hacking: security in practice
I have a question Is there a way to scan a website Using AWS or any other services using nmap.
submitted by /u/Beginning-Ad5714
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖
I have a question Is there a way to scan a website Using AWS or any other services using nmap.
submitted by /u/Beginning-Ad5714
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖
reddit
I have a question Is there a way to scan a website Using AWS or...
Posted in r/hacking by u/Beginning-Ad5714 • 0 points and 0 comments
hacking: security in practice
I have a question Is there a way to scan a website Using AWS or any other services using nmap.
submitted by /u/Beginning-Ad5714
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖
I have a question Is there a way to scan a website Using AWS or any other services using nmap.
submitted by /u/Beginning-Ad5714
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖
reddit
I have a question Is there a way to scan a website Using AWS or...
Posted in r/hacking by u/Beginning-Ad5714 • 0 points and 0 comments
hacking: security in practice
My Instagram is Getting Hacked by Pakistani Propaganda
Since March, my Instagram will post images like this.
No 3rd party app is connected.
My 2-factor authentication is never triggered.
I once got a notification that there was a log-in in Pakistan.
This has happened like 5 times now. What the hell do I do?
submitted by /u/Travelpickleball
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖
My Instagram is Getting Hacked by Pakistani Propaganda
Since March, my Instagram will post images like this.
No 3rd party app is connected.
My 2-factor authentication is never triggered.
I once got a notification that there was a log-in in Pakistan.
This has happened like 5 times now. What the hell do I do?
submitted by /u/Travelpickleball
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖
reddit
My Instagram is Getting Hacked by Pakistani Propaganda
Since March, my Instagram will post images like this. No 3rd party app is connected. My 2-factor authentication is never triggered. I once...
hacking: security in practice
F*cking money
I need to start earning >= 1000$/month(It's pretty good money in my country) within a year and a half(doesn't matter why)
Before discovering bug bounty programs I already had a little experience in hacking(and relatively a lot of experience in programming). When I started learning hacking I was very interested and didn't even think about money.
When I found out about bug bounty programs(on hackerone) I thought that It's a good opportunity to earn that amount of money(I know that It's almost impossible to become a millionaire, but 1000$ is a realistic goal, I think)
Money has become a very big part of my motivation. I lost my curiousity and everything I loved about hacking.
I believe that if I hadn't thought about money and just learnt hacking, it would probably come much faster. But I also doubt if I could make that amount of money within a year and a half and what's better: learning hacking now and trying to earn money or focusing on studying at school/university and then getting a job and thinking of hacking only as a hobby.
Is it a realistic goal to start earning 1000$/month within a year and a half if I spend about 2-3 hours(I can more, but I think I'll burn out) on hacking every day and how to get my love of hacking back???
submitted by /u/neirufiyu
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖
F*cking money
I need to start earning >= 1000$/month(It's pretty good money in my country) within a year and a half(doesn't matter why)
Before discovering bug bounty programs I already had a little experience in hacking(and relatively a lot of experience in programming). When I started learning hacking I was very interested and didn't even think about money.
When I found out about bug bounty programs(on hackerone) I thought that It's a good opportunity to earn that amount of money(I know that It's almost impossible to become a millionaire, but 1000$ is a realistic goal, I think)
Money has become a very big part of my motivation. I lost my curiousity and everything I loved about hacking.
I believe that if I hadn't thought about money and just learnt hacking, it would probably come much faster. But I also doubt if I could make that amount of money within a year and a half and what's better: learning hacking now and trying to earn money or focusing on studying at school/university and then getting a job and thinking of hacking only as a hobby.
Is it a realistic goal to start earning 1000$/month within a year and a half if I spend about 2-3 hours(I can more, but I think I'll burn out) on hacking every day and how to get my love of hacking back???
submitted by /u/neirufiyu
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖
reddit
r/hacking - F*cking money
0 votes and 0 comments so far on Reddit
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Dora : Find Exposed API Keys Based On RegEx And Get Exploitation Methods
Dora, a tool to Find Exposed API Keys Based On RegEx And Get Exploitation Methods For Some Of Keys That Are Found
Features
* Blazing fast as we are using
* Exploit/PoC steps for many of the API key, allowing to write a good report for bug bounty hunting
* Unlike many other API key finders,
* Can easily be implemented into scripts. See Example Use Cases
Installation
Make sure to install ripgrep
clone the repo
git clone https://github.com/sdushantha/dora.git
change the working directory to sherlock
cd dora
install dora
python3 setup.py install –user
Usage
$ dora –help
usage: dora [options]
positional arguments:
PATH Path to directory or file to scan
optional arguments:
-h, –help show this help message and exit
–rg-path RG_PATH Specify path to ripgrep
–rg-arguments RG_ARGUMENTS
Arguments you want to provide to ripgrep
–json JSON Load regex data from a valid JSON file (default: db/data.json)
–verbose, -v, –debug, -d
Display extra debugging information
–no-color Don’t show color in terminal output
Example Use Cases
* Decompile an APK using
* Scan GitHub repos by cloning it and allowing
* While scraping sites, run
Download
Dora : Find Exposed API Keys Based On RegEx And Get Exploitation Methods
Dora, a tool to Find Exposed API Keys Based On RegEx And Get Exploitation Methods For Some Of Keys That Are Found
Features
* Blazing fast as we are using
ripgrepin backend* Exploit/PoC steps for many of the API key, allowing to write a good report for bug bounty hunting
* Unlike many other API key finders,
doraalso shows the path to the file and the line with context for easier analysis* Can easily be implemented into scripts. See Example Use Cases
Installation
Make sure to install ripgrep
clone the repo
git clone https://github.com/sdushantha/dora.git
change the working directory to sherlock
cd dora
install dora
python3 setup.py install –user
Usage
$ dora –help
usage: dora [options]
positional arguments:
PATH Path to directory or file to scan
optional arguments:
-h, –help show this help message and exit
–rg-path RG_PATH Specify path to ripgrep
–rg-arguments RG_ARGUMENTS
Arguments you want to provide to ripgrep
–json JSON Load regex data from a valid JSON file (default: db/data.json)
–verbose, -v, –debug, -d
Display extra debugging information
–no-color Don’t show color in terminal output
Example Use Cases
* Decompile an APK using
apktooland run dorato find exposed API keys* Scan GitHub repos by cloning it and allowing
dorato scan it* While scraping sites, run
dorato scan for API keysDownload
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Requests-Ip-Rotator : A Python Library To Utilize AWS API Gateway’s Large IP Pool
Requests-Ip-Rotator is a Python library to utilize AWS API Gateway’s large IP pool as a proxy to generate pseudo-infinite IPs for web scraping and brute forcing.
This library will allow the user to bypass IP-based rate-limits for sites and services.
X-Forwarded-For headers are automatically randomised and applied unless given. This is because otherwise, AWS will send the client’s true IP address in this header.
AWS’ ApiGateway sends its requests from any available IP – and since the AWS infrastructure is so large, it is almost guarented to be different each time. By using ApiGateway as a proxy, we can take advantage of this to send requests from different IPs each time. Please note that these requests can be easily identified and blocked, since they are sent with unique AWS headers (i.e. “X-Amzn-Trace-Id”). InstallationThis package is on pypi so you can install via any of the following:
*
from requests_ip_rotator import ApiGateway
Create gateway object and initialise in AWS
gateway = ApiGateway(“https://site.com”)
gateway.start()
Assign gateway to session
session = requests.Session()
session.mount(“https://site.com”, gateway)
Send request (IP will be randomised)
response = session.get(“https://site.com/index.html”)
print(response.status_code)
Delete gateways
gateway.shutdown()
Alternate Usage (auto-start and shutdown)
import requests
from requests_ip_rotator import ApiGateway
with ApiGateway(“https://site.com”) as g:
session = requests.Session()
session.mount(“https://site.com”, g)
response = session.get(“https://site.com/index.html”)
print(response.status_code)
Please remember that if gateways are not shutdown via the
At the time of writing, AWS charges ~$3 per million requests after the free tier has been exceeded.
If your requests involve data stream, AWS would charge data transfer fee at $0.09 per GB. DocumentationAWS AuthenticationIt is recommended to setup authentication via environment variables. With awscli, you can run
NameDescriptionRequiredDefaultsiteThe site (without path) requests will be sent to.TrueregionsAn array of AWS regions to setup gateways in.Falseip_rotator.DEFAULT_REGIONSaccess_key_idAWS Access Key ID (will override env variables).FalseRelies on env variables.access_key_secretAWS Access Key Secret (will override env variables).FalseRelies on env variables.
from ip_rotator import ApiGateway, EXTRA_REGIONS, ALL_REGIONS
Gateway to outbound HTTP IP and port for only two regions
gateway_1 = ApiGateway(“http://1.1.1.1:8080”, regions=[“eu-west-1”, “eu-west-2”])
Gateway to HTTPS google for the extra regions pack, with specified access key pair
gateway_2 = ApiGateway(“https://www.google.com”, regions=EXTRA_REGIONS, access_key_id=”ID”, access_key_secret=”SECRET”) Starting API gatewayAn ApiGateway object must then be started using the
By default, if an ApiGateway already exists for the site, it will use the existing endpoint instead of creating a new one.
This does not require any parameters, but accepts the following:
NameDescriptionRequiredforceCreate a new set of endpoints, even if some already exist.FalseendpointsArray of pre-existing endpoints (i.e. fro[...]
Requests-Ip-Rotator : A Python Library To Utilize AWS API Gateway’s Large IP Pool
Requests-Ip-Rotator is a Python library to utilize AWS API Gateway’s large IP pool as a proxy to generate pseudo-infinite IPs for web scraping and brute forcing.
This library will allow the user to bypass IP-based rate-limits for sites and services.
X-Forwarded-For headers are automatically randomised and applied unless given. This is because otherwise, AWS will send the client’s true IP address in this header.
AWS’ ApiGateway sends its requests from any available IP – and since the AWS infrastructure is so large, it is almost guarented to be different each time. By using ApiGateway as a proxy, we can take advantage of this to send requests from different IPs each time. Please note that these requests can be easily identified and blocked, since they are sent with unique AWS headers (i.e. “X-Amzn-Trace-Id”). InstallationThis package is on pypi so you can install via any of the following:
*
pip3 install requests-ip-rotator* python3 -m pip install requests-ip-rotatorSimple Usageimport requestsfrom requests_ip_rotator import ApiGateway
Create gateway object and initialise in AWS
gateway = ApiGateway(“https://site.com”)
gateway.start()
Assign gateway to session
session = requests.Session()
session.mount(“https://site.com”, gateway)
Send request (IP will be randomised)
response = session.get(“https://site.com/index.html”)
print(response.status_code)
Delete gateways
gateway.shutdown()
Alternate Usage (auto-start and shutdown)
import requests
from requests_ip_rotator import ApiGateway
with ApiGateway(“https://site.com”) as g:
session = requests.Session()
session.mount(“https://site.com”, g)
response = session.get(“https://site.com/index.html”)
print(response.status_code)
Please remember that if gateways are not shutdown via the
shutdown()method when using method #1, you may be charged in future. CostsAPI Gateway is free for the first million requests per region, which means that for most use cases this should be completely free.At the time of writing, AWS charges ~$3 per million requests after the free tier has been exceeded.
If your requests involve data stream, AWS would charge data transfer fee at $0.09 per GB. DocumentationAWS AuthenticationIt is recommended to setup authentication via environment variables. With awscli, you can run
aws configureto do this, or alternatively, you can simply set the AWS_ACCESS_KEY_IDand AWS_SECRET_ACCESS_KEYvariables yourself. Creating ApiGateway objectThe ApiGateway class can be created with the following optional parameters:NameDescriptionRequiredDefaultsiteThe site (without path) requests will be sent to.TrueregionsAn array of AWS regions to setup gateways in.Falseip_rotator.DEFAULT_REGIONSaccess_key_idAWS Access Key ID (will override env variables).FalseRelies on env variables.access_key_secretAWS Access Key Secret (will override env variables).FalseRelies on env variables.
from ip_rotator import ApiGateway, EXTRA_REGIONS, ALL_REGIONS
Gateway to outbound HTTP IP and port for only two regions
gateway_1 = ApiGateway(“http://1.1.1.1:8080”, regions=[“eu-west-1”, “eu-west-2”])
Gateway to HTTPS google for the extra regions pack, with specified access key pair
gateway_2 = ApiGateway(“https://www.google.com”, regions=EXTRA_REGIONS, access_key_id=”ID”, access_key_secret=”SECRET”) Starting API gatewayAn ApiGateway object must then be started using the
startmethod.By default, if an ApiGateway already exists for the site, it will use the existing endpoint instead of creating a new one.
This does not require any parameters, but accepts the following:
NameDescriptionRequiredforceCreate a new set of endpoints, even if some already exist.FalseendpointsArray of pre-existing endpoints (i.e. fro[...]
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials Requests-Ip-Rotator : A Python Library To Utilize AWS API Gateway’s Large IP Pool Requests-Ip-Rotator is a Python library to utilize AWS API Gateway’s large IP pool as a proxy to generate pseudo-infinite IPs for web scraping and brute…
m previous session).False
Starts new ApiGateway instances for site, or locates existing endpoints if they already exist.
gateway_1.start()
Starts new ApiGateway instances even if some already exist.
gateway_2.start(force=True) Sending requestsRequests are sent by attaching the ApiGateway object to a requests Session object.
The site given in
import requests
Posts a request to the site created in gateway_1. Will be sent from a random IP.
session_1 = requests.Session()
session_1.mount(“http://1.1.1.1:8080”, gateway_1)
session_1.post(“http://1.1.1.1:8080/update.php”, headers={“Hello”: “World”})
Send 127.0.0.1 as X-Forwarded-For header in outbound request (otherwise X-Forwarded-For is randomised).
session_1.post(“http://1.1.1.1:8080/update.php”, headers={“X-Forwarded-For”, “127.0.0.1”})
Execute Google search query from random IP
session_2 = requests.Session()
session_2.mount(“https://www.google.com”, gateway_2)
session_2.get(“https://www.google.com/search?q=test”) Closing ApiGateway ResourcesIt’s important to shutdown the ApiGateway resources once you have finished with them, to prevent dangling public endpoints that can cause excess charges to your account.
This is done through the
Alternatively, you can selectively shutdown specific endpoints, if needed. To do this, simply pass in an array of endpoints to the shutdown() method, i.e:
This will force start a new gateway (i.e. create new endpoints even if some exist on the region already), and then delete the first 3 of them only.
gateway_3 = ApiGateway(“http://1.1.1.1:8082”, regions=ALL_REGIONS)
endpoints = gateway_3.start(force=True)
gateway_3.shutdown(endpoints[:3]) Download
Starts new ApiGateway instances for site, or locates existing endpoints if they already exist.
gateway_1.start()
Starts new ApiGateway instances even if some already exist.
gateway_2.start(force=True) Sending requestsRequests are sent by attaching the ApiGateway object to a requests Session object.
The site given in
mountmust match the site passed in the ApiGatewayconstructor.import requests
Posts a request to the site created in gateway_1. Will be sent from a random IP.
session_1 = requests.Session()
session_1.mount(“http://1.1.1.1:8080”, gateway_1)
session_1.post(“http://1.1.1.1:8080/update.php”, headers={“Hello”: “World”})
Send 127.0.0.1 as X-Forwarded-For header in outbound request (otherwise X-Forwarded-For is randomised).
session_1.post(“http://1.1.1.1:8080/update.php”, headers={“X-Forwarded-For”, “127.0.0.1”})
Execute Google search query from random IP
session_2 = requests.Session()
session_2.mount(“https://www.google.com”, gateway_2)
session_2.get(“https://www.google.com/search?q=test”) Closing ApiGateway ResourcesIt’s important to shutdown the ApiGateway resources once you have finished with them, to prevent dangling public endpoints that can cause excess charges to your account.
This is done through the
shutdownmethod of the ApiGateway object. It will close all resources for the regions specified in the ApiGateway object constructor.Alternatively, you can selectively shutdown specific endpoints, if needed. To do this, simply pass in an array of endpoints to the shutdown() method, i.e:
This will force start a new gateway (i.e. create new endpoints even if some exist on the region already), and then delete the first 3 of them only.
gateway_3 = ApiGateway(“http://1.1.1.1:8082”, regions=ALL_REGIONS)
endpoints = gateway_3.start(force=True)
gateway_3.shutdown(endpoints[:3]) Download
The most powerful CRLF injection (HTTP Response Splitting) scanner. CRLFsuite — CRLF injection scannerContinue reading on Medium » (https://medium.com/@reconshell.com/crlf-injection-scanner-3aa66cd6ffff?source=rss------bug_bounty-5)
CRLF injection scanner
The most powerful CRLF injection (HTTP Response Splitting) scanner. CRLFsuite — CRLF injection scannerContinue reading on Medium »
Read more...
The most powerful CRLF injection (HTTP Response Splitting) scanner. CRLFsuite — CRLF injection scannerContinue reading on Medium »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
What’s all the hype about Cybersecurity?
https://cdn-images-1.medium.com/max/2600/1*dE12AuNUZMJl7bIokKDmAg.jpeg
What if Stark never fought Stane and admitted being Iron Man? Avengers: Endgame would have had a very different ending then, which seems…
Continue reading on Medium »
What’s all the hype about Cybersecurity?
https://cdn-images-1.medium.com/max/2600/1*dE12AuNUZMJl7bIokKDmAg.jpeg
What if Stark never fought Stane and admitted being Iron Man? Avengers: Endgame would have had a very different ending then, which seems…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
TryHackMe : Source write-up
https://cdn-images-1.medium.com/max/2600/1*Z7t_iMberqG2SCd-vA97Bw.png
I start usually by updating the hosts file on my computer, in order to make accessing the machine easier without the need of typing the IP…
Continue reading on Medium »
TryHackMe : Source write-up
https://cdn-images-1.medium.com/max/2600/1*Z7t_iMberqG2SCd-vA97Bw.png
I start usually by updating the hosts file on my computer, in order to make accessing the machine easier without the need of typing the IP…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Anonymous — TryHackMe WriteUp
https://cdn-images-1.medium.com/max/972/1*p4rQnkBzBpTnVaTIdhq8pQ.png
ANONYMOUS is a LINUX machine, of MEDIUM difficulty.
Continue reading on Medium »
Anonymous — TryHackMe WriteUp
https://cdn-images-1.medium.com/max/972/1*p4rQnkBzBpTnVaTIdhq8pQ.png
ANONYMOUS is a LINUX machine, of MEDIUM difficulty.
Continue reading on Medium »