Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
Credential-Stuffing Attacks on Remote Windows Systems Took Off in 2021

Password-guessing became last year's weapon of choice, as attackers attempted to brute-force vulnerable Remote Desktop Protocol (RDP) servers, SQL databases, and SMB file shares.

11 views01:27

Source

Dark Reading: Attacks/Breaches
Retailers' Offboarding Procedures Leave Potential Risks

IT teams need to consider unforeseen threats to avoid violating privacy regulations and supplier contracts.

13 views01:27

Source

Hacking Articles Tips Tricks Videos Tutorials

12 views01:27

Hacking Articles Tips Tricks Videos Tutorials

Photo

Dark Reading: Attacks/Breaches
Apple Releases Security Update for Webkit Flaw

A Webkit use-after-free vulnerability in iOS, iPadOS, Monterey, and Safari may already have been exploited, Apple said in a security advisory issued today.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading

Apple Releases Security Update for Webkit Flaw

A Webkit use-after-free vulnerability in iOS, iPadOS, Monterey, and Safari may already have been exploited, Apple said in a security advisory issued today.

13 viewsedited 01:27

Hacking Articles Tips Tricks Videos Tutorials

Authenticated Penetration Testing
https://www.reddit.com/r/Pentesting/comments/spo2ff/authenticated_penetration_testing/

As with vulnerability scans, the tests (Penetration Testing) can either be authenticated or unauthenticated. An authenticated test runs as a registered and logged-in user on the internal network, whereas unauthenticated would be from an external source with no network privileges. https://phoenixnap.com/blog/vulnerability-scanning-vs-penetration-testing Let say there are multiple user roles on the target system. Do we need to request for all of them (tester id) and test or only one or two low privilege user and try privesc, IDOR, etc? submitted by /u/w0lfcat (https://www.reddit.com/user/w0lfcat)
[link] (https://www.reddit.com/r/Pentesting/comments/spo2ff/authenticated_penetration_testing/) [comments] (https://www.reddit.com/r/Pentesting/comments/spo2ff/authenticated_penetration_testing/)

___________________________
@hacking_Attack
@Hacking_Video

Authenticated Penetration Testing

>As with vulnerability scans, the tests (Penetration Testing) can either be authenticated or unauthenticated. An authenticated test runs as a...

11 viewsedited 02:46

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
John The Ripper: Incremental ASCII unreasonably effective?

I just used JTR for the first time to get the password to a ZIP file. After going through the wordlist it switched over to incremental ASCII, which to my understanding just bruteforces the password.

Now my password turned out to be 9 characters long, all lower case, starting with "a", and kind of sounding like a valid word, but I had no idea beforehand what kind of characters would be used and how long it was, so I just let it go on "automatic".

If we assume 26 lowercase letters, 26 uppercase, 10 digits and a couple for punctuation, we get ~70 possible characters. 70^9 = 4*10^16. My terminal was showing 16 000 Kp/s per second, which I understand to be Kilopasswords per second. Combine the two and you obtain almost exactly 80 years to go through all possible 9 character ASCII combinations.

Here's the surprising part: JTR found the password in one hour. What's going on here? Did I totally misunderstand what Kp/s means? Am I really bad at math? Is JTR magic? DId I just get insanely lucky?

If we limit ourselves to lowercase letters the time falls back to a reasonable ~100 hours, if we assume we try combinations that start with "a" first down to ~4, but that's not what it seemed to be doing, it showed it was trying upper case letters, digits and punctuation signs as well.

submitted by /u/Nitrolo
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

John The Ripper: Incremental ASCII unreasonably effective?

I just used JTR for the first time to get the password to a ZIP file I didn't know. After going through the rockyou wordlist from Kali it switched...

9 viewsedited 02:52

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Puzzling out a security concern: website allows unauthenticated private uploaded files

submitted by /u/stevetheserioussloth
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Puzzling out a security concern: website allows unauthenticated...

Posted in r/hacking by u/stevetheserioussloth • 0 points and 0 comments

9 viewsedited 02:52

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
I want to download a keylogger onto my computer.

Not a hostile one but one that while spit back a txt file or something like that to track activity on my account for a project

submitted by /u/TheRougeGeo
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

I want to download a keylogger onto my computer.

Not a hostile one but one that while spit back a txt file or something like that to track activity on my account for a project

9 viewsedited 02:52

Hacking Articles Tips Tricks Videos Tutorials

VulnLab SQL Injection— Dynamic Application Security Testing #3
https://muh-hidayat7799.medium.com/vulnlab-sql-injection-dynamic-application-security-testing-3-2138d56dbe03?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Medium

VulnLab SQL Injection— Dynamic Application Security Testing #3

Assalamualaikum Wr.Wb

10 viewsedited 03:11

Hacking Articles Tips Tricks Videos Tutorials

12 views03:11