OpenLeverage Partners with Code4rena for Audit Contest to Enhance Security Measures
https://openleverage.medium.com/openleverage-partners-with-code4rena-for-audit-contest-to-enhance-security-measures-fb04a5bb08f?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Since our inception, OpenLeverage has been committed to developing a permissionless lending and margin trading protocol with aggregated…Continue reading on Medium » (https://openleverage.medium.com/openleverage-partners-with-code4rena-for-audit-contest-to-enhance-security-measures-fb04a5bb08f?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Looking for work?

Dm/Pm me

submitted by /u/OrganizationSea6549
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Domain Codex - Domain Intel Search Engine

submitted by /u/cstadler
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Kali Linux Spec Recommendations

Hello all,

Kali Linux has always seemed like a fun distro to work in. There seem to be a bunch of cool ways to test the integrity of a network using Kali. My question is what sort of laptop would be best for a beginner who just wants to learn about the various tools that you can employ using Kali? This is purely for fun.

​

Thanks guys!

submitted by /u/Adept_Measurement160
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

OpenLeverage Partners with Code4rena for Audit Contest to Enhance Security Measures

Since our inception, OpenLeverage has been committed to developing a permissionless lending and margin trading protocol with aggregated…Continue reading on Medium »
Read more...

TEJAS PANCHAL ONE OF THE YOUNGEST CYBER SECURITY EXPERT.
https://medium.com/@tejasworkspace.mp/tejas-panchal-one-of-the-youngest-cyber-security-expert-e6aaff51c34a?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

We welcome increasingly more potent online vulnerabilities as we go into a digitized future with advanced information technology shaping…Continue reading on Medium » (https://medium.com/@tejasworkspace.mp/tejas-panchal-one-of-the-youngest-cyber-security-expert-e6aaff51c34a?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
rare and strange Deep web mysterious video

https://external-preview.redd.it/gF0pkci37f9bGgdqEAVM01Uuq9HFqi_zzMaAVEdtdJo.jpg?width=320&crop=smart&auto=webp&s=d2660fccf02d4154c948689fc72dd6ac47524f7f submitted by /u/Interesting_Stand877
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Apple pays out $100k bounty for Safari webcam hack that imperiled victims’ online accounts

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Apple pays out $100k bounty for Safari webcam hack that imperiled victims’ online accountsPost Views: 79 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute
Security vulnerabilities in Apple iCloud and Safari 15 could have enabled attackers to compromise macOS webcams and, thereafter, victims’ online accounts.
Ryan Pickren, an independent security researcher, netted an eye-watering $100,500 bug bounty for the universal cross-site scripting (uXSS) exploit and a total of four flaws. uXSS all areasWhile the camera hack required user interaction, the potential impact of a successful compromise was egregious.

“While this bug does require the victim to click ‘open’ on a popup from my website, it results in more than just multimedia permission hijacking,” said Pickren in a technical write-up.

The exploit, he added, gives “the attacker full access to every website ever visited by the victim. That means in addition to turning on your camera, my bug can also hack your iCloud, PayPal, Facebook, Gmail, etc. accounts too.”

The researcher demonstrated a scenario in which a victim agrees to view a folder containing PNG images and a hidden webarchive file that injects code into icloud.com that exfiltrates their iOS camera roll.

A paper (PDF) published by Google Project Zero has described uXSS bugs, which can imperil multiple online accounts because they exploit browser vulnerabilities, as “almost as valuable as a remote code execution (RCE) exploit with the sandbox escape”.
See Also: Complete Offensive Security and Ethical Hacking Course ‘Subtle, but wildly impactful’As suggested by the authors of penetration testing application Metasploit back in 2013, Pickren used webarchive files as the trojan horse for uXSS.

Safari’s alternative to HTML for saving websites locally, webarchive files specify the web origin in which the content should be rendered.

Pickren circumvented macOS Gatekeeper’s block on users opening webarchive files directly by opening the files indirectly via an approved app, Safari. The researcher discovered that the .url shortcut filetype would launch Safari and instruct the browser to open the file.

“A subtle, but wildly impactful, design flaw” in ShareBear, a backend application for sharing files via iCloud, meant an attacker could surreptitiously swap a benign file with a malicious file after it had been shared with and downloaded by a victim.
See Also: McAfee Bug Can Be Exploited to Gain Windows SYSTEM Privileges
The victim would receive no notification of this file swap.

“In essence, the victim has given the attacker permission to plant a polymorphic file onto their machine and the permission to remotely launch it at any moment,” said Pickren.

The researcher fashioned the exploit after successfully performing a similar trick on Safari v14.1.1, but it soon transpired that beta Safari v15 was inadvertently impervious due to an unrelated code refactor.

He also managed to steal local files by circumventing sandbox restrictions, as well as unearthing a popup-blocker bypass and iframe sandbox escape.
See Also: Recon Tool: WitnessMe RemediationPickren reported the bugs to Apple in July 2021. They were addressed recently in macOS Monterey 12.0.1 that has resulted in ShareBear now revealing (rather than launching) files, and by preventing WebKit from opening quarantined files in [...]

___________________________
@hacking_Attack
@Hacking_Video

Safari 15.

The $100,000 reward dwarfs the $75,000 payout Pickren revealed in 2020 for a one-click JavaScript-to-webcam access exploit that worked on iPhones, iPads, and macOS.

Pickren soon renewed his interest in Apple webcams and once again compromised iOS and macOS cameras last year, this time via a Safari bug chain that leveraged Skype’s camera permission.
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
See Also: Stuxnet – A weapon made out of code that almost started WW3 Source: portswigger.net (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/Apple-glitch-90x90.jpg Apple fixes new zero-day exploited to hack macOS, iOS devices1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/new-linux-kernel-memory-corruption-bug-causes-full-system-compromise-90x90.jpg Linux system service bug gives root on all major distros, exploit released2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/centos1-90x90.png CWP bugs allow code execution as root on Linux servers3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/mcafee-d2c-90x90.jpg McAfee Bug Can Be Exploited to Gain Windows SYSTEM Privileges4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/ezgif.com-gif-maker-12-90x90.jpg Cisco bug gives remote attackers root privileges via debug mode1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/ezgif.com-gif-maker-11-1-90x90.jpg Beijing Olympics App Flaws Allow Man-in-the-Middle Attacks1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/ezgif.com-gif-maker-10-90x90.jpg SSRF vulnerability in VMWare authentication software could allow access to user data1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/Safari-Apple-navigateur-90x90.jpg Same-origin violation vulnerability in Safari 15 could leak a user’s website history and identity1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/Qlocker-Ransomware-1-90x90.png Qlocker ransomware returns – targets QNAP NAS devices worldwide2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/https___specials-images.forbesimg.com_imageserve_61aff357a4c71fc225ab8ba7_0x0-90x90.jpg AWS fixes security flaws that exposed AWS customer data2 weeks ago
The post Apple pays out $100k bounty for Safari webcam hack that imperiled victims’ online accounts first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Ethical Hacking (part 9.1/20): Timing attack against strings with Python code explained

https://cdn-images-1.medium.com/max/1920/1*Wlvz2eMHSUxfQl0G4Dt7Zw.jpeg
Note: This article is being updated regularly. The latest update: 29/01/2022

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How Hackers are Taking Advantage of COVID-19

https://cdn-images-1.medium.com/max/2600/1*fqLNZfA8vs7JQhDaFG7_4A.jpeg
The pandemic has had a radical effect on nearly every type of business around the world, but one of the biggest booms that few are talking…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
How to Learn Java With No Programming Experience

So you’ve decided you want to learn Java but don’t know where to start? First of all – well done! Java is an excellent choice for a first programming language. However, regardless of the language, learning programming with no previous experience can be quite intimidating. But don’t fret. We are here to help! In this article, we will help you reassure yourself that you made the right choice, teach you how to create an effective study plan, and provide a variety of resources where you can learn Java programming. Why learn JavaChoosing your first programming language can be overwhelming. There are hundreds of languages to choose from. And the continuous debate on which is the best to learn first around them. Here are the main reasons why we insist that you made the right choice with Java as your first programming language. Beginner friendly and easy to learnJava is designed to be beginner-friendly and easy to learn, read, compile, and debug. It is a high-level, class-based, object-oriented programming language. All of this means the language mimics and tries to solve real-world problems. Add to that the syntax which is similar to several other popular languages, particularly its predecessors C and C++, and you have a perfect first language. Learning Java will help you understand the main concepts of programming. So moving to other languages will be a lot easier with Java in your arsenal.

Java also handles complex tasks like memory management and pointer automatically. Which makes it easier for beginners to write and run programs. Java is a cross-platform language with few limitationsJava Virtual Machine makes Java a cross-platform language. You can write code on a Windows computer and seamlessly run it later on a Linux one. Java compiler converts your source code into byte code, which is then translated to machine code by the JVM. And JVM can execute the code on any OS.

Because of this, and the amount of available APIs and libraries, Java has very few limitations in its application. It can be used to write virtually anything. Java is applied in Big Data, the internet of things, web and mobile apps, fintech, enterprise server apps, machine learning, the sky is the limit. Vast community supportJava has been around for a while. This is one of its biggest advantages. It had time to grow a community around itself. Any professional programmer will tell you how important community is in your education and everyday work. When you are stuck, you simply go looking for answers from other programmers who have already seen and resolved the problem you are currently having.

In the recent Stack Overflow survey, 29 162 respondents named Java as their primary language. This means there are over 29000 people ready to help on Stack Overflow alone. Java has a vast and helpful community on other platforms as well. Open Source supportMost of the features Java offers are open-source, which is great for creating beginner-level projects. There’s also the open-source version of the compiler from Oracle. And a huge number of support files and libraries. High Demand on Java developersBecause of the limitless number of fields where Java can be used, it is one of the most in-demand programming languages. Another reason for the high demand for Java developers is the rise of mobile usage worldwide. Java is a native Android language, after all. This increased demand forms a rather significant advantage salary-wise. A junior Java developer makes an average of over $60 000 per year. The number rises to about $86 000 for middle-level developers. How to build an effective self-study planThe Stack Overflow research we’ve already mentioned above states that over 60% of the respondents learned to code from online resources. We wo[...]

___________________________
@hacking_Attack
@Hacking_Video