Hacking on Medium
Proving Grounds illusion Walkthrough

https://cdn-images-1.medium.com/max/757/1*G1o5GEKI6zgNVLWH727MmA.png
Hi, today i am going to walk you through illusion, a new, medium rated Proving Grounds Practice box.

Continue reading on Medium »

Hacking on Medium
SQL Injection Attacks

https://cdn-images-1.medium.com/max/2600/0*uPihVu9440V9tsbi
Shubhankar Kalekar, Advait Kamathe, Dhawal Khapre, Mihir Kanitkar, Chinmay Kulkarni

Continue reading on Medium »

Deep Web
this is one heck of a spooky place

do gamers use deep web? what games do they playi?

submitted by /u/camilnsandbox
[link] [comments]

Into The Great Beyond
https://medium.com/@mad_glitcher/into-the-great-beyond-6a406bd5ddf6?source=rss------bug_bounty-5

I have been wanting to become a professional Bug Bounty Hunter for about 4 years now, attending a couple of HackerOne conferences, which I…Continue reading on Medium » (https://medium.com/@mad_glitcher/into-the-great-beyond-6a406bd5ddf6?source=rss------bug_bounty-5)

Into The Great Beyond

I have been wanting to become a professional Bug Bounty Hunter for about 4 years now, attending a couple of HackerOne conferences, which I…Continue reading on Medium »
Read more...

hacking: security in practice
usb key to input text when plugged in

I want to create a sort of physical password manager with usb keys. Is there any easy way to make a usb that simply types any text when plugged in?

submitted by /u/Dufouch
[link] [comments]

hacking: security in practice
How to Check Multiple Websites for TLS Certificate status?

I’m trying to validate ~300 public/external websites to see if there is a valid TLS certificate. Can anyone recommend a way to verify this in a relatively easy manner or tools/software that can assist?

submitted by /u/bobleeswagggg
[link] [comments]

Just Another blog in InfoSec
https://medium.com/@_avn_/just-another-blog-in-infosec-1936fda87dd6?source=rss------bug_bounty-5

Hello everyone!Continue reading on Medium » (https://medium.com/@_avn_/just-another-blog-in-infosec-1936fda87dd6?source=rss------bug_bounty-5)

Just Another blog in InfoSec

Hello everyone!Continue reading on Medium »
Read more...

Cloud pentesting certifications??
https://www.reddit.com/r/Pentesting/comments/vawm3m/cloud_pentesting_certifications/

I recently passed SANS SEC588 cloud pentesting course and was looking for other certifications to take relating to cloud (there aren’t many out there). Has anyone taken the respective GCP, AWS, and Azure security engineer certifications and found they helped your cloud pentesting skills? submitted by /u/yungtrent (https://www.reddit.com/user/yungtrent)
[link] (https://www.reddit.com/r/Pentesting/comments/vawm3m/cloud_pentesting_certifications/) [comments] (https://www.reddit.com/r/Pentesting/comments/vawm3m/cloud_pentesting_certifications/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hacker Inc is Your Digital Partner For Life

https://cdn-images-1.medium.com/max/770/0*5EUZmmGzPEk-kzAa
What is Hacker, Inc? Simply put, Hacker, Inc is a black hat firm dedicated to aggressively and offensively serving the needs of its global…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

DOMDig - DOM XSS Scanner For Single Page Applications
http://www.kitploit.com/2022/06/domdig-dom-xss-scanner-for-single-page.html

___________________________
@hacking_Attack
@Hacking_Video

DOMDig is a DOM XSS scanner (https://www.kitploit.com/search/label/XSS%20scanner) that runs inside the Chromium (https://www.kitploit.com/search/label/Chromium) web browser and it can scan single page applications (SPA) recursively.
Unlike other scanners, DOMDig can crawl any webapplication (including gmail) by keeping track of DOM modifications and XHR/fetch/websocket requests and it can simulate a real user interaction by firing events. During this process, XSS payloads are put into input fields and their execution is tracked in order to find injection (https://www.kitploit.com/search/label/Injection) points and the related URL modifications.
It is based on htcrawl (https://htcrawl.org/), a node library powerful enough to easily crawl a gmail account.
KEY FEATURES Runs inside a real browser (Chromium) Recursive DOM crawling engine Handles XHR, fetch, JSONP and websockets (https://www.kitploit.com/search/label/Websockets) requests Supports cookies, proxy, custom headers, http auth and more Scriptable login sequences GETTING STARTED Installation git clone https://github.com/fcavallarin/domdig.git
cd domdig && npm i && cd ..
node domdig/domdig.js
Example node domdig.js -c 'foo=bar' -p http:127.0.0.1:8080 https://htcap.org/scanme/domxss.php
Crawl Engine DOMDig uses htcrawl (https://htcrawl.org/) as crawling engine, the same engine used by htcap (https://htcap.org/).
The diagram shows the recursive crawling proccess.

The video below shows the engine crawling gmail. The crawl lasted for many hours and about 3000 XHR request have been captured. Login Sequence A login sequence (or initial sequence) is a json object containing a list of actions to take before the scan starts. Each element of the list is an array where the first element is the name of the action to take and the remaining elements are "parameters" to those actions. Actions are: write click clickToNavigate sleep Example Payloads file Payloads can be loaded from json file (-P option) as array of strings. To build custom payloads, the string window.___xssSink({0}) must be used as the function to be executed (instead of the classic alert(1)) Example [
';window.___xssSink({0});',
'

___________________________
@hacking_Attack
@Hacking_Video

'
]


Download Domdig (https://github.com/fcavallarin/domdig)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
DOMDig - DOM XSS Scanner For Single Page Applications

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjvOzTXaMbb9CXjEw9netji8LfGIK_L72Soe_LhhPvFxptiS9UQBigpE1Nu58_nQ1_YmTWOfSy2b4-6gCKnQbpEZELP2AyM4uVnwLYPT0UyvIZVqO-qYfzFOkv_j7YMAUKJCa88aoGqHpZZ5meDhyrc6PFpBmxDGtxT1zhTWqsSUnaS0VBJQP7TiwbE/w640-h540/DOMDig.png
DOMDig is a DOM XSS scanner that runs inside the Chromium web browser and it can scan single page applications (SPA) recursively.
Unlike other scanners, DOMDig can crawl any webapplication (including gmail) by keeping track of DOM modifications and XHR/fetch/websocket requests and it can simulate a real user interaction by firing events. During this process, XSS payloads are put into input fields and their execution is tracked in order to find injection points and the related URL modifications.
It is based on htcrawl, a node library powerful enough to easily crawl a gmail account.
KEY FEATURES

* Runs inside a real browser (Chromium)
* Recursive DOM crawling engine
* Handles XHR, fetch, JSONP and websockets requests
* Supports cookies, proxy, custom headers, http auth and more
* Scriptable login sequences

GETTING STARTED

Installation

git clone https://github.com/fcavallarin/domdig.git
cd domdig && npm i && cd ..
node domdig/domdig.js


Example

node domdig.js -c 'foo=bar' -p http:127.0.0.1:8080 https://htcap.org/scanme/domxss.php


Crawl Engine

DOMDig uses htcrawl as crawling engine, the same engine used by htcap.
The diagram shows the recursive crawling proccess.

The video below shows the engine crawling gmail. The crawl lasted for many hours and about 3000 XHR request have been captured.

Login Sequence

A login sequence (or initial sequence) is a json object containing a list of actions to take before the scan starts. Each element of the list is an array where the first element is the name of the action to take and the remaining elements are "parameters" to those actions. Actions are:

* write Example

Payloads file
Payloads can be loaded from json file (-P option) as array of strings. To build custom payloads, the string window.___xssSink({0})must be used as the function to be executed (instead of the classic alert(1))

Example

[
';window.___xssSink({0});',
'a '
]

Download Domdig

___________________________
@hacking_Attack
@Hacking_Video