Hacking on Medium
DERPNSTINK1 VM Walkthrough

https://cdn-images-1.medium.com/max/799/0*gs6lzL6r5T9KE9MZ
Makineyi indirebilirsiniz.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
If My Organization Is Mostly in the Cloud, Do I Need a Firewall?

A firewall is still a valuable part of the IT security stack, but businesses need to consider all their attack surfaces.

Dark Reading: Attacks/Breaches
Cato Networks Delivers Instant Visibility and Control of Cloud Application Data Risk

CASB Cato converges a full CASB into its global SASE platform to defend enterprises against data breach and cloud-delivered threats.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
A Powerful Mindset Hack to Zap Back! Record THIS Hypnosis Session.

https://cdn-images-1.medium.com/max/960/1*QWHgdqjEBJW2ndT-GabAzA.png
This is a very effective hypnosis session carefully drafted to be extremely powerful. It will heighten your mental clarity, stamina and…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
GoogleSheets PDF w/ JavaScript-embedded found from the web, interested in your analysis

submitted by /u/wisdomteethhelp
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Travelling around the world using Public WiFi - How to be safe?

Hi all,

I'm about to embark on some travelling and finding that I rely on a lot of Public WiFi Hotspots (ik this is pretty bad - especially with what I'm doing - largely investing). I also realise the answer is very much likely to be DON'T USE PUBLIC WIFI YOU FOOL.

I'm wondering if I should 100% use a VPN and whether that's all that's needed to help protect myself when using Public WiFi hotspots.

Or if you have any alternatives to using Public WiFi Hotspots, please let me know.

Thanks all,

- Burge

submitted by /u/MyNamesBurge
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
I built a Chrome extension to find and autofill job applications in 1 click

https://b.thumbs.redditmedia.com/SSopmHKqAepALJDjgsu5qNoyeZNP2xeISauP-EDS1BU.jpg After filling out ~100 job applications by hand, I got tired of copy/pasting and writing down submitted job apps in excel sheets. So I made a website and a Chrome extension called EasyJobs to do everything easily to help lazy people like me.

The website contains ~200,000 autofillable job openings from the Internet. You can find and autofill most applications in 1 click without even leaving the website. I also included a "My Applications" section to keep track of submitted job apps (no excel!!). It's completely free:

https://easyjobs.so/

Give it a try. Let me know what you think or want something added/changed.

https://i.redd.it/9ttjdo2cbkf81.gif

submitted by /u/Ok_Woodpecker5107
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Netflix 德劇二：How to Sell Drugs online 全歐最酷線上藥頭

https://cdn-images-1.medium.com/max/2600/1*ORMDZ7nA4jIC6TiD5TlvGQ@2x.jpeg
#科技#程式語言#青少年#搖頭丸#虛擬貨幣

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What were the steps in the colonial pipeline attack?

Like what really happened in chronologic order

submitted by /u/HimymLover123
[link] [comments]

Black Hat Ethical Hacking
ESET antivirus bug let attackers gain Windows SYSTEM privileges

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png ESET antivirus bug let attackers gain Windows SYSTEM privilegesPost Views: 188 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute
The flaw (CVE-2021-37852) was reported by Michael DePlante of Trend Micro’s Zero Day Initiative, and it enables attackers to escalate privileges to NT AUTHORITY\SYSTEM account rights (the highest level of privileges on a Windows system) using the Windows Antimalware Scan Interface (AMSI).
Slovak internet security firm ESET released security fixes to address a high severity local privilege escalation vulnerability affecting multiple products on systems running Windows 10 and later or Windows Server 2016 and above. AMSI was first introduced with Windows 10 Technical Preview in 2015, and it allows apps and services to request memory buffer scans from any major antivirus product installed on the system. According to ESET, this can only be achieved after attackers gain SeImpersonatePrivilege rights, normally assigned to users in the local Administrators group and the device’s local Service account to impersonate a client after authentication which should “limit the impact of this vulnerability.”

However, ZDI’s advisory says attackers are only required to “obtain the ability to execute low-privileged code on the target system,” which matches ESET’s CVSS severity rating also showing that the bug can be exploited by threat actors with low privileges.

While ESET said it only found out about this bug on November 18, a disclosure timeline available in ZDI’s advisory reveals that the vulnerability was reported four months earlier, on June 18, 2021.
See Also: Complete Offensive Security and Ethical Hacking Course Affected ESET productsThe list of products impacted by this vulnerability is quite long, and it includes:

* ESET NOD32 Antivirus, ESET Internet Security, ESET Smart Security, and ESET Smart Security Premium from version 10.0.337.1 to 15.0.18.0
* ESET Endpoint Antivirus for Windows and ESET Endpoint Security for Windows from version 6.6.2046.0 to 9.0.2032.4
* ESET Server Security for Microsoft Windows Server 8.0.12003.0 and 8.0.12003.1, ESET File Security for Microsoft Windows Server from version 7.0.12014.0 to 7.3.12006.0
* ESET Server Security for Microsoft Azure from version 7.0.12016.1002 to 7.2.12004.1000
* ESET Security for Microsoft SharePoint Server from version 7.0.15008.0 to 8.0.15004.0
* ESET Mail Security for IBM Domino from version 7.0.14008.0 to 8.0.14004.0
* ESET Mail Security for Microsoft Exchange Server from version 7.0.10019 to 8.0.10016.0
See Also: Windows vulnerability with new public exploits lets you become admin Users of ESET Server Security for Microsoft Azure are also advised to immediately update ESET File Security for Microsoft Azure to the latest available version of ESET Server Security for Microsoft Windows Server to address the flaw.

The antivirus maker released multiple security updates between December 8 and January 31 to address this vulnerability, when it patched the last vulnerable product exposed to attacks.

Luckily, ESET found no evidence of exploits designed to target products affected by this security bug in the wild.

“The attack surface can also be eliminated by disabling the Enable advanced scanning via AMSI option in ESET products’ Advanced setup,” ESET added.

“However, ESET strongly recommends performing an upgrade to a fixed product version and only applying this workaround when the upgrade is not possible[...]

for an important reason.”
See Also: Recon Tool: WitnessMe Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
See Also: How ILOVEYOU worm became the first global computer virus pandemic Source: bleepingcomputer.com (Original Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/image6-90x90.png Cloudflare launches a paid public bug bounty program1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/do-any-web-page-convert-into-elementor-pro-template-90x90.jpg 600K WordPress sites impacted by critical plugin RCE vulnerability2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/hacking-windows-10-evade-detection-netstat-tasklist.1280x600-90x90.jpg Windows vulnerability with new public exploits lets you become admin3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/ryanpickrenapplehack-768x768-1-90x90.jpg Apple pays out $100k bounty for Safari webcam hack that imperiled victims’ online accounts6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/Apple-glitch-90x90.jpg Apple fixes new zero-day exploited to hack macOS, iOS devices1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/new-linux-kernel-memory-corruption-bug-causes-full-system-compromise-90x90.jpg Linux system service bug gives root on all major distros, exploit released1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/centos1-90x90.png CWP bugs allow code execution as root on Linux servers1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/mcafee-d2c-90x90.jpg McAfee Bug Can Be Exploited to Gain Windows SYSTEM Privileges1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/ezgif.com-gif-maker-12-90x90.jpg Cisco bug gives remote attackers root privileges via debug mode2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/ezgif.com-gif-maker-11-1-90x90.jpg Beijing Olympics App Flaws Allow Man-in-the-Middle Attacks2 weeks ago
The post ESET antivirus bug let attackers gain Windows SYSTEM privileges first appeared on Black Hat Ethical Hacking.

Kali Linux Tutorials
Swurg : Parse OpenAPI Documents Into Burp Suite For Automating OpenAPI-based APIs Security Assessments

Swurg is a Burp Suite extension designed for OpenAPI testing.

The OpenAPI Specification (OAS) defines a standard, programming language-agnostic interface description for REST APIs, which allows both humans and computers to discover and understand the capabilities of a service without requiring access to source code, additional documentation, or inspection of network traffic. When properly defined via OpenAPI, a consumer can understand and interact with the remote service with a minimal amount of implementation logic. Similar to what interface descriptions have done for lower-level programming, the OpenAPI Specification removes guesswork in calling a service.

Use cases for machine-readable API definition documents include, but are not limited to: interactive documentation; code generation for documentation, clients, and servers; and automation of test cases. OpenAPI documents describe an API’s services and are represented in either YAML or JSON formats. These documents may either be produced and served statically or be generated dynamically from an application.

– OpenAPI Initiative

Performing security assessment of OpenAPI-based APIs can be a tedious task due to Burp Suite (industry standard) lacking native OpenAPI parsing capabilities. A solution to this situation, is to use third-party tools (e.g. SOAP-UI) or to implement custom scripts (often on a per engagement basis) to handle the parsing of OpenAPI documents and integrate/chain the results to Burp Suite to use its first class scanning capabilities.

Swurg is an OpenAPI parser that aims to streamline this entire process by allowing security professionals to use Burp Suite as a standalone tool for security assessment of OpenAPI-based APIs. Supported Features

* OpenAPI documents can be parsed either from a supplied file or URL. The extension can fetch OpenAPI documents directly from a URL using the Send to Swagger Parserfeature under the Target -> Site mapcontext menu.
* Parse OpenAPI documents, formerly known as the Swagger specification, fully compliant with OpenAPI 2.0/3.0 Specifications (OAS).
* Requests can be directly viewed/edited within the extension prior to sending them to other Burp tools.
* Requests can be sent to the Comparer, Intruder, Repeater, Scanner, Site map and ScopeBurp tools.
* Requests matching specific criterias (detailed in the ‘Parameters’ tab) can be intercepted to automatically match and replace the parsed parameters default values defined in the ‘Parameters’ tab. This feature allows for fine-tuning of the requests prior to sending them to other Burp tools (e.g., scanner). Edited requests can be viewed within the ‘Modified Request (OpenAPI Parser)’ tab of Burp’s message editor.
* Row highlighting allowing pentesters to highlight “interesting” API calls and/or colour code them for reporting purposes.
* Supports both JSON and YAML formats. Installation Compilation Windows & Unix

* Install and configure Gradle (https://gradle.org/) on your system.
* Download/clone this repository

$ git clone https://github.com/aress31/swurg
$ cd .\swurg\

Create the standalone jar:

$ gradle fatJar

Loading the extension into the Burp Suite

In Burp Suite, under the Extender/Optionstab, click on the Addbutton and load the swurg-alljar file located in the .\build\libsfolder.

Alternatively, you can now directly install/load this extension from the BApp Store.

Note: The version distributed on the BApp Storemight be behind the version available on this repository. Possible Improvements

* Beautify the graphical user interface.
* Deep parsing of OpenAPI schemas to collect all nested paramete[...]

rs along with their example/type.
* Code simplification/refactoring.
* Enable cells editing to change API calls directly from the GUI.
* Further optimise the source code.
* Implement support for authenticated testing (via user-supplied API-keys).
* Improve the Param column by adding the type of parameters (e.g. inquery, inbody, etc.).
* Implement the tables and context menus.
* Increase the extension verbosity (via the bottom panel). Download

Hacking on Medium
How Machine Learning Has Become Essential in Stopping Spam and Bots

https://cdn-images-1.medium.com/max/640/0*by3Laf361zc6-gy-.jpg
Spam filters are essential. Without them we couldn’t cut through the noise of phishing scams and malware links to read our messages.

Continue reading on Netacea »