lic IP address and extract location info using https://reallyfreegeoip.org
* -locationEndpoint LOCATIONENDPOINTDefault REST endpoint for location is "https://reallyfreegeoip.org/json/". You can specify a diffrent end point, includding placeholder. The result must be in JSON and must include the following fields: country_name, region_code, region_name, city, zip_code, time_zone, latitude, longitude, metro_code Remarks* The tool extracts IPv4 addresses only in dot decimal notation (xxx.xxx.xxx.xxx). It doesn’t extract IPv4 addresses in decimal, octal or hexadecimal notation because of the high rate of false positives.
* Depending on the number of public IP addresses found, querying the online services could take a long time. If you are dealing with a lot of IP addresses, it is recommended to first run the tool without querying any of the services and just to extract the IP addresses. After seeing the extraction result, you can calculate an estimate of the total run time of the tool if the services are queried, and eventually choose to query only one or two of the services.
* TOR relays are checked at the moment of running the tool. Because these IPs are constantly changing, this information may not be very accurate. If a date can also be identified for an IP, then it should be checked against ExoneraTor at this address: https://metrics.torproject.org/exonerator.html
* Who Is information as well as the location information is gathered live from publicly available services, so the IP addresses are sent to these services. There are downloadable databases that would allow you to collect this information locally, but these downloads are not free and would need constant updates. This tool is not built to work with local databases.
* The default service used for location gathering is https://reallyfreegeoip.org. This is a free service with no limitations, but it may not be very accurate. You can change this service with another, by using the -locationEndpoint parameter of the script. You can provide another service that takes an IP address as a parameter and returns a JSON response. Use the as a placemark for the IP address location. Examples: https://ipapi.co//json, https://api.ipstack.com/?access_key=ACCESS_KEY, https://freeapi.robtex.com/ipquery/. Please note that some of these other REST endpoints may not return the required fields and thus will break the script’s logic. In this case, the method named RequestInfoFromRestEndpoint should be modified accordingly. Acknowledgements* IPv6 regex -https://gist.github.com/dfee/6ed3a4b05cfe7a6faf40a2102408d5d8
* Onion Peeler: Batch Tor Lookup Program - http://az4n6.blogspot.com/2017/02/onion-peeler-batch-tor-lookup-program.html Download OSIPs

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
ORACLE CLOUD. An unprivileged user can query information about all cloud service (with ids, admin emails, public ssh keys...) without any policy allowing it and NO WAY to block it.

An unprivileged user can use OCI to query any information about the cloud without any policy allowing it. Oracle let it happen by default and after almost 2 weeks talking with their support they are not considering this as a security problem.

Whats your opinion?

How to:
$ oci --auth instance_principal oci iam compartment list --all

$ oci --auth instance_principal iam compartment list --compartment-id ocid1.compartment.oc1..XXXXXXXXX

(you can get information about resources outside the vm's compartment too)

Using OCI you can get information about ANY resource in the cloud, just using "--auth instance_principal" without any policy allowing or any way to block it.

You can get information about the machine too with the metadata API:
$ wget http://169.254.169.254/opc/v1/instance/

Any request made by your service can be used to get the admin email, public ssh key and other information about the instance.

If you upgrade the metadata api version to V2, you can block it on Ubuntu, however it can still works with Oracle Linux. But, no proper way to block it.

submitted by /u/alemunhoz
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hacking my own home network

I'm new to hacking and I'd like to try hack my home network (for example remotely open the browser on the computer behind the wall). I'm not a skid so without ready hacking tools. Can anyone give me some tips how to do it, please?

submitted by /u/DasHeidekraut
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
HackThisSite Extended Basic Mission 6

https://cdn-images-1.medium.com/max/700/0*khfPN3hzkvE_LAPo.jpg
Back at it with another PHP script, unfortunately I started coding after the 1800’s so I have no real clue what is going on as per usual…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
XSS in practice: how to exploit XSS in web applications (Walktrought into Google XSS game) —…

https://cdn-images-1.medium.com/max/1280/1*mGATJ1ASFK1S9VGn1kJEMw.jpeg
The best way to understanding is the practical one. Learn xss in practice by exploiting some vulnerable forms in Google XSS…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe RootMe Writeup

https://cdn-images-1.medium.com/max/838/1*HeVbdnr0qQo7y6jFKseI-g.jpeg
Lets Start.
So Task 1, Deploy the machine.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Kenyan Law Enforcement Agency Arrests Two Students Accused of Using Stolen Funds to Buy BTC

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hackers Also Have Financial Reporting And Quotas :)

https://cdn-images-1.medium.com/max/800/0*1tvWBGCdBfRN-5n7
“Chief Hacking Officer: Yevi, where are you at with London bank hack?”

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Giving Red Team Ops certs to women and LGBTQIA+ for Pride Month!
https://www.reddit.com/r/redteamsec/comments/vevrkp/giving_red_team_ops_certs_to_women_and_lgbtqia/

submitted by /u/VVX7 (https://www.reddit.com/user/VVX7)
[link] (https://twitter.com/VV_X_7/status/1537038139176394754) [comments] (https://www.reddit.com/r/redteamsec/comments/vevrkp/giving_red_team_ops_certs_to_women_and_lgbtqia/)

___________________________
@hacking_Attack
@Hacking_Video

How I found a No Rate Limit bug

Hello everyone,Continue reading on Medium »
Read more...

AlbusSec:- Penetration-List 011 API Vulnerabilities  — Sample

Hi Information Security folk, I hope you liked my previous article that was on Cross-Origin-Resource-Sharing(CORS) Misconfiguration…Continue reading on Medium »
Read more...

How I found a No Rate Limit bug
https://medium.com/@riddu.sarav/how-i-found-a-no-rate-limit-bug-9e347967d14c?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello everyone,Continue reading on Medium » (https://medium.com/@riddu.sarav/how-i-found-a-no-rate-limit-bug-9e347967d14c?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

AlbusSec:- Penetration-List 011 API Vulnerabilities  — Sample
https://as745591.medium.com/albussec-penetration-list-011-api-vulnerabilities-sample-e0be773e951b?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video