https://b.thumbs.redditmedia.com/U-6Z8mWWHC2RBgblJkjwjBKQUIPi1pVri3Z_4Z-_ZfA.jpg submitted by /u/Zedd213
[link] [comments]

hacking: security in practice
Using operators in js to exec code

Can somebody give me a good explanation (searched for it online but couldn’t find an exaustive answer) of why you can use let’s say the “-“ operand to execute code? (“-alert()-“). Is it possible to use it everywhere?

submitted by /u/Bongioo
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
21 Days of Bitcoin (Sarah’s Version) | Lesson 8: Can Bitcoin be Hacked?

https://cdn-images-1.medium.com/max/2550/1*gA2cwCgTlBm_tL5IiA1lGg.png
This series was originally published via Bitcoin Magazine. If you’d like to earn 2100 free sats, sign up for the email version here.

Continue reading on Ladies in Bitcoin »

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
GitHub Opens Security Database to Community Contributions

The Microsoft company will allow community members to add information and code samples to security advisories using the standard pull request to change the document.

Dark Reading: Attacks/Breaches
Palo Alto Networks Introduces the Autonomous Security Platform, Cortex XSIAM

The new AI-driven platform brings threat response times from days to minutes and provides a modern alternative to SIEM. Cortex XSIAM is currently available to a limited set of customers with general availability expected later this year.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Hikvision Network Cyber-Protect Helps Ensure Physical Cybersecurity Protection

Combines technology, education and tools to help dealers protect networked security systems.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Log4j Remediation Took Weeks or More for Over 50% of Organizations

ISC(2) survey also found that half of cybersecurity teams worldwide worked on fixing Log4j issues on weekends and during time off.

___________________________
@hacking_Attack
@Hacking_Video

HSTS false positive findings in Burp Pro?
https://www.reddit.com/r/Pentesting/comments/sz6wq9/hsts_false_positive_findings_in_burp_pro/

I notice that Burp keep showing low finding "Strict transport security not enforced" when "strict-transport-security" not found in the HTTP header which is the right thing to do. https://portswigger.net/kb/issues/01000300_strict-transport-security-not-enforced Example of good HSTS configuration $ curl -sI https://owasp.org HTTP/2 200 content-type: text/html; charset=utf-8 strict-transport-security: max-age=31536000; includeSubDomains However, Burp also show similar finding when the site is redirecting (302) to different page and there is no HSTS in the landing page e.g. $ curl -sI https://127.0.0.1 HTTP/1.1 302 Found Cache-Control: private Content-type: text/html; charset=utf-8 Location: https://127.0.0.1/otherPage.php But then when checked the redirected page, HSTS is there $ curl -sI https://127.0.0.1/otherPage.php HTTP/1.1 302 Found Cache-Control: private Content-type: text/html; charset=utf-8 ... Strict-Transport-Security: max-age=31536000; includeSubDomains Is this considered as false positive? submitted by /u/w0lfcat (https://www.reddit.com/user/w0lfcat)
[link] (https://www.reddit.com/r/Pentesting/comments/sz6wq9/hsts_false_positive_findings_in_burp_pro/) [comments] (https://www.reddit.com/r/Pentesting/comments/sz6wq9/hsts_false_positive_findings_in_burp_pro/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Big question: When is Hacking Illegal and Legal?

https://cdn-images-1.medium.com/max/976/1*bshdy5xbzhxEojf6awebLA.jpeg
The big question of the day is that, When is Hacking Illegal and Legal?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Descomplicando cálculos de sub-rede (IPV4)

https://cdn-images-1.medium.com/max/600/1*TUpykgCsJ8rV4fAZzri4jw.jpeg
Antes de irmos direto para os calculos de sub-rede, acho que se faz necessário uma breve explicação sobre o IPV4 (Internet Protocol…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
HSTS false positive findings in Burp Pro?

I notice that Burp keep showing low finding "Strict transport security not enforced" when "strict-transport-security" not found in the HTTP header which is the right thing to do.

https://portswigger.net/kb/issues/01000300_strict-transport-security-not-enforced

Example of good HSTS configuration
$ curl -sI https://owasp.org HTTP/2 200 content-type: text/html; charset=utf-8 strict-transport-security: max-age=31536000; includeSubDomains
However, Burp also show similar finding when the site is redirecting (302) to different page and there is no HSTS in the landing page

e.g. (no HSTS here)
$ curl -sI https://127.0.0.1 HTTP/1.1 302 Found Cache-Control: private Content-type: text/html; charset=utf-8 Location: https://127.0.0.1/otherPage.php
But then when checked the redirected page, HSTS is there
$ curl -sI https://127.0.0.1/otherPage.php HTTP/1.1 302 Found Cache-Control: private Content-type: text/html; charset=utf-8 ... Strict-Transport-Security: max-age=31536000; includeSubDomains
My questions:

1. Is this considered as false positive?
2. Is HSTS flag required in every single HTTP response?

submitted by /u/w0lfcat
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Best & Simple Things About Malicious

https://cdn-images-1.medium.com/max/600/0*m-90DMp9mnQZwRXu.jpg
Malicious software / code can disrupt computer systems, IT, mobile app and, in more extreme cases, delete your private data or hold it for…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hacking paper

https://cdn-images-1.medium.com/max/976/1*1VG8_q0m2Y4GYjhyUD4umA.jpeg
Hi guys! I’m back with another blog and this is great because it’s a write up from hackthebox!

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

2 Days Left for IWCON 2022 Virtual Infosec Conference & Networking Event
https://infosecwriteups.com/2-days-left-for-iwcon-2022-virtual-infosec-conference-networking-event-407715243eaa?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Never attended a virtual networking event before? Your FAQs answered + Check our live demo here.Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/2-days-left-for-iwcon-2022-virtual-infosec-conference-networking-event-407715243eaa?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video