Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
TryHackMe — M4tr1x: Exit Denied
https://cdn-images-1.medium.com/max/723/1*hOAKKKaLzKB-J8IBb3J7Ag.png
M4tr1x: Exit Denied
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
TryHackMe — M4tr1x: Exit Denied
https://cdn-images-1.medium.com/max/723/1*hOAKKKaLzKB-J8IBb3J7Ag.png
M4tr1x: Exit Denied
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
TryHackMe — M4tr1x: Exit Denied
M4tr1x: Exit Denied
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
If you see this PowerShell Commands on your pc, sorry you probably got hacked
https://cdn-images-1.medium.com/max/700/1*2gKlHxeAwdoqe7BCbMtjJQ.jpeg
If you suspicious to hacked your computer and you do not have any experience about cybersecurity field, you are correct place. But since…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
If you see this PowerShell Commands on your pc, sorry you probably got hacked
https://cdn-images-1.medium.com/max/700/1*2gKlHxeAwdoqe7BCbMtjJQ.jpeg
If you suspicious to hacked your computer and you do not have any experience about cybersecurity field, you are correct place. But since…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
If you see this PowerShell Commands on your pc, sorry you probably got hacked
If you suspicious to hacked your computer and you do not have any experience about cybersecurity field, you are correct place. But since…
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
RedTeam Physical Tools
https://cdn-images-1.medium.com/max/1425/1*JD4sprrqiuHu-xMKAgS3FA.jpeg
Red Team Toolkit — A curated list of tools that are commonly used in the field for Physical Security, Red Teaming, and Tactical Covert…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
RedTeam Physical Tools
https://cdn-images-1.medium.com/max/1425/1*JD4sprrqiuHu-xMKAgS3FA.jpeg
Red Team Toolkit — A curated list of tools that are commonly used in the field for Physical Security, Red Teaming, and Tactical Covert…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
RedTeam Physical Tools
Red Team Toolkit — A curated list of tools that are commonly used in the field for Physical Security, Red Teaming, and Tactical Covert…
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Solidity Smart Contract Security: Preventing Reentrancy Attacks
https://cdn-images-1.medium.com/max/2600/0*mKIQvqjebXngTZHW
Checks, Effects, and Interactions (CEI), Mutex, Pull Payments, and Gas Limits are all effective techniques to prevent reentrancy attacks.
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Solidity Smart Contract Security: Preventing Reentrancy Attacks
https://cdn-images-1.medium.com/max/2600/0*mKIQvqjebXngTZHW
Checks, Effects, and Interactions (CEI), Mutex, Pull Payments, and Gas Limits are all effective techniques to prevent reentrancy attacks.
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Solidity Smart Contract Security: Preventing Reentrancy Attacks
Checks, Effects, and Interactions (CEI), Mutex, Pull Payments, and Gas Limits are all effective techniques to prevent reentrancy attacks.
hacking: security in practice
XSS works in burp suite but not in browser
I found a reflected XSS vulnerability in Burp on a site I was tasked with auditing. The javascript payload executes when I send the request using burp suite (the URL is not encoded before it is sent), but it is not executed when I execute the request in-browser. Not even when I capture the url-encoded request and send it using burp. Is this able to be exploited and how?
submitted by /u/dominate1090
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
XSS works in burp suite but not in browser
I found a reflected XSS vulnerability in Burp on a site I was tasked with auditing. The javascript payload executes when I send the request using burp suite (the URL is not encoded before it is sent), but it is not executed when I execute the request in-browser. Not even when I capture the url-encoded request and send it using burp. Is this able to be exploited and how?
submitted by /u/dominate1090
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Reddit
From the hacking community on Reddit
Explore this post and more from the hacking community
hacking: security in practice
fuck fuck fuck
How do i stop the urge to hack people. I need real people to train i can't keep using my home network
submitted by /u/osint_god
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
fuck fuck fuck
How do i stop the urge to hack people. I need real people to train i can't keep using my home network
submitted by /u/osint_god
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
fuck fuck fuck
How do i stop the urge to hack people. I need real people to train i can't keep using my home network
hacking: security in practice
Accessing Internet during Internet Shutdown in a country?
Can you access internet in any way if the country has imposed internet shutdown? Using satellite signals or something?
submitted by /u/Cheemashyper
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Accessing Internet during Internet Shutdown in a country?
Can you access internet in any way if the country has imposed internet shutdown? Using satellite signals or something?
submitted by /u/Cheemashyper
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Accessing Internet during Internet Shutdown in a country?
Can you access internet in any way if the country has imposed internet shutdown? Using satellite signals or something?
Hacking Articles Tips Tricks Videos Tutorials
Photo
Black Hat Ethical Hacking
Malware Builder Leverages Discord Webhooks
Malware Builder Leverages Discord WebhooksPost Views: 8
Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes
Researchers discovered a simple malware builder designed to steal credentials, then pinging them to Discord webhooks.
On April 23rd, 2022, a Discord user with the handle “Portu” began advertising a new password-stealing malware builder.
Malware builders are programs which so-called script kiddie hackers can craft their own executables on top of. Script kiddie is cybersecurity parlance for a novice hacker who uses a preexisting code to slightly modify it for their own nefarious purposes.
Four days later, threat analysts from Uptycs discovered the first sample of a Portu-inspired malware sample in the wild researchers dubbed “KurayStealer.” According to researchers, the malware has been used to target Discord users. https://media.threatpost.com/wp-content/uploads/sites/103/2022/05/12070343/Discord-Malware-Author-300x154.png How KurayStealer WorksThe author behind KurayStealer has clearly taken inspiration – and code – from those other attacks. “We have seen several other similar versions floating around in public repositories like github,” the researchers noted, concluding that “the KurayStelaer builder has several components of different password stealers.”
When it’s first executed, KurayStealer runs a check to determine if the malicious user is running the free or “VIP” (paid) version.
Next, it attempts to replace the string “api/webhooks” with “Kisses” in BetterDiscord – an extended version of the Discord app, with greater functionality for developers. If this action is successful, the hacker can undermine the app in order to set up webhooks.
See Also: Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png Webhooks are a mechanism by which webpages and applications can send real-time data to one another over HTTP. They’re like APIs, the key difference being that webhooks send information automatically, without the need for a request from the receiver.
With webhooks in place, the program takes a screenshot and grabs the geo-location of the target machine. Then it begins credential hunting: probing for passwords, tokens, IP addresses and more from Discord, Microsoft Edge, Chrome, and 18 other apps. Any data scoured in this process funnels back to the attacker via the webhooks. What We Know of the AuthorScript kiddies are rarely subtle.
Within KurayStealer’s code is a reference to who wrote it: “Suleymansha & Portu,” and an invite to a Discord channel run by the user “Portu#0022.” Portu#0022’s profile contains a link to their profile on Shoppy – an ecommerce platform – with samples of other malicious programs. It also points to their YouTube channel, which used to have a video up that demonstrated how to use KurayStealer. The channel is barren now, but for a cartoon profile picture and an indication that Portu is from Spain.
See Also: Attackers Use Event Logs to Hide Fileless Malware On April 26th, Portu announced they were working on a new ransomware program. “Based on the announcement and the observations,” the researchers concluded, “we believe that the authors might come up with newer versions of password stealers and other malware.”
“Our research on KurayStealer backed with OSINT highlights the rise in prevalence of password stealers using Discord tokens as a C2 for harvesting the victims’ credentials. Enterprises must have tight security controls and multi-layered visibility and security solutions to identify and detect such attacks.”
See Also: Offensive Security [...]
___________________________
@hacking_Attack
@Hacking_Video
Malware Builder Leverages Discord Webhooks
Malware Builder Leverages Discord WebhooksPost Views: 8
Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes
Researchers discovered a simple malware builder designed to steal credentials, then pinging them to Discord webhooks.
On April 23rd, 2022, a Discord user with the handle “Portu” began advertising a new password-stealing malware builder.
Malware builders are programs which so-called script kiddie hackers can craft their own executables on top of. Script kiddie is cybersecurity parlance for a novice hacker who uses a preexisting code to slightly modify it for their own nefarious purposes.
Four days later, threat analysts from Uptycs discovered the first sample of a Portu-inspired malware sample in the wild researchers dubbed “KurayStealer.” According to researchers, the malware has been used to target Discord users. https://media.threatpost.com/wp-content/uploads/sites/103/2022/05/12070343/Discord-Malware-Author-300x154.png How KurayStealer WorksThe author behind KurayStealer has clearly taken inspiration – and code – from those other attacks. “We have seen several other similar versions floating around in public repositories like github,” the researchers noted, concluding that “the KurayStelaer builder has several components of different password stealers.”
When it’s first executed, KurayStealer runs a check to determine if the malicious user is running the free or “VIP” (paid) version.
Next, it attempts to replace the string “api/webhooks” with “Kisses” in BetterDiscord – an extended version of the Discord app, with greater functionality for developers. If this action is successful, the hacker can undermine the app in order to set up webhooks.
See Also: Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png Webhooks are a mechanism by which webpages and applications can send real-time data to one another over HTTP. They’re like APIs, the key difference being that webhooks send information automatically, without the need for a request from the receiver.
With webhooks in place, the program takes a screenshot and grabs the geo-location of the target machine. Then it begins credential hunting: probing for passwords, tokens, IP addresses and more from Discord, Microsoft Edge, Chrome, and 18 other apps. Any data scoured in this process funnels back to the attacker via the webhooks. What We Know of the AuthorScript kiddies are rarely subtle.
Within KurayStealer’s code is a reference to who wrote it: “Suleymansha & Portu,” and an invite to a Discord channel run by the user “Portu#0022.” Portu#0022’s profile contains a link to their profile on Shoppy – an ecommerce platform – with samples of other malicious programs. It also points to their YouTube channel, which used to have a video up that demonstrated how to use KurayStealer. The channel is barren now, but for a cartoon profile picture and an indication that Portu is from Spain.
See Also: Attackers Use Event Logs to Hide Fileless Malware On April 26th, Portu announced they were working on a new ransomware program. “Based on the announcement and the observations,” the researchers concluded, “we believe that the authors might come up with newer versions of password stealers and other malware.”
“Our research on KurayStealer backed with OSINT highlights the rise in prevalence of password stealers using Discord tokens as a C2 for harvesting the victims’ credentials. Enterprises must have tight security controls and multi-layered visibility and security solutions to identify and detect such attacks.”
See Also: Offensive Security [...]
___________________________
@hacking_Attack
@Hacking_Video
Black Hat Ethical Hacking
Malware Builder Leverages Discord Webhooks | Black Hat Ethical Hacking
Researchers discovered a simple malware builder designed to steal credentials, then pinging them to Discord webhooks.
Hacking Articles Tips Tricks Videos Tutorials
Black Hat Ethical Hacking Malware Builder Leverages Discord Webhooks Malware Builder Leverages Discord WebhooksPost Views: 8 Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png Subscribe to Patreon to watch this…
Tool: malicious-pdf Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?
If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
See Also: Write up: Find hidden and encrypted secrets from any website Source: threatpost.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/backdoor-90x90.jpg BPFdoor: Stealthy Linux malware bypasses firewalls for remote access3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/microsoft-exploit-90x90.jpg Actively Exploited Zero-Day Bug Patched by Microsoft4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/maxresdefault-90x90.jpg UK government blocked four times as many cyber-scams in 20215 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/microsoft-azure-cloud-90x90.jpg Microsoft releases fixes for Azure flaw allowing RCE attacks6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/f5-big-ip-hacking-90x90.jpg Exploits created for critical F5 BIG-IP flaw, install patch immediately7 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/Fileless-Malware-660x400-1-90x90.jpg Attackers Use Event Logs to Hide Fileless Malware1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/poison-1481596_1920-90x90.jpg Zero-day bug in uClibc library could leave IoT devices vulnerable to DNS poisoning attacks2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/1ed10a11bb45c273cebc7b8cb492979249bcdcec-90x90.png Security bug in VMWare Workspace ONE could allow access to internal, cloud networks2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/ezgif.com-gif-maker-2-90x90.jpg New PyScript project lets you run Python programs in the browser2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/1614322146_pexels-kevin-ku-577585-scaled-90x90.jpg Open source ‘Package Analysis’ tool finds malicious npm, PyPI packages2 weeks ago
The post Malware Builder Leverages Discord Webhooks first appeared on Black Hat Ethical Hacking.
___________________________
@hacking_Attack
@Hacking_Video
If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
See Also: Write up: Find hidden and encrypted secrets from any website Source: threatpost.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/backdoor-90x90.jpg BPFdoor: Stealthy Linux malware bypasses firewalls for remote access3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/microsoft-exploit-90x90.jpg Actively Exploited Zero-Day Bug Patched by Microsoft4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/maxresdefault-90x90.jpg UK government blocked four times as many cyber-scams in 20215 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/microsoft-azure-cloud-90x90.jpg Microsoft releases fixes for Azure flaw allowing RCE attacks6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/f5-big-ip-hacking-90x90.jpg Exploits created for critical F5 BIG-IP flaw, install patch immediately7 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/Fileless-Malware-660x400-1-90x90.jpg Attackers Use Event Logs to Hide Fileless Malware1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/poison-1481596_1920-90x90.jpg Zero-day bug in uClibc library could leave IoT devices vulnerable to DNS poisoning attacks2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/1ed10a11bb45c273cebc7b8cb492979249bcdcec-90x90.png Security bug in VMWare Workspace ONE could allow access to internal, cloud networks2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/ezgif.com-gif-maker-2-90x90.jpg New PyScript project lets you run Python programs in the browser2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/1614322146_pexels-kevin-ku-577585-scaled-90x90.jpg Open source ‘Package Analysis’ tool finds malicious npm, PyPI packages2 weeks ago
The post Malware Builder Leverages Discord Webhooks first appeared on Black Hat Ethical Hacking.
___________________________
@hacking_Attack
@Hacking_Video
Bounty Hacker Walkthrough — Try Hack Me
https://medium.com/@kor3s/bounty-hacker-walkthrough-try-hack-me-4188bed9cae4?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://medium.com/@kor3s/bounty-hacker-walkthrough-try-hack-me-4188bed9cae4?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
Bounty Hacker Walkthrough — Try Hack Me
You were boasting on and on about your elite hacker skills in the bar and a few Bounty Hunters decided they'd take you up on claims! Prove…
You were boasting on and on about your elite hacker skills in the bar and a few Bounty Hunters decided they'd take you up on claims! Prove…Continue reading on Medium » (https://medium.com/@kor3s/bounty-hacker-walkthrough-try-hack-me-4188bed9cae4?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
Bounty Hacker Walkthrough — Try Hack Me
You were boasting on and on about your elite hacker skills in the bar and a few Bounty Hunters decided they'd take you up on claims! Prove…
Bounty Hacker Walkthrough — Try Hack Me
You were boasting on and on about your elite hacker skills in the bar and a few Bounty Hunters decided they'd take you up on claims! Prove…Continue reading on Medium »
Read more...
You were boasting on and on about your elite hacker skills in the bar and a few Bounty Hunters decided they'd take you up on claims! Prove…Continue reading on Medium »
Read more...
Module-2 | Introduction -Pentesting & Bypassing AWS/Azure/GCP Cloud WAF Fun & Profit
https://justm0rph3u5.medium.com/module-2-introduction-pentesting-bypassing-aws-azure-gcp-cloud-waf-fun-profit-cfcfd55454f6?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://justm0rph3u5.medium.com/module-2-introduction-pentesting-bypassing-aws-azure-gcp-cloud-waf-fun-profit-cfcfd55454f6?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
Module-2 | Introduction -Pentesting & Bypassing AWS/Azure/GCP Cloud WAF Fun & Profit
Q. What is Core Rule Set & why it is utilized by all the cloud WAFs? A. We will try to understand more about the core rule set along with…