hacking: security in practice
How are electronic road signs hacked exactly as to modify the text or turn them off etc

This is from a purely educational interest of mine, thanks!

submitted by /u/painterman99
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Real world projects

any recommendations for real world projects?

submitted by /u/void02241
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Modify encrypted file

Hey guys,

I'm running through an introduction to Cyber Security and I have a question I'm trying to work out but struggling with.

Question: Your name is Bob and you are a programmer working for Acme Enterprises who wants to increase your salary without actually earning it.

You have access to the encrypted payroll file (salary.bf.enc) that contains annual salaries for each of the employees but has been protected with encryption using the Blowfish algorithm in ECB mode. You do not know the password.

You know that the other employees are Alice, Carol, David and Eve. Each line of the payroll is 16 bytes in length with the first 8 bytes being the name and the remainder the salary. You know the file is sorted alphabetically and that both Alice and Eve earn more than you.

What I am trying to do: Increase Bob's salary to the same as Alice and Eve's. I'm not sure what commands or tool I need to be using.

If you require access to the file, this is it here: https://temp.sh/thVyB/salary.bf.enc

What I have tried: I've looked into John The Ripper, BurpSuite and hex editing tools. A specific wordlist isn't mentioned so I wasn't able to crack the file and I wasn't sure if what I was trying to crack was even the password - I was using the hash of the file which seems wrong. BurpSuite looked promising after finding this link here: https://portswigger.net/blog/breaking-encrypted-data-using-burp which references the 8 and 16 byte sizes but after installing the Windows version I wasn't able to work this out. When adding the file into a hex editor I can't identify common data within the file.

Any help would be greatly appreciated!

submitted by /u/PowerOfTheShell
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hi quick q

Can someone reverse search a number there’s a lady sending me a minor nudes and saying weird stuff and I tried telling the police but they said I’d have to make a report and they would have to come to my house and it’s 12 am. Any help would be appreciated

submitted by /u/UwUsmasher
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Complete Guide To Start Bug Bounty In 2022
https://technicalsurendra.medium.com/complete-guide-to-start-bug-bounty-in-2022-5036630e5d98?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hey Everyone ! Today we learn how you can start your bug bounty journey and how you can make a successful bug bounty hunter !Continue reading on Medium » (https://technicalsurendra.medium.com/complete-guide-to-start-bug-bounty-in-2022-5036630e5d98?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Privacy Disclosure on Facebook Lite after Creating a Post
https://medium.com/@RheyJuls/privacy-disclosure-on-facebook-lite-after-creating-a-post-b12a1cad8d8a?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello,Continue reading on Medium » (https://medium.com/@RheyJuls/privacy-disclosure-on-facebook-lite-after-creating-a-post-b12a1cad8d8a?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Complete Guide To Start Bug Bounty In 2022

Hey Everyone ! Today we learn how you can start your bug bounty journey and how you can make a successful bug bounty hunter !Continue reading on InfoSec Write-ups »
Read more...

Privacy Disclosure on Facebook Lite after Creating a Post

Hello,Continue reading on Medium »
Read more...

Hacking on Medium
FSB detains Yalta resident for cyber attacks on Russian information resources

https://cdn-images-1.medium.com/max/600/0*-1Lc5eQlCg586jC_.jpg
Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Complete Guide To Start Bug Bounty In 2022

https://cdn-images-1.medium.com/max/1280/1*94i5cBESpmMlIumeHX3D2A.png
Hey Everyone ! Today we learn how you can start your bug bounty journey and how you can make a successful bug bounty hunter !

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
John the ripper

i am workig on kali linux , is john the ripper supose to take so long ? i have waited more than 2 hours for a password thats 8 letters only.

i am using the shadow file and passwd and i use the command : unshadow passwd shadow > combined

submitted by /u/imaGallex
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Exposing Thousands of Indian Railways Outlets’ private data.

Don’t just use the features, try to exploit them. — UnknownContinue reading on Medium »
Read more...

Web app PT help
https://www.reddit.com/r/Pentesting/comments/u0eebf/web_app_pt_help/

<!-- SC_OFF -->hey guys, I am a cybersecurity student and I am practicing PT on my school training system. I am given a website and I am supposed to : -Identify a vulnerability in the web application that can cause credentials to be sent across the network.
- Trigger the identified vulnerability and intercept the credentials sent over the network. I've looked for everything I know and couldn't find anything, the only this I found is the ability to access a database or a server for some CSV files. the request looks like this : http://:/Class/Logic?filename=\\FS-srv\Dec19.csv I have tried SQLi, XXS, HHHattack, CSRF, and had Burb intruder work really hard. i guess it must be how the server authenticate the file request but i have no idea how to check for that . i would really appreciate any help . PS: not looking for an answer , just for some directions <!-- SC_ON --> submitted by /u/Joeissa89 (https://www.reddit.com/user/Joeissa89)
[link] (https://www.reddit.com/r/Pentesting/comments/u0eebf/web_app_pt_help/) [comments] (https://www.reddit.com/r/Pentesting/comments/u0eebf/web_app_pt_help/)

hacking: security in practice
Someone I know had their key fob falling apart

And I had nothing better to do so I'd look up if I could make a mobile app that could unlock their car door.

I looked up how key fobs work. This is a good resource, basically a 40-bit code is sent from the fob to the car, once the car recieves the code, both the transmitter and the car switch the code based on the same pseudo-random number generation algorithm. (If you're wondering what happens if the car doesn't receive the code, the car maintains a window of 256 codes, so any of the subsequent 255 codes will be accepted, which means don't press those buttons 256 times out of range).

I thought I'll first try brute forcing through the 40-bit code to have a simple first attempt, 40-bit codes are obsolete and breakable, not fast enough on a phone to be of any practical use though, but I still went ahead with the idea out of curiosity. There's also the problem of this not only unlocking the car in question, but all the cars in proximity, which would be cool, but also probably illegal and not cool for the owners of the other cars.... I thought I could just try it in an isolated area.

Next I checked what frequency key fobs operate on, 433.92 mhz in my case, then I checked if my mobile would be capable of transmitting at that frequency, and this is when naive me realised there's nothing on a mobile phone that can do that :') so I had to drop the idea, sucks.

I still looked up a bit more about it and found this great video, he uses a laptop, a RF transceiving equipment and a much more educated approach.

submitted by /u/kcolcllaw
[link] [comments]

Poro - Scan Publicly Accessible Assets On Your AWS Cloud Environment
http://www.kitploit.com/2022/04/poro-scan-publicly-accessible-assets-on.html

Scan for publicly accessible assets on your AWS environment Services covered by this tool: AWS ELB API Gateway S3 Buckets RDS Databases EC2 instances Redshift Databases Poro also check if a tag you specify is applied to identified public resources using --tag-key and --tag-value arguments.
Prequisites AWS account with Read Only Access (https://www.kitploit.com/search/label/Access) to services listed above. Python 3.X requests>=2.22.0 boto3>=1.20 botocore>= 1.20 enlighten>=1 Usage Clone this repository Configure your envionment with active (https://www.kitploit.com/search/label/Active) credentials (https://www.kitploit.com/search/label/Credentials) -> aws configure [sso] Run python poro.py [-h] [--profile PROFILE] [--export FILE_NAME] [--verbose] [--tag-key KEY] [--tag-value VALUE] optional arguments:
-h, --help show this help message and exit
--profile PROFILE Specify the aws profile (default is default)
--export FILE_NAME Specify the file name if you want to expport the results
--verbose, -v
--tag-key KEY Specify the tag key that you want to check if it exists in public resources
--tag-value VALUE Specify the tag value that you want to check if it exists in public resources
Poro prints the scanning (https://www.kitploit.com/search/label/Scanning) results at the end of it's execution in a json (https://www.kitploit.com/search/label/JSON) file if no export option is not specified.

Download Poro (https://github.com/9rnt/poro)