hacking: security in practice
Traitor now includes an exploit for CVE-2021-4034 (pwnkit)

https://external-preview.redd.it/OgJf5z4cFGo1qafeEPS4Y2J_uzRTxsB8jt_bK_jujLM.jpg?width=640&crop=smart&auto=webp&s=a2a26656580d677f8321380a0bf01462c14c0a26 submitted by /u/pope_friction
[link] [comments]

hacking: security in practice
reverse engineered and documented United Airlines in flight API

https://external-preview.redd.it/55UHUECqap9Rou_PC8ER1EAM9jBG2DB2nczhIbvlMcs.jpg?width=640&crop=smart&auto=webp&s=b3923b5aedc9a3e23dfff4feb965ce64aa93dd95 submitted by /u/binaryfor
[link] [comments]

hacking: security in practice
I think someone was trying to hack me

This person that follows me on Instagram, sent me a message saying “it took me over 3 hours to make this I hope you like it” and the next message was a link and I don’t remember it clearly but it said something like “gift” and it had my Instagram username at the very end. Was this person trying to hack me?

submitted by /u/confusiontime101
[link] [comments]

Kerbrute - An Script To Perform Kerberos Bruteforcing By Using Impacket

An script to perform kerberos bruteforcing by using the Impacket library. When is executed, as input it receives a user or list of users and a password or list of password. Then is performs a brute-force attack to enumerate: Valid username/passwords pairs Valid usernames Usernames without pre-authentication required As a result, the script generates a list of valid credentials discovered, and the TGT's generated due those valid credentials. Installation From pypi: pip3 install kerbrute From repo: git clone https://github.com/TarlogicSecurity/kerbrutecd kerbrutepip install -r requirements.txt Use Help without arguments: root@kali:~# kerbruteImpacket v0.9.18 - Copyright 2018 SecureAuth Corporationusage: kerbrute.py -h -debug (-user USER | -users USERS) -password PASSWORD | -passwords PASSWORDS -domain DOMAIN -dc-ip <ip\_address> -threads THREADS -outputfile OUTPUTFILE -no-save-ticketoptional arguments: -h, --help show this help message and exit -debug Turn DEBUG output ON -user USER User to perform bruteforcing -users USERS File with user per line -password PASSWORD Password to perform bruteforcing -passwords PASSWORDS File with password per line -domain DOMAIN Domain to perform bruteforcing -dc-ip <ip_address> IP Address of the domain controller -threads THREADS Number of threads to perform bruteforcing. Default = 1 -outputfile OUTPUTFILE File to save discovered user:password -no-save-ticket Do not save retrieved TGTs with correct credentialsExamples: ./kerbrute.py -users users_file.txt -passwords passwords_file.txt -domain contoso.com Example of execution: velociraptor NOT PREAUTH \* Valid user => trex \* Saved discovered passwords in jurassic_passwords.txt">root@kali:~# kerbrute -domain jurassic.park -users users.txt -passwords passwords.txt -outputfile jurassic_passwords.txtImpacket v0.9.18 - Copyright 2018 SecureAuth Corporation\* Stupendous => triceratops:Sh4rpH0rns\* Saved TGT in triceratops.ccache\* Valid user => velociraptor NOT PREAUTH\* Valid user => trex\* Saved discovered passwords in jurassic_passwords.txt Download Kerbrute
Read more...

Building Custom Empire Modules
https://www.reddit.com/r/redteamsec/comments/sglg5r/building_custom_empire_modules/

submitted by /u/DLLCoolJ (https://www.reddit.com/user/DLLCoolJ)
[link] (https://youtu.be/ZS3Rdld_Ebo) [comments] (https://www.reddit.com/r/redteamsec/comments/sglg5r/building_custom_empire_modules/)

How I Found A Simple Stored XSS

This is the story of how I found my first Stored XSS (“Cross Site Scripting”) vulnerability in a bug bounty program and a walk through on…Continue reading on Medium »
Read more...

Hacking on Medium
I am Interested in Cyber Security. Where do I start?

https://cdn-images-1.medium.com/max/1500/1*IyR4X4KE7YuPugIZorGdxw.jpeg
I know just the place.

Continue reading on Everything Secure »

Hacking on Medium
Privilege Escalation in Linux Systems

https://cdn-images-1.medium.com/max/1000/1*FOIjs40QzGv1vT24qgMvuw.jpeg
Looking for a way to gain root access after establishing the initial foothold in Linux systems? Here are some things to look for to…

Continue reading on Medium »

Hacking on Medium
Hacking Django websites: Man In The Middle attack

https://cdn-images-1.medium.com/max/820/1*Q2OJE8anx_Scj7Eb3EWzgw.png
A website served via HTTP is vulnerable to Man In The Middle (MITM) attacks: a hacker can get between your browser and the server…

Continue reading on Medium »

Hacking on Medium
How I Found A Simple Stored XSS

https://cdn-images-1.medium.com/max/800/1*v3z_7_uX2eKGvh7GFtaXhw.jpeg
This is the story of how I found my first Stored XSS (“Cross Site Scripting”) vulnerability in a bug bounty program and a walk through on…

Continue reading on Medium »

Hacking on Medium
Hack a Linux Desktop with The Cheapest USB Rubber Ducky and The Android Terminal (Termux)

https://cdn-images-1.medium.com/max/2600/0*38rjKZvpmfl-S2WG
Last time, I have written an article about making a USB Rubber Ducky with less than $3 and I did a simple test and attach how to…

Continue reading on InfoSec Write-ups »

Good scanners recommendations for learning?
https://www.reddit.com/r/Pentesting/comments/sgo3al/good_scanners_recommendations_for_learning/

<!-- SC_OFF -->I'm interested in learning more about network and web application scanning. I started off with nmap, and found some of the NSE scripts very helpful. I then went to nikto but it's seems very basic, and I haven't been able to find much documentation. Do you all have some recommendations on scanning tools to learn for network, vulnerability, and web app scanning? ​ Kind regards <!-- SC_ON --> submitted by /u/sma92878 (https://www.reddit.com/user/sma92878)
[link] (https://www.reddit.com/r/Pentesting/comments/sgo3al/good_scanners_recommendations_for_learning/) [comments] (https://www.reddit.com/r/Pentesting/comments/sgo3al/good_scanners_recommendations_for_learning/)

How I Found A Simple Stored XSS
https://medium.com/@raymond-lind/how-i-found-a-simple-stored-xss-a2976c5251b?source=rss------bug_bounty-5