Hacking Articles Tips Tricks Videos Tutorials

7 views23:07

KitPloit - PenTest Tools!
DOMDig - DOM XSS Scanner For Single Page Applications

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjvOzTXaMbb9CXjEw9netji8LfGIK_L72Soe_LhhPvFxptiS9UQBigpE1Nu58_nQ1_YmTWOfSy2b4-6gCKnQbpEZELP2AyM4uVnwLYPT0UyvIZVqO-qYfzFOkv_j7YMAUKJCa88aoGqHpZZ5meDhyrc6PFpBmxDGtxT1zhTWqsSUnaS0VBJQP7TiwbE/w640-h540/DOMDig.png
DOMDig is a DOM XSS scanner that runs inside the Chromium web browser and it can scan single page applications (SPA) recursively.
Unlike other scanners, DOMDig can crawl any webapplication (including gmail) by keeping track of DOM modifications and XHR/fetch/websocket requests and it can simulate a real user interaction by firing events. During this process, XSS payloads are put into input fields and their execution is tracked in order to find injection points and the related URL modifications.
It is based on htcrawl, a node library powerful enough to easily crawl a gmail account.
KEY FEATURES

* Runs inside a real browser (Chromium)
* Recursive DOM crawling engine
* Handles XHR, fetch, JSONP and websockets requests
* Supports cookies, proxy, custom headers, http auth and more
* Scriptable login sequences

GETTING STARTED

Installation

git clone https://github.com/fcavallarin/domdig.git
cd domdig && npm i && cd ..
node domdig/domdig.js

Example

node domdig.js -c 'foo=bar' -p http:127.0.0.1:8080 https://htcap.org/scanme/domxss.php

Crawl Engine

DOMDig uses htcrawl as crawling engine, the same engine used by htcap.
The diagram shows the recursive crawling proccess.

The video below shows the engine crawling gmail. The crawl lasted for many hours and about 3000 XHR request have been captured.

Login Sequence

A login sequence (or initial sequence) is a json object containing a list of actions to take before the scan starts. Each element of the list is an array where the first element is the name of the action to take and the remaining elements are "parameters" to those actions. Actions are:

* write Example

Payloads file
Payloads can be loaded from json file (-P option) as array of strings. To build custom payloads, the string window.___xssSink({0})must be used as the function to be executed (instead of the classic alert(1))

Example

[
';window.___xssSink({0});',
'a '
]

Download Domdig

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

DOMDig - DOM XSS Scanner For Single Page Applications

8 viewsedited 23:07

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Does anyone know why my vpn think im in the US but websites think im russian or dutch?

Does anyone know why my vpn think im in the US but websites think im russian or dutch? I think I may have been hacked. I using Linux so threat is ssmall but not at 0. I have noticed this many times. I set VPN to miami, usa but when I go to certain websites they think im somewhere else. I dont get it.

submitted by /u/olympus1112
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Does anyone know why my vpn think im in the US but websites think...

Does anyone know why my vpn think im in the US but websites think im russian or dutch? I think I may have been hacked. I using Linux so threat is...

5 viewsedited 00:37

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Harassment Issues?

Weirdest thing but I think he uses my devices to hurt me. Puts stuff in my brain. He discovered hate and love are the same thing, and he can make me love him?

Worried that typing up my hate and psychology for him might justify him having access to my devices and then my brain. What do I do? Damned if I post and condemn and damned if I don't. He punishes me whatever, but won't even reply to an email? What do I do?

No one replies to me. I feel so victimised. Punishments are his thing. I don't want a relationship. I don't want to punish anyone. I need help.

submitted by /u/thomaskicks
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Harassment Issues?

Weirdest thing but I think he uses my devices to hurt me. Puts stuff in my brain. He discovered hate and love are the same thing, and he can make...

5 viewsedited 00:37

Hacking Articles Tips Tricks Videos Tutorials

5 views00:37

Hacking Articles Tips Tricks Videos Tutorials

Photo

hacking: security in practice
The Reality Of Full-Time Bug Bounty Hunting

https://external-preview.redd.it/8RmTnjYwADFetm4kW2BVVXUG1WELcRce8SCyYL3UtkI.jpg?width=640&crop=smart&auto=webp&s=1e3e64996ecbae9d8f9b13c57357e6541668b22b submitted by /u/ibuydan
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

From the hacking community on Reddit: The Reality Of Full-Time Bug Bounty Hunting

Posted by ibuydan - 497 votes and 22 comments

5 viewsedited 00:37

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Tik Tok

Please remove if not allowed. So, my partner is a fairly popular Tik Tok influencer. In the millions with follower count. Her legal name isn’t accessible anywhere on the internet with her tik tok handle. This morning, an account commented my partners legal name on one of her videos. The accounts handle, is our 2 year old daughters legal name, which NOBODY should be able to know. Not too long after, they commented on one of my videos saying MY legal name. I don’t use the app much, follower count under 1000). We are slightly concerned for our safety and aren’t too sure what to do. The suspected hacker account is private, so I can’t get a link to it for an IP search. We would $o greatly appreciate any advice, PMs are open as well if anybody would like to talk confidentially. Thank you.

submitted by /u/Powwdaa
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Tik Tok

Please remove if not allowed. So, my partner is a fairly popular Tik Tok influencer. In the millions with follower count. Her legal name isn’t...

8 viewsedited 00:37

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Cell Phone Issues

So i recently broke the screen on my cell phone running android 11. The touch sensors work but i can't unlock it with my swipe because its a difficult swipe. I don't have a pin backup (I will when I get the screen replaced) but I need to get into it. There's information that I need for my job on there. Is there any way to bypass the lock and download the notepad to my computer?

submitted by /u/RadiantCharacter9792
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Cell Phone Issues

A subreddit dedicated to hacking and hackers. Constructive collaboration and learning about exploits, industry standards, grey and white hat...

12 viewsedited 00:37

Hacking Articles Tips Tricks Videos Tutorials

9 views02:49

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
Malware Analysis brbbot.exe

https://cdn-images-1.medium.com/max/900/1*9DmeVWwJMCAm8IgKRN-95g.jpeg
brbbot.exe

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Medium

Malware Analysis brbbot.exe

brbbot.exe

9 viewsedited 02:49