will authorize me. Custom domainssish supports allowing users to bring custom domains to the service, but SSH key auth is required to be enabled. To use this feature, you must setup TXT and CNAME/A records for the domain/subdomain you would like to use for your forwarded connection. The CNAME/A record must point to the domain or IP that is hosting sish. The TXT record must be be a key=valstring that looks like: sish=SSHKEYFINGERPRINT Where SSHKEYFINGERPRINTis the fingerprint of the key used for logging into the server. You can set multiple TXT records and sish will check all of them to ensure at least one is a match. You can retrieve your key fingerprint by running: sish=SSHKEYFINGERPRINT If you trust the users connecting to sish and would like to allow any domain to be used with sish (bypassing verification), there are a few added flags to aid in this. This is especially useful when adding multiple wildcard certificates to sish in order to not need to automatically provision Let's Encrypt certs. To disable verfication, set --bind-any-host=true, which will allow and subdomain/domain combination to be used. To only allow subdomains of a certain subset of domains, you can set --bind-hoststo a comma separated list of domains that are allowed to be bound.

To add certficates for sish to use, configure the --https-certificate-directoryflag to point to a dir that is accessible by sish. In the directory, sish will look for a combination of files that look like name.crtand name.key. namecan be arbitrary in either case, it just needs to be unique to the cert and key pair to allow them to be loaded into sish. Load balancingsish can load balance any type of forwarded connection, but this needs to be enabled when starting sish using the --http-load-balancer, --tcp-load-balancer, and --alias-load-balancerflags. Let's say you have a few edge nodes (raspberry pis) that are running a service internally but you want to be able to balance load across these devices from the outside world. By enabling load balancing in sish, this happens automatically when a device with the same forwarded TCP port, alias, or HTTP subdomain connects to sish. Connections will then be evenly distributed to whatever nodes are connected to sish that match the forwarded connection. Whitelisting IPsWhitelisting IP ranges or countries is also possible. Whole CIDR ranges can be specified with the --whitelisted-ipsoption that accepts a comma-separated string like "192.30.252.0/22,185.199.108.0/22". If you want to whitelist a single IP, use the /32range.

To whitelist countries, use --whitelisted-countrieswith a comma-separated string of countries in ISO format (for example, "pt" for Portugal). You'll also need to set --geodbto true. DNS SetupTo use sish, you need to add a wildcard DNS record that is used for multiplexed subdomains. Adding an Arecord with *as the subdomain to the IP address of your server is the simplest way to achieve this configuration. Demo - At this time, the demo instance has been set to require auth due to abuseThere is a demo service (and my private instance) currently running on ssi.shthat doesn't require any authentication. This service provides default logging (errors, connection IP/username, and pubkey fingerprint). I do not log any of the password authentication data or the data sent within the service/tunnels. My deploy uses the exact deploy steps that are listed above. This instance is for testing and educational purposes only. You can deploy this extremely easily on any host (Google Cloud Platform provides an always-free instance that this should run perfectly on). If the service begins to accrue a [...]

Deep Web
I do not understand

How can owners of big markets not buying their way out of jail? Since they got millions of dollars? And we al know there is a lot of manipulation and corruption.

submitted by /u/Peort
[link] [comments]

$100 My First Bug Bounty for DOS

Hello Amazing Hackers,Continue reading on Medium »
Read more...

$100 My First Bug Bounty for DOS
https://xcheater.medium.com/100-my-first-bug-bounty-for-dos-f9b507fc0c02?source=rss------bug_bounty-5

Hello Amazing Hackers,Continue reading on Medium » (https://xcheater.medium.com/100-my-first-bug-bounty-for-dos-f9b507fc0c02?source=rss------bug_bounty-5)

Deep Web
Has anyone ever used the deepweb to find cheap flights?

Has anyone ever used the deepweb to find cheap flights? I don't really care if the options are limited. If so, I'm curious how so or if theres any tips or tricks.

submitted by /u/ABraveLittle_Toaster
[link] [comments]

hacking: security in practice
Your favorite comedic hacking team finally takes on their evil boss the Curator in Ctrl + Alt + Underground 1.07

https://external-preview.redd.it/MWvlMe240ylCd-Ss0JKdUweGCUtk3DE-S7RCJsf6dhU.jpg?width=320&crop=smart&auto=webp&s=296344143b7ba55834e4df96044e72593368bfba submitted by /u/YoungGoosey
[link] [comments]

hacking: security in practice
New Zero-Day Vulnerability Found in Google Chrome, Microsoft Edge

https://external-preview.redd.it/IsXUgHzSnD7X85OKhg_-L9g9wIVDtGTiRhGVxsAOSbw.jpg?width=640&crop=smart&auto=webp&s=f38f70b3fafd3be746f0e280fd384866ad1e5dff submitted by /u/fatrat957
[link] [comments]

hacking: security in practice
How do you read a .txt file in the same directory as the program using buffer overflow and return oriented programming?

The program in question is a simple c program that is susceptible to the buffer overflow attack, uses fixed addresses and has nx protection. I am running the program on x86-64 linux. The program reads from another file and the payload will be loaded from that file.

I first tried run a return to shell exploit which worked, but the requirements was not to use external programs like cat. addresses I loaded for shell: https://imgur.com/a/wvkTiMW

Now the problem is that I tried to run all the local instructions instead like fopen, fread and puts together with all the rop gadgets to set the values of the arguments but fread does not write anything into the target address for puts to print. Stack: https://imgur.com/a/SZjfWcy

I would like to know if there is a better way to read and print directly from the file instead.

submitted by /u/lesspylons
[link] [comments]

Hacking on Medium
The Great Bitcoin & Crypto Heists: A History

https://cdn-images-1.medium.com/max/2600/1*A4lDa6jM2H51smd3LQ0DTQ.jpeg
(And an Alternative)

Continue reading on Medium »

Unauthorized access to admin setpassword page BY bypass 403 Forbidden

Hi, everyoneContinue reading on Medium »
Read more...

Unauthorized access to admin setpassword page BY bypass 403 Forbidden
https://notifybugme.medium.com/unauthorized-access-to-admin-setpassword-page-by-bypass-403-forbidden-f10bbb92ab35?source=rss------bug_bounty-5

Hi, everyoneContinue reading on Medium » (https://notifybugme.medium.com/unauthorized-access-to-admin-setpassword-page-by-bypass-403-forbidden-f10bbb92ab35?source=rss------bug_bounty-5)

Deep Web
Weird encounter on Omegle

I recently added the Deep Web tag when I decided to hop on Omegle. Came across a couple people that would immediately disconnect after saying “strg”. No clue what that means! One guy even said “strg not going first because scammers.” I tried looking it up but I couldn’t find anything that would fit this context. Help?

submitted by /u/thegrimweeper81
[link] [comments]

hacking: security in practice
is there anyway to grab an ip off of twitter?

There is a small group of pedophiles and groomers harassing me and when i report the twitter does nothing about it, and whenever i block them they just make new accounts. i've even tried exposing them twice now and. they still wont stop.this is my last resort. send there location to to them and hope that they will piss off after that. or even better yet get them arrested by the FBI.

submitted by /u/BongFullofcatcum
[link] [comments]