Dark Reading: Attacks/Breaches
Name That Toon: Out in the Cold

Feeling creative? Submit your caption and our panel of experts will reward the winner with a $25 Amazon gift card.

Dark Reading: Attacks/Breaches
More Orgs Suffered Successful Phishing Attacks in 2021 Than in 2020

Threat actors maintained their relentless attacks on enterprise end users for yet another year, new study shows.

hacking: security in practice
What Can Someone Do With Your IP Address?

https://external-preview.redd.it/RrV-f6fSIRPXvWsqjBzwIRKLKA1_BhPJPEDBG5H3YKA.jpg?width=640&crop=smart&auto=webp&s=aa46d68e44e4485ff3abf5f98dbdf383063bc2d4 submitted by /u/AfroBoyUg
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How would you add multiple filters on wireshark?

How would you add multiple filters on a pcap file? Eg. I want to see DNS requests coming from IP xyz?

Any help would be appreciated

submitted by /u/BoiledCabbage16
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

https://b.thumbs.redditmedia.com/U-6Z8mWWHC2RBgblJkjwjBKQUIPi1pVri3Z_4Z-_ZfA.jpg submitted by /u/Zedd213
[link] [comments]

hacking: security in practice
Using operators in js to exec code

Can somebody give me a good explanation (searched for it online but couldn’t find an exaustive answer) of why you can use let’s say the “-“ operand to execute code? (“-alert()-“). Is it possible to use it everywhere?

submitted by /u/Bongioo
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
21 Days of Bitcoin (Sarah’s Version) | Lesson 8: Can Bitcoin be Hacked?

https://cdn-images-1.medium.com/max/2550/1*gA2cwCgTlBm_tL5IiA1lGg.png
This series was originally published via Bitcoin Magazine. If you’d like to earn 2100 free sats, sign up for the email version here.

Continue reading on Ladies in Bitcoin »

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
GitHub Opens Security Database to Community Contributions

The Microsoft company will allow community members to add information and code samples to security advisories using the standard pull request to change the document.

Dark Reading: Attacks/Breaches
Palo Alto Networks Introduces the Autonomous Security Platform, Cortex XSIAM

The new AI-driven platform brings threat response times from days to minutes and provides a modern alternative to SIEM. Cortex XSIAM is currently available to a limited set of customers with general availability expected later this year.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Hikvision Network Cyber-Protect Helps Ensure Physical Cybersecurity Protection

Combines technology, education and tools to help dealers protect networked security systems.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Log4j Remediation Took Weeks or More for Over 50% of Organizations

ISC(2) survey also found that half of cybersecurity teams worldwide worked on fixing Log4j issues on weekends and during time off.

___________________________
@hacking_Attack
@Hacking_Video

HSTS false positive findings in Burp Pro?
https://www.reddit.com/r/Pentesting/comments/sz6wq9/hsts_false_positive_findings_in_burp_pro/

I notice that Burp keep showing low finding "Strict transport security not enforced" when "strict-transport-security" not found in the HTTP header which is the right thing to do. https://portswigger.net/kb/issues/01000300_strict-transport-security-not-enforced Example of good HSTS configuration $ curl -sI https://owasp.org HTTP/2 200 content-type: text/html; charset=utf-8 strict-transport-security: max-age=31536000; includeSubDomains However, Burp also show similar finding when the site is redirecting (302) to different page and there is no HSTS in the landing page e.g. $ curl -sI https://127.0.0.1 HTTP/1.1 302 Found Cache-Control: private Content-type: text/html; charset=utf-8 Location: https://127.0.0.1/otherPage.php But then when checked the redirected page, HSTS is there $ curl -sI https://127.0.0.1/otherPage.php HTTP/1.1 302 Found Cache-Control: private Content-type: text/html; charset=utf-8 ... Strict-Transport-Security: max-age=31536000; includeSubDomains Is this considered as false positive? submitted by /u/w0lfcat (https://www.reddit.com/user/w0lfcat)
[link] (https://www.reddit.com/r/Pentesting/comments/sz6wq9/hsts_false_positive_findings_in_burp_pro/) [comments] (https://www.reddit.com/r/Pentesting/comments/sz6wq9/hsts_false_positive_findings_in_burp_pro/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Big question: When is Hacking Illegal and Legal?

https://cdn-images-1.medium.com/max/976/1*bshdy5xbzhxEojf6awebLA.jpeg
The big question of the day is that, When is Hacking Illegal and Legal?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Descomplicando cálculos de sub-rede (IPV4)

https://cdn-images-1.medium.com/max/600/1*TUpykgCsJ8rV4fAZzri4jw.jpeg
Antes de irmos direto para os calculos de sub-rede, acho que se faz necessário uma breve explicação sobre o IPV4 (Internet Protocol…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
HSTS false positive findings in Burp Pro?

I notice that Burp keep showing low finding "Strict transport security not enforced" when "strict-transport-security" not found in the HTTP header which is the right thing to do.

https://portswigger.net/kb/issues/01000300_strict-transport-security-not-enforced

Example of good HSTS configuration
$ curl -sI https://owasp.org HTTP/2 200 content-type: text/html; charset=utf-8 strict-transport-security: max-age=31536000; includeSubDomains
However, Burp also show similar finding when the site is redirecting (302) to different page and there is no HSTS in the landing page

e.g. (no HSTS here)
$ curl -sI https://127.0.0.1 HTTP/1.1 302 Found Cache-Control: private Content-type: text/html; charset=utf-8 Location: https://127.0.0.1/otherPage.php
But then when checked the redirected page, HSTS is there
$ curl -sI https://127.0.0.1/otherPage.php HTTP/1.1 302 Found Cache-Control: private Content-type: text/html; charset=utf-8 ... Strict-Transport-Security: max-age=31536000; includeSubDomains
My questions:

1. Is this considered as false positive?
2. Is HSTS flag required in every single HTTP response?

submitted by /u/w0lfcat
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Best & Simple Things About Malicious

https://cdn-images-1.medium.com/max/600/0*m-90DMp9mnQZwRXu.jpg
Malicious software / code can disrupt computer systems, IT, mobile app and, in more extreme cases, delete your private data or hold it for…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video