Hacking on Medium
DeFi Insurance at its Best: Bundled Covers

https://cdn-images-1.medium.com/max/2600/1*DtcgLDGb9CAxYTFdxV9GMA.png
DeFi has lost over $1.2B to hacks in 2022 alone, almost 7 times higher than Q1 2021’s losses totaling $155M — which was already a huge…

Continue reading on Uno Re »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The Weekly Threat 4–26–2022

https://cdn-images-1.medium.com/max/2099/0*UrY7b9R7AOszYuv7
A handful of security news/vulns from the past week that you may have missed…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

https://medium.com/@Diegoeducacao404.../xss-refletido-um-exemplo-na-pr%C3%A1tica-544b0f857f70?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Self XSSContinue reading on Medium » (https://medium.com/@Diegoeducacao404.../xss-refletido-um-exemplo-na-pr%C3%A1tica-544b0f857f70?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Inszene der Heimatschutzbehörde enthüllt eine große Anzahl von Mängel
https://medium.com/@nhunglucbuongm416/inszene-der-heimatschutzbeh%C3%B6rde-enth%C3%BCllt-eine-gro%C3%9Fe-anzahl-von-m%C3%A4ngel-2215308b9a2a?source=rss------bug_bounty-5

Continue reading on Medium » (https://medium.com/@nhunglucbuongm416/inszene-der-heimatschutzbeh%C3%B6rde-enth%C3%BCllt-eine-gro%C3%9Fe-anzahl-von-m%C3%A4ngel-2215308b9a2a?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
The Ins and Outs of Secure Infrastructure as Code

The move to IaC has its challenges but done right can fundamentally improve an organization's overall security posture.

Dark Reading: Attacks/Breaches
Tenable Acquires External Attack Surface Management Vendor for $44.5M

Acquisition will add Internet-facing attack surface mapping and monitoring to Tenable's internal asset management products.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Why aren’t programmers good at hacking?

Just curious. I see many intelligent engineers, programmers and coders speak talk etc. They sound intelligent. Come up with amazing projects.

But they don’t know how to hack. It’s not a must for them to but… I thought they would.

submitted by /u/Waltc222
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
QR Codes

Hey everyone. I live in New York City & a lot of musicians/artists/clubs post random stickers with QR codes. There's not always additional info, sometimes just a quote or picture. From what I understand, you can't really be hacked or get viruses by scanning a QR code right? I guess it could take you to a malicious website, but wouldn't you have to do something from that point to be at risk?

Most sources say it's fine, but other sources have a very 2005 internet scare tactics vibe.

Thanks in advance yall!

submitted by /u/shanndawgg
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hak5 Shark Jack exploits

I've been researching the Hak5 products to see which, if any, would be the most useful for me and I have decided that if I was to get one of the products it would be the Shark Jack. I have tried typing all the variations of "shark jack backdoor bash script" but I haven't had any useful results. Do any of you know any bash scripts that would allow for a backdoor into the system? I am aware that the shark jack would likely need to remain plugged in to the ethernet port so this isn't an issue.

Edit: there is a youtube video that partially demonstrates what I want. https://youtu.be/xD-53orqoiU

submitted by /u/AnonymousGinger27
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hello, has anyone tried using VPN Relay Servers from VPN Gate? are they good for privacy?

I wanna know if it's worth the trouble of installing it and connecting to one.

submitted by /u/sylph79
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What is this?

Hi all,

Wht is this? I need a tool like this for PoC. Watch below:

https://www.veed.io/view/ceb181b6-0211-4d91-964e-9d4b143bde34

submitted by /u/110615
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

VulFi - Plugin To IDA Pro Which Can Be Used To Assist During Bug Hunting In Binaries
http://www.kitploit.com/2022/04/vulfi-plugin-to-ida-pro-which-can-be.html

___________________________
@hacking_Attack
@Hacking_Video

The VulFi (Vulnerability Finder) tool is a plugin to IDA Pro which can be used to assist during bug hunting in binaries. Its main objective is to provide a single view with all cross-references to the most interesting functions (such as strcpy, sprintf, system, etc.). For cases where a Hexrays decompiler (https://www.kitploit.com/search/label/Decompiler) can be used, it will attempt to rule out calls to these functions which are not interesting from a vulnerability research (https://www.kitploit.com/search/label/Vulnerability%20Research) perspective (think something like strcpy(dst,"Hello World!")). Without the decompiler, the rules are much simpler (to not depend on architecture) and thus only rule out the most obvious cases.
Installation Place the vulfi.py, vulfi_prototypes.json and vulfi_rules.json files in the IDA plugin folder (cp vulfi* ). Preparing the Database File Before you run VulFi make sure that you have a good understanding of the binary that you work with. Try to identify all standard functions (strcpy, memcpy, etc.) and name them accordingly. The plugin is case insensitive and thus MEMCPY, Memcpy and memcpy are all valid names. However, note that the search for the function requires exact match. This means that memcpy? or std_memcpy (or any other variant) will not be detected as a standard function and therefore will not be considered when looking for potential vulnerabilities. If you are working with an unknown binary you need to set the compiler options first Options > Compiler. After that VulFi will do its best to filter all obvious false positives (such as call to printf with constant string as a first parameter). Please note that while the plugin is made without any ties to a specific ar chitecture some processors do not have full support for specifying types and in such case VulFi will simply mark all cross-references to potentially dangerous standard functions to allow you to proceed with manual analysis. In these cases, you can benefit from the tracking features of the plugin. Usage Scanning To initiate the scan, select Search > VulFi option from the top bar menu. This will either initiate a new scan, or it will read previous results stored inside the idb/i64 file. The data are automatically saved whenever you save the database. Once the scan is completed or once the previous results are loaded a table will be presented with a view containing following columns: IssueName - Used as a title for the suspected issue. FunctionName - Name of the function. FoundIn - The function that contains the potentially interesting reference. Address - The address of the detected call. Status - The review status, initial Not Checked is assigned to every new item. The other statuses are False Positive, Suspicious and Vulnerable. Those can be set using a right-click menu on a given item and should reflect the results of the manual review of the given function call. Priority - An attempt to prioritize more interesting calls over the less interesting ones. Possible values are High, Medium and Low. The priorities are defined along with other rules in vulfi_rules.json file. Comment - A user defined comment for the given item. In case that there are no data inside the idb/i64 file or user decides to perform a new scan. The plugin will ask whether it should run the scan using the default included rules or whether it should use a custom rules file. Please note that running a new scan with already existing data does not overwrite the previously found items identified by the rule with the same name as the one with previously stored results. Therefore, running the scan again does not delete existing comments and status updates.

___________________________
@hacking_Attack
@Hacking_Video

In the right-click context menu within the VulFi view, you can also remove the item from the results or remove all items. Please note that any comments or status updates will be lost after performing this operation. Investigation Whenever you would like to inspect the detected instance of a possible vulnerable (https://www.kitploit.com/search/label/Vulnerable) function, just double-click anywhere in the desired row and IDA will take you to the memory location which was identified as potentially interesting. Using a right-click and option Set Vulfi Comment allows you to enter comment for the given instance (to justify the status for example). Adding More Functions The plugin also allows for creating custom rules. These rules could be defined in the IDA interface (ideal for single functions) or supplied as a custom rule file (ideal for rules that aim to cover multiple functions). Within the Interface When you would like to trace a custom function, which was identified during the analysis, just switch the IDA View to that function, right-click anywhere within its body and select Add current function to VulFi.

___________________________
@hacking_Attack
@Hacking_Video