IDOR — Insecure Direct Object Reference, abuse of the lack of authentication at every stage.Continue reading on Medium » (https://medium.com/@Sm9l/what-i-learnt-from-reading-220-idor-bug-reports-6efbea44db7?source=rss------bug_bounty-5)

Hacking on Medium
What I learnt from reading 220* IDOR bug reports.

https://cdn-images-1.medium.com/max/873/1*AOVysctTl30shhuoPEHmCQ.png
IDOR — Insecure Direct Object Reference, abuse of the lack of authentication at every stage.

Continue reading on Medium »

Hacking on Medium
Learning binary exploitation — 4

Format String Vulnerability

Continue reading on Medium »

Hacking on Medium
How To Hack A Whatsapp Account Through MAC Spoofing Attack| Updated

https://cdn-images-1.medium.com/max/720/1*M_7qVdgoPl9uvDKDVUMCtA.png
Let's Hack WhatsApp today!

Continue reading on Medium »

hacking: security in practice
Is hacking viable as only as hobby / as a non-professional

Hi, sorry if this is the wrong sub, sorry for bad english.

My question is simply: Is hacking viable as a hobby. By "viable" I mean, if you pursued hacking as a hobby besides your 9-5 job and are not working in IT security or something related, will you even see any results in a resonable time. Or is the learning curve so steap that a hobbyist will work on it for two decades and still have no where near enough skills for "real world application"? (as in, not only solving challenges specifcally created to be solved)

I am torn wheiter hacking is for me, on one side I have a deep passion for computers/coding/problem-solving/math, but I am worried I will spend a big chunck of my life pursuing this field only to find out at the end of my life that I have achieved nothing of relevance.

submitted by /u/n0tALizard
[link] [comments]

hacking: security in practice
Scraper for bug bounty reports for specific vendors

I am looking for ideas for scrapping bug bounty reports from sites like BugCrowd or HackerOne. I'd like to monitor for bounties posted by vendors and any reports posted for those programs. Setting up alerts or monitoring news/social media is good but those reports often are not disclosed publicly or if they are posted to late. Monitoring this way may help prevent supply chain attacks, formulating ideas now and would appreciate any input. Thanks

submitted by /u/ashertehll6831
[link] [comments]

hacking: security in practice
Compromised website junk text over original page

My website was compromised. Someone put over junk text over original page. Examples below:

* https://accept.aseanenergy.org/Baby-Boys-Gentleman-Outfits-Suits-Long-Sleeve-Onesie-Romper/Bow-tie-Shirt-Bib-Pants-Overall-Clothes-Set-1046975/
* https://accept.aseanenergy.org/event/asean-energy-outlook-forum-2022/

Website uses Wordpress as backend CMS and bitnami.

My question would be:

1. Does this type of attack has any specific terminology?
2. What are the possible cause?
3. Which server side file might be compromised?
4. Tips to prevent this from happening again?

Thanks a lot.

submitted by /u/pinokioblabla
[link] [comments]

hacking: security in practice
I have a P.C and Laptop. which one should I use to install linux to learn cyber security ?

and also , which flavour of linux should I chose ?

submitted by /u/DaFukTheyDoinOvaDer
[link] [comments]

Dark Reading: Attacks/Breaches
Tales from the Dark Web, Part 2: Ransomware Stacked With Distribution Services Creates the Perfect Storm

Security professionals need to understand the actors behind ransomware threats, how they operate and how they continuously find new victims to target

Dark Reading: Attacks/Breaches
Test Your Team, Not Just Your Disaster Recovery Plan

Cyberattacks imperil business continuity, but there is a much more common security threat — unintentional human error.

Dark Reading: Attacks/Breaches
Cyber-Physical Security: What It Is and What You Should Do

Ancillary installations like the Internet of Things, operational technology, and industrial control systems enable lots of great functionality, and they face most of the same risks as IT infrastructure.

Dark Reading: Attacks/Breaches
4 Steps Toward Knowing Your Exploitable Attack Surface

Actionable steps you can take today to identify the true risk your organization faces — learn how to separate the exploitable vulnerabilities from the rest.

I found a way to extract passwords from any iOS device. When I reported it to Apple? Silence.
https://medium.com/@ConnorFord1/i-found-a-way-to-extract-passwords-from-any-ios-device-when-i-reported-it-to-apple-silence-a027b12b7013?source=rss------bug_bounty-5

Apple’s Bug Bounty program, in theory, incentivizes programmers to report flaws they find in the company’s code. In practice? Not so much.Continue reading on Medium » (https://medium.com/@ConnorFord1/i-found-a-way-to-extract-passwords-from-any-ios-device-when-i-reported-it-to-apple-silence-a027b12b7013?source=rss------bug_bounty-5)

I found a way to extract passwords from any iOS device. When I reported it to Apple? Silence.

Apple’s Bug Bounty program, in theory, incentivizes programmers to report flaws they find in the company’s code. In practice? Not so much.Continue reading on Medium »
Read more...