hacking: security in practice
What’s is up with the bvp 47 backdoor? Is there anything one can do ?

https://thehackernews.com/2022/02/chinese-experts-uncover-details-of.html

submitted by /u/Meier2
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
If Ddos is illegal then what about anonymous

Correct me if I’m wrong but in this cyber war between Russia and Ukraine the anonymous hacker group have been using Ddos attacks, so if they get caught will they be arrested or will an exception be made due to their cause. In my country Ddos is punishable by a jail sentence/ fine. Any insight helps, thanks

submitted by /u/Armweak5104
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Bruteforce metamask password

Hi, a friend of mine lost his metamask password, he has no seedphrase, no private key, nothing.
He can only try to brute force it.
He knows the password is around 15-18 chars and he also knows the first 7 letters. The other chars are either numbers (0-9) or ! or ?.
What would be the best way to bruteforce?

submitted by /u/Hyposs
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Anonymous is not alone NB65

submitted by /u/Haldane-FRS
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Rustpad : Multi-Threaded Padding Oracle Attacks Against Any Service

Rustpadis a multi-threaded successor to the classic padbuster, written in Rust. It abuses a Padding Oracle vulnerability to decrypt any cypher text or encrypt arbitrary plain text without knowing the encryption key!

Features

* Decryption of cypher texts
* Encryption of arbitrary plain text
* Multi-threading on both block and byte level
* Modern, real-time and interactive TUI!
* No-TTY support, so you can just pipe output to a file
* Supports Web server oracles…
* … and Script-based oracles. For when you need just that extra bit of control.
* Automated calibration of web oracle’s (in)correct padding response
* Progress bar and automated retries
* Tab auto-completion
* Block-level caching
* Smart detection of cypher text encoding, supporting: hex, base64, base64url* No IV support
* Written in purely safe Rust, making sure you don’t encounter nasty crashes

Usage

Using rustpadto attack a padding oracle is easy. It requires only 4 pieces of information to start:

* type of oracle (web/script, see below)
* target oracle (--oracle)
* cypher text to decrypt (--decrypt)
* block size (--block-size) Web mode

Web mode specifies that the oracle is located on the web. In other words, the oracle is a web server with a URL.

For a padding oracle attack to succeed, an oracle must say so if a cypher text with incorrect padding was provided. rustpadwill analyse the oracle’s responses and automatically calibrate itself to the oracle’s behaviour.

rustpad web –help
rustpad-web 1.8.0
Question a web-based oracle
USAGE:
rustpad {web, –web, -W} [OPTIONS] –oracle –block-size –decrypt
OPTIONS:
-A, –user-agent
User-agent to identify with
[default: rustpad/1.8.0]
-B, –block-size
Block size used by the cypher
[options: 8, 16]
-c, –consider-body
Consider the response body and content length when determining the web oracle’s response to (in)correct padding
-d, –data
Data to send in a POST request
-D, –decrypt
Original cypher text, received from the target service, which is to be decrypted
–delay
Delay between requests within a thread, in milliseconds
[default: 0]
-e, –encoding
Specify encoding used by the oracle to encode the cypher text
[options: auto, hex, base64, base64url]
[default: auto]
-E, –encrypt
Plain text to encrypt. Note: encryption mode requires a cypher text to gather necessary data
-h, –help
Print help information
-H, –header
HTTP header to send
[format: :]
-k, –insecure
Disable TLS certificate validation
-K, –keyword
Keyword indicating the location of the cypher text in the HTTP request. It is replaced by the cypher text’s value at runtime
[default: CTEXT]
-n, –no-iv
Cypher text does not include an Initialisation Vector
–no-cache
Disable reading and writing to the cache file
–no-url-encode
Disable URL encoding and decoding of cypher text
-o, –output
File path to which log output will be written
-O, –oracle
The oracle to question with forged cypher texts. This can be a URL or a shell script.
See the subcommands web --helpand script --helprespectively for further help.
–proxy-credentials
Credentials to authenticate against the proxy server with
[format: :]
-r, –redirect
Follow HTTP Redirects
-t, –threads
Amount of threads in the thread pool
[default: 64]
-T, –timeout
Web request timeout in seconds
[default: 10]
-v, –verbose
Increase verbosity of logging
-V, –version
Print version information
-x, –proxy
Proxy server to send web requests over. Supports HTTP(S) and SOCKS5
Indicate the cypher text’s location! See --keywordfor clarification.

Script mode

Script mode was made for power users or[...]

___________________________
@hacking_Attack
@Hacking_Video

CTF players https://s.w.org/images/core/emoji/13.1.0/72x72/1f3f4-200d-2620-fe0f.png who were given a script to run. The target oracle is a local shell script.

Scripts allow you to run attacks against local oracles or more exotic services. Or you can use script mode to customize and extend rustpad‘s features. However, if you’re missing a feature, feel free to open an issue on GitHub!

rustpad script –help
rustpad-script 1.8.0
Question a script-based oracle
USAGE:
rustpad {script, –script, -S} [OPTIONS] –oracle –block-size –decrypt
OPTIONS:
-B, –block-size
Block size used by the cypher
[options: 8, 16]
-D, –decrypt
Original cypher text, received from the target service, which is to be decrypted
–delay
Delay between requests within a thread, in milliseconds
[default: 0]
-e, –encoding
Specify encoding used by the oracle to encode the cypher text
[options: auto, hex, base64, base64url]
[default: auto]
-E, –encrypt
Plain text to encrypt. Note: encryption mode requires a cypher text to gather necessary data
-h, –help
Print help information
-n, –no-iv
Cypher text does not include an Initialisation Vector
–no-cache
Disable reading and writing to the cache file
–no-url-encode
Disable URL encoding and decoding of cypher text
-o, –output
File path to which log output will be written
-O, –oracle
The oracle to question with forged cypher texts. This can be a URL or a shell script.
See the subcommands web --helpand script --helprespectively for further help.
-t, –threads
Amount of threads in the thread pool
[default: 64]
-v, –verbose
Increase verbosity of logging
-V, –version
Print version information
Script must respond with exit code 0 for correct padding, and any other code otherwise. Cypher text is
passed as the 1st argument. Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Log4J-Detect : Script To Detect The “Log4j” Java Library Vulnerability For A List Of URLs With Multithreading

Log4J-Detect is a script “log4j-detect.py” developed in Python 3 is responsible for detecting whether a list of URLs are vulnerable to CVE-2021-44228.

To do so, it sends a GET request using threads (higher performance) to each of the URLs in the specified list. The GET request contains a payload that on success returns a DNS request to Burp Collaborator / interactsh. This payload is sent in a test parameter and in the “User-Agent” / “Referer” / “X-Forwarded-For” / “Authentication” headers. Finally, if a host is vulnerable, an identification number will appear in the subdomain prefix of the Burp Collaborator / interactsh payload and in the output of the script, allowing to know which host has responded via DNS.

It should be noted that this script only handles DNS detection of the vulnerability and does not test remote command execution.

Downloading log4j-detect.py

wget https://github.com/takito1812/log4j-detect/raw/main/log4j-detect.py

Running log4j-detect.py

python3 log4j-detect.py
https://blogger.googleusercontent.com/img/a/AVvXsEhqFKJHdlOcMRHGhHd_6TNDY8nU5c8pM3zYXRuXfovrJFynfKaDed5xpjY22SxC300G0zNC2WP8F_DZn9wNQp0IzdlSE1e7vzCtut9hEkuhAowlSxXNAAsMoFUYpc8CbZIbfa-lX4FRxSl9lV8_jziPU47xS-uvFO6BFvubxLD5fzgcyS8E12iJrk8x=s1241

Download

___________________________
@hacking_Attack
@Hacking_Video

How anyone could have gotten a free pass to attended @IWCON2022

Recently I attended InfoSec Community (@InfoSecComm) ‘s security conference IWCON2022. Awesome conference and awesome experience attending…Continue reading on Medium »
Read more...

How anyone could have gotten a free pass to attended @IWCON2022

Recently I attended InfoSec Community (@InfoSecComm) ‘s security conference IWCON2022. Awesome conference and awesome experience attending…Continue reading on Medium »
Read more...

Hacking on Medium
Robot followers? The impact of social media bots

https://cdn-images-1.medium.com/max/2600/0*4_GaZoOu0122I29f
Continue reading on Netacea »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Improve your Cybersecurity Skill with best Books.

https://cdn-images-1.medium.com/max/1920/1*WgwH5FBhT3HVyuP9pDFBaw.jpeg
Today’s rapidly developing world, cybersecurity is booming.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Load vs Stress Testing: Expect the Unexpected

https://cdn-images-1.medium.com/max/1920/0*nE2GVT08naZ9dbAM.jpg
At Cyrex, we like to break down the complexities and keep things simple.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

How anyone could have gotten a free pass to attended @IWCON2022
https://medium.com/@irajkumar/how-anyone-could-have-got-a-free-pass-to-attended-iwcon2022-374cd016a96e?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Recently I attended InfoSec Community (@InfoSecComm) ‘s security conference IWCON2022. Awesome conference and awesome experience attending…Continue reading on Medium » (https://medium.com/@irajkumar/how-anyone-could-have-got-a-free-pass-to-attended-iwcon2022-374cd016a96e?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Hacking stories: MafiaBoy, the hacker who took down the Internet

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Hacking stories: MafiaBoy, the hacker who took down the InternetPost Views: 26
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png
Reading Time: 6 Minutes
In 2000, a high school student named Michael Calce, aka MafiaBoy, paralyzed the websites of e-commerce, and media giants including eBay, Amazon, CNN, Dell, and Yahoo with a series of denial-of-service attacks (DDoS).
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/hacker-michael-calce-1024x693.jpg
Early years

Michael Calce was born in the West Island area of Montreal, Quebec, Canada.

At a very young age, his parents got divorced, and he eventually moved to live with his mother, while his father had also his custody on the weekends.

The young Michael, at around the age of 6 felt isolated from his friends, and his father make sure to preoccupy him with a personal computer he brought from work

The digital world instantly had a hold of him. In his own words,

“There was something intoxicating about the idea of dictating everything the computer did, down to the smallest of functions”.
The computer gave him a sense of control and command which nothing in his world operated that way.

Over the first few weeks of using the computer, Michael went from not knowing anything to using DOS commands. He spent countless days on manuals gaining knowledge and putting it into work.

Few years later he got his first free trial of AOL, and it was his first time on the Internet. A few days later, the 9-year-old managed to hack AOL’s systems so he could stay up online past the 30-day trial period, pretty remarkable for his age.
First steps into Hacking

As a teenager, Michael began chatting with people using AOL’s chat function. He was getting kicked off from the chat rooms, in other words, “punting”, where someone would have knocked him offline by hitting him with so much data that his connection was severed.

It didn’t bother him, but instead, he was intrigued by the idea that an individual was able to “attack” someone else, regardless of the distance between them, using the Internet.

After gaining the knowledge needed, he was making fun by “punting” people who got on his nerves in the chat.

Michael was one of the first members that got involved in the first online hacking communities. As he got more and more involved in online hacker groups his hacking skills and knowledge got even deeper.

When joined the IWC (a hacker’s group), he found out that other people online had the power to shut down the computer, erase data, build malicious tools, steal personal information, disrupt credit ratings, and much more.

Michael was taught by the leader of the group and other members on how the IRC network works, and how to exploit certain vulnerabilities in order to compromise machines or networks, ideally with root access.

During the next couple of months, and all of a sudden, the leader of the group vanished into thin air leaving Michael and the members of IWC worried about what happened to him and how to continue running the group.
Eventually, Michael decided to leave the group as the backbone of IWC was gone and no other seemed to know what to do next.

He then proceeded to join another hacking group, the TNT/PHORCE group which was even bigger than what IWC used to be. TNT was considered the elite among the other hacking groups on IRC.

It was the first time that he used his alias, MafiaBoy, which was originated from his brother, who was downloading music i[...]

___________________________
@hacking_Attack
@Hacking_Video