Dark Reading: Attacks/Breaches
You Can't Opt Out of Citizen Development

To see why low-code/no-code is inevitable, we need to first understand how it finds its way into the enterprise.

Dark Reading: Attacks/Breaches
Open Source Security Gets $150M Boost From Industry Heavy Hitters

Maintainers of open source software (OSS) will gain additional security tools for their own projects, while the developers who use OSS — and about 97% of software does — will gain more data on security.

Dark Reading: Attacks/Breaches
iPhones Open to Attack Even When Off, Researchers Say

Wireless chips that run when the iPhone iOS is shut down can be exploited.

___________________________
@hacking_Attack
@Hacking_Video

The Bucket’s Got a Hole in it
https://medium.com/@manikesh-singh/the-buckets-got-a-hole-in-it-343b676e23d4?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

IntroductionContinue reading on Medium » (https://medium.com/@manikesh-singh/the-buckets-got-a-hole-in-it-343b676e23d4?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
OSCP Prep New Exam 2022

https://cdn-images-1.medium.com/max/600/1*nzBpBT8AobwgMiW3giZCcw.png
I recently received an email from a student looking to take their OSCP exam this coming July and was searching for the best prep tips I…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The Bucket’s Got a Hole in it

https://cdn-images-1.medium.com/max/600/1*Hst_FCFvnepGF_iIJUc20Q.png
Introduction

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Beginner Guide To Getting Into Cybersecurity

https://cdn-images-1.medium.com/max/740/1*xup4l8oyk9bjL5nP17mi3g.png
A while ago, a local Google Developer Students’ Club invited me to speak about the beginner’s journey into cybersecurity.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Investigadores advierten sobre el servicio de malware “Eternity Project” que se vende a través de…

https://cdn-images-1.medium.com/max/1591/0*G0wL6fvvCZZQSXym
PUBLICADO EN 16 MAYO, 2022POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

BirDuster - A Multi Threaded Python Script Designed To Brute Force Directories And Files Names On Webservers
http://www.kitploit.com/2022/05/birduster-multi-threaded-python-script.html

___________________________
@hacking_Attack
@Hacking_Video

BirDuster is a Python based knockoff of the original DirBuster. BirDuster is a multi threaded Python application designed to brute force (https://www.kitploit.com/search/label/Brute%20Force) directories and files names on web/application servers. Often is the case now of what looks like a web server in a state of default installation is actually not, and has pages and applications hidden (https://www.kitploit.com/search/label/Hidden) within.
Installation Use PIP: pip3 install --user BirDuster Clone source: git clone https://www.github.com/ytisf/BirDuster
cd BirDuster
pip3 install --user -r requirements.txt
python3 BirDuster.py --help Usage BirDuster has the following flags and options (which you can see with the -h flag): -h/--help: Show help and exit. -v,-vv,-vvv/--verbosity: Verbosity level. -p/--port: Port to use while dirbusting. Default 80/443. -P/--pfile: If you want to test several ports just write them to a file with newlines. -t/--threads: Amount of concurrent threads. Default is 15. -o/--output: Output CSV of responses. Default is domain_output.csv. -l/--dlist: Directory (https://www.kitploit.com/search/label/Directory) list file. Default is dir_list.txt. -w/--writereponse: Will write HTTP/S responses to files. Default is False. -i/--ignorecertificate: Ignore SSL certificate errors. Default is False. -u/--useragent: User-Agent to use. Default is random user-agent. --ssl: Use SSL or not. -i flag will automatically turn on SSL. --timeout: Change default socket (https://www.kitploit.com/search/label/Socket) timeout. Default is 3 seconds. usage: dirbus.py [-h] [-v] [-p PORT] [-P PFILE] [-t THREADS] [-o OUTPUT]
[-l DLIST] [-w] [-i] [-u USERAGENT] [--ssl]
[--timeout TIMEOUT]
domain

positional arguments:
domain domain or host to buster

Download BirDuster (https://github.com/ytisf/BirDuster)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
what advice would you give to someone who is new and just starting to learn how to properly hunt for bugs and do bounties?

As the title says, what advice would you give to someone who is new and just starting to learn how to properly hunt for bugs and do bounties? Perhaps something you may have learned in hindsight.

submitted by /u/Repulsive_Problem272
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
(Unpopular opinion?) How do you avoid burnout when learning?

A little backstory:

Switching careers from oil/gas to infosec. 34 yo, no degree.

Most likely I’m doing it wrong. But I started with TryHackMe. Did presecurity, started Complete Beginner path and switched to hackthebox since job listings keep mentioning HTB profiles etc. From there I started the “Starting point”, and kept seeing so many ads about their HTB Academy. Started that and I love it. The gamification is awesome. However, reading isn’t necessarily the best method of learning for me.

So my routine is work through a module - try a box on HTB. Fail on the box because I have no idea what to do next. (Disclaimer: I’ve read comments on how much “fundamental IT topics” mean, so I’ve mostly done the General topics and nmap and web proxies is the most offensive topics I’ve dabbled with so far) And since I know I basically have to learn everything about everything I still find motivation cause it’s Hella-Fun!

But not knowing programming that much, and no real attacks for that matter other than trying some ZAP scans on a website I still try a box every now and then and I also joined my first CTF this weekend. It is not going well. I decided to try cryptography since I find it interesting, but hard!

This made me deviate onto a site called cryptohack so I tried that, but there is no real teaching there. So I tried YT and how someone else does crypto-challenges. This made me make some small python scripts. Which is awesome, but it got hard real fast.

I don’t mind doing all this, and I learn something new every day. But with failure after failure I do get a bit discouraged.

Is it wrong to try stuff before I have more knowledge?

How do people get over that first steep hill before they actually find a flag?

Am I doing too much at the same time? THM, HTB, HTBacademy, CTFs.

I recently saw TCM had video courses which I think I learn more from than just reading(since everything is so new to me) and wonder if I should pause the other stuff and do a course from him first?

Also! This should be a separate post: In which job/position do you find fun? Meaning pentesting/red team/blue team/purple team in a consulting company, internal security for your own company and other roles? What are the pros and cons?

I have so many questions but will keep it short.

submitted by /u/Zozi-_-
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Could someone spoof my IP and commit fraud?

So, I just had the most terrifying experience. Two FBI agents came to my apartment and said that someone was using my IP (and asked if it was me) to commit fraud with Economic Impact Disaster Loans (EIDL). Whether you believe me or not, it was definitely not me.

How easy would it be for someone to take my IP, spoof it (hopefully this is the right terminology) and use it commit financial fraud? I know I didn't do anything, but my anxiety is through the roof. I've definitely visited some shady streaming sites (I need my shows), but my malware/virus scanners aren't detecting anything weird on my computer.

submitted by /u/Rainy_Day_Archivist
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Trying to gain Internet access at work - Fully blocked

submitted by /u/Temporary-Bit-5448
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video