home address.
When it comes to personal information, use the mantra, “When in doubt, don’t open it”. Lock down your computerMany students use the library to study, but even in the library there are many distractions.
Leaving your laptop for just two minutes to go to the vending machine can be potentially dangerous if you don’t “bother” to log out or lock your computer before leaving it unattended.
While it’s unlikely that someone will hide and wait for you to leave your account open and be able to use it for a while, it’s better to be reassured than sorry.
It’s better to spend a few seconds unlocking your screen or logging in again than to let someone mess up your settings, view your files, or install some malicious application that will spy on you.
Worry[...]
___________________________
@hacking_Attack
@Hacking_Video
Kali Linux Tutorials
Cybersecurity for Students - Kali Linux Tutorials
With technology being such a huge part of student life, it’s alarming how many students ignore or don’t pay attention to cybersecurity threats. Sometimes, it’s better to ask for some thesis help at reliable services than looking for the information for your…
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials Cybersecurity for Students With technology being such a huge part of student life, it’s alarming how many students ignore or don’t pay attention to cybersecurity threats. Sometimes, it’s better to ask for some thesis help at reliable…
ingly, only 3 out of 15 students surveyed said they log out of their account or lock the system when they leave their laptop in the library unattended.
Don’t rely on “auto-lock” because it usually takes at least two minutes to trigger after you leave your laptop alone. Use Windows+L on Windows or Control+Command+Q on Mac. Find yourself a good password managerSurprisingly, many students have stated that they do not use a password manager.
When you have a lot of passwords to remember, it’s easy to develop the habit of using the same (or at least very similar) passwords for each account.
In other words, if one of your accounts gets hacked, the person who hacked it will immediately know how to log in to all your other accounts.
The Password Manager automatically selects and remembers a strong password for each account.
It also helps prevent accidental posting of passwords to imposter sites (this is what is described above as “phishing”), because the Password Manager keeps a record of the correct web pages for each account.
Just remember to choose a really strong password for the password manager itself! One last thing! Don’t forget to update your operating system and your applications regularlyUsing these simple cybersecurity tips will help you keep your personal accounts and personal data to yourself! Make sure all your family and friends are also aware of it. Prepare for them a killer speech if needed to prevent them from giving all their data to the hackers.
___________________________
@hacking_Attack
@Hacking_Video
Don’t rely on “auto-lock” because it usually takes at least two minutes to trigger after you leave your laptop alone. Use Windows+L on Windows or Control+Command+Q on Mac. Find yourself a good password managerSurprisingly, many students have stated that they do not use a password manager.
When you have a lot of passwords to remember, it’s easy to develop the habit of using the same (or at least very similar) passwords for each account.
In other words, if one of your accounts gets hacked, the person who hacked it will immediately know how to log in to all your other accounts.
The Password Manager automatically selects and remembers a strong password for each account.
It also helps prevent accidental posting of passwords to imposter sites (this is what is described above as “phishing”), because the Password Manager keeps a record of the correct web pages for each account.
Just remember to choose a really strong password for the password manager itself! One last thing! Don’t forget to update your operating system and your applications regularlyUsing these simple cybersecurity tips will help you keep your personal accounts and personal data to yourself! Make sure all your family and friends are also aware of it. Prepare for them a killer speech if needed to prevent them from giving all their data to the hackers.
___________________________
@hacking_Attack
@Hacking_Video
The New King “Broken Access Control”
https://medium.com/@aravindbalaji1995/the-new-king-broken-access-control-5d4fe465c7ea?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://medium.com/@aravindbalaji1995/the-new-king-broken-access-control-5d4fe465c7ea?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
The New King “Broken Access Control”
The King (Injection Bug) who was ruling the bug world for more than a decade is now conquered by the New King known as “Broken Access…
The King (Injection Bug) who was ruling the bug world for more than a decade is now conquered by the New King known as “Broken Access…Continue reading on Medium » (https://medium.com/@aravindbalaji1995/the-new-king-broken-access-control-5d4fe465c7ea?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
The New King “Broken Access Control”
The King (Injection Bug) who was ruling the bug world for more than a decade is now conquered by the New King known as “Broken Access…
Driftwood - Private Key Usage Verification
Driftwood is a tool that can enable you to lookup whether a private key is used for things like TLS or as a GitHub SSH key for a user. Driftwood performs lookups with the computed public key, so the private key never leaves where you run the tool. Additionally it supports some basic password cracking for encrypted keys. Installation Three easy ways to get started. Run with Docker cat private.key | docker run --rm -i trufflesecurity/driftwood --pretty-json - Run pre-built binary Download the binary from the releases page and run it. Build yourself go install github.com/trufflesecurity/driftwood@latest Usage Minimal usage is $ driftwood path/to/privatekey.pem Run with --help to see more options. Library Usage Packages under pkg/ are libraries that can be used for external consumption. Packages under pkg/exp/ are considered to be experimental status and may have breaking changes. Download Driftwood
Read more...
___________________________
@hacking_Attack
@Hacking_Video
Driftwood is a tool that can enable you to lookup whether a private key is used for things like TLS or as a GitHub SSH key for a user. Driftwood performs lookups with the computed public key, so the private key never leaves where you run the tool. Additionally it supports some basic password cracking for encrypted keys. Installation Three easy ways to get started. Run with Docker cat private.key | docker run --rm -i trufflesecurity/driftwood --pretty-json - Run pre-built binary Download the binary from the releases page and run it. Build yourself go install github.com/trufflesecurity/driftwood@latest Usage Minimal usage is $ driftwood path/to/privatekey.pem Run with --help to see more options. Library Usage Packages under pkg/ are libraries that can be used for external consumption. Packages under pkg/exp/ are considered to be experimental status and may have breaking changes. Download Driftwood
Read more...
___________________________
@hacking_Attack
@Hacking_Video
Bug Bounty Recon: Content Discovery (Efficiency pays $)
Content Discovery — The process of finding vulnerable endpoints; URLs, Parameters and Resources.Continue reading on Medium »
Read more...
Content Discovery — The process of finding vulnerable endpoints; URLs, Parameters and Resources.Continue reading on Medium »
Read more...
Introducing the Exponent Bug Bounty Program in Collaboration with Immunefi
Website | Litepaper | Twitter | Medium | Discord | Bug Bounty ProgramContinue reading on Medium »
Read more...
Website | Litepaper | Twitter | Medium | Discord | Bug Bounty ProgramContinue reading on Medium »
Read more...
Bug Bounty Recon: Content Discovery (Efficiency pays $)
https://medium.com/@Sm9l/bug-bounty-recon-content-discovery-efficiency-pays-2ec2462532b1?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://medium.com/@Sm9l/bug-bounty-recon-content-discovery-efficiency-pays-2ec2462532b1?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
Bug Bounty Recon: Content Discovery (Efficiency pays $)
Content Discovery — The process of finding vulnerable endpoints; URLs, Parameters and Resources.
Content Discovery — The process of finding vulnerable endpoints; URLs, Parameters and Resources.Continue reading on Medium » (https://medium.com/@Sm9l/bug-bounty-recon-content-discovery-efficiency-pays-2ec2462532b1?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
Bug Bounty Recon: Content Discovery (Efficiency pays $)
Content Discovery — The process of finding vulnerable endpoints; URLs, Parameters and Resources.
Introducing the Exponent Bug Bounty Program in Collaboration with Immunefi
https://exponent-cx.medium.com/introducing-the-exponent-bug-bounty-program-in-collaboration-with-immunefi-5a8f7ba8cc14?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://exponent-cx.medium.com/introducing-the-exponent-bug-bounty-program-in-collaboration-with-immunefi-5a8f7ba8cc14?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
Introducing the Exponent Bug Bounty Program in Collaboration with Immunefi
Website | Litepaper | Twitter | Medium | Discord | Bug Bounty Program