Hacking on Medium
Critical CSRF to RCE in FileBrowser

https://cdn-images-1.medium.com/max/1200/1*JuQWZtUHamKuKhjU1VZeQg.png
Introduction

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Letting China in Through the Front Door?

https://cdn-images-1.medium.com/max/1400/1*r3zRiOi48_0-psv-NTVHog.png
By Andy Keiser, NSI Fellow and Michael Lumpkin

Continue reading on The SCIF »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
MetaMask ve NFT’ler bir araya geldiğinde IP adresinizin açığa çıkabileceğini biliyor muydunuz?

https://cdn-images-1.medium.com/max/1280/1*atrLJTbPDz6TA_zAMKplIA.jpeg
21 milyon kullanıcısı*¹ ile kripto para cüzdanlarının en güçlüsü, en çok tercih edileni MetaMask! Hangi DeFi projesine giderseniz gidin…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Cambios en la nueva ISO/IEC 27002:2022

https://cdn-images-1.medium.com/max/1593/0*x_IYCmliQBBDUHs8
PUBLICADO EN 27 ENERO, 2022POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Nineveh | HackTheBox writeup

https://cdn-images-1.medium.com/max/698/1*IxtrEjWnHS0AU7Y4Smm_PA.png
an ancient Assyrian city of Upper Mesopotamia, located on the outskirts of Mosul in modern-day northern Iraq

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Journey to the first 2 CVEs

https://cdn-images-1.medium.com/max/728/1*DkGtePD8FwvWNS-H8RsaUQ.png
Hello Hackers,

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Alfred —  TryHackMe walkthrough

https://cdn-images-1.medium.com/max/600/1*LCrIBEvO-NKFN5IQWxjZYQ.png
Exploit Jenkins to gain an initial shell, then escalate your privileges by exploiting Windows authentication tokens.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Tiny File Manager Authenticated RCE

https://cdn-images-1.medium.com/max/1024/0*--imb12G6Pw53VMg
Introduction

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Kerberoast : Kerberoast Attack -Pure Python-

Kerberoast attack toolkit -pure python

Install

pip3 install kerberoast

Prerequirements

Python 3.6 See requirements.txt For the impatient

IMPORTANT: the accepted target url formats for LDAP and Kerberos are the following : : Steps -with SSPI-: kerberoast auto Steps -SSPI not used-:

* Look for vulnerable users via LDAP kerberoast ldap all * Use ASREP roast against users in the ldapenum_asrep_users.txtfile kerberoast asreproast * Use SPN roast against users in the ldapenum_spn_users.txtfile kerberoast spnroast * Crack SPN roast and ASPREP roast output with hashcat Commands ldap

This command group is for enumerating potentially vulnerable users via LDAP. Command structure kerberoast ldap Type: It supports three types of users to be enumerated

* spnEnumerates users with servicePrincipalNameattribute set.
* asrepEnumerates users with DONT_REQ_PREAUTHflag set in their UAC attribute.
* allStartes all the above mentioned enumerations. ldap_connection_url: Specifies the usercredential and the target server in the msldap url format (see help) options: -o: Output file base name brute

This command is to perform username enumeration by brute-forcing the kerberos service with possible username candidates Command structure kerberoast brute realm: The kerberos realm usually looks like COMPANY.corpdc_ip: IP or hostname of the domain controller targets: Path to the file which contains the possible username candidates options: -o: Output file base name asreproast

This command is to perform ASREProast attack Command structure kerberoast asreproast dc_ip: IP or hostname of the domain controller options: -r: Specifies the kerberos realm to be used. It overrides all other realm info. -o: Output file base name -t: Path to the file which contains the usernames to perform the attack on -u: Specifies the user to perform the attack on. Format is either or but in the first case, the -roption must be used to specify the realm spnroast

This command is to perform SPNroast (AKA kerberoast) attack. Command structure kerberoast spnroast kerberos_connection_url: Specifies the usercredential and the target server in the kerberos URL format (see help) options: -r: Specifies the kerberos realm to be used. It overrides all other realm info. -o: Output file base name -t: Path to the file which contains the usernames to perform the attack on -u: Specifies the user to perform the attack on. Format is either or but in the first case, the -roption must be used to specify the realm Download

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Linkedin Account Generator

I am writing a script to generate linkedin account for digital makerting , I am in testing phase, so I created various accounts manually with different cellphone sms verification numbers, but days after that without any actions, all these accounts are blocked with restricctions including my original account, I need to upload an real ID document to recovery each of them, Does anybody knows how Microsoft/ Linkedin known these accounts are 'fakes' and how linked with my original account? I am thinking about use diferent proxies to manage my accounts, but I donot know if i am right? And how to bypass this posible detection.

submitted by /u/happygroweed
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Explained: The OpenSea NFT Listing Vulnerability

https://external-preview.redd.it/4TcJsI4xV3GkJta_amRNS-Lv_dIgfbNHe1bfpT2_4BI.jpg?width=640&crop=smart&auto=webp&s=afcbd0a97708f5b4139f3739dcd01aadad3789f9 submitted by /u/joe691013
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video