Hacking Articles Tips Tricks Videos Tutorials

Pentest Report Example for a PriviaHub Vulnerability Machine

Furkan Enes Polatoğlu ·Just now

11 viewsedited 03:08

Getting Password Hashes for dictionary attacks

hacking: security in practice
Getting Password Hashes for dictionary attacks

Hello i am wondering how to get a hash for a password to perform a dictionary attack on, ive been searching for it on the net but i didnt find anything so i would appreciate some help. Thanks in advance!

submitted by /u/SebiIstCool
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hello i am wondering how to get a hash for a password to perform a dictionary attack on, ive been searching for it on the net but i didnt find...

11 viewsedited 03:23

ok techy friends, need some help. I installed Fedora 35 and need the driver for this>>> 802.11b/g/n (1x1) wi-fi® and bluetooth® 4.2 combo . link...

hacking: security in practice
Fedora

ok techy friends, need some help. I installed Fedora 35 and need the driver for this>>> 802.11b/g/n (1x1) wi-fi® and bluetooth® 4.2 combo . link me please!!

submitted by /u/jacksonstillspitts
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Fedora

13 viewsedited 03:23

Welcome to pwn.college! Free Course for reverse engineering.

hacking: security in practice
Welcome to pwn.college! Free Course for reverse engineering.

submitted by /u/3DMilk
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Posted in r/hacking by u/3DMilk • 1 point and 0 comments

14 viewsedited 03:23

14 views07:08

Hacking on Medium
Metroverse公发是怎么了

https://cdn-images-1.medium.com/max/1400/1*Q7K58uce9fE9KWVcsnXJIg.png
发生了什么？

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Metroverse公发是怎么了

发生了什么？

15 viewsedited 07:08

16 views07:08

Hacking on Medium
We Need To Know Session Hijacking

https://cdn-images-1.medium.com/max/600/0*tIYk4jKw7dHVyw-e.png
Session Hijacking also Known as Cookie Hijacking

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

We Need To Know Session Hijacking

Session Hijacking also Known as Cookie Hijacking

16 viewsedited 07:08

Hey guys, I used to play around with phishing tools using Kali and there used to be some really fun/good ones like Blackeye and ZPhisher. I've...

hacking: security in practice
Best Phishing Tools?

Hey guys, I used to play around with phishing tools using Kali and there used to be some really fun/good ones like Blackeye and ZPhisher. I've recently become reinterested in hacking and I just can't find good phishing tools anymore. The functional version of Blackeye isn't available anymore and ZPhisher isn't operational as far as I know it . The only one I have at the moment is my social engineering toolkit as offered by Kali and one working copy of Blackeye on another virtual machine of mine that hasn't been updated in 3 years. Do any of you know of some good phishing tools? It just seems like I can't find any new or good ones anymore.

submitted by /u/botnetboi8080
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Best Phishing Tools?

17 viewsedited 07:23

Nakji Network’s 200K Bug Bounty Program
https://nakji.medium.com/nakji-networks-200k-bug-bounty-program-d500b3f305c3?source=rss------bug_bounty-5

The Nakji FoundationContinue reading on Medium » (https://nakji.medium.com/nakji-networks-200k-bug-bounty-program-d500b3f305c3?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Nakji Network’s 200K Bug Bounty Program

The Nakji Foundation

14 viewsedited 10:00

Nakji Network’s 200K Bug Bounty Program

The Nakji FoundationContinue reading on Medium »
Read more...

13 views10:15

12 views10:27

11 views10:27

Black Hat Ethical Hacking

Black Hat Ethical Hacking
Beijing Olympics App Flaws Allow Man-in-the-Middle Attacks

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Beijing Olympics App Flaws Allow Man-in-the-Middle AttacksPost Views: 120 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute
Attackers can access audio and files uploaded to the MY2022 mobile app required for use by all winter games attendees – including personal health details.
The mobile app that all attendees and athletes of the upcoming Beijing Winter Olympics must use to manage communications and documentation at the event has a “devastating” flaw in the way it encrypts data that can allow for man-in-the-middle attacks that access sensitive user information, researchers have found.

MY2022 is an app mandated for use by all attendees – including members of the press and athletes – of the 2022 Olympic Games in Beijing. The problem is, it poses a significant security risk because the encryption used to protect users’ voice audio and file transfers “can be trivially sidestepped” due to two vulnerabilities in how it handles data transport, according to a blog post from Citizen Lab posted online Tuesday.

Additionally, “server responses can also be spoofed, allowing an attacker to display fake instructions to users,” Citizen Lab’s Jeffrey Knockel wrote in the post.

MY2022 collects info such as health customs forms that transmit passport details, demographic information, and medical and travel history, which are vulnerable due to the flaw, he said. It’s also not clear with whom or which organizations this info is shared.

MY2022 also includes a feature that allow users to report “politically sensitive” content, as well as a censorship keyword list. While the latter is “presently inactive,” it targets a variety of political topics, including domestic issues such as Xinjiang and Tibet as well as references to Chinese government agencies, Knockel wrote.
See Also: Complete Offensive Security and Ethical Hacking Course Background and DisclosureResearchers disclosed the security issues to the Beijing Organizing Committee for the 2022 Olympic and Paralympic Winter Games on Dec. 3, 2021, giving organizers a deadline of 15 days to respond and 45 days to fix the issues. As of yesterday, Jan. 18, 2022, researchers still hadn’t received a response, according to the post.

Citizen Lab researchers also inspected a Jan. 17 release of version 2.0.5 of MY2022 for iOS to Apple’s App Store, finding that the issues reported still had not been resolved, Knockel wrote. Moreover, that version of the app introduced a new feature called “Green Health Code” that asks for travel documents and medical info from users that also is vulnerable to the flaws, he added.

MY2022 is being used as part of a closed-loop system implemented due to COVID-19 restrictions that requires all international and domestic attendees to monitor and submit their health status – e.g., a negative test for the virus – to the app on a daily basis.

For domestic users, MY2022 collects personal information including name, national identification number, phone number, email address, profile picture and employment information, and shares it with the Beijing Organizing Committee for the 2022 Olympics. For international users, the app collects users’ demographic information and passport information, as well as the organization to which they belong.
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is wort[...]

___________________________
@hacking_Attack
@Hacking_Video

Beijing Olympics App Flaws Allow Man-in-the-Middle Attacks | Black Hat Ethical Hacking

The mobile app that all attendees and athletes of the upcoming Beijing Winter Olympics must use to manage communications and documentation at the event has a “devastating” flaw in the way it encrypts data that can allow for man-in-the-middle attacks that…

12 viewsedited 10:27

Black Hat Ethical Hacking

Black Hat Ethical Hacking
OSINT Tool: Commit Stream

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png OSINT Tool: Commit StreamPost Views: 57 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 4 Minutes

OSINT Tool: Commit Stream GitHub Link Commit StreamCommit-Stream by x1sec drinks commit logs from the GitHub event firehose exposing the author details (name and email address) associated with GitHub repositories in real time. This tool is an Open-source intelligence tool aimed to perform significant recon for Red Teams, Pentesters and Bug Bounty hunters.

Source code review is one of the most important aspects and often a lot of mistakes usually from developers are found, resulting in revealing secret keys hardcoded into JavaScript’s, or source codes hosted on Platform like GitHub, which hosts a lot of major code for top companies globally. Features* Uncover repositories which employees of a target company is committing code (filter by email domain)
* Identify repositories belonging to an individual (filter by author name)
* Chain with other tools such as trufflehog to extract secrets in uncovered repositories.
See Also: Beijing Olympics App Flaws Allow Man-in-the-Middle Attacks
See Also: Complete Offensive Security and Ethical Hacking Course InstallationBinariesCompiled 64-bit executable files for Windows, Mac and Linux are available here Go getIf you would prefer to build yourself (and Go is setup correctly):

go get -u github.com/x1sec/commit-stream Building from sourcego get && go build
See Also: Hacking stories – Rafael Núñez (aka RaFa), hacking NASA with the hacking group: World of Hell Usage

Usage:
  commit-stream [OPTIONS] Options: -e, --email        Match email addresses field (specify multiple with comma). Omit to match all.
  -n, --name         Match author name field (specify multiple with comma). Omit to match all.
  -t, --token        Github token (if not specified, will use environment variable 'CSTREAM_TOKEN')
  -a  --all-commits  Search through previous commit history (default: false)
  -i  --ignore-priv  Ignore noreply.github.com private email addresses (default: false)

commit-stream requires a Github personal access token to be used. You can generate a token navigating in Github [Settings / Developer Settings / Personal Access Tokens] then selecting ‘Generate new token’. Nothing here needs to be selected, just enter the name of the token and click generate.

Once the token has been created, the recommended method is to set it via an environment variable CSTREAM_TOKEN:
export CSTREAM_TOKEN=xxxxxxxxxx
Alternatively, the –token switch maybe used when invoking the program, e.g:

./commit-stream –token xxxxxxxxxx
When running commit-stream with no options, it will immediately dump author details and the associated repositories in CSV format to the terminal. Filtering options are available.
To filter by email domain:

./commit-stream –email ‘@company.com’

To filter by author name:

./commit-stream –name ‘John Smith’
Multiple keywords can be specified with a , character. e.g.

./commit-stream –email ‘@telsa.com,@ford.com’
It is possible to search up to 20 previous commits for the filter keywords by specifying –all-commits. This may increase the likelihood of a positive matches.

Email addresses that have been set to private (@users.noreply.github.com) can be omitted by specifying –ignore-priv. This is useful to reduce the volume of data collected if running the tool for an extended period of time. https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/merch.png Recent Tools* https://www.blackhatethicalhacking.com/wp-co[...]

___________________________
@hacking_Attack
@Hacking_Video

OSINT Tool: Commit Stream | Black Hat Ethical Hacking

Commit Stream drinks commit logs from the GitHub event firehose exposing the author details (name and email address) associated with GitHub repositories in real time.

12 viewsedited 10:27

Black Hat Ethical Hacking Beijing Olympics App Flaws Allow Man-in-the-Middle Attacks https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Beijing Olympics App Flaws Allow Man-in-the-Middle AttacksPost Views: 120 https…

h sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com What’s Not WorkingCitizen Lab discovered two security vulnerabilities in the app related to the security of how it transmits user data. Researchers examined version 2.0.0 of the iOS version of MY2022 and version 2.0.1 of the Android version in their analysis.

“Although we were only able to create an account on and thus fully examine the iOS version of MY2022, from our best understanding, the vulnerabilities described below appear to exist in both the iOS and Android versions of MY2022,” Knockel wrote.

The first vulnerability discovered in MY2022 is that it fails to validate SSL certificates, thus failing to validate the party to whom it is sending sensitive, encrypted data, according to the report. This allows an attacker to spoof trusted servers by interfering with the communication between the app and these servers.

“This failure to validate means the app can be deceived into connecting to a malicious host while believing it is a trusted host, allowing information that the app transmits to servers to be intercepted and allowing the app to display spoofed content that appears to originate from trusted servers,” Knockel wrote.

Though some connections the app created weren’t vulnerable, the SSL connections to at least the following servers are: my2022.beijing2022.cn, tmail.beijing2022.cn, dongaoserver.beijing2022.cn, app.bcia.com.cn and health.customsapp.com.

The other vulnerability researchers found in MY2022 is that some sensitive data is being transmitted without SSL encryption or any security at all, according to the report. The app transmits non-encrypted data – including sensitive metadata relating to messages, such as the names of message senders and receivers and their user account identifiers – to “tmail.beijing2022.cn” on port 8099, researchers found.

“Such data can be read by any passive eavesdropper, such as someone in range of an unsecured Wi-Fi access point, someone operating a Wi-Fi hotspot, or an Internet Service Provider or other telecommunications company,” Knockel wrote.
See Also: Microsoft: New critical Windows HTTP vulnerability is wormable Fueling the FireResearchers believe the app’s flaws may not only violate Google’s Unwanted Software Policy and Apple’s App Store guidelines but also China’s own laws and national standards pertaining to privacy protection, they said.

Indeed, the insecurity of the app is concerning on the eve of the Olympic Games, set to begin on Feb. 4, which have already sparked controversy. As early as February 2021, more than 180 human rights groups had called for governments to boycott the games due to worry that they will legitimize a Chinese regime currently engaging in significant human-rights violations, particularly against Uyghur people in China.

Governments including Canada, the United Kingdom and the United States are diplomatically boycotting the games, which means athletes from these countries can compete but government delegates will not attend the event.

The flaw in MY2022 also is worrying because the Olympics are known to be a major target for cybercriminals. Last year’s Summer Olympics in Japan saw more than 450 million attempted cyberattacks, a significant increase from the 180 million attacks that occurred during the 2012 London Summer Olympics.

Unfortunately, the security issues found in MY2022, while concerning, are not unique and are likely found in many mobile apps. Such issues have spurred an epidemic of cyberattacks against devices with poor app security, noted one security professional.
See Also: Offensive Security Tool: Ivy “Not all mobile apps are susceptible to man-in-the-middle attacks, but most of them do contain undisclosed third parties who can access the same user data as the developer,” Chris Olson, CEO at enterprise digital security platform The Media Trust, wrot[...]

___________________________
@hacking_Attack
@Hacking_Video

8 viewsedited 10:27