Kali Linux Tutorials
Cloak : A Censorship Circumvention Tool To Evade Detection By Authoritarian State Adversaries

Cloak is a pluggable transport that enhances traditional proxy tools like OpenVPN to evade sophisticated censorship and data discrimination.

Cloak is not a standalone proxy program. Rather, it works by masquerading proxied traffic as normal web browsing activities. In contrast to traditional tools which have very prominent traffic fingerprints and can be blocked by simple filtering rules, it’s very difficult to precisely target Cloak with little false positives. This increases the collateral damage to censorship actions as attempts to block Cloak could also damage services the censor state relies on.

To any third party observer, a host running Cloak server is indistinguishable from an innocent web server. Both while passively observing traffic flow to and from the server, as well as while actively probing the behaviours of a Cloak server. This is achieved through the use a series of cryptographic steganography techniques.

Cloak can be used in conjunction with any proxy program that tunnels traffic through TCP or UDP, such as Shadowsocks, OpenVPN and Tor. Multiple proxy servers can be running on the same server host and Cloak server will act as a reverse proxy, bridging clients with their desired proxy end.

Cloak multiplexes traffic through multiple underlying TCP connections which reduces head-of-line blocking and eliminates TCP handshake overhead. This also makes the traffic pattern more similar to real websites.

Cloak provides multi-user support, allowing multiple clients to connect to the proxy server on the same port (443 by default). It also provides traffic management features such as usage credit and bandwidth control. This allows a proxy server to serve multiple users even if the underlying proxy software wasn’t designed for multiple users

Cloak also supports tunneling through an intermediary CDN server such as Amazon Cloudfront. Such services are so widely used, attempts to disrupt traffic to them can lead to very high collateral damage for the censor. Buildgit clone https://github.com/cbeuw/Cloak
cd Cloak
go get ./…
make ConfigurationExamples of configuration files can be found under example_configfolder. ServerRedirAddris the redirection address when the incoming traffic is not from a Cloak client. Ideally it should be set to a major website allowed by the censor (e.g. www.bing.com) BindAddris a list of addresses Cloak will bind and listen to (e.g. [":443",":80"]to listen to port 443 and 80 on all interfaces) ProxyBookis an object whose key is the name of the ProxyMethod used on the client-side (case-sensitive). Its value is an array whose first element is the protocol, and the second element is an IP:PORTstring of the upstream proxy server that Cloak will forward the traffic to.

Example:

{
“ProxyBook”: {
“shadowsocks”: [
“tcp”,
“localhost:51443”
],
“openvpn”: [
“tcp”,
“localhost:12345”
]
}
} PrivateKeyis the static curve25519 Diffie-Hellman private key encoded in base64. BypassUIDis a list of UIDs that are authorised without any bandwidth or credit limit restrictions AdminUIDis the UID of the admin user in base64. You can leave this empty if you only ever add users to BypassUID. DatabasePathis the path to userinfo.db, which is used to store user usage information and restrictions. Cloak will create the file automatically if it doesn’t exist. You can leave this empty if you only ever add users to BypassUID. This field also has no effect if AdminUIDisn’t a valid UID or is empty. KeepAliveis the number of seconds to tell the OS to wait after no activity before sending TCP KeepAlive probes to the upstream proxy server. Zero or nega[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Cloak : A Censorship Circumvention Tool To Evade Detection By Authoritarian State Adversaries

___________________________
@hacking_Attack
@Hacking_Video

From Wayback to Account Takeover

Hi, I would like to share how Wayback Machine leads to limited Account Takeover.Continue reading on Medium »
Read more...

From Wayback to Account Takeover
https://medium.com/@mohamedtaha_42562/from-wayback-to-account-takeover-ea7e80600188?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hi, I would like to share how Wayback Machine leads to limited Account Takeover.Continue reading on Medium » (https://medium.com/@mohamedtaha_42562/from-wayback-to-account-takeover-ea7e80600188?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

How I was able to access IBM internal documents
https://medium.com/@mohamedtaha_42562/how-i-was-able-to-access-ibm-internal-documents-a33858387d30?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hi, today I will share how I was able to access internal data of https://weathercommunity.ibm.com using salesforce misconfiguration.Continue reading on Medium » (https://medium.com/@mohamedtaha_42562/how-i-was-able-to-access-ibm-internal-documents-a33858387d30?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking Web3: Introduction and How to Start

Web3 is a newfound technology and it’s claimed that it can greatly increase the security on the websites using it. In fact web3 is a new…Continue reading on Medium »
Read more...

Pentest with MacOS M1
https://www.reddit.com/r/Pentesting/comments/ut5duq/pentest_with_macos_m1/

Hi everyone. I want to know if Macbook Pro M1 works with parallels instead vmware fusion (because M1 compatibility). Always used Windows machines as host and VMWare as virtualizator. Im open to read opinions. Thanks! submitted by /u/pwnhun7 (https://www.reddit.com/user/pwnhun7)
[link] (https://www.reddit.com/r/Pentesting/comments/ut5duq/pentest_with_macos_m1/) [comments] (https://www.reddit.com/r/Pentesting/comments/ut5duq/pentest_with_macos_m1/)

___________________________
@hacking_Attack
@Hacking_Video

Please help me with setting up this VMware
https://www.reddit.com/r/Pentesting/comments/ut6a2n/please_help_me_with_setting_up_this_vmware/

https://youtu.be/qlK174d_uu8?t=1318 I am trying to use this youtube guide on beginner pentesting and in the setup for the VMware there is a file used at 00:21:58 and I have no idea where to get it. I really want to do this, but I need this file to set it up. Please anyone help I have already tried reaching out in their discord but to no avail. submitted by /u/pmmethecarfax (https://www.reddit.com/user/pmmethecarfax)
[link] (https://www.reddit.com/r/Pentesting/comments/ut6a2n/please_help_me_with_setting_up_this_vmware/) [comments] (https://www.reddit.com/r/Pentesting/comments/ut6a2n/please_help_me_with_setting_up_this_vmware/)

___________________________
@hacking_Attack
@Hacking_Video

Anonymous Declares Cyber Warfare In Putin After Ukrainian Invasion
https://www.reddit.com/r/redteamsec/comments/ut5prr/anonymous_declares_cyber_warfare_in_putin_after/

submitted by /u/cybersocdm (https://www.reddit.com/user/cybersocdm)
[link] (https://youtube.com/watch?v=QtUrr3KQBX4&feature=share) [comments] (https://www.reddit.com/r/redteamsec/comments/ut5prr/anonymous_declares_cyber_warfare_in_putin_after/)

___________________________
@hacking_Attack
@Hacking_Video

Rise in XorDdos: A deeper look at the stealthy DDoS malware targeting Linux devices
https://www.reddit.com/r/redteamsec/comments/ut775l/rise_in_xorddos_a_deeper_look_at_the_stealthy/

submitted by /u/SCI_Rusher (https://www.reddit.com/user/SCI_Rusher)
[link] (https://aka.ms/RiseInXorDdos) [comments] (https://www.reddit.com/r/redteamsec/comments/ut775l/rise_in_xorddos_a_deeper_look_at_the_stealthy/)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Phishing Attacks for Initial Access Surged 54% in Q1

For the first time in a year, security incidents involving email compromises surpassed ransomware incidents, a new analysis shows.

Dark Reading: Attacks/Breaches
6 Scary Tactics Used in Mobile App Attacks

Mobile attacks have been going on for many years, but the threat is rapidly evolving as more sophisticated malware families with novel features enter the scene.

Hacking on Medium
Waspada, Group Discord NFT jadi Incaran Hackers!

https://cdn-images-1.medium.com/max/1080/1*SoSnCA_boAwVcp5VQbQ6RQ.png
Peretas telah menargetkan grup Discord Inc. yang membahas token yang tidak dapat dipertukarkan (NFT) dalam upaya membuat pengguna mengklik…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Cyber Apocalypse CTF 2022 — HackTheBox

https://cdn-images-1.medium.com/max/1200/0*pCzUXZXZcLlwKo3d.jpg
Writeup 01: Web Challenges

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video