Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials Covert-Control : Google Drive, OneDrive And Youtube As Covert-Channels – Control Systems Remotely By Uploading Files To Google Drive, OneDrive, Youtube Or Telegram Covert-Control systems remotely by uploading files to Google Drive, OneDrive…
6v1JBNHF7ZDeKXgeJWeSsGqDFomNal3Avs_ZkElM6OSuGYkDGSxpF7MRGTwIEWhs2PvYKG8u4IY64BLmNVJbmqg126yR00dj2PyBYF7NlYwCreHd5GG8ZSIc7Lc0NHXlTI2k_ADNI8azm7R-uQIre8=s376
After finding there is a new file uploaded to the folder, it is downloaded, processed and the commands are executed:
https://blogger.googleusercontent.com/img/a/AVvXsEhsOuOHIKhkahz-AJ5a6F8uvfW2baUemeOgtonRJc1v5c_NEe4z4aZBxnwW6crKIXRtzIHR69tKyRfB86rTzlsmo9xq_cu1xhNZlzaYGFc5caGIGC8YNsMp8ahO6EH1nfJNrRjtFfabGzl5kVArSvEQjJawiDDfvIB_9Fq0dbH6pc9EpRCpkkk8OJ44=s567
Onedrive
It allows to execute commands uploading text files, images, audio and videos, unencrypted or encrypted with AES. The optional input argument is the public folder url, which can be also configured in config.py:
python3 covert-onedrive.py [FOLDER_URL]
The listener will check the OneDrive folder every 300 seconds by default (this can be updated in config.py). In this case an audio, “audio_encrypted.wav”, is uploaded with the command encrypted with AES:
https://blogger.googleusercontent.com/img/a/AVvXsEgKKyiPs1qyXjJ9F6eiuflhcdBoLMvdCVv9EbYl-0sl8AGGfTwYNBUKHswlMb0nMu-0HcgcQj_0_oXQ3mWogRwjfJs9e4pjddn_iwcQZJwAFDAC10JltaCDfar3Jj8ID6wuPU0_HFotbJh2F4po37r9JW7-G-Uk6q1lqYYWm7JK2j77dpVO8UnLs47O=s230
After finding there is a new file uploaded to the folder, it is downloaded, processed and the commands are executed:
https://blogger.googleusercontent.com/img/a/AVvXsEiFWipP0330C1-vfJAbjmIuUyGCeQA-SuPh1TLTpFrvMss2fKvJ-PBcxmzPrVr1UjKsu3LYCA5I6WreBSjnQNY5ZxjeV5fSjZLnQezc98PN5B9UHsuewtVLmjW3Iz56BNl-zpwAX1TE9xeQapnMCmUoqePR2XOduNMOaNHgABJsNwRNJ6B-TJzJeRs5=s605
NOTE: This will only work if you do not delete any file in the folder, if you do it you must create a new one. It could be possible to implement it to work even after deleting files, but it would be necessary to create many requests and would be less stealthy. Youtube
It allows to execute commands uploading videos, unencrypted or encrypted with AES. The optional input arguments are the Youtube channel ID to monitor and the API key, which can be also configured in config.py:
python3 covert-youtube.py [CHANNEL_ID] [API_KEY]
The listener will check the Youtube channel every 300 seconds by default (this can be updated in config.py). First the video is uploaded:
https://blogger.googleusercontent.com/img/a/AVvXsEgVTIoZe4SSgWs-qxCQsipdPVG2QywLg-E9Jq-73XJQQjCKQq3c_64Tga8EhH-95rb02-UfCmNKgSRJBfL9Wo8zLpb_LrtvTijnikOT4EcXJnIs66wsP8A6P5V9D1bLhffYPKjk2bPt_eA_6ayXodnLiwy791JawsRINUHvcTR1jBArUibWJBuXAgfb=s640
After finding there is a new video in the channel, it is downloaded, processed and the commands are executed:
https://blogger.googleusercontent.com/img/a/AVvXsEgabeaMu4DUfInuM5x5acxzrfau9oIFqSVcTv0Vh5h2cGBwwVL0hb2zxjmc_J-oNNDysKYY-vM7E72wFV103upM0f6aOXkkyRaeXB2SDjPifmx5NRKF4sBMl5YWTUX7LklxzerJ3JMHcLeKKQZBxjiQyqLZaPLJRJqA5lZDdhAlORwwV1c0DI0GiaDZ=s657
Telegram
Control systems remotely with a Telegram bot. This option does not allow to upload files, but it is possible to send the commands in cleartext (“/cmd”) or encrypted with AES (“/encrypted”). The first optional input argument is the bot token, which can be also configured in config.py; the second one is used to configure a single Telegram user who can send commands to the bot (without “@”):
python3 covert-telegram.py [BOT_TOKEN] [TELEGRAM_USER]
The listener will check the commands in the chat and show the output:
/cmd CLEARTEXT_COMMAND
/encrypted AES_ENCRYPTED_COMMAND
https://blogger.googleusercontent.com/img/a/AVvXsEh7_SVWVNyeyjDVsGhq3iHdElVdakxkYRaTkF0QGiZ15VPVgSeASBdklvFuYDa4V7-LcPiFsa2L-kbDesjClpxaPlVMZdc3-_2fOmTE7e0iBSUX8ufUXN-FsnkUqspj2zo8NtSfKvlpnOa1AbLG5Kxx-uYkKs_FWTU0TEsFfJtfhAgUKU2c4cWWEPdN=s485
Installation
sudo apt install libzbar0
pip install bs4 Pillow opencv-python pyqrcode pypng pyzbar youtube_dl pytesseract python-telegram-bot requests argparse pycryptodome
git clone https://github.com/ricardojoserf/covert-control && cd covert-control/
Creating standalone binaries
pyinstaller –onefile covert-googledrive.py
[...]
___________________________
@hacking_Attack
@Hacking_Video
After finding there is a new file uploaded to the folder, it is downloaded, processed and the commands are executed:
https://blogger.googleusercontent.com/img/a/AVvXsEhsOuOHIKhkahz-AJ5a6F8uvfW2baUemeOgtonRJc1v5c_NEe4z4aZBxnwW6crKIXRtzIHR69tKyRfB86rTzlsmo9xq_cu1xhNZlzaYGFc5caGIGC8YNsMp8ahO6EH1nfJNrRjtFfabGzl5kVArSvEQjJawiDDfvIB_9Fq0dbH6pc9EpRCpkkk8OJ44=s567
Onedrive
It allows to execute commands uploading text files, images, audio and videos, unencrypted or encrypted with AES. The optional input argument is the public folder url, which can be also configured in config.py:
python3 covert-onedrive.py [FOLDER_URL]
The listener will check the OneDrive folder every 300 seconds by default (this can be updated in config.py). In this case an audio, “audio_encrypted.wav”, is uploaded with the command encrypted with AES:
https://blogger.googleusercontent.com/img/a/AVvXsEgKKyiPs1qyXjJ9F6eiuflhcdBoLMvdCVv9EbYl-0sl8AGGfTwYNBUKHswlMb0nMu-0HcgcQj_0_oXQ3mWogRwjfJs9e4pjddn_iwcQZJwAFDAC10JltaCDfar3Jj8ID6wuPU0_HFotbJh2F4po37r9JW7-G-Uk6q1lqYYWm7JK2j77dpVO8UnLs47O=s230
After finding there is a new file uploaded to the folder, it is downloaded, processed and the commands are executed:
https://blogger.googleusercontent.com/img/a/AVvXsEiFWipP0330C1-vfJAbjmIuUyGCeQA-SuPh1TLTpFrvMss2fKvJ-PBcxmzPrVr1UjKsu3LYCA5I6WreBSjnQNY5ZxjeV5fSjZLnQezc98PN5B9UHsuewtVLmjW3Iz56BNl-zpwAX1TE9xeQapnMCmUoqePR2XOduNMOaNHgABJsNwRNJ6B-TJzJeRs5=s605
NOTE: This will only work if you do not delete any file in the folder, if you do it you must create a new one. It could be possible to implement it to work even after deleting files, but it would be necessary to create many requests and would be less stealthy. Youtube
It allows to execute commands uploading videos, unencrypted or encrypted with AES. The optional input arguments are the Youtube channel ID to monitor and the API key, which can be also configured in config.py:
python3 covert-youtube.py [CHANNEL_ID] [API_KEY]
The listener will check the Youtube channel every 300 seconds by default (this can be updated in config.py). First the video is uploaded:
https://blogger.googleusercontent.com/img/a/AVvXsEgVTIoZe4SSgWs-qxCQsipdPVG2QywLg-E9Jq-73XJQQjCKQq3c_64Tga8EhH-95rb02-UfCmNKgSRJBfL9Wo8zLpb_LrtvTijnikOT4EcXJnIs66wsP8A6P5V9D1bLhffYPKjk2bPt_eA_6ayXodnLiwy791JawsRINUHvcTR1jBArUibWJBuXAgfb=s640
After finding there is a new video in the channel, it is downloaded, processed and the commands are executed:
https://blogger.googleusercontent.com/img/a/AVvXsEgabeaMu4DUfInuM5x5acxzrfau9oIFqSVcTv0Vh5h2cGBwwVL0hb2zxjmc_J-oNNDysKYY-vM7E72wFV103upM0f6aOXkkyRaeXB2SDjPifmx5NRKF4sBMl5YWTUX7LklxzerJ3JMHcLeKKQZBxjiQyqLZaPLJRJqA5lZDdhAlORwwV1c0DI0GiaDZ=s657
Telegram
Control systems remotely with a Telegram bot. This option does not allow to upload files, but it is possible to send the commands in cleartext (“/cmd”) or encrypted with AES (“/encrypted”). The first optional input argument is the bot token, which can be also configured in config.py; the second one is used to configure a single Telegram user who can send commands to the bot (without “@”):
python3 covert-telegram.py [BOT_TOKEN] [TELEGRAM_USER]
The listener will check the commands in the chat and show the output:
/cmd CLEARTEXT_COMMAND
/encrypted AES_ENCRYPTED_COMMAND
https://blogger.googleusercontent.com/img/a/AVvXsEh7_SVWVNyeyjDVsGhq3iHdElVdakxkYRaTkF0QGiZ15VPVgSeASBdklvFuYDa4V7-LcPiFsa2L-kbDesjClpxaPlVMZdc3-_2fOmTE7e0iBSUX8ufUXN-FsnkUqspj2zo8NtSfKvlpnOa1AbLG5Kxx-uYkKs_FWTU0TEsFfJtfhAgUKU2c4cWWEPdN=s485
Installation
sudo apt install libzbar0
pip install bs4 Pillow opencv-python pyqrcode pypng pyzbar youtube_dl pytesseract python-telegram-bot requests argparse pycryptodome
git clone https://github.com/ricardojoserf/covert-control && cd covert-control/
Creating standalone binaries
pyinstaller –onefile covert-googledrive.py
[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
provided in templates/; if there is a file templates/FOO.bt, then make FOO-fuzzerwill build a fuzzer. Method 3: Manual steps If the above makemethod does not work, or if you want more control, you may have to proceed manually. Step 1: Compiling Binary Template…
es and back: AFL would mutate decision files, and the program under test would run on the translated binary files. In contrast to mutating binary files directly (as AFL would normally do), this would have the advantage of always having valid inputs – and thus progressing much faster towards coverage. AFL++ Integration
In addition to the format-specific fuzzers, such as
To run AFL++ with FormatFuzzer, just follow the instructions on our modified version of AFL++. We support different fuzzing strategies, including:
* AFL+FFMut: runs AFL++ using FormatFuzzer to provide format-specific smart mutations.
* AFL+FFGen: uses FormatFuzzer as a format-specific generator, while AFL++ mutates its decision seeds. Creating and Customizing Binary Templates
To write your own
In many cases, a template of the format you are looking for (or a similar one) may already exist. Have a look at the 010 editor binary template collection whether there is something that you can use or base your format on.
Note that the
In this section, we discuss some of the ways in which you can customize
For example, for the GIF format, the file templates/gif-orig.bt shows the original binary template, which was only designed for parsing, while the file templates/gif.bt is a modified version which is capable of generating valid GIFs. Comparing the two files, we see that a small number changes was required to achieve this.
If you have created a
The GIF binary template makes use of lookahead functions
By default, our translation procedure
./ffcompile templates/gif.bt gif.cpp
a printed message shows the lookahead functions identified, as well as the mined interesting values:
Finished creating cpp generator.
Lookahead functions found:
ReadUByte
ReadUShort
Mined interesting values:
GlobalColorTableFlag: [‘1’]
LocalColorTableFlag: [‘1’]
ReadUByte: [‘0x3B’, ‘0x2C’]
ReadUShort: [‘0xF921’, ‘0xFE21’, ‘0x0121’, ‘0xFF21’]
Signature: [‘”GIF”‘]
For GIF generation, however, it is better to specify the set of good known values for
const local [...]
___________________________
@hacking_Attack
@Hacking_Video
In addition to the format-specific fuzzers, such as
gif-fuzzer, FormatFuzzer can also be compiled into format-specific shared libraries, such as gif.so(for that, simply run ./build.sh gifor make gif.so). Those shared libraries can be loaded by general-purpose fuzzers, such as AFL++.To run AFL++ with FormatFuzzer, just follow the instructions on our modified version of AFL++. We support different fuzzing strategies, including:
* AFL+FFMut: runs AFL++ using FormatFuzzer to provide format-specific smart mutations.
* AFL+FFGen: uses FormatFuzzer as a format-specific generator, while AFL++ mutates its decision seeds. Creating and Customizing Binary Templates
To write your own
.btbinary templates (and thus create a high-efficiency fuzzer/parser for this format), read the section Introduction to Templates and Scripts from the 010 Editor Manual.In many cases, a template of the format you are looking for (or a similar one) may already exist. Have a look at the 010 editor binary template collection whether there is something that you can use or base your format on.
Note that the
.btfiles provided in the repository generally target parsing files. They can be used for generating files, too; but they often lack exact information which parts of the input are required.In this section, we discuss some of the ways in which you can customize
.btfiles to work well with FormatFuzzer.For example, for the GIF format, the file templates/gif-orig.bt shows the original binary template, which was only designed for parsing, while the file templates/gif.bt is a modified version which is capable of generating valid GIFs. Comparing the two files, we see that a small number changes was required to achieve this.
If you have created a
gif-fuzzer, either by running make gif-fuzzeror by using the ffcompiletool, you have already obtained a C++ file gif.cppwhich contains an implementation of the GIF generator and parser. This is useful to see how the changes you make to the binary template are translated into executable code. More details on the C++ code are presented on the next section.The GIF binary template makes use of lookahead functions
ReadUByte()and ReadUShort()to look ahead at the values of the next bytes in the file before actually parsing them into a struct field. At generation time, we allow those functions to receive an additional argument specifying a set of good known values to pick for the bytes that we look ahead. In addition, we also allow specifying a global set of good known values to always use when calling a particular lookahead function, such as ReadUByte(). Those are stored in the ReadUByteInitValuesvector.By default, our translation procedure
ffcompiletries to mine interesting values which have been used in comparisons against lookahead bytes and use them as a global set of known values. When running./ffcompile templates/gif.bt gif.cpp
a printed message shows the lookahead functions identified, as well as the mined interesting values:
Finished creating cpp generator.
Lookahead functions found:
ReadUByte
ReadUShort
Mined interesting values:
GlobalColorTableFlag: [‘1’]
LocalColorTableFlag: [‘1’]
ReadUByte: [‘0x3B’, ‘0x2C’]
ReadUShort: [‘0xF921’, ‘0xFE21’, ‘0x0121’, ‘0xFF21’]
Signature: [‘”GIF”‘]
For GIF generation, however, it is better to specify the set of good known values for
ReadUByte()individually at each call to the function. So we define an empty array (size 0)const local [...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
6v1JBNHF7ZDeKXgeJWeSsGqDFomNal3Avs_ZkElM6OSuGYkDGSxpF7MRGTwIEWhs2PvYKG8u4IY64BLmNVJbmqg126yR00dj2PyBYF7NlYwCreHd5GG8ZSIc7Lc0NHXlTI2k_ADNI8azm7R-uQIre8=s376 After finding there is a new file uploaded to the folder, it is downloaded, processed and the commands…
pyinstaller –onefile covert-onedrive.py
pyinstaller –onefile covert-telegram.py
pyinstaller –onefile covert-youtube.py
rm -rf build
rm *spec
ls dist/ Download
___________________________
@hacking_Attack
@Hacking_Video
pyinstaller –onefile covert-telegram.py
pyinstaller –onefile covert-youtube.py
rm -rf build
rm *spec
ls dist/ Download
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
es and back: AFL would mutate decision files, and the program under test would run on the translated binary files. In contrast to mutating binary files directly (as AFL would normally do), this would have the advantage of always having valid inputs – and thus…
UBYTE ReadUByteInitValues[0];
to overwrite the set of global
if(GifHeader.Version == “89a”)
local UBYTE values[] = { 0x3B, 0x2C, 0x21 };
else
local UBYTE values[] = { 0x3B, 0x2C };
while (ReadUByte(FTell(), values) != 0x3B) {
…
}
The remaining edits required for the GIF binary template are similar. For example, for each struct field can also specify a set of known good values. For example this specifies the correct values for the
char Version[3] = { {“87a”}, {“89a”} };
Understanding the Generated C++ Code
For debugging purposes, as well as for understanding how to make appropriate changes to improve your generators and parsers, it may be useful to understand some inner workings of the generated C++ code. Ideally, you should be able to edit the binary template files until they can be used to generate valid files with high probability, so you wouldn’t have to edit the generated C++ code.
The C++ code creates a class for each
At construction time, when initializing a variable, we can define a set of good known values that this variable can assume. For example, the constructor call
char_array_class cname(cname_element, { “IHDR”, “tEXt”, “PLTE”, “cHRM”, “sRGB”, “iEXt”, “zEXt”, “tIME”, “pHYs”, “bKGD”, “sBIT”, “sPLT”, “acTL”, “fcTL”, “fdAT”, “IHDR”, “IEND” });
would specify 17 good values to use for variable
GENERATE(chunk, ::g->chunk.generate({ “IHDR” }, false));
When generating the second chunk, we might use this long list of possible chunks that can come between the IHDR chunk and the PLTE chunk:
GENERATE(chunk, ::g->chunk.generate({ “iCCP”, “sRGB”, “sBIT”, “gAMA”, “cHRM”, “pHYs”, “sPLT”, “tIME”, “zTXt”, “tEXt”, “iTXt”, “eXIf”, “oFFs”, “pCAL”, “sCAL”, “acTL”, “fcTL”, “fdAT”, “fRAc”, “gIFg”, “gIFt”, “gIFx”, “sTER” }, true));
The generator will then uniformly pick one of the good known values to use for the new instance. We also allow the choice of an evil value which is not one of the good known values with small probability 1/128. This feature can be enabled or disabled any time by using the method
All the random choices taken by the generator are done by calling the
long long rand_int(unsigned long long x, std::function parse);
When running the program as a generator, this method samples an integer from 0 to x-1 by reading bytes from the random buffer. When running the program as a parser, this method uses the
___________________________
@hacking_Attack
@Hacking_Video
to overwrite the set of global
ReadUByteInitValuesand for each call to ReadUByte(), we use an additional argument to specify the set of good values to use for that particular location. The binary template language is also powerful enough to allow this choice to be made based on runtime conditions. For example, in the following code we show how the choice of appropriate values for a ReadUByte()call can depend on the current GIF version we are generating. A GIF version 89aallows one extra possible value for the byte (0x21).if(GifHeader.Version == “89a”)
local UBYTE values[] = { 0x3B, 0x2C, 0x21 };
else
local UBYTE values[] = { 0x3B, 0x2C };
while (ReadUByte(FTell(), values) != 0x3B) {
…
}
The remaining edits required for the GIF binary template are similar. For example, for each struct field can also specify a set of known good values. For example this specifies the correct values for the
Versionfield: 87aand 89a.char Version[3] = { {“87a”}, {“89a”} };
Understanding the Generated C++ Code
For debugging purposes, as well as for understanding how to make appropriate changes to improve your generators and parsers, it may be useful to understand some inner workings of the generated C++ code. Ideally, you should be able to edit the binary template files until they can be used to generate valid files with high probability, so you wouldn’t have to edit the generated C++ code.
The C++ code creates a class for each
structand uniondefined in the binary template, as well as for native types, such as int.At construction time, when initializing a variable, we can define a set of good known values that this variable can assume. For example, the constructor call
char_array_class cname(cname_element, { “IHDR”, “tEXt”, “PLTE”, “cHRM”, “sRGB”, “iEXt”, “zEXt”, “tIME”, “pHYs”, “bKGD”, “sBIT”, “sPLT”, “acTL”, “fcTL”, “fdAT”, “IHDR”, “IEND” });
would specify 17 good values to use for variable
cname. But this is often not enough, since the choice of appropriate chunk types is context sensitive. So we also allow specifying a set of good values at generation time when generating a new chunk. For example, this call could be used to generate an instance of chunkfor the first chunk, which must have type IHDR.GENERATE(chunk, ::g->chunk.generate({ “IHDR” }, false));
When generating the second chunk, we might use this long list of possible chunks that can come between the IHDR chunk and the PLTE chunk:
GENERATE(chunk, ::g->chunk.generate({ “iCCP”, “sRGB”, “sBIT”, “gAMA”, “cHRM”, “pHYs”, “sPLT”, “tIME”, “zTXt”, “tEXt”, “iTXt”, “eXIf”, “oFFs”, “pCAL”, “sCAL”, “acTL”, “fcTL”, “fdAT”, “fRAc”, “gIFg”, “gIFt”, “gIFx”, “sTER” }, true));
The generator will then uniformly pick one of the good known values to use for the new instance. We also allow the choice of an evil value which is not one of the good known values with small probability 1/128. This feature can be enabled or disabled any time by using the method
set_evil_bit.All the random choices taken by the generator are done by calling the
rand_int()method.long long rand_int(unsigned long long x, std::function parse);
When running the program as a generator, this method samples an integer from 0 to x-1 by reading bytes from the random buffer. When running the program as a parser, this method uses the
parse()function to find out which random bytes must be present in the random buffer in order to generate the target file, and then writes those bytes to the random buffer. The parsefunction receives as an argument the buffer at the current position of the file and must then return which value would have to be returned by the current call to rand_int()in order to generate this exact file configuration. Download___________________________
@hacking_Attack
@Hacking_Video
SQL Injection [CWE-89] — The Hacktivists
SQL Injection is a weakness that is caused by improper neutralization of special elements used in an SQL query.Continue reading on Medium »
Read more...
SQL Injection is a weakness that is caused by improper neutralization of special elements used in an SQL query.Continue reading on Medium »
Read more...
LDAP Injection [CWE-90] — The Hacktivists
LDAP Injection weakness describes improper neutralization of special elements used in LDAP queries.Continue reading on Medium »
Read more...
LDAP Injection weakness describes improper neutralization of special elements used in LDAP queries.Continue reading on Medium »
Read more...
XML Injection [CWE-91] — The Hacktivists
XML Injection weakness describes improper neutralization of special elements used in XML queries.Continue reading on Medium »
Read more...
XML Injection weakness describes improper neutralization of special elements used in XML queries.Continue reading on Medium »
Read more...
Code Injection [CWE-94] — The Hacktivists
Code Injection weakness describes improper control of code generation.Continue reading on Medium »
Read more...
Code Injection weakness describes improper control of code generation.Continue reading on Medium »
Read more...
PHP File Inclusion [CWE-98] — The Hacktivists
PHP File Inclusion weakness describes improper control of filename within Include() or Require() statements in a PHP program.Continue reading on Medium »
Read more...
PHP File Inclusion weakness describes improper control of filename within Include() or Require() statements in a PHP program.Continue reading on Medium »
Read more...
Off-by-one Error [CWE-193] — The Hacktivists
Off-by-one error occurs when a program uses an improper maximum or minimum value that is one more or one less than the proper value.Continue reading on Medium »
Read more...
Off-by-one error occurs when a program uses an improper maximum or minimum value that is one more or one less than the proper value.Continue reading on Medium »
Read more...
Improper Handling of Length Parameter Inconsistency [CWE-130] — The Hacktivists
Improper Handling of Length Parameter Inconsistency is a security weakness that describes improper handling of a length field for…Continue reading on Medium »
Read more...
Improper Handling of Length Parameter Inconsistency is a security weakness that describes improper handling of a length field for…Continue reading on Medium »
Read more...
HTTP Response Splitting [CWE-113] — The Hacktivists
HTTP Response Splitting weakness describes improper neutralization of CRLF sequences in HTTP headers.Continue reading on Medium »
Read more...
HTTP Response Splitting weakness describes improper neutralization of CRLF sequences in HTTP headers.Continue reading on Medium »
Read more...
hacking: security in practice
When using BEEF browser hacking, do your hacking capabilities basically stop the moment the user exist the page with the JS hook?
In other words you can't send a facebook login later or pretty much anything else.
submitted by /u/hankcarter90
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
When using BEEF browser hacking, do your hacking capabilities basically stop the moment the user exist the page with the JS hook?
In other words you can't send a facebook login later or pretty much anything else.
submitted by /u/hankcarter90
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
When using BEEF browser hacking, do your hacking capabilities...
In other words you can't send a facebook login later or pretty much anything else.
hacking: security in practice
deleted text messages
hello, question…. does anyone know how to retrieve deleted text messages from a Samsung Galaxi S20?
submitted by /u/Verlocco
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
deleted text messages
hello, question…. does anyone know how to retrieve deleted text messages from a Samsung Galaxi S20?
submitted by /u/Verlocco
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
deleted text messages
hello, question…. does anyone know how to retrieve deleted text messages from a Samsung Galaxi S20?
hacking: security in practice
Bandwithe required for Darknet DDoS
Im wondering if it requires alot of bandwidth to DdoS someone when it seems limited. And with captcha set up some sites make you start over with 3 failed attempts, whats a likely way this is getting through. I'm just curious and trying to understand and I have very little knowledge. I saw a forum go down today for a few hours, they claimed it was an attack, but it was over in a couple hours
submitted by /u/Born_Option_4432
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Bandwithe required for Darknet DDoS
Im wondering if it requires alot of bandwidth to DdoS someone when it seems limited. And with captcha set up some sites make you start over with 3 failed attempts, whats a likely way this is getting through. I'm just curious and trying to understand and I have very little knowledge. I saw a forum go down today for a few hours, they claimed it was an attack, but it was over in a couple hours
submitted by /u/Born_Option_4432
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Bandwithe required for Darknet DDoS
Im wondering if it requires alot of bandwidth to DdoS someone when it seems limited. And with captcha set up some sites make you start over with 3...
hacking: security in practice
open source code for malware
So I'm pretty new to all this but I'm really interested in viruses/malware and how they work, I was wondering if theres any good open source code (preferably something simpler to start) that could maybe help me learn more? Thanks.
submitted by /u/BoringUsername_69
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
open source code for malware
So I'm pretty new to all this but I'm really interested in viruses/malware and how they work, I was wondering if theres any good open source code (preferably something simpler to start) that could maybe help me learn more? Thanks.
submitted by /u/BoringUsername_69
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
open source code for malware
So I'm pretty new to all this but I'm really interested in viruses/malware and how they work, I was wondering if theres any good open source code...
SQL Injection [CWE-89] — The Hacktivists
https://thehacktivists.medium.com/sql-injection-cwe-89-the-hacktivists-5d43c8eeb8eb?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://thehacktivists.medium.com/sql-injection-cwe-89-the-hacktivists-5d43c8eeb8eb?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
SQL Injection [CWE-89] — The Hacktivists
SQL Injection is a weakness that is caused by improper neutralization of special elements used in an SQL query.
SQL Injection is a weakness that is caused by improper neutralization of special elements used in an SQL query.Continue reading on Medium » (https://thehacktivists.medium.com/sql-injection-cwe-89-the-hacktivists-5d43c8eeb8eb?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
SQL Injection [CWE-89] — The Hacktivists
SQL Injection is a weakness that is caused by improper neutralization of special elements used in an SQL query.
LDAP Injection [CWE-90] — The Hacktivists
https://thehacktivists.medium.com/ldap-injection-cwe-90-the-hacktivists-b51ab5835cc?source=rss------bug_bounty-5
LDAP Injection weakness describes improper neutralization of special elements used in LDAP queries.Continue reading on Medium » (https://thehacktivists.medium.com/ldap-injection-cwe-90-the-hacktivists-b51ab5835cc?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
https://thehacktivists.medium.com/ldap-injection-cwe-90-the-hacktivists-b51ab5835cc?source=rss------bug_bounty-5
LDAP Injection weakness describes improper neutralization of special elements used in LDAP queries.Continue reading on Medium » (https://thehacktivists.medium.com/ldap-injection-cwe-90-the-hacktivists-b51ab5835cc?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
Medium
LDAP Injection [CWE-90] — The Hacktivists
LDAP Injection weakness describes improper neutralization of special elements used in LDAP queries.
XML Injection [CWE-91] — The Hacktivists
https://thehacktivists.medium.com/xml-injection-cwe-91-the-hacktivists-a8dd1a7d9945?source=rss------bug_bounty-5
XML Injection weakness describes improper neutralization of special elements used in XML queries.Continue reading on Medium » (https://thehacktivists.medium.com/xml-injection-cwe-91-the-hacktivists-a8dd1a7d9945?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
https://thehacktivists.medium.com/xml-injection-cwe-91-the-hacktivists-a8dd1a7d9945?source=rss------bug_bounty-5
XML Injection weakness describes improper neutralization of special elements used in XML queries.Continue reading on Medium » (https://thehacktivists.medium.com/xml-injection-cwe-91-the-hacktivists-a8dd1a7d9945?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
Medium
XML Injection [CWE-91] — The Hacktivists
XML Injection weakness describes improper neutralization of special elements used in XML queries.