An Clickjacking - Which Rewarded me with 275$

Vulnerability Category: A6- Security MisconfigurationContinue reading on Medium »
Read more...

Hacking on Medium
How to find out who is connected to my WIFI

◾️Fing has helped 40 million users worldwide to understand:
• Who’s on my WiFi
• Is someone stealing my WiFi and broadband?
• Have I’ve…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Lumberjack Turtle(Medium)-THM writeup

https://cdn-images-1.medium.com/max/1475/1*fWu5_8bdDm7QbwefFnbr8Q.png
Reconnaissance

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Paper — HackTheBox (L-E)

https://cdn-images-1.medium.com/max/1392/1*RSAjRHWs708-CVWLDSGCrw.png
A fun and easy Linux machine for the fans of The Office!

Continue reading on System Weakness »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to learn how to hack WIFI where to start

https://cdn-images-1.medium.com/max/1600/1*CeLL-jJrJutxMOdYuZkYwg.jpeg
◾️I present to your attention the basic tool of a hacker.
Kali Linux (https://www.kali.org/) is the backbone of all black or white hackers!

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Ukraine invasion: WordPress-hosted university websites hacked in ‘targeted attacks’

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Ukraine invasion: WordPress-hosted university websites hacked in ‘targeted attacks’18 total views,  18 views today
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png
Reading Time: 1 Minute
At least 30 Ukrainian university websites have been hacked in a targeted attack allegedly launched in support of Russia’s invasion of the European country.
In a report released last night (March 1), researchers from Wordfence said the company had witnessed a “massive attack” on Ukrainian education institutions by threat actors identified as the ‘Monday Group’, which it says has publicly supported Russia’s recent actions.

The group, whose members refer to themselves as ‘the Mx0nday’, have targeted the WordPress-hosted sites more than 100,000 times since February 24, when Russian troops officially invaded Ukraine. Cyber assaultsA blog post from Wordfence founder and CEO Mark Maunder explains that the company protects over 8,000 websites in Ukraine, including those belonging to more than 300 university institutions. It also provides support to government, military, and police websites.

The security firm said it witnessed a peak of 144,000 web attacks on February 25, one day after the kinetic attack started, Maunder explains.

“The peak is roughly three times the number of daily attacks from earlier in the month across the Ukrainian websites that we protect,” he wrote.
See Also: Complete Offensive Security and Ethical Hacking Course
Maunder added: “An attacker was making a concerted effort to attack universities in Ukraine, and they started immediately after the Russian invasion started.”

An investigation into the attacks has identified four IP addresses behind the campaign, which are routed through a VPN service based in Sweden.

The hacking group also appears to have links to Brazil, where Wordfence has claimed it is based.

However, the individuals behind the incident have not yet been publicly identified. Destructive campaignThe report comes on the heels of new research from ESET, which said several malware families are now being used in targeted attacks against Ukrainian organizations.

A blog post from ESET detailed that on February 23, a “destructive campaign” using HermeticWiper targeted multiple organizations.
See Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH The attack used at least three components; HermeticWiper, which makes a system inoperable by corrupting its data; HermeticWizard, which spreads HermeticWiper across a local network via WMI and SMB; and HermeticRansom, ransomware written in Go.

“This cyber-attack preceded, by a few hours, the start of the invasion of Ukraine by Russian Federation forces,” the blog states.

“Malware artifacts suggest that the attacks had been planned for several months.”

HermeticWiper was observed “on hundreds of systems in at least five Ukrainian organizations”, claims ESET, which noted that it has not found any tangible connection with a known threat actor. See Also: Recon Tool: Metagoofil Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
See Also: Hacking stories: MafiaBoy, the hacker who took down t[...]

___________________________
@hacking_Attack
@Hacking_Video

he Internet
Source: portswigger.net Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-3-90x90.jpg RCE Bugs in WhatsApp, Other Hugely Popular VoIP Apps: Patch Now!24 hours ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/download-90x90.jpg Cyber-attack on Nvidia linked to Lapsus$ ransomware gang2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/GettyImages-802535150-1-90x90.jpg Conti ransomware’s internal chats leaked after siding with Russia3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/6469-article-220223-ukraine-body-text-90x90.jpg Data wiper deployed in cyber-attacks targeting Ukrainian systems6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/T8F9rL5Ub6TRWHtQwsVCK6-1200-80-90x90.jpg Samsung Shattered Encryption on 100M Phones1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/4346-article-220222-airtags-body-text-90x90.jpg AirTag clone bypassed Apple’s tracking-protection features, claims researcher1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Banner-Img-AWS-90x90.jpg Introducing Ghostbuster – AWS security tool protects against dangling elastic IP takeovers1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/zabbix_blog_java-apps-90x90.png Critical vulnerabilities in Zabbix Web Frontend allow authentication bypass, code execution on servers1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/ezgif.com-gif-maker-4-1-90x90.jpg GitHub code scanning now finds more security vulnerabilities2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/012qzWe52HXVPxkc8nUrPyv-1.fit_lim.size_1200x630.v1617817629-90x90.jpg Massive LinkedIn Phishing, Bot Attacks Feed on the Job-Hungry2 weeks ago
The post Ukraine invasion: WordPress-hosted university websites hacked in ‘targeted attacks’ first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Undetectable Viruses are easy to make
https://www.reddit.com/r/Pentesting/comments/t5p5ng/undetectable_viruses_are_easy_to_make/

Ok now a while ago I got In to pentesting, but I loved back doors for some reason (I think I found them super cool) and I made a post about how to make them and it brought me down a rabbit hole and I decided to start coding in C# and holy crap AVs are Terrible all you need to do is think out side of the box and not copy code from other malware and if you have to copy or find out use a way that isn’t thought to be used as hacking, now I’m making a Cookie and session stealer and using a download and send to a cnc server. And like honestly with a bit of stack over flow and a couple of hours you can make something cool. Btw I’m thinking of releasing code to a download and execute file that goes to startup but a bit unsure should I? Thing is I don’t want it to be misused and ultimately get detected. What is your stands on this? Open to criticism. (If I spelt thing wrong or things seem of I’m typing on my phone. submitted by /u/gallacticscambaiter (https://www.reddit.com/user/gallacticscambaiter)
[link] (https://www.reddit.com/r/Pentesting/comments/t5p5ng/undetectable_viruses_are_easy_to_make/) [comments] (https://www.reddit.com/r/Pentesting/comments/t5p5ng/undetectable_viruses_are_easy_to_make/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Golang 1000 goroutine port scanner and service detection tool.

https://external-preview.redd.it/Q3jSsjkJKG9DUTyQeLkng-0F7VTGPx3h0RCkq6wORis.jpg?width=640&crop=smart&auto=webp&s=fd79ada7d32c5ca2a373ea4e7bcadaaf3f0e2be5 submitted by /u/mytechnotalent_com
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
As the Tanks Rolled into Ukraine, So Did Malware. Then Microsoft Entered the War.

https://external-preview.redd.it/qvqaeHFXrmQ8mr5oNaezZdsOWCURHy-vvOnchBRrLtM.jpg?width=640&crop=smart&auto=webp&s=debdc14a33daa60eddc3b945d3defb4697531263 submitted by /u/ivyguy507
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Cyber Security Documents

Hi everyone,

I'm looking for a SLA template for penertration testing an vulnerability scanning. Please advise where I can this, I would really appreciate it. Thank you.

submitted by /u/messi1_0-
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hacker makes life miserable for top Mumbai executive

https://www.indiatoday.in/india/story/hacker-makes-life-miserable-for-top-mumbai-executive-1919796-2022-03-02

submitted by /u/anonymousfirsttimer
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
RAUDI : A Repo To Automatically Generate And Keep Updated A Series Of Docker Images

RAUDI (Regularly and Automatically Updated Docker Images) automatically generates and keep updated a series of Docker Images through GitHub Actions for tools that are not provided by the developers.

What is RAUDI

RAUDI is what will save you from creating and managing a lot of Docker Images manually. Every time a software is updated you need to update the Docker Image if you want to use the latest features, the dependencies are not working anymore.

This is messy and time-consuming.

Don’t worry anymore, we got you covered.

You may either fork this repo and use the GitHub Workflow yourself or use it locally (and manage its execution the way you want). Fork

If you want to fork this repo you also have to set up some secrets to be able to push your images on your personal Docker Hub account. Two GitHub secrets must be set:

* DOCKER_USER: Your Docker Hub Username;
* DOCKER_API_TOKEN: Your Docker Hub Password or API Token.

After setting those secrets you have to edit the organization variable set in the tools/main.py file since it is configured to push on the Docker Hub for SecSI.

That’s all guys: go to Action, enable it for your forked repo, wait until midnight, and the Workflow will do the heavy work! Setup

This repo can also be executed locally. The requirements to be met are the following:

* Python 3.x
* Docker (with BuildX)

Here is the documentation for working with BuildX: https://docs.docker.com/buildx/working-with-buildx/

The setup phase is pretty straightforward, you just need the following commands:

git clone https://github.com/cybersecsi/RAUDI
cd RAUDI
pip install -r requirements.txt

You’re ready to go! Test

To run the test you need to install pytestwith the command pip install pytest(it is not in requirements.txtsince it is needed only for testing purposes) and then you may run:

pytest -s

or

python -m pytest -s

to run the tests. Local Usage

RAUDI can build and push all the tools that are put into the tools directory. There are different options that can be used when running it. Before using it locally you should create a .env file (you can just copy the .env.sample file) and add your GitHub Personal Access Token to avoid Rate Limiting. For unauthenticated users GitHub allows up to 60 requests per hour, while authenticated users are allowed up to 15.000 requests per hour. For this reason we advice you to add it! You can also create a personal access token without any scope since anything we do is read some info for every GitHub repo. Execution Modes Normal Execution

In this mode RAUDI tries to build all the tools if needed. The command to run it is simply:

python3 ./raudi.py –all

Single Build

In this mode RAUDI tries to build only the specified tool. The command in this case is:

python3 ./raudi.py –single

tool_name MUST be the name of the directory inside the tools folder. Test tool

Since the tests parameter has been added to the configuration structure of the tool is can be helpful to test if the inserted commands do return a 0 status code. The command to test a specific tool is:

python3 ./raudi.py –test

tool_name MUST be the name of the directory inside the tools folder. Show tools

If you want to know the available tools you can run this command:

python3 ./raudi.py –list

Bootstrap tool

If you want to quickly add a new tool folder starting from one of the available templates you can run this command:

python3 ./raudi.py –bootstrap

Options
OptionDescriptionDefault Value–pushWhether automatically push to Docker HubFalse–remoteWhether check against Docker Hub instead of local Docker before buildFalse–forceWhether build or not if an image with the same tagname has been foundFalse Available Tools

This [...]

___________________________
@hacking_Attack
@Hacking_Video

is the current list of tools that have been added. Those are all tools that do not have an official Docker Image provided by the developer:
NameDocker ImageSource3proxysecsi/3proxyhttps://github.com/3proxy/3proxyAltdnssecsi/altdnshttps://github.com/infosec-au/altdnsApktoolsecsi/apktoolhttps://github.com/iBotPeaches/ApktoolArjunsecsi/arjunhttps://github.com/s0md3v/Arjunbfacsecsi/bfachttps://github.com/mazen160/bfacCloudFailsecsi/cloudfailhttps://github.com/m0rtem/CloudFailCMSeeKsecsi/cmseekhttps://github.com/Tuhinshubhra/CMSeeKCrowbarsecsi/crowbarhttps://github.com/galkan/crowbarDalfoxsecsi/dalfoxhttps://github.com/hahwul/dalfoxdatasploitsecsi/datasploithttps://github.com/DataSploit/datasploitdex2jarsecsi/dex2jarhttps://github.com/pxb1988/dex2jardirbsecsi/dirbhttp://dirb.sourceforge.net/dirhuntsecsi/dirhunthttps://github.com/Nekmo/dirhuntdirsearchsecsi/dirsearchhttps://github.com/maurosoria/dirsearchdnscansecsi/dnscanhttps://github.com/rbsec/dnscanDorks Eyesecsi/dorks-eyehttps://github.com/BullsEye0/dorks-eyedvcs-rippersecsi/dvcs-ripperhttps://github.com/kost/dvcs-ripperExifToolsecsi/exiftoolhttps://github.com/exiftool/exiftoolEyeWitnesssecsi/eyewitnesshttps://github.com/FortyNorthSecurity/EyeWitnessfast-reconsecsi/fast-reconhttps://github.com/DanMcInerney/fast-reconffufsecsi/ffufhttps://github.com/ffuf/ffuffiercesecsi/fiercehttps://github.com/mschwager/fierceFindsploitsecsi/findsploithttps://github.com/1N3/FindsploitGetJSsecsi/getjshttps://github.com/003random/getJSGitrobsecsi/gitrobhttps://github.com/michenriksen/gitrobGitToolssecsi/gittoolshttps://github.com/internetwache/GitToolgobustersecsi/gobusterhttps://github.com/OJ/gobusterGoogD0rkersecsi/googd0rkerhttps://github.com/ZephrFish/GoogD0rkerGoSpidersecsi/gospiderhttps://github.com/jaeles-project/gospiderGround controlsecsi/ground-controlhttps://github.com/jobertabma/ground-controlHakrawlersecsi/hakrawlerhttps://github.com/hakluke/hakrawlerhakrevdnssecsi/hakrevdnshttps://github.com/hakluke/hakrevdnshashIDsecsi/hashidhttps://github.com/psypanda/hashIDhttprobesecsi/httprobehttps://github.com/tomnomnom/httprobehydrasecsi/hydrahttps://github.com/vanhauser-thc/thc-hydraimpacketsecsi/impackethttps://github.com/SecureAuthCorp/impacketJoomScansecsi/joomscanhttps://github.com/OWASP/joomscanThe JSON Web Token Toolkitsecsi/jwt_toolhttps://github.com/ticarpi/jwt_toolknocksecsi/knockpyhttps://github.com/guelfoweb/knockLFI Suitesecsi/lfisuitehttps://github.com/D35m0nd142/LFISuiteLinkFindersecsi/linkfinderhttps://github.com/GerbenJavado/LinkFinderMASSCANsecsi/masscanhttps://github.com/robertdavidgraham/masscanMassDNSsecsi/massdnshttps://github.com/blechschmidt/massdnsMemcrashed DDoS Exploitsecsi/memcrashedhttps://github.com/649/Memcrashed-DDoS-ExploitNetifysecsi/netifydhttps://gitlab.com/netify.ai/public/netify-agentniktosecsi/niktohttps://github.com/sullo/niktonmapsecsi/nmaphttps://github.com/nmap/nmapoxml_xxesecsi/oxml_xxehttps://github.com/BuffaloWill/oxml_xxePagodosecsi/pagodohttps://github.com/opsdisk/pagodophotonsecsi/photonhttps://github.com/s0md3v/PhotonPivotSuitesecsi/pivotsuitehttps://github.com/RedTeamOperations/PivotSuitepsalmsecsi/psalmhttps://github.com/vimeo/psalmpureDNSsecsi/purednshttps://github.com/d3mondev/purednsRace The Websecsi/race-the-webhttps://github.com/TheHackerDev/race-the-webRestfulHarvestsecsi/restfulharvesthttps://github.com/laramies/theHarvesterRetire.jssecsi/retirehttps://github.com/RetireJS/retire.jsRouterSploitsecsi/routersploithttps://github.com/threat9/routersploitSandcastlesecsi/sandcastlehttps://github.com/0xSearches/sandcastlescanlesssecsi/scanlesshttps://github.com/vesche/scanlessseclistssecsi/seclistshttps://github.com/danielmiessler/SecListsspyse.pysecsi/spysepyhttps://github.com/zeropwn/spyse.pysqlmapsecsi/sqlmaphttps://github.com/sqlmapproject/sqlmapspidysecsi/spidyhttps://github.com/rivermont/spidyStrikersecsi/strikerhttps://github.com/s0md3v/StrikerSubfindersecsi/subfinderhttps://github.com/projectdiscovery/subfinderSubjacksecsi/[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
RAUDI : A Repo To Automatically Generate And Keep Updated A Series Of Docker Images

___________________________
@hacking_Attack
@Hacking_Video

Litefuzz - A Multi-Platform Fuzzer For Poking At Userland Binaries And Servers
http://www.kitploit.com/2022/03/litefuzz-multi-platform-fuzzer-for.html

___________________________
@hacking_Attack
@Hacking_Video