uard WireGuard + Phantun WireGuard + udp2raw (cipher-mode=none auth-mode=none disable-anti-replay) iperf3 -c IP -R 1.56 Gbit/s 540 Mbit/s 369 Mbit/s iperf3 -c IP 1.71 Gbit/s 519 Mbit/s 312 Mbit/s Back to TOC Future plans* IPv6 support for fake-tcp
* Load balancing a single UDP stream into multiple TCP streams
* Integration tests
* Auto insertion/removal of required firewall rules Back to TOC Compariation to udp2rawudp2raw is another popular project by @wangyu- that is very similar to what Phantun can do. In fact I took inspirations of Phantun from udp2raw. The biggest reason for developing Phantun is because of lack of performance when running udp2raw (especially on multi-core systems such as Raspberry Pi). However, the goal is never to be as feature complete as udp2raw and only support the most common use cases. Most notably, UDP over ICMP and UDP over UDP mode are not supported and there is no anti-replay nor encryption support. The benefit of this is much better performance overall and less MTU overhead because lack of additional headers inside the TCP payload.

Here is a quick overview of comparison between those two to help you choose:
Phantun udp2raw UDP over FakeTCP obfuscation
✅

✅
UDP over ICMP obfuscation
❌

✅
UDP over UDP obfuscation
❌

✅
Multi-threaded
✅

❌
Throughput Better Good Raw IP mode TUN interface Raw sockets + BPF Tunneling MTU overhead 12 bytes 44 bytes Seprate TCP connections for each UDP connection Client/Server Server only Anti-replay, encryption
❌

✅
IPv6 UDP only
✅ Back to TOC LicenseCopyright 2021-2022 Datong Sun (dndx@idndx.com)

Licensed under the Apache License, Version 2.0 or the MIT license , at your option. Files in the project may not be copied, modified, or distributed except according to those terms. Back to TOC Download Phantun

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How to start doing Bug Bountys?

I'd like to get into bug bounty hunting. Where is a good place to start? I'd prefer to go for the low hanging fruit that more advanced people would pass up.

Also, is it plausible to get into this with Burp Suite community edition or do you need the pro version to have a chance at being successful?

submitted by /u/Practical_Bathroom53
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hacking a Samsung Note 8 Pen

Hi!

Not sure if this is the right sub for this but, I need to figure out, if possible, how to hack into my Samsung Note 8 Pen to use on my Google Pixel 6 phone. If I'm in the wrong sub, please don't hesitate to let me know. Or if this isn't even possible.

❤️

submitted by /u/Loverofallanimals66
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to recover deleted files that are not in the recycle bin.

https://cdn-images-1.medium.com/max/1202/1*E4R1J5PoHjxpZrV_EYAf5w.jpeg
It is easy enough to accidentally delete files from your computer. But recovering them can be problematic. Especially if you don’t know…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Desanonimización de anónimos con Canarytokens

https://cdn-images-1.medium.com/max/1280/1*wZtXlJgiFuxB4uQQonEChg.jpeg
Los Canarytokens (https://canarytokens.org/) son un tipo de enlace único personalizado en el que alguien hace clic o accede, podemos…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Masking IPLogger as YouTube

https://cdn-images-1.medium.com/max/900/1*AT_acKyGLKL3LvtQYFjA9w.jpeg
IPLogger (https://iplogger.org/) is a service that allows you to get the victim’s IP address and User Agent using a link.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How I cleared eJPT Exam — My Experience

https://cdn-images-1.medium.com/max/1456/1*qcA5Omur8tYgd99MfhQ4Bw.png
Hello everyone. I have successfully passed eLearnSecurity Junior Penetration Tester exam on April 03, 2022. I would like to share my…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Changing the MAC Address on Android

https://cdn-images-1.medium.com/max/1280/1*6sfKxVCcL35UaqPbET3Feg.jpeg
This Android app allows you to change your device’s MAC address to a random one, or one that you specify.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Create your own QR code with your logo?

https://cdn-images-1.medium.com/max/1280/1*NoAeGXDDG3Nk_PRyKwcQew.jpeg
The conventional wisdom is that QR codes are used by large companies and brands, but this is not the case. Anyone can create their own…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Gitlab critical vulnerability leading to account takeovers

hey guys have you heard this news about some sort of compromise at gitlab? has any of you guys using Gitlab had their passwords reset right after this incident?

https://www.bleepingcomputer.com/news/security/critical-gitlab-vulnerability-lets-attackers-take-over-accounts/

submitted by /u/alicia30765
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Decoding raw data from magnetic stripe card

My university uses a magnetic stripe card for IDs. It stored your student information, food balance, and door access.

I’ve already learned that Track 2 stores the student ID which is also used for food balance, and I’ve already learned how to edit this. But actually using it isn’t plausible considering it’s a blank card and you have to hand it to an employee to get food.

I’m assuming that Track 3 is where door access is stored, but when trying to read it as data type “User_Type” with my MSR605X it gives me a Read Error. It gives me read error in all types except raw data actually.

I’ve attempted cloning my ID raw data to a card that only uses track 3, and it successfully opened my dorm door. So I know track 3 stores that information, but I don’t understand why I’m receiving a read error. Is it in a custom format or something? How would I go about editing it?

submitted by /u/LucienMr
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
what do "you" do next?

Lab environment or contacted pentest. You get a Foothold in the AD domain as a low level priv domain user and escalate your privileges to local admin or system. I know what the first thing I check next, but curious what's the first thing other check and why? Do you work bottom up 'low hanging fruit' or top to bottom?

submitted by /u/newworldsamurai3030
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Newly found Android malware records audio, tracks your location

hey guys check out this news on a newly detected android malware that's tracking your activities down to the minute details and in real time? Apparently, it seems like this is guising as a so called 'process manager' but actually a malicious spyware related to APT? Well then, better stay alert and keep your guards up against any suspicious activities that might be going on your phone without your knowledge ！

https://www.bleepingcomputer.com/news/security/newly-found-android-malware-records-audio-tracks-your-location/

submitted by /u/alicia30765
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Spring Cloud RCE Bugs massively cropping up?

you know i've recently heard news that some RCE bug associated with Javascript, so better beware of its potential impact regardless of its lowly scored CVSS? Well potentially it could have serious ramifications in the long haul so experts agree that its impact should not be underestimated! what do you think?

submitted by /u/alicia30765
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is hacking getting easier or harder?

Literally everything I’ve learned on Udemy, YouTube and tryhackme (so far) is blocked by standard security features like cloud flare or windows defender.

They say that the demand for cyber security is going to increase by 33% in the next few years.

My professor said that ~93% of hacking is done by script kiddies. If standard script kiddy tools are blocked by default windows defender configurations, where is this increasing threat coming from? Nation state actors and the elite criminal organizations who have access to zero days?

submitted by /u/Practical_Bathroom53
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Uncommon/Unique malware evasion techniques?

I’m in the final stages of developing a Crypter at the moment. It’s sitting at 0/38 Scantime and 1/22 Runtime.

I have anti-VM features implemented which do standard checks on storage, ram, and CPU queries.

What other AV evasion techniques / anti debug features have you heard of?

The current list of features are as follows:

Polymorphic Encrypted Strings

Strings that would be constant within the stub are encrypted with a polymorphic encryption scheme so that the injected strings are different upon each build.

No decryption key in the “Stub”

The decryption key is not passed to the stub. Instead, a charset and length is passed along to be brute-forced at run. (Bypass some runtime AV; harder for reversing)

Randomized Code Blocks

Code Blocks / Subs&Functions are randomized in their placement when the assembly is crypted.

Legitimate Workstation Checks

At run, the program utilizes 3 check points to verify it is being run on a legitimate machine and not a virtualized environment.

Memory Execution

The crypted file is run directly in memory via a background thread.

Service Startup

The crypted file runs as a windows service until the injected bytes are run into memory.

Compression

The payload is compressed before being Injected into the stub, this sometimes provides outputs smaller than the stub+original payload.

Obfuscation

Using Mono.cecil, the assembly is lightly obfuscated using renaming techniques paired with invalid whitespace characters.

Only one static variable

Entire integer,string,array is dynamically changed each build with exception to one integer that is a divisor for bytes. A common number that would not be marked as malicious.

Small Stub

Only 12kb total size.

submitted by /u/MysticalTeamMember
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Whatsapp does not require OTP

NOTE: This finding was declared as feature by Facebook team so i would like to share this new feature with everyone.Continue reading on Medium »
Read more...

Whatsapp does not require OTP
https://sheshasai.medium.com/whatsapp-does-not-require-otp-794f94e0d62b?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video