Hacking on Medium
TryHackMe-Overpass 3 -Hosting

https://cdn-images-1.medium.com/max/682/1*X4kXpdTYp15bnLodyglO7A.png
Difficulty: Medium

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
USSD Codes to Check Hacked Phone

Hackers are wild. Phishing assaults are going on routinely. All of you ought to know what to dial to check whether your phone is hacked…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
WHY PAY FOR TRYHACKME WHEN YOU CAN STILL LEARN HACKING WITH THIS FREE CHECKLIST — LEARN HACKING…

https://cdn-images-1.medium.com/max/1024/0*qtZ9Bykeo7eHfzAo.png
You want to be a Whitehat Hacker or a professional Pentester but have no idea where to begin? You want to participate in the TryHackMe…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
SearchMap Information Collection Tool

https://cdn-images-1.medium.com/max/780/1*8TiIzNB9CIbRUIq2bwMvnQ.png
Searchmap is a comprehensive information collection tool for pre-penetration testing that integrates domain name resolution, IP reverse…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How To Hack A Paywall

https://cdn-images-1.medium.com/max/2600/0*q_Inds8g-5akRTnU
It’s a whole lot easier than you think.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
BWASP - BoB Web Application Security Project

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEirO_eF2Dh9KQSVnCc1tO-1w4tUxtvCVKPlp8icOCaoJLRg2pPrIWMDkuN9LiBiorPhxFOhhjmenk6K633OM7C_ywWk5H653JRYM-S2T8c4SUVy9bd6YEDKVTY9J_WdpEb0IF7Y2f4sFuqFCPyeC_IyLfxHhKt52Kg3HDThmJwj5ZyWGQvBDcc5DJVz/w564-h640/BWASP.png
The BoB Web Application Security Project (BWASP) is an open-source, analysis tool to support for Web Vulnerability Manual Analysis hackers.

The BWASP tool basically provides predicted information through vulnerability analysis without proceeding with an attack.

BWASP supports performing automated analysis and manual analysis.

The BWASP Project supports:

* Find Attack vector automatically. (e.g. SQL Injection, Cross-site Scripting)
* Detect website technology.
* Log4J vulnerability scan (Partially supports java language)
* HTTP REST API
* GuideLine Result
* Test payload option(attack test)
Getting started

pip3 install -r requirements.txt

python3 start.py

BWASP Tool Guide

* guide-ko-documentation
* guide-en-documentation

Roadmap

* Add OSINT feature (find subdomains)

Reference

Web Infra Environment Analysis: wappalyzer(https://github.com/AliasIO/wappalyzer)

Contact

* bwasptop9@gmail.com

Contributor

* Dohun Koo (@dohunny)
* Sanghyeon Lee (@isanghyeon)
* Joowon Kim (@arrester)
* Jongmin Kim (@Universe1122)
* Joonyoung Jeong (@jeongjy0317)
* Joomyeong Lee (@PecentZero)
* PL: Jiheon Choi (@jiheon-dev)
* Mentor: Gangseok Lee (@codeengn), Sehan Park (@combab0)

Acknowledgement

This work was supported by Korea Information Technology Research Institute (KITRI) Best of the Best (BoB) Program 10th vulnerability analysis track.

[Project Name: BoB Web Application Security Project]
Download BWASP

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Zkar : A Java Serialization Protocol Analysis Tool Implement In Go

ZKar is a Java serialization protocol analysis tool implement in Go. This tool is still work in progress, so no complete API document and contribution guide.

ZKar provides:

* A Java serialization payloads parser and viewer in pure Go, no CGO or JDK is required
* From the Java serialization protocol to a Go struct
* A Go library that can manipulate the Java serialization data
* WIP: ysoserial implement in Go
* WIP: Java class bytecodes parser, viewer and manipulation
* WIP: An implementation of RMI/LDAP in Go InstallingUsing ZKar is easy. use go getto install the ZKar along with the library and its dependencies:

go get -u github.com/phith0n/zkar

Next, use github.com/phith0n/zkar/*in your application:

package main
import (
“fmt”
“github.com/phith0n/zkar/serz”
“io/ioutil”
“log”
)
func main() {
data, _ := ioutil.ReadFile(“./testcases/ysoserial/CommonsCollections6.ser”)
serialization, err := serz.FromBytes(data)
if err != nil {
log.Fatal(“parse error”)
}
fmt.Println(serialization.ToString())
} Command line utility toolZKar also provides a command line utility tool that you can use it directly:

$ go run main.go
NAME:
zkar – A Java serz tool
USAGE:
main [global options] command [command options] [arguments…]
COMMANDS:
generate generate Java serz attack payloads
dump parse the Java serz streams and dump the struct
help, h Shows a list of commands or help for one command
GLOBAL OPTIONS:
–help, -h show help (default: false)

For example, you are able to dump the payload CommonsBeanutils3 from ysoserial like:

$ go run main.go dump -f “$(pwd)/testcases/ysoserial/CommonsBeanutils3.ser” TestsZKar is a well-tested tool that passed all ysoserial generated gadgets parsing and rebuilding tests. It means that gadget generating by ysoserial can be parsed by ZKar, and parsed struts can be converted back into bytes string which is equal to the original one.
GadgetPackageParseRebuildParse TimeAspectJWeaverysoserialhttps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png 80.334µsBeanShell1ysoserialhttps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png 782.613µsC3P0ysoserialhttps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png 98.321µsClick1ysoserialhttps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png 573.298µsClojureysoserialhttps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png 72.415µsCommonsBeanutils1ysoserialhttps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png 461.15µsCommonsCollections1ysoserialhttps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png 64.484µsCommonsCollections2ysoserialhttps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png 508.918µsCommonsCollections3ysoserialhttps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png 564.071µsCommonsCollections4ysoserialhttps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png 535.449µsCommonsCollections5ysoserialhttps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png 137.609µsCommonsCollections6ysoserialhttps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png 68.753µsCommonsCollections7ysoserialhttps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png 178.549µsFileUpload1ysoserialhtt[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Request_Smuggler : Http Request Smuggling Vulnerability Scanner

Request_Smuggler is a Http request smuggling vulnerability scanner. Based on the amazing research by James Kettle. The tool can help to find servers that may be vulnerable to request smuggling vulnerability.

Usage

USAGE:
request_smuggler [OPTIONS] –url
FLAGS:
-h, –help Prints help information
-V, –version Prints version information
OPTIONS:
–amount-of-payloads low/medium/all [default: low]
-t, –attack-types
[ClTeMethod, ClTePath, ClTeTime, TeClMethod, TeClPath, TeClTime] [default: “ClTeTime” “TeClTime”]
–file
send request from a file
you need to explicitly pass \r\n at the end of the lines
-H, –header Example: -H ‘one:one’ ‘two:two’
-X, –method [default: POST]
-u, –url
-v, –verbose
0 – print detected cases and errors only,
1 – print first line of server responses
2 – print requests [default: 0]
–verify how many times verify the vulnerability [default: 2]

Installation

* Linux
* from releases
* from source code (rust should be installed)
git clone https://github.com/Sh1Yo/request_smuggler
cd request_smuggler
cargo build –release

using cargo install

cargo install request_smuggler –version 0.1.0-alpha.2

Mac

* from source code (rust should be installed)

git clone https://github.com/Sh1Yo/request_smuggler
cd request_smuggler
cargo build –release

using cargo install

cargo install request_smuggler –version 0.1.0-alpha.2

* Windows
* from releases
Download
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

ps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png 35.39µsGroovy1ysoserialhttps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png 150.991µsHibernate1ysoserialhttps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png 789.674µsHibernate2ysoserialhttps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png 168.624µsJBossInterceptors1ysoserialhttps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png 632.581µsJRMPClientysoserialhttps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png 32.967µsJRMPListenerysoserialhttps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png 38.263µsJSON1ysoserialhttps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png 2.157225msJavassistWeld1ysoserialhttps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png 468.596µsJdk7u21ysoserialhttps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png 355.01µsJython1ysoserialhttps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png 216.862µsMozillaRhino1ysoserialhttps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png 1.775193msMozillaRhino2ysoserialhttps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png 409.124µsMyfaces1ysoserialhttps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png 22.997µsMyfaces2ysoserialhttps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png 38.131µsROMEysoserialhttps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png 485.804µsSpring1ysoserialhttps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png 797.469µsSpring2ysoserialhttps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png 358.041µsURLDNSysoserialhttps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png 21.502µsVaadin1ysoserialhttps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png 438.729µsWicket1ysoserialhttps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png 23.509µsJDK8u20*pwntesterhttps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png 529.3µs
Notice: For parsing JDK8u20 payload, you should add --jdk8u20flag to dumpcommand. As the payload is not a valid serialized data stream, it’s necessary to tell ZKar patches the data through this flag. Download
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

My New Discovery In Oracle E-Business Login Panel That Allowed To Access For All Employees…
https://orwaatyat.medium.com/my-new-discovery-in-oracle-e-business-login-panel-that-allowed-to-access-for-all-employees-ed0ec4cad7ac?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hay Hunters , Hello Infosec CommunityContinue reading on Medium » (https://orwaatyat.medium.com/my-new-discovery-in-oracle-e-business-login-panel-that-allowed-to-access-for-all-employees-ed0ec4cad7ac?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

My New Discovery In Oracle E-Business Login Panel That Allowed To Access For All Employees…

Hay Hunters , Hello Infosec CommunityContinue reading on Medium »
Read more...

Dark Reading: Attacks/Breaches
How to Turn a Coke Can Into an Eavesdropping Device

Cyber-researchers are testing the bounds of optical attacks with a technique that allows attackers to recover voice audio from meetings if there are shiny, lightweight objects nearby.