hacking: security in practice
Weird code on school computer

A classmate has been putting a usb flash drive into school computers, it seems to open cmd a couple of times and close a few programs when its plugged in, any ideas what it could be? He told me to go away when I asked what it does, the kid is an outcast most known as someone who uses cheats or a mod menu while playing games.

submitted by /u/ForkInMyAss
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Malware and web pages

Hello, computer science student here. Been learning a bit about security. From what I understand, malware needs to be installed on a computer to be of any harm. I have asked some people and they have told me that because malware needs to be installed, visiting a website does not generally install malware. So I asked them why are people afraid of clicking links to google web search results? And someone said that it is because when you visit a website, your browser will download a local copy of it, and it is in this copy of the website that malware can be put into your computer.

Is any of this right? Am I missing some important details?

tl;dr

Can someone put a malicious program in the file of the web page that your web browser downloads when you visit a web page? And does this file need to be installed or anything to activate the malware?

submitted by /u/MeesterMoo74
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

vAPI - Vulnerable Adversely Programmed Interface Which Is Self-Hostable API That Mimics OWASP API Top 10 Scenarios Through Exercises
http://www.kitploit.com/2022/04/vapi-vulnerable-adversely-programmed.html

___________________________
@hacking_Attack
@Hacking_Video

vAPI is Vulnerable (https://www.kitploit.com/search/label/Vulnerable) Adversely Programmed Interface which is Self-Hostable API that mimics OWASP API Top 10 scenarios in the means of Exercises.
Requirements PHP MySQL PostMan MITM Proxy Installation (Docker) docker-compose up -d Installation (Manual) Copying the Code cd git clone https://github.com/roottusk/vapi.git Setting up the Database Import vapi.sql into MySQL Database Configure the DB Credentials (https://www.kitploit.com/search/label/Credentials) in the vapi/.env Starting MySQL service Run following command (Linux) service mysqld start Starting Laravel Server Go to vapi directory (https://www.kitploit.com/search/label/Directory) and Run php artisan serve Setting Up Postman Import vAPI.postman_collection.json in Postman Import vAPI_ENV.postman_environment.json in Postman OR Use Public Workspace https://www.postman.com/roottusk/workspace/vapi/ Usage Browse http://localhost/vapi/ for Documentation After Sending requests, refer to the Postman Tests or Environment for Generated Tokens Deployment Helm (https://helm.sh/) can be used to deploy to a Kubernetes (https://www.kitploit.com/search/label/Kubernetes) namespace. The chart is in the vapi-chart folder. The chart requires one secret named vapi with the following values: DB_USERNAME: username to use>">DB_PASSWORD:
DB_USERNAME:
Sample Helm Install Command: helm upgrade --install vapi ./vapi-chart --values=./vapi-chart/values.yaml *** Important *** The MYSQL_ROOT_PASSWORD on line 232 in the values.yaml must match that on line 184 in order to work. Presented At OWASP 20th Anniversary (https://owasp20thanniversaryevent20.sched.com/event/ll1k) Blackhat Europe 2021 Arsenal (https://www.youtube.com/watch?v=7_Q5Rlm7Too) HITB Cyberweek 2021, Abu Dhabi, UAE (https://cyberweek.ae/2021/hitb-armory/) @Hack, Riyadh, KSA (https://athack.com/speakers?keys=Tushar) Upcoming APISecure.co (https://apisecure.co/) Mentions and References [1] https://apisecurity.io/issue-132-experian-api-leak-breaches-digitalocean-geico-burp-plugins-vapi-lab/ [2] https://dsopas.github.io/MindAPI/references/ [3] https://dzone.com/articles/api-security-weekly-issue-132 [4] https://owasp.org/www-project-vulnerable-web-applications-directory/ [5] https://github.com/arainho/awesome-api-security [6] https://portswigger.net/daily-swig/introducing-vapi-an-open-source-lab-environment-to-learn-about-api-security [7] https://apisecurity.io/issue-169-insecure-api-wordpress-plugin-tesla-3rd-party-vulnerability-introducing-vapi/ Walkthroughs/Writeups/Videos [1] https://cyc0rpion.medium.com/exploiting-owasp-top-10-api-vulnerabilities-fb9d4b1dd471 (vAPI 1.0 Writeup) [2] https://www.youtube.com/watch?v=0F5opL_c5-4&list=PLT1Gj1RmR7vqHK60qS5bpNUeivz4yhmbS (Turkish Language) (vAPI 1.1 Walkthrough) [3] https://medium.com/@jyotiagarwal3190/roottusk-vapi-writeup-341ec99879c (vAPI 1.1 Writeup) Acknowledgements The icon and banner uses image from Flaticon (https://www.flaticon.com/free-icon/bug_190835)

Download Vapi (https://github.com/roottusk/vapi)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Inside a Data Center Outage: Lessons About Resilience

A power failure at a major London data center shows that a truly resilient network is flexible, not just redundant.

Dark Reading: Attacks/Breaches
New Malware Tools Pose 'Clear and Present Threat' to ICS Environments

The recent discovery of highly customized malware targeting programmable logic controllers has renewed concerns about the vulnerability of critical infrastructure.

Deep Web
What are some good crypto related forums on the deep web?

Like NFT marketplaces, crypto discussion etc.

submitted by /u/yasuogaming
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Encontrei meu Primeiro Cross-site Scripting (XSS)

Olá Hunters! Nesse pequeno Artigo Vou explicar como encontrei meu primeiro (XSS)

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Responder HackTheBox | Walkthrough

https://cdn-images-1.medium.com/max/1920/1*r1GKwekVHaJdgGtwLOO-WA.png
Responder is the latest free machine on Hack The Box‘s Starting point Tier 1. It gives us a walkthrough of an NTLM hash capturing when the…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
My own Have I been pwned (HIBP) web app written in Go

https://cdn-images-1.medium.com/max/2560/1*HORz5rZj9MKeq0vNzrdlqA.png
This is my version of HIBP web app, which is searching for pwned passwords in database with billions of records, just in milliseconds.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How Servers Are Being Stolen To Commit Massive DDoS Attacks By Hackers And Cybercriminals… (2022)

https://cdn-images-1.medium.com/max/1000/0*ClIwA8mQ4YFaWj2x
Hackers all around the world are constantly attacking governments, businesses, and individuals with DDoS attacks. Recently, stolen servers…

Continue reading on HackerHub »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What to do if your Facebook Profile was Cloned (you weren’t hacked)

https://cdn-images-1.medium.com/max/1280/1*0We-R6jUqNONrNZ31xUfQw.jpeg
A step-by-step tutorial to share with your friends who have been cloned, not hacked.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
vAPI - Vulnerable Adversely Programmed Interface Which Is Self-Hostable API That Mimics OWASP API Top 10 Scenarios Through Exercises

https://blogger.googleusercontent.com/img/a/AVvXsEjoSKcbkydYCJ3vmGCwfE6xCoYmpR-OOaKgEb8z34mEC03p36EWuCj4wc9M4HDg1x8WEzIXrmFUkvezH3Ddx5vlUkXLXu91Y_-haF-JqoBkVM8TIPGL1UgupZL5d7AR8K79ZMfqfH48YzezAScrx06lWN74cVsL7ND-VALbtmQToJB_h1Ivo4p0PjTa=w640-h280 vAPI is Vulnerable Adversely Programmed Interface which is Self-Hostable API that mimics OWASP API Top 10 scenarios in the means of Exercises. Requirements* PHP
* MySQL
* PostMan
* MITM Proxy Installation (Docker)docker-compose up -dInstallation (Manual)Copying the Codecd git clone https://github.com/roottusk/vapi.gitSetting up the DatabaseImport vapi.sqlinto MySQL Database

Configure the DB Credentials in the vapi/.envStarting MySQL serviceRun following command (Linux) service mysqld startStarting Laravel ServerGo to vapidirectory and Run php artisan serveSetting Up Postman* Import vAPI.postman_collection.jsonin Postman
* Import vAPI_ENV.postman_environment.jsonin Postman

OR

Use Public Workspace https://www.postman.com/roottusk/workspace/vapi/ UsageBrowse http://localhost/vapi/for Documentation

After Sending requests, refer to the Postman Tests or Environment for Generated Tokens DeploymentHelm can be used to deploy to a Kubernetes namespace. The chart is in the vapi-chartfolder. The chart requires one secret named vapiwith the following values:

username to use>">DB_PASSWORD:

Sample Helm Install Command: helm upgrade --install vapi ./vapi-chart --values=./vapi-chart/values.yaml*** Important ***

The MYSQL_ROOT_PASSWORD on line 232 in the values.yamlmust match that on line 184 in order to work. Presented AtOWASP 20th Anniversary Blackhat Europe 2021 Arsenal HITB Cyberweek 2021, Abu Dhabi, UAE @Hack, Riyadh, KSA UpcomingAPISecure.co Mentions and References[1] https://apisecurity.io/issue-132-experian-api-leak-breaches-digitalocean-geico-burp-plugins-vapi-lab/

[2] https://dsopas.github.io/MindAPI/references/

[3] https://dzone.com/articles/api-security-weekly-issue-132

[4] https://owasp.org/www-project-vulnerable-web-applications-directory/

[5] https://github.com/arainho/awesome-api-security

[6] https://portswigger.net/daily-swig/introducing-vapi-an-open-source-lab-environment-to-learn-about-api-security

[7] https://apisecurity.io/issue-169-insecure-api-wordpress-plugin-tesla-3rd-party-vulnerability-introducing-vapi/ Walkthroughs/Writeups/Videos[1] https://cyc0rpion.medium.com/exploiting-owasp-top-10-api-vulnerabilities-fb9d4b1dd471 (vAPI 1.0 Writeup)

[2] https://www.youtube.com/watch?v=0F5opL_c5-4&list=PLT1Gj1RmR7vqHK60qS5bpNUeivz4yhmbS (Turkish Language) (vAPI 1.1 Walkthrough)

[3] https://medium.com/@jyotiagarwal3190/roottusk-vapi-writeup-341ec99879c (vAPI 1.1 Writeup) Acknowledgements* The icon and banner uses image from Flaticon Download Vapi

___________________________
@hacking_Attack
@Hacking_Video

Encontrei meu Primeiro Cross-site Scripting (XSS)

Olá Hunters! Nesse pequeno Artigo Vou explicar como encontrei meu primeiro (XSS)Continue reading on Medium »
Read more...

Encontrei meu Primeiro Cross-site Scripting (XSS)
https://medium.com/@arthursantos404/encontrei-meu-primeiro-cross-site-scripting-xss-f53f065a1b59?source=rss------bug_bounty-5

Olá Hunters! Nesse pequeno Artigo Vou explicar como encontrei meu primeiro (XSS)Continue reading on Medium » (https://medium.com/@arthursantos404/encontrei-meu-primeiro-cross-site-scripting-xss-f53f065a1b59?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
I'm being hacked RIGHT NOW. What do I do?

What do I buy? What do I install? I'm going to get that google protection thingy soon that looks like a key, because I just saw it but what do I DO?! How do I never get hacked ever again without knowing a guy?

submitted by /u/thelessermalefic
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
You know what I’m Going to ask !!

Is it possible to Wire Tap a phone in the USA with Some Software without being Law Enforcement? Has this been done before ?

submitted by /u/Gng599xx
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

What is it like to work as a pen tester?
https://www.reddit.com/r/Pentesting/comments/u3wbv0/what_is_it_like_to_work_as_a_pen_tester/

Pen testers of Reddit what is your work day like? How many hours do you guys work? Also how do you get permission to do what you guys do? submitted by /u/ELIDAL99 (https://www.reddit.com/user/ELIDAL99)
[link] (https://www.reddit.com/r/Pentesting/comments/u3wbv0/what_is_it_like_to_work_as_a_pen_tester/) [comments] (https://www.reddit.com/r/Pentesting/comments/u3wbv0/what_is_it_like_to_work_as_a_pen_tester/)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Data Scientists, Watch Out: Attackers Have Your Number

Researchers should take extra care in deploying data-science applications to the cloud, as cybercriminals are already targeting popular data-science tools such as Jupyter Notebook.