Hacking Articles Tips Tricks Videos Tutorials

8 views18:30

Dark Reading: Attacks/Breaches
5-Year Vulnerability Trends Are Both Surprising and Sadly Predictable

What 5,800+ pentests show us: Companies have been struggling with the same known and preventable security bugs year over year. Bandwidth stands at the heart of the problem.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading

5-Year Vulnerability Trends Are Both Surprising and Sadly Predictable

What 5,800+ pentests show us: Companies have been struggling with the same known and preventable security bugs year over year. Bandwidth stands at the heart of the problem.

8 viewsedited 18:30

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Mainly for Czech speaking people (and it's not my work)

submitted by /u/Ejave
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Mainly for Czech speaking people (and it's not my work)

Posted in r/hacking by u/Ejave • 1 point and 0 comments

10 viewsedited 18:36

Hacking Articles Tips Tricks Videos Tutorials

Pentesting vs. Pentesting
https://www.reddit.com/r/Pentesting/comments/udauts/pentesting_vs_pentesting/

This will be lengthy and philosophical, though my thoughts are all over the place as I think I am heavily effected by Dunning-Krugers, so it would be great to hear thoughts from someone that went through this. Anyways, please bare with me and just contribute if you are interested in such discusison. I have been asking some of these questions myself and I want to discuss it with people that also thought about the same. I have recently watched some videos: https://www.youtube.com/watch?v=sXThugPk_zA - Video on the topic. https://www.youtube.com/watch?v=wv2YhT89LDU - Do you need programming to be a hacker? https://www.youtube.com/watch?v=rfjV8XukxO8 https://www.youtube.com/watch?v=2TofunAI6fU - His path of studies. https://www.youtube.com/watch?v=Lus7aNf2xDg https://www.youtube.com/watch?v=wDQ0KXR4D7A - The other kind of pentester. In the first video LiveOverflow compares Pentesting and AppSec, he basically says that the term Pentesting is used usually for both, but in EU is more of AppSec, where in US is more Pentesting usually Red Teaming. He also gives a good comparison that in AppSec usually you come over from being a developer, where Pentesters origin from Networking/Sysadmin roles. In the second video he talks about how you usually can go by without programming knowledge in web app hacking/bug bounties, because the web has HTTP as a standardized protocol web apps and browsers got to speak that protocol, so different languages produce same kind of issues and this where the market for tools and jobs for interpreting them is born and thus knowledge of programming languages becomes not needed. At least this is how I am interpretting the whole thing. Then he has a video where he talks how he started in hacking, which is a whole different world than learning fundamentals of networking and such, but this would be normal, as this guy is focused more on the low end coding side, then he supplimented that in CS college, but also OSCP, yet he doesn't work as a programmer who uses tools as metasploit. Then the last video, we have someone like The Cyber Mentor, which he basically talks about red team type of pentests, mostly using tools or physical hacking and social engineering. So I just cannot understand few things. LO basically says US Pentesters usually focuses on breaking into corporations, EU Pentesters are usually AppSec and they break into apps that can affect customers that use those apps. Naturally EU vs US because of the job markets, but you get the point. Which means that only AppSec deals with code auditing, which means that only AppSec leads to vulnerability research, CVE, zero days, which means that AppSec is the driving force that is building up Pentesters who use those tools. So would it be fair to say that AppSec can be a profession meters, yet not inches wide and miles deep, while Pentesting is the exact opposite. Then can we say that Pentesting usually fit people that love to learn new stuff all the time, but also do not go truly deep into how something works? Which is basically the opposite of what hacking is considered to be, which is breaking stuff down to learn exactly how they work and potentially manipulate them to work your way? Now you could say that a pentester can learn how the malware in question works, he already knows how to break it, if he is skilled enough (knows programming languages and methodologies, can know how they actually work), and manipulate it, but he is more of a Doctor and if he does know the programming language and methodologies then is he truly only a pentester? Now, code auditors and exploit developers and reverse engineers are closer to biochemist and in a way biochemists are the hackers, not the doctors, the very best doctors can understand the disease, they know how it works, they know what damage it can do, they can scan to diagnose them with the tools,

___________________________
@hacking_Attack
@Hacking_Video

Pentesting vs. Pentesting

This will be lengthy and philosophical, though my thoughts are all over the place as I think I am heavily effected by Dunning-Krugers, so it would...

9 viewsedited 19:38

Hacking Articles Tips Tricks Videos Tutorials

machines, blood works, they can manipulate them again with the tools that biochemists make (pharmacuticals) and basically hack the body doing stuff that they ought to be doing. So being a doctor can be really fun, and maybe every great doctor should have decent enough of Dr. House in them, however they are not the guys who work on the molecular level on why something works the way it works, they can understand it figure connections out, but they are not creating anything new. So very skilled Pentesters are like Dr. House, they know all kinds of stuff, they can research them, they can put them in practice, with the right tools and methodologies for diagnosis they can test them and even again with the right tools they can manipulate and treat them, in a way they are fiddling with hacking, but without the biochemistry, there will be nothing but guessing, there will be no tools and methods to diagnose and no tools to treat, there will be some hacking, but no science. This doesn't mean that Dr. House is not awesome, it just means is different. In the real world I believe the number of people that are as good and deep in their knowledge as pentesters as Dr. House is as a doctor, is very few, just like in the real world where most doctors are very superficial, specialists included. So I am not talking about those people, I am talking about the Dr. Houses of pentesting, people that truly learn, research and implement and test and are curious, people that know a lot about all kinds of technologies and they know how and when to use each new tool to counter anything that counters achieving their goal, however they are not the guys working on the theorems, they are practical, they apply and they know how and when to apply it, but they do not discover it. While there can be great difference between two pentesters, it seems that AppSec allows less of that, just because tools are not the primary use, the skill ceiling can be higher of course. Pentesting can be a spectrum of Dr. House to script kiddie practitioners. Reading this subreddit there are a lot of people mentioning that they learn each day, I first wondered to ask, what do you guys learn each day? Do you just update yourself on the latest CVEs or is there more to it? Or maybe all your free time you spent learning of low level code, binary exploitation, work on embedded hardware, solder, lockpick, do you do CTFs - surely those are interesting, but not as applicable in day to day job. What exactly do you mean when you say you never stop studying and it is a 40 hour work week, but not lifestyle? Maybe I should post a poll about this very question, because if you do work as a pentester for a few years, I believe you can soak up the new information that you need to know the next day at work in 30 minutes average at best and/or learn more during your that work day. It seems that in a perfect world, I would be interested in both AppSec and Pentesting, to me it seems they compliment each other in terms of the hacker mindset, I cannot understand how LO says that he is not interested in checking tools at metasploit regularly, but also cannot understand if someone never studies binary exploitation. I am not there yet, so maybe I am too new too understand that it is not a natural progression and it truly is just different as I mentioned earlier, maybe I am just more into AppSec and I do not know that as I have not started with, or maybe Pentesting is what I truly like and I just am curious about the basics of low level code and nothing beyond, at last I have always been interested in new technologies and learning ways to use them efficiently and differently, so can I truly throw that out Maybe I know too little to understand all of this? Maybe Pentesting people are truly the hacker type of people, while AppSec guys would be the more academic research type of people that want to dwell into particular problems and find ways around them. Maybe I cannot categorize all of this and I am wasting

___________________________
@hacking_Attack
@Hacking_Video

8 viewsedited 19:38

Hacking Articles Tips Tricks Videos Tutorials

time trying to map personality traits of a person to this concept? I am just baffled and in a way want to look into the future of how some of my opinions will form, but I know I probably lack the knowledge and experience to come to that conclusion on my own, so I am asking you guys, not to give me a conclusion that I will consume as a bible, however read into some of your thoughts if any of you were in a similar thought situation as me at some point and how it turned out on the end. submitted by /u/appwizcpl (https://www.reddit.com/user/appwizcpl)
[link] (https://www.reddit.com/r/Pentesting/comments/udauts/pentesting_vs_pentesting/) [comments] (https://www.reddit.com/r/Pentesting/comments/udauts/pentesting_vs_pentesting/)

___________________________
@hacking_Attack
@Hacking_Video

overview for appwizcpl

The u/appwizcpl community on Reddit. Reddit gives you the best of the internet in one place.

7 viewsedited 19:38

Hacking Articles Tips Tricks Videos Tutorials

6 views20:20

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
Exploring Google Dorks

https://cdn-images-1.medium.com/max/600/1*QnLE__4w7_2CPyaVZlgkSA.jpeg
Note: This article is strictly for educational purpose only.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Medium

Exploring Google Dorks

Note: This article is strictly for educational purpose only.

6 viewsedited 20:20