Vimana is a modular security framework designed to audit Python web applications.The base of the Vimana is composed of crawlers focused on…Continue reading on Medium » (https://medium.com/@pentesterclubpvtltd/vimana-an-experimental-security-framework-that-aims-to-provide-resources-for-auditing-python-web-app-ad21f24a175c?source=rss------bug_bounty-5)

ctf-screenshotter-a-ctf-web-challenge-about-making-screenshots
https://medium.com/@pentesterclubpvtltd/ctf-screenshotter-a-ctf-web-challenge-about-making-screenshots-7ed0a5a5f29b?source=rss------bug_bounty-5

A CTF web challenge about making screenshots. It is inspired by a bug found in real life. The challenge was created by @LiveOverflow for…Continue reading on Medium » (https://medium.com/@pentesterclubpvtltd/ctf-screenshotter-a-ctf-web-challenge-about-making-screenshots-7ed0a5a5f29b?source=rss------bug_bounty-5)

FisherMan — CLI Program That Collects Information From Facebook User Profiles Via Selenium
https://medium.com/@pentesterclubpvtltd/fisherman-cli-program-that-collects-information-from-facebook-user-profiles-via-selenium-f0492982c0e7?source=rss------bug_bounty-5

Search for public profile information on FacebookInstallationContinue reading on Medium » (https://medium.com/@pentesterclubpvtltd/fisherman-cli-program-that-collects-information-from-facebook-user-profiles-via-selenium-f0492982c0e7?source=rss------bug_bounty-5)

hacking: security in practice
shocked to have found a password easily

Before when I took control of a person's computer thanks to my program that he downloaded via phishing

I remember one day, I came across a pc where I activated the webcam out of curiosity and I found a paper on the desk where it was written: Daisy108277189

I tested the password on the Gmail account and it worked the first time! It was the first time it had happened to me: finding the password the first time, WTF!

I was so shocked that I logged out and left him a text file that said I broke into his computer and he needs to change his password.

I went from black hat to gray hat in 2 seconds!

submitted by /u/Melodic-Heart-1172
[link] [comments]

hacking: security in practice
Is this malicious? Or legitimate

Get.misguided.com Windows activator txt.

I’m trying to active windows. I’m running it in a VM.

There are videos on YouTube. Idk if the the comments are legit.

It’s not malicious right?

Anyone fact check it

submitted by /u/Waltc222
[link] [comments]

hacking: security in practice
Looking to build a CTF from scratch for a school assignment. I have never done this before and only done two CTFs myself.

Like the title says, I need to build a CTF. The requirements are very relaxed: Can be on any platform and employ any measure of vulnerability. Just need a way to submit to my prof. I think if I could just get a rough idea of what I want to build I could troubleshoot my way through it, but am having a tough time getting a plan together. I am getting more comfortable with linux and would like to build a vulnerable linux box, but I just don’t have a place to start

submitted by /u/YungLawn0
[link] [comments]

hacking: security in practice
Looking to meet/talk with hackers on VC about how it's like and how to begin.

I am an intermediate programmer and I have been interested in this field for a while. I would love to have a conversation with people who live this life style and wouldn't mind sharing knowledge.

If anyone is interested I will send you my discord! :)

submitted by /u/Nimai_TV
[link] [comments]

hacking: security in practice
Hackers keep finding me on skribbl.io?

So I played skribbl.io while chilling and all of a sudden these guys just started talking about things I know. I have formatted my Windows PC a few times but they always come back. I don’t even feel mad or anything, I just want to find out how they did it so I can regain my privacy and move on. I don’t know if this is interesting enough for the rules. I hope it is. Basically long story short is I befriended a narcissist, I realise they are a narcissist, tried to get away, process of getting away was very messy, lot of people then chose sides between him and me, but worst of all, even though I’m not around him anymore, and I told him I don’t want to be around him anymore, he’s still leaching on me. He basically just checks on what I do on the cyber world, if they see I have friends or whatever on the cyber world they tell that person how bad of a person I am, I lose that friend, and this basically just keeps happening. So how do I regain my privacy?

submitted by /u/GoldenwithaG
[link] [comments]

Hacking on Medium
Your online services will be compromised

https://cdn-images-1.medium.com/max/2600/0*1gu22-ZbnHy2PwwC
Stop using centralized authentication services to secure your own online services

Continue reading on Geek Culture »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hacking GraphQL -Part 2

https://cdn-images-1.medium.com/max/1748/1*KaK1RpW5QUjn-VZc8oy_Bw.png
In part 1 of the Hacking GraphQL series, we discussed about the basics of GraphQL, In part 2 of this series, we’re going to try multiple…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
[HTB] Lame 靶機 Write-Up

https://cdn-images-1.medium.com/max/659/1*r2kVTknC14ps6h6RWFa4yA.png
Hack The Box Lame machine Write-Up

Continue reading on 璿的筆記 »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hackers Exploiting Spring4Shell Vulnerability to Deploy Mirai Botnet Malware. This is far from the first time the botnet operators have quickly added newly publicized flaws to their exploit toolset. last year, multiple botnets were uncovered leveraging the Log4Shell to breach susceptible servers.

https://external-preview.redd.it/WSF6aZTPaXiv_7pFWIPM8sc2tMEBJgsV4ENNbxTYelQ.jpg?width=640&crop=smart&auto=webp&s=484629d97d502b18c06a923b9c27b61251b98c45 submitted by /u/Late_Ice_9288
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Attackers Spoof WhatsApp Voice-Message Alerts to Steal Info

Attackers Spoof WhatsApp Voice-Message Alerts to Steal InfoPost Views: 45
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/patreon-300x61.png Advanced Enumeration techniques with NMAP, Zenmap and Hydra

Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes
Attackers are spoofing voice message notifications from WhatsApp in a malicious phishing campaign that uses a legitimate domain to spread an info-stealing malware.
Researchers at cloud email security firm Armorblox discovered the malicious campaign targeting Office 365 and Google Workspace accounts using emails sent from domain associated with the Center for Road Safety, an entity believed to reside within the Moscow, Russia region. The site itself is legitimate, as it’s connected to the State Road Safety operations for Moscow and belongs to the Ministry of Internal Affairs of the Russian Federation, according to a blog post published Tuesday.

So far, attackers have reached about 27,660 mailboxes with the campaign, which spoofs WhatsApp by informing victims they have a “new private voicemail” from the chat app and includes a link purporting to allow them to play it, researchers said. Targeted organizations include healthcare, education and retail, researchers said.

The attack “employs a gamut of techniques to get past traditional email security filters and pass the eye tests of unsuspecting victims,” Armorblox Product Marketing Manager Lauryn Cash wrote in the post.

Those tactics include social engineering by eliciting trust and urgency in the emails sent to victims; brand impersonation by spoofing WhatsApp; the exploitation of a legitimate domain from which to send the emails; and the replication of existing workflows, i.e. getting an email notification of a voice message, Cash explained.
See Also: Complete Offensive Security and Ethical Hacking Course
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png How It WorksPotential victims of the campaign receive an email with the title “New Incoming Voice message” that includes a header in the email body reiterating this title. The email body spoofs a secure message from WhatsApp and tells the victim that he or she has received a new private voicemail, including a “Play” button so they allegedly can listen to the message.

The domain of the email sender was “mailman.cbddmo.ru,” which Amorblox researchers linked to the center for road safety of the Moscow region page–a legitimate site that allows the emails to slip past both Microsoft and Google’s authentication checks, they said. However, it’s possible that attackers exploited a deprecated or old version of this organization’s parent domain to send the malicious emails, they acknowledged.

If the recipient clicks the email’s “Play” link, he or she is redirected to a page that attempts to install a trojan horse JS/Kryptik–a malicious obfuscated JavaScript code embedded in HTML pages that redirects the browser to a malicious URL and implements a specific exploit, according to the post.

Once the target lands on the malicious page, a prompt asks for confirmation that the victim is not a robot. Then, if the victim clicks “allow” on the popup notification in the URL, a browser ad service can install the malicious payload as a Windows application, allowing it to bypass User Account Control.

“Once the malware was installed … it can steal sensitive information like credentials that are stored within the browser,” Cash wrote.
See Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH Targeting Unsuspecting ConsumersWhile the campaign appears to be focused on consumers rather than businesses[...]

___________________________
@hacking_Attack
@Hacking_Video

, it could be a threat to corporate networks if victims take the bait and the malware is installed, one security professional noted.

“The complexity and sophistication of the techniques make it very hard for the average consumer to detect a malicious attempt,” Purandar Das, CEO and co-founder at Sotero, an encryption-based data security solutions company, wrote in an email to Threatpost. “You could potentially see a path where they are able to collect business information once the malware is deployed and active.”

‘Targeting consumers is a successful path for cybercriminals, as people seem to let their guard down more with electronic communication than real-life communication, noted another security professional. The average person often falls for online scams if they are familiar with the social-media platform claiming to be the message sender,” James McQuiggan, security awareness advocate at security firm KnowBe4, wrote in an email to Threatpost.

“When they see it, most people will recognize someone trying to scam them in real life,” he said, citing an example of New York City street merchant trying to sell a passer-by a fake brand-name watch or handbag. “Most people will know they are fake and carry on walking. McQuiggan observed. See Also: Offensive Security Tool: Scapy
However, many people might not recognize an email claiming to have a voicemail from a popular messaging app or another social media platform is a scam and go along with it, he said.

“Users are too accepting of emails,” McQuiggan said. “There needs to be more education for everyone, not just within organizations, to spot electronic social engineering or scams, so it is apparent like someone who is trying to sell a fake watch or handbag on the street.”
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
See Also: Hacking stories: MafiaBoy, the hacker who took down the Internet
Source: threatpost.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/f956-article-211015-apple-body-text-90x90.jpg Apple paid out $36,000 bug bounty for HTTP request smuggling flaws3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/3e41-article-210226-vmware-body-text-90x90.jpg VMware warns of critical vulnerabilities in multiple products4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/A-New-Borat-RAT-Capable-Of-Conducting-Ransomware-DDOS-Activities-90x90.png No-Joke Borat RAT Propagates Ransomware, DDoS5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/php-pear-hacked-packages-malware-90x90.png Supply chain flaws in PHP package manager PEAR lay undiscovered for 15 years6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/php-hack-90x90.jpg PHP bug allows attackers to bypass domain filters, stage DoS attacks against servers1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/apple-iphone-hacking-90x90.jpg Apple emergency update fixes zero-days used to hack iPhones, Macs1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Google-Campus-90x90.jpg Google Chrome Bug Actively Exploited as Zero-Day2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/685f-article-211221-chrome-site-isolation-body-text-90x90.jpg HTML parser bug triggers Chromium XSS security flaw2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Polygon-hacker-90x90.jpg Hackers getting faster at latching onto unpatched vulnerabilities2 weeks ago
* http[...]

___________________________
@hacking_Attack
@Hacking_Video