Hacking on Medium
Hacking With PowerShell: Red Team

https://cdn-images-1.medium.com/max/600/0*chxHhtJllicSOQaD
As we explored in part one, PowerShell can be used for good and bad. We also talked about how monitoring and proper auditing is key. The…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Living Off The Land: Suspicious System32

https://cdn-images-1.medium.com/max/779/0*DZZ-mOcCO8qIjc_D
The services below are some of the most commonly abused services for malicious parties to “live of the land”. Each are built into Windows…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Multi XSS Exploit in Upload File
https://systemweakness.com/multi-xss-exploit-in-upload-file-2bfde6ce471a?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello amazing hunters, Today i want to notice 4 ways to find xss in file upload that i found all of them in bug bounty programs or pentest…Continue reading on System Weakness » (https://systemweakness.com/multi-xss-exploit-in-upload-file-2bfde6ce471a?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
We created an open source to view API traffic for Kubernetes enabling you to view all API communication between microservices. Mizu open source Monitoring network traffic in real-time. Supported protocols: HTTP/1.1 (REST, etc.) HTTP/2 (gRPC) AMQP (RabbitMQ, Apache Qpid, etc.)

https://external-preview.redd.it/tBoJBGaGQuKzzThLFheovPKHte4xSYbT0euafs43XPg.jpg?width=640&crop=smart&auto=webp&s=52f9c6a34de96958ae4ad295906bcdb42bddd58e submitted by /u/miso25
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hashing the Favicon.ico
https://medium.com/@SkiMask0/hashing-the-favicon-ico-a498fc3d665b?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hey Folks, I am Ski Mask and I recently started bug bounty. in this Write-up, I will tell you about one of my findings!!Continue reading on Medium » (https://medium.com/@SkiMask0/hashing-the-favicon-ico-a498fc3d665b?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
So why do WiFi deauth attacks work

It seems like a crazy oversight in the protocol to allow for deauth requests from a non authenticated party, regardless of the mac address it’s pretending to be.

Can someone give me some more insight into this

submitted by /u/slobcat1337
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Looking Beyond Biden's Binding Security Directive

Implementing these and other security procedures will greatly improve the security posture of the United States and its private partners.

Cronos Theft of Transactions Fees Bugfix Postmortem

Transactions in blockchain are like sound traveling through air. We communicate with others through transactions; we announce what we’re…Continue reading on Immunefi »
Read more...

Multi XSS Exploit in Upload File

Hello amazing hunters, Today i want to notice 4 ways to find xss in file upload that i found all of them in bug bounty programs or pentest…Continue reading on System Weakness »
Read more...

Hashing the Favicon.ico

Hey Folks, I am Ski Mask and I recently started bug bounty. in this Write-up, I will tell you about one of my findings!!Continue reading on Medium »
Read more...

Simple CTF- TryHackme

CTFContinue reading on System Weakness »
Read more...

Kali Linux Tutorials
FakeDataGen : Full Valid Fake Data Generator

FakeDataGen is a Full Valid Fake Data Generator.

This tool helps you to create fake accounts (in Spanish format) with fully valid data. Within this information, you can find the most common names, emails, bank details and other useful information.

Requirements

* Python 3
* Install requirements.txt

Download

It is recommended to clone the complete repository or download the zip file. You can do this by running the following command:

git clone https://github.com/JoelGMSec/FakeDataGen

Usage

./FakeDataGen.py -h _ _ | |_ | | | _ \ _ | |_ _ / | _ _
| |_ / | |/ / _ \ | | |/ _| / ` | | _ / _ \ ‘_ \
| | (| | < / || | (| | || (| | || | / | | | || _,||__|/ _,|___,|_|__|| ||
usage: FakeDataGen.py [-h] [-n NUMBER] [-b] [-e] [-f FILE] [-z] [-p PASSWORD]
optional arguments:
-h, –help show this help message and exit
-n NUMBER, –number NUMBER
The number of records should be created
-b, –bankdata Show only bank data (Card, CVV, IBAN..)
-e, –extended Show only extended info (City, Phone, SS..)
-f FILE, –file FILE File path to save data
-z, –zip Compress data to zip file
-p PASSWORD, –password PASSWORD
Password to protect zip file
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Cracken : A Fast Password Wordlist Generator, Smartlist Creation And Password Hybrid-Mask Analysis Tool

Cracken is a fast password wordlist generator, Smartlist creation and password hybrid-mask analysis tool written in pure safe Rust (more on talk/). Inspired by great tools like maskprocessor, hashcat, Crunch and  HuggingFace’s tokenizers. What? Why? Woot??

At DeepSec2021 we presented a new method for analysing passwords as Hybrid-Masks exploiting common substrings in passwords by utilizing NLP tokenizers (more info on talk/).

Our method splits a password into its subwords instead of just a characters mask. HelloWorld123!splitted into ['Hello', 'World', '123!']as these three subwords are very common in other passwords. Hybrid Masks & Smartlists

* Smartlists – Compact & representative subword lists created from passwords by utilizing NLP tokenizers
* Hybrid-Mask – A representation of a password as a combination of wordlists & characters (e.g. ?w1?w2?l?d) Analyzing RockYou Passwords with Smartlists & Hybrid-Masks:https://blogger.googleusercontent.com/img/a/AVvXsEhdw7aYM7PSpZpyAxj2u-4S4xa-RtKa2wSJELWr9JAmyn2JAgSWsLl_xYP6-dN2oJGX6JJ286GFvc10yWoTP4uLGiJqBKQ_GwXink27LFP4BQZsNmY6zn_ZSTZdiuz9LjtH2oyKQyAcVq8X-VjvGTXQcIg22DfpSx5afDzr7mrC-ucCdPry8Nfw60CZ=s1236
Cracken  is used for

* https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png Generating Hybrid-Masksvery VERY FAST  (see performance section)
* https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png Building Smartlists– compact & representative list of subwords from given passwords files (using  HuggingFace’s tokenizers)
* https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png Analyzing passwords for their Hybrid-Masks– building statistics for better password candidates (again very fast) Possible workflows with Cracken Simple

1. Generate wordlist candidates from a hybrid mask – e.g. cracken -w rockyou.txt -w 100-most-common.txt '?w1?w2?d?d?d?d?s'2. You can pipe the passwords Cracken generates into hashcat, johnor your favorite password cracker Advanced

1. Create a Smartlist from existing passwords – cracken create2. Analyze a passwords list of plaintext passwords – cracken entropy3. use most frequent Hybrid-Masksto generate password candidates fast – cracken generate -i hybrid-masks.txtFor more details see Usage section

Getting Started

download (linux only currently): latest release

for more installation options see installationsection

run Cracken:

generate all words of length 8 starting with uppercase followed by 6 lowercase chars and then a digit:

$ cracken -o pwdz.lst ‘?u?l?l?l?l?l?l?d’

generate words from two wordlists with year suffix (1000-2999) $ cracken –wordlist firstnames.txt –wordlist lastnames.lst –charset ’12’ ‘?w1?w2?1?d?d?d’

create a Smartlist of size 50k from subwords extracted from rockyou.txt

$ cracken create -f rockyou.txt -m 50000 –smartlist smart.lst

estimate the entropy of hybrid mask of the password HelloWorld123! using a smartlist

$ cracken entropy -f smart.lst ‘HelloWorld123!’
hybrid-min-split: [“hello”, “world1”, “2”, “3”, “!”]
hybrid-mask: ?w1?w1?d?d?s
hybrid-min-entropy: 42.73
charset-mask: ?l?l?l?l?l?l?l?l?l?l?d?d?d?s
charset-mask-entropy: 61.97

Performance

As of writing this, Cracken is probably the world’s fastest wordlist generator:

Cracken has around 25% increased performance over hashcat’s fast maskprocessor thats written in C.

Cracken can generate around 2 GB/s per core.

more details on benchmarks

Why speed is important? A typical GPU can test billions passwords per second depending on the password hash function. When the wordlist generato[...]

___________________________
@hacking_Attack
@Hacking_Video