hacking: security in practice
Is my account being targeted ?

So recently i've noticed some strange behaviour around one of my accounts.
Long Story Short.
Some of coments on youtube, have been replied for probably some bot, that aparently is trying to phishing me into some link or whatsapp, trick, asking for click on a link or add a certain phone number and call it in whatsapp. Obviously i did none.
But yet today, i received a notification from deezer on my email asking if i was having trouble connecting into it(as i further investitgated, it only happens when you try to logging using your email 3 times and fail).
It happens that the location that tried to connect into my deezer account is from shangai, in china.

So i come here to you guys to ask, what might be that all.
How they can find my account on a youtube comment?
also, is this something for me to worry about?
is there anything i can do towards it ?
would deleting my account resolve the problem or would they be able to find me even in another account ?

Thanks in advance.

submitted by /u/sargueras
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacktivist group shares details related to Belarusian Railways hack
https://www.reddit.com/r/redteamsec/comments/sd00r6/hacktivist_group_shares_details_related_to/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://www.curatedintel.org/2022/01/hacktivist-group-shares-details-related.html) [comments] (https://www.reddit.com/r/redteamsec/comments/sd00r6/hacktivist_group_shares_details_related_to/)

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
The SICKEST Movie of 2011 : "ONLY IN CMP"

https://external-preview.redd.it/KyBUnqDxqwlhjzWGS-JyWXYdGDbNc7lWRGlh6jyFKqY.jpg?width=640&crop=smart&auto=webp&s=81aed4d8658e5b7384c6e9d9c6fd56d9e2329be9 submitted by /u/PuckyMaxx
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What are XPath Injections and How to Avoid Them

https://cdn-images-1.medium.com/max/800/0*CELTJlNznH7ORfr0
XML is the language of web services. When we invoke a service or get a response from it, all the information we are sending/receiving is…

Continue reading on Nerd For Tech »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Smart Home/Smart Appliance integration?

I apologise if this is in the wrong space, but I think it's a solid question, what is Reddits thoughts on Smart Home things? I. E. I've a Samsung phone at the moment (great phone) and I've been browsing through 'Smart Things' , and the capabilities of Automation and integration of appliances and routines etc, through things like Smart bulbs etc, looks and sounds really interesting, my SO thinks they sound cool but unnecessary.

In terms of security and vulnerabilities, what is the general consensus? Good/bad? I did have a Smart Speaker that I got rid of (Google is evil, with their data fuckery) is this the same sort of thing? Just more data etc. To be harvested?

Cheers Reddit! Peace and love ❤️

submitted by /u/Lifes_punchline
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Are DDoS sites/Booters legal?

I understand that A DDoS attack is illegal if it is unauthorized but if lets say you were to ddos yourself then it would be legal from what ive seen. are the websites themselves legal then?

submitted by /u/raultheuniverse
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Someone sent me a http libk

Someone sent me a http link that supposedly leads to Imgur (I didn’t click on it or open it). What’s he trying to do? Can you report someone to the police doing that? Or can you report him to Reddit?

submitted by /u/angelisstic_
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

PORTSWIGGER WEB SECURITY - DIRECTORY TRAVERSAL LAB ÇÖZÜMLERİ

Directory Traversal (Dizin-Dosya Geçişi), saldırganların bir web sunucusundaki kısıtlı dizinlere erişmesine ve web sunucusunun kök dizini…Continue reading on Medium »
Read more...

PORTSWIGGER WEB SECURITY - DIRECTORY TRAVERSAL LAB ÇÖZÜMLERİ
https://ariarif.medium.com/portswigger-web-security-directory-traversal-lab-%C3%A7%C3%B6z%C3%BCmleri%CC%87-a02c59bfa95d?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Directory Traversal (Dizin-Dosya Geçişi), saldırganların bir web sunucusundaki kısıtlı dizinlere erişmesine ve web sunucusunun kök dizini…Continue reading on Medium » (https://ariarif.medium.com/portswigger-web-security-directory-traversal-lab-%C3%A7%C3%B6z%C3%BCmleri%CC%87-a02c59bfa95d?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Xolo - Tool To Crawl, Visualize And Interact With SQL Server Links In A D3 Graph

Author: ET Lownoise Version: 1.0 Tool to crawl, visualize and interact with SQL server links in a d3 graph to help in your red/blue/purple/.../risk assessments pentest hacking team exercises. Requirements: Requests==2.18.4Flask==0.12.2JsonPypyodbcbeautifulsoup4==4.6.0lxml==4.1.0Example: pip install pypyodbc python -m pip install pypyodbc Install/Run: - Download- Decompress - Put it in directory- Run it c:\xolo>python main.py ... * Running on http://127.0.0.1:5000/ (Press CTRL+C to quit)- Open your browser http://127.0.0.1:5000/ Questions/Suggestions/Bugfixes/Improvements/Contact: Twitter @etlow License: MIT License Notes: node will select it a target -When graph displayed right double click in a node will select it a source -Convert button will display the query required based on the shortest path calculated if you want to interact directly with the selected target from the source. -Query button will send your specified query using the shortest path to the target -Query all button will send your specified query using the shortest path to all nodes - The test graph is just for modifiying D3 code in case you want to play with visualization. -Copy data.json file if you want to have a backup of the graph -Modify queries.json if you want to add your own queries -Check the terminal output to follow what Xolo is doing in the background -Be careful with the max recursion levels and the number of nodes , start low (maybe 2 - 3 levels and max 10 nodes per level) -This was an exercise for me to play and learn some D3 and the need to perform some db links visualizations. For that reason Xolo was made possible by learning and/or modifiying the code of the following individuals: DB links: -Antti Rantasaari ', 'Scott Sutherland "nullbind" -When graph displayed left double click in a node will select it a target-When graph displayed right double click in a node will select it a source-Convert button will display the query required based on the shortest path calculated if you want to interact directly with the selected target from the source.-Query button will send your specified query using the shortest path to the target-Query all button will send your specified query using the shortest path to all nodes- The test graph is just for modifiying D3 code in case you want to play with visualization.-Copy data.json file if you want to have a backup of the graph-Modify queries.json if you want to add your own queries-Check the terminal output to follow what Xolo is doing in the background-Be careful with the max recursion levels and the number of nodes , star t low (maybe 2 - 3 levels and max 10 nodes per level)-This was an exercise for me to play and learn some D3 and the need to perform some db links visualizations. For that reason Xolo was made possible by learning and/or modifiying the code of the following individuals: DB links: -Antti Rantasaari ', 'Scott Sutherland "nullbind" Read more...

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Linux system service bug gives root on all major distros, exploit released

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Linux system service bug gives root on all major distros, exploit releasedPost Views: 482 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute
A vulnerability in Polkit’s pkexec component identified as CVE-2021-4034 (PwnKit) is present in the default configuration of all major Linux distributions and can be exploited to gain full root privileges on the system, researchers warn today.
CVE-2021-4034 has been named PwnKit and its origin has been tracked to the initial commit of pkexec, more than 12 years ago, meaning that all Polkit versions are affected.

Part of the Polkit open-source application framework that negotiates the interaction between privileged and unprivileged processes, pkexec allows an authorized user to execute commands as another user, doubling as an alternative to sudo. Easy to exploit, PoC expected soonResearchers at Qualys information security company found that the pkexec program could be used by local attackers to increase privileges to root on default installations of Ubuntu, Debian, Fedora, and CentOS.

They warn that PwnKit is likely exploitable on other Linux operating systems as well.

Bharat Jogi, Director of Vulnerability and Threat Research at Qualys explains that PwnKit is “a memory corruption vulnerability in Polkit’s, which allows any unprivileged user to gain full root privileges on a vulnerable system using default polkit configuration,”
See Also: Complete Offensive Security and Ethical Hacking Course The researcher notes that the issue has been hiding in plain sight since the first version of pkexec inn May 2009. The video below demonstrates the exploitability of the bug:
Exploiting the flaw is so easy, the researchers say, that proof-of-concept (PoC) exploit code is expected to become public in just a few days. The Qualys Research Team will not release a PoC for PwnKit.

Update: An exploit has already emerged in the public space, less than three hours after Qualys published the technical details for PwnKit. BleepingComputer has compiled and tested the available exploit, which proved to be reliable as it gave us root privileges on the system on all attempts.
https://www.bleepstatic.com/images/news/u/1100723/2022/PwnKitExploit.png
___________________________
@hacking_Attack
@Hacking_Video

n and on Enterprise products for supported architectures, as well as for extended life cycle support, TUS, and AUS.

A temporary mitigation for operating systems that have yet to push a patch is to strip pkexec of the read/write rights with the following command: chmod 0755 /usr/bin/pkexecSee Also: OSINT Tool: Commit Stream “Users that want to look for signs of PwnKit exploitation can do it by checking the logs for either “The value for the SHELL variable was not found the /etc/shells file” or “The value for environment variable […] contains suspicious content.” entries.

However, Qualys notes that exploiting PwnKit is possible without leaving a trace.

Last year, GitHub Security Lab researcher Kevin Backhouse discovered another old privilege escalation vulnerability affecting Polkit.

The bug had been present for seven years, since version 0.113 of the component and affected popular Linux distros including RHEL 8, Fedora 21 (or later), Ubuntu 20.04, and unstable versions of Debian (‘bullseye’) and its derivatives.

Update [January 25, 17:26 EST]: Added security notices on PolicyKit / Polkit from Ubuntu and Red Hat.

Update [January 25, 17:43 EST]: Article updated with information about proof-of-concept exploit code being publicly available.
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
See Also: Stuxnet – A weapon made out of code that almost started WW3 Source: bleepingcomputer.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/centos1-90x90.png CWP bugs allow code execution as root on Linux servers1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/mcafee-d2c-90x90.jpg McAfee Bug Can Be Exploited to Gain Windows SYSTEM Privileges2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/ezgif.com-gif-maker-12-90x90.jpg Cisco bug gives remote attackers root privileges via debug mode5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/ezgif.com-gif-maker-11-1-90x90.jpg Beijing Olympics App Flaws Allow Man-in-the-Middle Attacks6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/ezgif.com-gif-maker-10-90x90.jpg SSRF vulnerability in VMWare authentication software could allow access to user data1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/Safari-Apple-navigateur-90x90.jpg Same-origin violation vulnerability in Safari 15 could leak a user’s website history and identity1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/Qlocker-Ransomware-1-90x90.png Qlocker ransomware returns – targets QNAP NAS devices worldwide1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/https___specials-images.forbesimg.com_imageserve_61aff357a4c71fc225ab8ba7_0x0-90x90.jpg AWS fixes security flaws that exposed AWS customer data2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/image-apple-releases-15-2-1-update-for-ios-and-ipados-to-fix-bugs-164203308032302-90x90.jpg Apple fixes doorLock bug that can disable iPhones and iPads2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/0_Windows-headpic-90x90.jpg Microsoft: New critical Windows HTTP vulnerability is wormable2 weeks ago
The post Linux system service bug gives root on all major distros, exploit released first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Xolo - Tool To Crawl, Visualize And Interact With SQL Server Links In A D3 Graph

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
HackInOS VM Walkthrough

https://cdn-images-1.medium.com/max/800/0*QBoipewrRcTcUZpp.png
Makineyi indirebilirsiniz.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video