hacking: security in practice
Someone tried to login to 4 websites with my login and DIFFERENT PASSWORDS. How could it happen?

This night someone tried to login to 4 random websites with my user/pass. They failed because of 2 step authentications I had in place. However, seems like the password they had was correct.
The 4 websites were: N26, ePayments, Coinbase, Upwork

1. ALL the 4 passwords were different (however, I have a certain logic behind my passwords and it is unlikely but still possible to figure it out if you know one of the passwords)
2. One of the users was even different (the first 3 were using one email and the 4th website was using another email as a user)
3. No one had physical access to my PC.
4. My passwords are stored in Google Chrome passwords. No one had access to my Google account last night or in the past. I checked.
5. I didn't login to 2 of the websites for a couple of years (in other words no chance I used them on someone else's PC recently)
6. There is one server with my Chrome user logged in on it. So in theory someone could access the server and from there it would log him in autoamtically to all the 4 websites.
Therefore, I checked the RDP connection details and there was nothing unauthorized.
I checked Teamviewer log and there was nothing there neither.
I checked Chrome history and there was nothing there.
I realize that all the 3 things maybe could have been deleted after using, but I really doubt that..
Morever, the hack logins were done from UK and my server is not in UK. Unless someone used a proxy on my server.. another big doubt.
7. My impression is that somehow someone discovered the passwords to all the 4 websites on the same night..
Does anyone else has an idea what can it be?

submitted by /u/favsync
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Can someone hack phone thru hotspot?

Just gave some stranger some hotspot, i immediately knew i did something stupid, so i changed all my passwords, should i still be worried?

submitted by /u/Nevhyo
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Account Takeover by OTP bypass

Hey everyone! This bypass is little bit interesting and you will get to learn a lot hopefully.Continue reading on Medium »
Read more...

Account Takeover by OTP bypass
https://codewithvamp.medium.com/account-takeover-by-otp-bypass-ec0cff67f516?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hey everyone! This bypass is little bit interesting and you will get to learn a lot hopefully.Continue reading on Medium » (https://codewithvamp.medium.com/account-takeover-by-otp-bypass-ec0cff67f516?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Account Takeover by OTP bypass

https://cdn-images-1.medium.com/max/1435/1*v1XYTJuN3e-ujNpok1riQA.png
Hey everyone! This bypass is little bit interesting and you will get to learn a lot hopefully.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Social Media: A Blessing or a Curse?

https://cdn-images-1.medium.com/max/2600/1*uYdh5caRRjcgKBnGC7mP0w.jpeg
“We don’t have a choice on whether we do social media, the question is how well we do it.”

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Tool for find Geo location

Is there any tool or site to find someones exact location using IP address I've search with some sites but it shows the ISP's location.

submitted by /u/Anti_mage2002
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Trackers: The Sound of 16-Bit

https://external-preview.redd.it/ms2oIVlbho7YiddtO6FSNdHyWucMVpNbbYu8bNctg3E.jpg?width=320&crop=smart&auto=webp&s=bfdd224ba70b38856754f79face1dc0644f78a88 submitted by /u/nangaparbat
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

VAmPI - Vulnerable REST API With OWASP Top 10 Vulnerabilities For Security Testing
http://www.kitploit.com/2022/06/vampi-vulnerable-rest-api-with-owasp.html

___________________________
@hacking_Attack
@Hacking_Video

The Vulnerable API (Based on OpenAPI 3)  VAmPI is a vulnerable API made with Flask and it includes vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) from the OWASP top 10 vulnerabilities for APIs. It was created as I wanted a vulnerable API to evaluate the efficiency of tools used to detect security issues in APIs. It includes a switch on/off to allow the API to be vulnerable or not while testing. This allows to cover better the cases for false positives/negatives. VAmPI can also be used for learning/teaching purposes. You can find a bit more details about the vulnerabilities in erev0s.com (https://erev0s.com/blog/vampi-vulnerable-api-security-testing/).
Features Based on OWASP Top 10 (https://www.kitploit.com/search/label/OWASP%20Top%2010) vulnerabilities for APIs. OpenAPI3 specs and Postman Collection included. Global switch on/off to have a vulnerable environment or not. Token-Based Authentication (https://www.kitploit.com/search/label/Authentication) (Adjust lifetime from within app.py) VAmPI's flow of actions is going like this: an unregistered user can see minimal information about the dummy users included in the API. A user can register and then login to be allowed using the token received during login to post a book. For a book posted the data accepted are the title and a secret about that book. Each book is unique for every user and only the owner of the book should be allowed to view the secret. A quick rundown of the actions included can be seen in the following table: Action Path Details GET /createdb Creates and populates the database with dummy data GET / VAmPI home GET /users/v1 Displays all users with basic information GET /users/v1/_debug Displays all details for all users POST /users/v1/register Register new user POST /users/v1/login Login to VAmPI GET /users/v1/{username} Displays user by username DELETE /users/v1/{username} Deletes user by username (Only Admins) PUT /users/v1/{username}/email Update a single users email PUT /users/v1/{username}/password Update users password GET /books/v1 Retrieves all books POST /books/v1 Add new book GET /books/v1/{book} Retrieves book by title along with secret For more details you can use a service like the swagger editor (https://editor.swagger.io/) supplying it the OpenAPI specification which can be found in the directory openapi_specs. List of Vulnerabilities SQLi Injection Unauthorized Password Change Broken Object Level Authorization Mass Assignment Excessive Data Exposure through debug endpoint User and Password Enumeration RegexDOS (Denial of Service) Lack of Resources & Rate Limiting Run it It is a Flask application so in order to run it you can install all requirements (https://www.kitploit.com/search/label/Requirements) and then run the app.py. To install all requirements simply run pip3 install -r requirements.txt and then python3 app.py. Or if you prefer you can also run it through docker or docker compose. Run it through Docker Build with docker build -t vampi_docker:latest .
and Run (remove the -d if you want to see the output in your terminal) docker run -d -p 5000:5000 vampi_docker:latest
[Note: if you run Docker on newer versions of the MacOS, use -p 5001:5000 to avoid conflicting with the AirPlay Receiver service. Alternatively, you could disable the AirPlay Receiver service in your System Preferences -> Sharing settings.] Run it through Docker Compose Assuming you've built the container per the above steps, run one instance securely (port 5001) and another insecurely (port 5002): docker compose up -d
Customizing token timeout and vulnerable environment or not If you would like to alter the timeout of the token created after login or if you want to change the environment not to be vulnerable then you can use a few ways depending how you run the application. If you run it like

___________________________
@hacking_Attack
@Hacking_Video

normal with python3 app.py then all you have to do is edit the alive and vuln variables defined in the app.py itself. The alive variable is measured in seconds, so if you put 100, then the token expires after 100 seconds. The vuln variable is like boolean, if you set it to 1 then the application is vulnerable, and if you set it to 0 the application is not vulnerable. If you run it through Docker, then you must either pass environment variables to the docker run command or edit the Dockerfile and rebuild. Docker run example: docker run -d -e vulnerable=0 -e tokentimetolive=300 -p 5000:5000 vampire_docker:latest One nice feature to running it this way is you can startup a 2nd container with vulnerable=1 on a different port and flip easily between the two. In the Dockerfile you will find two environment variables being set, the ENV vulnerable=1 and the ENV tokentimetolive=60. Feel free to change it before running the docker build command. Picture from freepik - www.freepik.com (https://www.freepik.com/vectors/party)

Download VAmPI (https://github.com/erev0s/VAmPI)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Cómo atacar un SQL Server

https://cdn-images-1.medium.com/max/600/1*nVzHDMxlsbYXDa9EQTnP-g.png
Hacemos un escaneo al servidor con nmap.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
VAmPI - Vulnerable REST API With OWASP Top 10 Vulnerabilities For Security Testing

https://blogger.googleusercontent.com/img/a/AVvXsEiWkXGsybGWZUFpzkXOC_NJd4CzE6cH17TIxQ1Nqufn4lPbV4MDeFlPjFi4F3uT1aLy-GiXz0ER3msn0e9_jGzRc6VOePnLCU_NzBMT6HGyM9O6iis8xQzL7oOZ8zsTEH2P-DSc-Ml-W0UnaIZI3k0OkLsdfO2NFXc_bztQZE-vgkeVTm0xG-U_3OG-=w640-h336 The Vulnerable API (Based on OpenAPI 3)

VAmPI is a vulnerable API made with Flask and it includes vulnerabilities from the OWASP top 10 vulnerabilities for APIs. It was created as I wanted a vulnerable API to evaluate the efficiency of tools used to detect security issues in APIs. It includes a switch on/off to allow the API to be vulnerable or not while testing. This allows to cover better the cases for false positives/negatives. VAmPI can also be used for learning/teaching purposes. You can find a bit more details about the vulnerabilities in erev0s.com. Features* Based on OWASP Top 10 vulnerabilities for APIs.
* OpenAPI3 specs and Postman Collection included.
* Global switch on/off to have a vulnerable environment or not.
* Token-Based Authentication (Adjust lifetime from within app.py)

VAmPI's flow of actions is going like this: an unregistered user can see minimal information about the dummy users included in the API. A user can register and then login to be allowed using the token received during login to post a book. For a book posted the data accepted are the title and a secret about that book. Each book is unique for every user and only the owner of the book should be allowed to view the secret.

A quick rundown of the actions included can be seen in the following table:
Action Path Details GET /createdb Creates and populates the database with dummy data GET / VAmPI home GET /users/v1 Displays all users with basic information GET /users/v1/_debug Displays all details for all users POST /users/v1/register Register new user POST /users/v1/login Login to VAmPI GET /users/v1/{username} Displays user by username DELETE /users/v1/{username} Deletes user by username (Only Admins) PUT /users/v1/{username}/email Update a single users email PUT /users/v1/{username}/password Update users password GET /books/v1 Retrieves all books POST /books/v1 Add new book GET /books/v1/{book} Retrieves book by title along with secret
For more details you can use a service like the swagger editor supplying it the OpenAPI specification which can be found in the directory openapi_specs. List of Vulnerabilities* SQLi Injection
* Unauthorized Password Change
* Broken Object Level Authorization
* Mass Assignment
* Excessive Data Exposure through debug endpoint
* User and Password Enumeration
* RegexDOS (Denial of Service)
* Lack of Resources & Rate Limiting Run itIt is a Flask application so in order to run it you can install all requirements and then run the app.py. To install all requirements simply run pip3 install -r requirements.txtand then python3 app.py.

Or if you prefer you can also run it through docker or docker compose. Run it through DockerBuild with docker build -t vampi_docker:latest . and Run (remove the -d if you want to see the output in your terminal) docker run -d -p 5000:5000 vampi_docker:latest [Note: if you run Docker on newer versions of the MacOS, use -p 5001:5000to avoid conflicting with the AirPlay Receiver service. Alternatively, you could disable the AirPlay Receiver service in your System Preferences -> Sharing settings.] Run it through Docker ComposeAssuming you've built the container per the above steps, run one instance securely (port 5001) and another insecurely (port 5002): docker compose up -d Customizing token timeout and vulnerable environment or notIf you would like to alter the timeout of the token created after login or if you want to change th[...]

___________________________
@hacking_Attack
@Hacking_Video