KitPloit - PenTest Tools!
Octosuite - Advanced Github OSINT Framework

https://blogger.googleusercontent.com/img/a/AVvXsEj8XJA0tDLFZ5J5U7mCyO4HMcDAf72u2fblaZ1TA3WMWaijNVKiSFYyb2xWSu5SI-jq2ME-CvHAiyEj_pJTj2ICmxK1Fd5u2MJKOU6xI9tM7uHu13Bzl2qQT_XNocXAYb_O7_3SHX3TTl4Tm6OSgt7uQAiWeNd5TQQ0ORwPCwymgRIeyY4E0Ck9DDAL=w640-h526
Simply gather OSINT on Github users and organizations like a god


FEATURES

* Fetches organization info
* Fetches user info
* Fetches repository info
* Returns contents of a path from a repository
* Returns a list of repos owned by an organization
* Returns a list of repos owned by a user
* Returns a list of gists owned by a user
* Returns a list of a user's followers
* Checks whether user A follows user B
* Searches users
* Searches repositories
* Searches topics
* Searches issues
* Searches commits
* Easily updates with the 'update' command
* Automatically logs network activity (.logs folder)
INSTALLATION

clone project:

git clone https://github.com/rly0nheart/octosuite.git


cd octosuite


pip install -r requirements.txt


USAGE

Linux:

sudo chmod +x octosuite


sudo ./octosuite


Windows:

python3 octosuite


Mac:

python3 octosuite


AVAILABLE COMMANDS
Command Usage orginfoget organization info userinfoget user profile info repoinfoget repository info pathcontentsget contents of a path from a specified repository orgreposget a list of repositories owned by a specified organization userreposget a list of repositories owned by a specified user usergistsget a list of gists owned by a specified user userfollowersget a list of a user's followers userfollowingcheck whether user A follows user B usersearchsearch user(s) reposearchsearch repositor(y)(ies) topicsearchsearch topics(s) issuesearchsearch issue(s) commitsearchsearch commit(s) updateupdate octosuite changelogshow changelog authorshow author info helpshow usage/help exitexit session
NOTE

* octosuite automatically logs network and minor user activity. The logs are saved by date and time in .logs folder
* Although octosuite was developed to work on Mac, Windows, or any Linux Distribution, it has only been tested on Termux and Kali Linux

ABOUT AUTHOR

About.me
Download Octosuite

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Group

Hey!

Im looking to make a group with others just to learn, theres not skill requirement and the goal of the group is just to have a small group of people to talk about what your doing and work together on projects, if anyone wants to join just message me

(Note, no people who think they can hack the NSA with html)

submitted by /u/YAROBONZ-
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
BlackCat Purveyor Shows Ransomware Operators Have Nine Lives

Members of BlackMatter, and possibly REvil, have likely resurfaced in the new ransomware-as-a-service group ALPHV, whose primary tool is the BlackCat malware.

Dark Reading: Attacks/Breaches
SeeMetrics to Help CISOs Measure Security Success

The company makes cybersecurity performance management software to quantify how well cyber-risk solutions are actually working.

Dark Reading: Attacks/Breaches
Mandiant to Use CrowdStrike Technology in Its Incident Response Services

Collaboration between the two firms will help organizations better identify and protect against complexity cyberthreats, chief executives from both companies said.

Hacking on Medium
12 Warning Signs Your Computer Has Been Hacked

https://cdn-images-1.medium.com/max/2600/0*Zn__sYzylY5cCmFR
Are you worried your computer might have been hacked? Check out our list of 12 warning signs . Don’t wait until it’s too late.

Continue reading on CodeX »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
4 Worst Myths about Cybersecurity

https://cdn-images-1.medium.com/max/1170/1*lt7FeaWtr2Ac98zV3FzWBQ.jpeg
These cybersecurity myths are popular... and dangerous! Let’s find out why.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Roadmap and Resources to Become an Ethical Hacker

https://cdn-images-1.medium.com/max/2600/1*TYpOYGoII4CH8co0oM7P1w.jpeg
When you hear the word Hacking, the first thing that pops in your head is how cool they look in the movies. I mean they are cool in real…

Continue reading on DataDrivenInvestor »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Business People Seek Protection Against the Threat of Cyber Attacks

https://cdn-images-1.medium.com/max/1920/1*GJaY9Fkk6MLB2uLRiIRQ1A.jpeg
On a 1-to-10 scale, many owners are pinging from the danger

Continue reading on DataDrivenInvestor »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Reverse Engineering the SafetyNet Attestation API

https://external-preview.redd.it/qlbYeyvIgT9FeKg2VoLVEBPvGcklPDQ3huZcNvWvgFM.jpg?width=640&crop=smart&auto=webp&s=7d1cba36e94753e79b077d7f4f75895b43a2005a submitted by /u/OppositeMonday
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Exploiting XSS with Javascript/JPEG Polyglot

What is a polyglot?Continue reading on Medium »
Read more...

Exploiting XSS with Javascript/JPEG Polyglot
https://medium.com/@Medusa0xf/exploiting-xss-with-javascript-jpeg-polyglot-4cff06f8201a?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

What is a polyglot?Continue reading on Medium » (https://medium.com/@Medusa0xf/exploiting-xss-with-javascript-jpeg-polyglot-4cff06f8201a?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Find this free tool interesting
https://www.reddit.com/r/Pentesting/comments/tyx4mb/find_this_free_tool_interesting/

Try the ZOFixer.com penetration testing tool (Full Scan) For Free. It scans each target for approximately 1 to 2 hours and gives you a good report for OWASP. submitted by /u/oosdevelopergmailcom (https://www.reddit.com/user/oosdevelopergmailcom)
[link] (https://www.reddit.com/r/Pentesting/comments/tyx4mb/find_this_free_tool_interesting/) [comments] (https://www.reddit.com/r/Pentesting/comments/tyx4mb/find_this_free_tool_interesting/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Keep Your Family Safe Online: 10 Ways to Secure Your Home Network

https://cdn-images-1.medium.com/max/2600/0*bnLATV9sIFK-Xdd4
Are you concerned about your family’s safety online? 10 ways to secure your home network are outlined in this must-read article.

Continue reading on ILLUMINATION »

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Apple paid out $36,000 bug bounty for HTTP request smuggling flaws

Apple paid out $36,000 bug bounty for HTTP request smuggling flawsPost Views: 79
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/patreon-300x61.png Advanced Enumeration techniques with NMAP, Zenmap and Hydra

Subscribe to Patreon to watch this episode.
Reading Time: 1 Minute
A security researcher claims they netted $36,000 in bug bounties after uncovering critical HTTP request smuggling vulnerabilities affecting three of Apple’s core web applications.
The bug hunter, a 20-year-old hacker going by the online moniker ‘Stealthy’, said they deployed the same technique to achieve queue poisoning on the domains, paving the way to data disclosure and account takeover with no user interaction required.

The bugs supposedly affected servers for business.apple.com and school.apple.com, which businesses and schools respectively use to manage devices, apps, and accounts, as well as mapsconnect.apple.com, which organizations use to claim and manage business listings on Apple’s maps application.

The HTTP request smuggling flaws were CL.TE – or ‘Content-Length Transfer-Encoding’ – issues, whereby “the front-end server reads the Content-Length header in a request, and the backend server reads the Transfer-Encoding header”, Stealthy explained in a Medium blog post. Vulnerabilities arise because the servers disagree on where requests begin and end.
See Also: Complete Offensive Security and Ethical Hacking Course
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png Redirecting live users“A transformation was needed in the Transfer-Encoding header on Apple’s websites using a newline character and then a space in the header name,” said Stealthy.

This change – Transfer-Encoding\n : chunked – “successfully slipped the header past the frontend server but [it] was still used by the backend”.

Based on this observation Stealthy crafted the first proof of concept.

“My smuggled path is /static/docs because a redirect occurs there, using the Host header value in the redirect,” continued the researcher. “Thus, I could redirect live users to my server to ensure that the request smuggling affects production users.”
See Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH This would enable attackers to redirect JavaScript imports and achieve stored cross-site scripting (XSS) on the host.

More impactful still was the servers’ vulnerability to queue poisoning, an attack technique that “smuggles a complete request and breaks the response queue, which will start sending random responses to unintended users”.

All response data, including Set-Cookie headers, could be disclosed by this technique, the researcher claims.

Apple responded to the bug report quickly, remediated the vulnerabilities, and paid Stealthy a $12,000 bug bounty reward for each domain. See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
See Also: Hacking stories: MafiaBoy, the hacker who took down the Internet
Source: portswigger.net Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/3e41-article-210226-vmware-body-text-90x90.jpg VMware warns of critical vulnerabilities in multiple products1 day ago
* https://www.blackhatethical[...]

___________________________
@hacking_Attack
@Hacking_Video

hacking.com/wp-content/uploads/2022/04/A-New-Borat-RAT-Capable-Of-Conducting-Ransomware-DDOS-Activities-90x90.png No-Joke Borat RAT Propagates Ransomware, DDoS2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/php-pear-hacked-packages-malware-90x90.png Supply chain flaws in PHP package manager PEAR lay undiscovered for 15 years3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/php-hack-90x90.jpg PHP bug allows attackers to bypass domain filters, stage DoS attacks against servers4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/apple-iphone-hacking-90x90.jpg Apple emergency update fixes zero-days used to hack iPhones, Macs1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Google-Campus-90x90.jpg Google Chrome Bug Actively Exploited as Zero-Day1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/685f-article-211221-chrome-site-isolation-body-text-90x90.jpg HTML parser bug triggers Chromium XSS security flaw1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Polygon-hacker-90x90.jpg Hackers getting faster at latching onto unpatched vulnerabilities1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/mitmproxy-90x90.png HTTP request smuggling bug patched in mitmproxy2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ee3dc49c79d14f20970cc8b20063f52e-90x90.jpg Flash loan attack on One Ring protocol nets crypto-thief $1.4 million2 weeks ago
The post Apple paid out $36,000 bug bounty for HTTP request smuggling flaws first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video