Dark Reading: Attacks/Breaches
Researchers Devise Attack for Stealing Data During Homomorphic Encryption

A vulnerability in a Microsoft crypto library gives attackers a way to figure out what data is being encrypted in lockpicker-like fashion.

Dark Reading: Attacks/Breaches
Log4Shell Makes the Case for Runtime Application Self-Protection

Dive into the case for RASP to combat Log4Shell and why Web app firewalls aren't great for these types of attacks.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Protecting Field Programmable Gate Arrays From Attacks

FPGAs can be part of physical systems in the aerospace, medical, or industrial fields, so a security compromise can be potentially serious.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
7 Ways to Secure Collaboration Tools in Your Organization

The push to embrace Slack, Teams, and Zoom at work comes with new security risks for organizations.

Searpy - Search Engine Tookit
http://www.kitploit.com/2022/03/searpy-search-engine-tookit.html

___________________________
@hacking_Attack
@Hacking_Video

1. Install git clone https://github.com/j3ers3/Searpy
pip install -r requirement.txt

配置API及账号 ./config.py

python Searpy -h
2. Help baidu Engine --google Using google Engine --so Using 360so Engine --bing Using bing (https://www.kitploit.com/search/label/Bing) Engine --shodan Using shodan (https://www.kitploit.com/search/label/Shodan) Engine --fofa Using fofa (https://www.kitploit.com/search/label/Fofa) Engine --zoomeye Using zoomeye (https://www.kitploit.com/search/label/Zoomeye) Engine --goo Using goo Engine --yahoo Using yahoo Engine SCRIPT: --shodan_icon SHODAN_ICON Get ip list which using the same favicon.ico --fofa_icon FOFA_ICON Get ip list which using the same favicon.ico MISC: -s SEARCH Speciy Keyword -o OUTPUT Specify output file default output.txt -p PAGE Search page (default 1) -l LIMIT Maximum searching results (default:10) Only Shodan">
Searpy Engine Tookit

optional arguments:
-h, --help show this help message and exit

ENGINE:
--baidu Using baidu Engine
--google Using google Engine
--so Using 360so Engine
--bing Using bing Engine
--shodan Using shodan Engine
--fofa Using fofa Engine
--zoomeye Using zoomeye Engine
--goo Using goo Engine
--yahoo Using yahoo Engine

SCRIPT:
--shodan_icon SHODAN_ICON
Get ip list which using the same favicon.ico
--fofa_icon FOFA_ICON
Get ip list which using the same favicon.ico

MISC:
-s SEARCH Speciy Keyword
-o OUTPUT Specify output file default output.txt
-p P AGE Search page (default 1)
-l LIMIT Maximum searching results (default:10) Only Shodan
2.1 示例 python3 Searpy.py --fofa -s "app=jboss" -p 1

python3 Searpy.py --shodan -s "weblogic" -l 10

python3 Searpy.py --google -s "inurl:login.action" -p 1

🥀 Search Engine Tookit，URL采集、Favicon哈希值查找真实IP、子域名查找 (10)">

___________________________
@hacking_Attack
@Hacking_Video

2.2 其他功能 利用favicon.icon图标hash来寻找使用相同图标的网站，可用于溯源真实IP和资产发现 python3 Searpy.py --shodan_icon https://www.qq.com
python3 Searpy.py --fofa_icon https://www.qq.com
🥀 Search Engine Tookit，URL采集、Favicon哈希值查找真实IP、子域名查找 (11)">

___________________________
@hacking_Attack
@Hacking_Video

3. 模块调用 >> from Searpy import Bing >>> s = Bing('inurl:php?id=1', 2) >>> s.search() >>> for i in s.result: >>> print(i)">>>> from Searpy import Bing
>>> s = Bing('inurl:php?id=1', 2)
>>> s.search()
>>> for i in s.result:
>>> print(i) 4. 支持搜索引擎 Shodan Fofa Zoomeye Censys Dnsdb Google Baidu Bing 360so Goo Yahoo 6. ChangeLog v2.3 fix some bugs add fofa_icon module v2.2 fix some bugs 7. Donations XMR: 498AoZRwfC11Fa4LwAyVVp3wRD4Zyf1e1HziegczeWeSYVVTZ8gw8CoNPm5yhY91tkDqDMBg6A5KUfyowMtdkQDrDxE5aVN BTC: 1ALWC7rGL4dHgbyy4R8uTVHmDugPDD7Rvt 8. Contact Twitter (https://twitter.com/j3ers3)

Download Searpy (https://github.com/j3ers3/Searpy)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Finding “secret” directories on local servers

I found out that sonos and rokus have “secret” webpages with information.

Sonos you can log in at “http://sonosIP:1400/support/review” and you can get a lot of information about the network, and their connections.

With Roku, you can log in at “http://rokuIP:8060/query/apps” and get an XML file of the apps that are installed on it and app IDs so you can send a quick launch command to it using the ID.

I’ve done a port scan on these devices and found these open ports but that’s as far as I could take it… how would you go about finding these “hidden pages” on servers like this? Or find out if there are any other hidden gems on them?

submitted by /u/thesongdoctor
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Any good programs for cracking passwords

So here is the thing... I have an older HP laptop that I wanted to run Linux/kali. The problem is that secure boot is enabled, and I don't know the uefi password. This older pc has a bios updating program that requires the uefi password to iniciate the update. The thing is that it doesn't block me from brute forcing it. Are there any good brute forcing programs that could do the job? Here is an image of how the updater looks like

submitted by /u/kaupas24
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
CTF Sites - Biggest Collection Of CTF Sites

Hello there, I updated my CTF Sites project! Hope you like the idea to keep all the CTF sites organized, if you want to add a CTF site you can comment here or contact me via discord.

The site: https://ctfsites.github.io/

If you want to suggest something on design or generally to make it better tell me.

submitted by /u/damnigotpwned
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Noob here seeking guidance

So I've started on tryhackme.com and was wondering how do I get a brutforce attack program

submitted by /u/Round_Lie_5470
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Chats internos del ransomware Conti se filtran en línea después de declarar su apoyo a la invasión…

https://cdn-images-1.medium.com/max/1526/0*IDPCpEMK_2_l3rRX
PUBLICADO EN 2 MARZO, 2022POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Paper — HackTheBox (L-E)

https://cdn-images-1.medium.com/max/1392/1*RSAjRHWs708-CVWLDSGCrw.png
A fun and easy Linux machine for the fans of The Office!

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Ciberataque detiene la producción de Toyota

https://cdn-images-1.medium.com/max/1524/0*aEl7qXqlJOL9tRBa
PUBLICADO EN 2 MARZO, 2022POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Salt Security State of API Security Report Reveals API Attacks Increased 681% in the Last 12 Months

Key findings show API attack traffic grew at more than twice the rate of non-malicious traffic, and API security concerns are inhibiting innovation for two-thirds of organizations.
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video