Story about more than 3.5 million PII leakage in Yahoo!!!

Hello GUYS,Continue reading on Medium »
Read more...

Top 100 Hacking Tools.
https://thenurhabib.medium.com/top-100-hacking-tools-c355b77001df?source=rss------bug_bounty-5

Burp SuiteContinue reading on Medium » (https://thenurhabib.medium.com/top-100-hacking-tools-c355b77001df?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Story about more than 3.5 million PII leakage in Yahoo!!!
https://dhakalbibek.medium.com/story-about-more-than-3-5-million-pii-leakage-in-yahoo-3a530210dcc6?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello GUYS,Continue reading on Medium » (https://dhakalbibek.medium.com/story-about-more-than-3-5-million-pii-leakage-in-yahoo-3a530210dcc6?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Intigriti -1337up CTF — Warmup Encoder writeup

1337UP was a 24 hours long CTF was organized by Intigriti . I personally solved a couple of challenges in the web and cryptography…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Top 100 Hacking Tools.

Burp Suite

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Pequenas anotações sobre o cabeçalho TCP/IP e o Three-way Handshake

https://cdn-images-1.medium.com/max/856/1*oqx14hnvll8OIaQzAmauVA.jpeg
Em palavras simples, o TCP (Transmission Control Protocol) é um protocolo orientado a conexão responsável pela transmissão de dados na…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
I found out I can inject html into my school’s online hall pass system.

If I use a

___________________________
@hacking_Attack
@Hacking_Video

OffSecOps: Using Jenkins For Red Team Tooling
https://www.reddit.com/r/redteamsec/comments/tjxgbj/offsecops_using_jenkins_for_red_team_tooling/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://http418infosec.com/offsecops-using-jenkins-for-red-team-tooling) [comments] (https://www.reddit.com/r/redteamsec/comments/tjxgbj/offsecops_using_jenkins_for_red_team_tooling/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Account Takeovers Follow LinkedIn Data Breach, 2012 & 2016

On June 6th, 2012, LinkedIn responded to a seemingly harmless data breach that had occurred the day before. It appeared as though Russian…

Continue reading on Medium »

hacking: security in practice
Is there a way to tell if your computer activity is monitored?

Is there a way to tell if your computer activity is monitored on Windows 11? Long story short, my neighbors have been stalking me on social media after an argument about noise. I doubt they can hack, but I want to be sure anything I view or do isn't being watched or recorded. I've confirmed they were stalking me on social media, so it's not just paranoia. Any suggestions? I've already changed my network details and deactivated my social media accounts.

submitted by /u/bananasrulethisworld
[link] [comments]

hacking: security in practice
FBI Seizes $2.3 Million in Ransomware Payments from Russian Affiliate of REvil and GandCrab RaaS Operations

https://external-preview.redd.it/8TYCfir_LcjgUZV5GyohRQOQd7lsOuCeOydrjD4IFpM.jpg?width=320&crop=smart&auto=webp&s=e9f961e945fb6f1107adaa604fe24d333b81be03 submitted by /u/IleenRyder
[link] [comments]

A Bottle Message to Bug Hunters!
https://infosecwriteups.com/a-bottle-message-to-bug-hunters-18e5835069e6?source=rss------bug_bounty-5

Bug Bounty = PatienceContinue reading on InfoSec Write-ups » (https://infosecwriteups.com/a-bottle-message-to-bug-hunters-18e5835069e6?source=rss------bug_bounty-5)

A Bottle Message to Bug Hunters!

Bug Bounty = PatienceContinue reading on InfoSec Write-ups »
Read more...

Black Hat Ethical Hacking
Browser-in-the-Browser Attack Makes Phishing Nearly Invisible

Browser-in-the-Browser Attack Makes Phishing Nearly InvisiblePost Views: 73
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png
Reading Time: 2 Minutes
The novel method takes advantage of third-party single sign-on (SSO) options embedded on websites that issue popup windows for authentication, such as “Sign in with Google,” Facebook, Apple or Microsoft.
Can we trust web browsers to protect us, even if they say “https?” Not with the novel BitB attack, which fakes popup SSO windows to phish away credentials for Google, Facebook and Microsoft, et al.
We’ve had it beaten into our brains: Before you go wily-nily clicking on a page, check the URL. First things first, the tried-and-usually-but-not-always-true advice goes, check that the site’s URL shows “https,” indicating that the site is secured with TLS/SSL encryption.

If only it were that easy to avoid phishing sites. In reality, URL reliability hasn’t been absolute for a long time, given things like homograph attacks that swap in similar-looking characters in order to create new, identical-looking but malicious URLs, as well as DNS hijacking, in which Domain Name System (DNS) queries are subverted.

Now, there’s one more way to trick targets into coughing up sensitive info, with a coding ruse that’s invisible to the naked eye. The novel phishing technique, described last week by a penetration tester and security researcher who goes by the handle mr.d0x, is called a browser-in-the-browser (BitB) attack.
See Also: Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions.png The researcher used Canva as an example: In the log-in window for Canva shown below, the popup asks users to authenticate via their Google account. https://media.threatpost.com/wp-content/uploads/sites/103/2022/03/21194343/Legit-login-to-Canva-e1647906237286.png Login to Canva using Google account credentials. Source: mr.d0x It’s Easy to Fabricate an Identical, Malicious PopupThese days, SSO popups are a routine way to authenticate when you sign in.

But according to mr.d0x’s post, completely fabricating a malicious version of a popup window is a snap: It’s “quite simple” using basic HTML/CSS, the researcher said. The concocted popups simulate a browser window within the browser, spoofing a legitimate domain and making it possible to stage convincing phishing attacks.

“Combine the window design with an iframe pointing to the malicious server hosting the phishing page, and [it’s] basically indistinguishable,” mr.d0x wrote. The report provided an image, included below, that shows a side-by-side of a fake window next to the real window. https://media.threatpost.com/wp-content/uploads/sites/103/2022/03/21194525/real-v-fake-login-pages-e1647906342234.png Nearly identical real vs. fake login pages. Source: mr.d0x.
See Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH “Very few people would notice the slight differences between the two,” according to the report.

JavaScript can make the window appear on a link, button click or page loading screen, the report continued. As well, libraries – such as the popular JQuery JavaScript library – can make the window appear visually appealing … or, at least, visually bouncy, as depicted in the .gif provided in the researcher’s demo and shown below. https://media.threatpost.com/wp-content/uploads/sites/103/2022/03/21154801/BitB-demo.gif BitB demo. Source: mr.d0x. Hovering Over Links: Another Easily Fooled Security SafeguardThe BitB attack can also flummox those who use the [...]