KitPloit - PenTest Tools!
SysWhispers3 - AV/EDR Evasion Via Direct System Calls

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
what's the best free/paid course to learn bash scripting from scrap ?

I am looking for good course on bash scripting and so far i am unable to find one , if anyone know any good free/ paid course which is really good , please share with me ... Have a beautiful day !

submitted by /u/1Harmandeep
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is it illegal to access an app's images and source code for non-profit, non-malicious goals?

I'm part of a competitive community centered around teamgames in a mobile game, and currently trying to make a discord bot to automate some of the most tedious processes we usually perform on game screenshots.

I would like to be able to create images similar to those in game, both as a more familiar output for players and to generate arbitrary labeled images to train a classification IA on.

I have contacted the game's community manager, who shared me an incomplete google drive of weirdly scaled images and told me he'd ask the devs about the map-generating algorithm but I shouldn't expect an answer. About the missing images from the drive, he explained that was what the devs had given him and he didn't have any better. That was half a year ago, and I haven't heard from him yet. Overall, it looks to me like there is no opposition to me having those images and code, but they are not very well organized nor willing to bother.

Under these circumstances, is it illegal for me to try and obtain the app's images and source code?

Also, morally, if I were to make my bot and give the users an option to give me some money, like the other discord bots, would it be right to take money for work that is partly not mine?

submitted by /u/a1b2c3d4e5f6g8
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Aldi's has a $0.25 cart return incentive. How to create an electronic version for under $25?

To use a shopping cart at Aldi's will cost you a quarter. But, that quarter is returned to you once you connect it with another shopping cart.

I am wondering about electronic ways that can be hacked to simply add a sensor (bluetooth) to a shopping cart, and the program would detect when a cart has been returned, and give a credit. Any ideas?

Here is Aldi's cart scheme I'm talking about

submitted by /u/A_solo_tripper
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
MacBook possibly hacked

Hey everyone, I was on my mac and opened metamask (crypto wallet). Google chrome and Spotify instantly stopped communicating. I force quit them, and while in the process I heard the audio of one of my videos from the photos app being played. The photos app wasn’t even open! Was I hacked or am I imagining?

submitted by /u/carltisa
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
The Central Bank of Russian Federation leak (28 GB) has been published by Anonymous

https://external-preview.redd.it/emTjl259TXOsfIR-pKqJsRJP2TdhU0lwaL5IM9tpODQ.jpg?width=108&crop=smart&auto=webp&s=d78f8b27db3e57af54c81800ead3b5a32634d1a0 submitted by /u/bretsko
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
how to mitigate camera finger printing?

how do i mitigate camera finger printing?

i found this in an article and someone else talking about this on reddit on a post about removing identifying exif/meta data from photos

to Clarify i am asking how to remove/ mask the unique sensor pattern / finger print that can possibly be used to track a person using forensics

"Just as how no two fingerprints are ever exactly the same, the sensors inside two digital cameras contain extremely small differences as well, known as sensor pattern noise. These subtle pixel-level imperfections cause each camera to leave a unique fingerprint on every photo made with it."

https://ieeexplore.ieee.org/document/1634362

also found a pdf called "Removing camera fingerprint to disguise photograph" with a bunch of phd level mathematics shit

submitted by /u/KillaX9
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Can anyone suggest an online training platform with Labs and Lectures?
https://www.reddit.com/r/Pentesting/comments/tok6p1/can_anyone_suggest_an_online_training_platform/

Most of the posts that discuss those are over 2 years old. submitted by /u/Beginning_java (https://www.reddit.com/user/Beginning_java)
[link] (https://www.reddit.com/r/Pentesting/comments/tok6p1/can_anyone_suggest_an_online_training_platform/) [comments] (https://www.reddit.com/r/Pentesting/comments/tok6p1/can_anyone_suggest_an_online_training_platform/)

___________________________
@hacking_Attack
@Hacking_Video

Beginner Bug Bounty Guide — Part 4

Previous: Beginner Bug Bounty Guide — Part 3Continue reading on Medium »
Read more...

Beginner Bug Bounty Guide — Part 4
https://takshilp.medium.com/beginner-bug-bounty-guide-part-4-765c6bfd0562?source=rss------bug_bounty-5

Previous: Beginner Bug Bounty Guide — Part 3Continue reading on Medium » (https://takshilp.medium.com/beginner-bug-bounty-guide-part-4-765c6bfd0562?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to secure facebook account from the hacking in 2022

How to secure Facebook account is working to protect your private account from hacking.

Continue reading on Medium »

Hacking on Medium
How to hack WhatsApp 2022.. Beware, you are in danger

How to hack WhatsApp 2022.. The hacker develops daily their methods to trap their victims in their nets and blackmail them, and one of…

Continue reading on Medium »

Hacking on Medium
Careem’s Recruitment CTF Challenge

https://cdn-images-1.medium.com/max/2600/1*oAOeG8VtVridLHboHlw2qQ.png
Hi everyone, I’m Jawad back with another write-up of solving Careem’s recruitment CTF challenge which took me almost 1.5 hours.

Continue reading on Medium »

KitPloit - PenTest Tools!
Zkar - A Java Serialization Protocol Analysis Tool Implement In Go

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgUJiCVT32pp3swxE-p7DBbWrbsjWjU2zVz-fW7STR5_fS-bj_71ASMaD8EMobodOon-U9PySNt3_jyNQQQjj3SujcATCY18AU-TvETkDIqAfW6jUrWshA2DnbtRNadmttzM7Wb6YY5xFWbvOdGvS_KhcaujAu16wzNNJuZnZ-RYmlieXN2lH4cs-_z/w640-h384/JavaSerialization.png ZKar is a Java serialization protocol analysis tool implement in Go. This tool is still work in progress, so no complete API document and contribution guide.

ZKar provides:

* A Java serialization payloads parser and viewer in pure Go, no CGO or JDK is required
* From the Java serialization protocol to a Go struct
* A Go library that can manipulate the Java serialization data
* WIP: ysoserial implement in Go
* WIP: Java class bytecodes parser, viewer and manipulation
* WIP: An implementation of RMI/LDAP in Go Installing Using ZKar is easy. use go getto install the ZKar along with the library and its dependencies: go get -u github.com/phith0n/zkarNext, use github.com/phith0n/zkar/*in your application: package main

import (
"fmt"
"github.com/phith0n/zkar/serz"
"io/ioutil"
"log"
)

func main() {
data, _ := ioutil.ReadFile("./testcases/ysoserial/CommonsCollections6.ser")
serialization, err := serz.FromBytes(data)
if err != nil {
log.Fatal("parse error")
}

fmt.Println(serialization.ToString())
}Command line utility tool ZKar also provides a command line utility tool that you can use it directly: $ go run main.go
NAME:
zkar - A Java serz tool

USAGE:
main [global options] command [command options] [arguments...]

COMMANDS:
generate generate Java serz attack payloads
dump parse the Java serz streams and dump the struct
help, h Shows a list of commands or help for one command

GLOBAL OPTIONS:
--help, -h show help (default: false)For example, you are able to dump the payload CommonsBeanutils3 from ysoserial like: $ go run main.go dump -f "$(pwd)/testcases/ysoserial/CommonsBeanutils3.ser"https://camo.githubusercontent.com/30972d21736f6e5375027d395fda27c31c6dc8a8a52d174cd56d9cc8d16f36db/68747470733a2f2f61736369696e656d612e6f72672f612f5a6c726731794167686a676175476c6f67776d6246357650352e737667 Tests ZKar is a well-tested tool that passed all ysoserial generated gadgets parsing and rebuilding tests. It means that gadget generating by ysoserial can be parsed by ZKar, and parsed struts can be converted back into bytes string which is equal to the original one.
Gadget Package Parse Rebuild Parse Time AspectJWeaver ysoserial
✅

✅
80.334µs BeanShell1 ysoserial
✅

✅
782.613µs C3P0 ysoserial
✅

✅
98.321µs Click1 ysoserial
✅

✅
573.298µs Clojure ysoserial
✅

✅
72.415µs CommonsBeanutils1 ysoserial
✅

✅
461.15µs CommonsCollections1 ysoserial
✅

✅
64.484µs CommonsCollections2 ysoserial
✅

✅
508.918µs CommonsCollections3 ysoserial
✅

✅
564.071µs CommonsCollections4 ysoserial
✅

✅
535.449µs CommonsCollections5 ysoserial
✅

✅
137.609µs CommonsCollections6 ysoserial
✅

✅
68.753µs CommonsCollections7 ysoserial
✅

✅
178.549µs FileUpload1 ysoserial
✅

✅
35.39µs Groovy1 ysoserial
✅

✅
150.991µs Hibernate1 ysoserial
✅

✅
789.674µs Hibernate2 ysoserial
✅

✅
168.624µs JBossInterceptors1 ysoserial
✅

✅
632.581µs JRMPClient ysoserial
✅

✅
32.967µs JRMPListener ysoserial
✅

✅
38.263µs JSON1 ysoserial
✅

✅
2.157225ms JavassistWeld1 ysoserial
✅

✅
468.596µs Jdk7u21 ysoserial
✅

✅
355.01µs Jython1 ysoserial
✅

✅
216.862µs MozillaRhino1 ysoserial
✅

✅
1.775193ms MozillaRhino2 ysoserial
✅

✅
409.124µs Myfaces1 ysoserial
✅

✅
22.997µs Myfaces2 ysoserial
✅

✅
38.131µs ROME ysoserial
✅

✅
485.804µs Spring1 ysoserial
✅

✅
797.469µs Spring2 ysoserial
✅

✅
358.041µ[...]

s URLDNS ysoserial
✅

✅
21.502µs Vaadin1 ysoserial
✅

✅
438.729µs Wicket1 ysoserial
✅

✅
23.509µs Jdk8u20 pwntester
❌

❌
312.882µs JDK/JRE 8u20 gadget is not supported now, I am current working on it. TODO * Java bytecodes parser and generator
* JDK/JRE 8u20 Gadget supporting
* Serialization payloads generator
* An implementation of RMI/LDAP in Go License ZKar is released under the MIT license. See LICENSE See Also * SerializationDumper: A tool to dump and rebuild Java serialization streams and Java RMI packet contents in a more human readable form.
* ysoserial: A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
* Java-Deserialization-Cheat-Sheet: The cheat sheet about Java Deserialization vulnerabilities Download Zkar

hacking: security in practice
New York City: The personal data of 820,000 students compromised in hack

https://external-preview.redd.it/TIsliHCQzFCa-FfEaXToErUHY5bQykJOI9SbDn4qkAQ.jpg?width=640&crop=smart&auto=webp&s=937fc6c627be952a2c6854a215e3c5a3dad7c20c submitted by /u/Motor-Ad-8858
[link] [comments]