Insecure Java Deserialization
https://medium.com/@ladecruze/insecure-java-deserialization-4d64d977544f?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

In this content, we’ll be covering serialization and deserialization, how they can be used to cause severe damage to the application when…Continue reading on Medium » (https://medium.com/@ladecruze/insecure-java-deserialization-4d64d977544f?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Open season: I have a free pass from Ukrainian government to cyberattack Russia

UA govt just gave my team a legal permission to do anything I want to Russian cyberspace. If you have an idea you hesitated to execute, go ahead. Napalm the mofos.

submitted by /u/msklvsk
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Espoofer : An Email Spoofing Testing Tool That Aims To Bypass SPF/DKIM/DMARC

Espoofer is an open-source testing tool to bypass SPF, DKIM, and DMARC authentication in email systems. It helps mail server administrators and penetration testers to check whether the target email server and client are vulnerable to email spoofing attacks or can be abused to send spoofing emails.
https://blogger.googleusercontent.com/img/a/AVvXsEh4FtJWcn_RhXm4oNRRDWT8H56eT7Twa3FYVSXbGdzOh_TfPGp5_weUCfoUDLPnTAUoQ1YmDKNTeE-IBg1SyH3JZMAk7oiSukSscsqCnIRz2bS3PX9l5iWaDPFcT3UmQQBPZonrWeG97aGNFkliog_ctjSl098_h0nftgc4OE-ZzqlMFbJKe7lu0RsH=s1264
Why build this tool?

Email spoofing is a big threat to both individuals and organizations (Yahoo breach, John podesta). To address this problem, modern email services and websites employ authentication protocols — SPF, DKIM, and DMARC — to prevent email forgery.

Our latest research shows that the implementation of those protocols suffers a number of security issues, which can be exploited to bypass SPF/DKIM/DMARC protections. Figure 1 demonstrates one of our spoofing attacks to bypass DKIM and DMARC in Gmail. For more technical details, please see our Black Hat USA 2020 talk (with presentation video) or USENIX security 2020 paper.

* Black Hat USA 2020 slides (PDF): You have No Idea Who Sent that Email: 18 Attacks on Email Sender Authentication
* USENIX security 2020 paper (PDF): Composition Kills: A Case Study of Email Sender Authentication
* Distinguished Paper Award Winner
In this repo, we summarize all test cases we found and integrate them into this tool to help administrators and security-practitioners quickly identify and locate such security issues.Please use the following citation if you do scentific research (Click me). Installation

* Download this tool

git clone https://github.com/chenjj/espoofer

* Install dependencies

sudo pip3 install -r requirements.txt

Usage

espoofer has three work modes: server (‘s’, default mode), client (‘c’) and manual (‘m’). In server mode, espoofer works like a mail server to test validation in receiving services. In client mode, espoofer works as an email client to test validation in sending services. Manual mode is used for debug purposes.
https://blogger.googleusercontent.com/img/a/AVvXsEgOi1mn8H_mI0xsIGsytf7Ywhi1DbDFBpa5Qay5Pgb0Lkv9BcjSS9HpcHaZbgN2Ghhb3wNjzcS9DvT1L7CbwPukObd4yxk4c67_HX7p81fD_z5XdacSlaLKAiqzPTD9OEiu1fvMEueL0rEZNukB5OLoKDMAInrIO16j_rLY7FB3vLrGb90iUevdT181=s983
Server mode

To run espoofer in server mode, you need to have: 1) an IP address (1.2.3.4), which outgoing port 25 is not blocked by the ISP, and 2) a domain (attack.com).

Domain configuration

* Set DKIM public key for attack.comselector._domainkey.attacker.com TXT  “v=DKIM1; k=rsa; t=y; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDNjwdrmp/gcbKLaGQfRZk+LJ6XOWuQXkAOa/lI1En4t4sLuWiKiL6hACqMrsKQ8XfgqN76mmx4CHWn2VqVewFh7QTvshGLywWwrAJZdQ4KTlfR/2EwAlrItndijOfr2tpZRgP0nTY6saktkhQdwrk3U0SZmG7U8L9IPj7ZwPKGvQIDAQAB”

Set SPF record for attack.comattack.com TXT “v=spf1 ip4:1.2.3.4 +all”

Configure the tool in config.py

config ={
“attacker_site”: b”attack.com”, # attack.com
“legitimate_site_address”: b”admin@bank.com”, # legitimate.com
“victim_address”: b”victim@victim.com”, # victim@victim.com
“case_id”: b”server_a1″, # server_a1
}

You can list find the case_id of all test cases using -loption:

python3 espoofer.py -l

You can change case_id in the config.py or use -idoption in the command line to test different cases:

python3 espoofer.py -id server_a1

Client mode

To run epsoofer in client mode, you need to have an account on the target email services. This attack exploits the failure of some email services to perform sufficient validation of emails received from local MUAs. For ex[...]

___________________________
@hacking_Attack
@Hacking_Video

ample, attacker@gmail.comtries to impersonate admin@gmail.com.

1. Configure the tool in config.py

config ={
“legitimate_site_address”: b”admin@gmail.com”,
“victim_address”: b”victim@victim.com”,
“case_id”: b”client_a1″,
“client_mode”: {
“sending_server”: (“smtp.gmail.com”, 587),  # SMTP sending serve ip and port
“username”: b”attacker@gmail.com”, # Your account username and password
“password”: b”your_passward_here”,
},
}

You can list find the case_id of all test cases using -loption:

python3 espoofer.py -l

Note: sending_servershould be the SMTP sending server address, not the receiving server address.

1. Run the tool to send a spoofing email

python3 espoofer.py -m c

You can change case_id in the config.py and run it again, or you can use -idoption in the command line:

python3 espoofer.py -m c -id client_a1

Manual mode

Here is an example of manual mode:

python3 espoofer.py -m m -helo attack.com -mfrom m@attack.com -rcptto victim@victim.com -data raw_msg_here -ip 127.0.0.1 -port 25

Screenshots

1. A brief overview of test cases.
https://blogger.googleusercontent.com/img/a/AVvXsEi9wuRI5NoOX1rFP0XxHSfhK84_NP_Fp8TbLR0jz6stQhZkvowD5s6LBW8jGBBpuwJ7T2ZrEdeEzDtDrIMF5q9x33xJ5QOXA4ACR8-A0_9WMQy3UAdwW0KQPOyg47SXd7Vcv16apXTavU_GiSjDGH6U0S4AhWNJ2Yin4abc6eg7aADHH-9wAfnJC7FQ=s2474 Download

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How hackers can gain access to your device?

https://cdn-images-1.medium.com/max/2600/0*PmSpqbHRPVOmo1jy.jpg
Technology has changed the way we live our lives and organize our information. There are wireless systems, Bluetooth, and different…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Ethical Hacking (part 11.0/20): Introduction to steganography with examples and tools

https://cdn-images-1.medium.com/max/2600/1*_pw1I6rLLLMEWGcuavMlwA.jpeg
How to hide secret messages inside digital objects

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Ark Survival Evolved Mod Apk 2022 (Unlimited Money + God Console)

https://cdn-images-1.medium.com/max/1280/1*G9JEeR1vRh9N2eIjqk3EnA.jpeg
Download the latest hacked version of ark survival mod from the following link.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Python Cybersecurity — Find Deleted Files

https://cdn-images-1.medium.com/max/600/1*JGv7GtYLdEivJsQ8-ngEjA.jpeg
Learn how to build a simple Python script that can be used to find deleted files on a given Operation System and sort them based on the…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Global Information Security Issue

https://cdn-images-1.medium.com/max/1920/1*9ufFZDNMpg5UZCCereeGag.png
Is this Call to Action? It should be — we are all paying for the consequences.

Continue reading on Technology Hits »

___________________________
@hacking_Attack
@Hacking_Video

Bug Bounty: Open Xmlrpc.php vulnerability on WordPress site.
https://medium.com/@Hacker_Yogi/bug-bounty-open-xmlrpc-php-vulnerability-on-wordpress-site-723361febfaf?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

what is Xml-RPC?Continue reading on Medium » (https://medium.com/@Hacker_Yogi/bug-bounty-open-xmlrpc-php-vulnerability-on-wordpress-site-723361febfaf?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Cloudflare WAF bypass via Origin IP
https://navdeepkhubber.medium.com/cloudflare-waf-bypass-via-origin-ip-d456705693c7?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Cloudflare supports more than 16 million Internet attributes and is now one of the most popular WAFs(Web Application Firewalls). A year…Continue reading on Medium » (https://navdeepkhubber.medium.com/cloudflare-waf-bypass-via-origin-ip-d456705693c7?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Issue with Virutal box

Hardware acceleration is not available on your system, certain guests require this feature and will fail to boot without it

submitted by /u/Boki_999
[link] [comments]

hacking: security in practice
i want to prank my friend

hi,i want to prank my friend by making an link and gaining access to his camera.Is that possible?I want to send it through instagram?Thanks a lot

submitted by /u/Lukav1nE
[link] [comments]

Hacking on Medium
Anonymous collective takes down the Federal Security Service of the Russian Federation

https://cdn-images-1.medium.com/max/881/1*PA4sNwE_jL-88sAfRITHZQ.jpeg
#Anonymous collective has taken down the federal security service of the Russian federation site (fsb.ru), earlier today the group stated:

Continue reading on Medium »

Hacking on Medium
The most important thing when using cloud services

https://cdn-images-1.medium.com/max/1272/1*s5p4_mkGHgyDq96NIao5fQ.jpeg
What is cloud space, and how does it work?

Continue reading on Medium »