Hacking Articles Tips Tricks Videos Tutorials

7 views05:19

hacking: security in practice
Without adequate authentication for admin page of Multi-Function Printer, the MFPs admin page has become a major target for data breaches. Analysis report on data lekage due to Multi-Function Printer vulnerability.

https://external-preview.redd.it/Ai6EGga_0Fp2cn9jIDJvhn1W6E7LUrrK_Rkb2R2U9L8.jpg?width=640&crop=smart&auto=webp&s=d2e5fe4ea83d4b66303a3fc9d659d4b44ae954db submitted by /u/Late_Ice_9288
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Without adequate authentication for admin page of Multi-Function...

Posted in r/hacking by u/Late_Ice_9288 • 1 point and 0 comments

7 viewsedited 05:19

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
There's a group of hackers holding hostage most Ubisoft account names.

They use bots to auto create accounts with names by a certain number of characters. They pull accounts with rare skins and sell them at high value.

My friends and I are annoyed because we can't have names without dots and dashes.

How are these guys doing this? What can I do about it?

submitted by /u/aGuyOnTheMoon
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

There's a group of hackers holding hostage most Ubisoft account names.

They use bots to auto create accounts with names by a certain number of characters. They pull accounts with rare skins and sell them at high...

5 viewsedited 05:19

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Phishing site URL sent to my phone is inaccessible to my PC. What's the deal?

So a scammer sent a link for an old bank account designed to phish my credentials. I can access it from my phone and it pops up as my former banks login screen. Now when I go to scan the URL with my PC, it doesn't exist. I first tried pinging the URL and then traceroute, nmap, metasploit, a few more etc... None pull up an IP/server. Nothing found. The URL is 100% without typo. I haven't been involved in pentesting or netsec in a few years and am wondering what the deal is. What's changed? Why am I able to access the URL from the text message on my phone but not my PC? It's a .php site. What am I missing? This is a new encounter for me.

submitted by /u/Day2Late
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Phishing site URL sent to my phone is inaccessible to my PC....

So a scammer sent a link for an old bank account designed to phish my credentials. I can access it from my phone and it pops up as my former banks...

4 viewsedited 05:19

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Freaked out…

Help .. so freaked out.

Middle of WhatsApp chat conversation with my sister she says did you just send a pic it disappeared? It happened once last week also? Is this a glitch or has she or I been hacked? So creeped out.

submitted by /u/rockandharderplace
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Freaked out…

Help .. so freaked out. Middle of WhatsApp chat conversation with my sister she says did you just send a pic it disappeared? It happened once...

4 viewsedited 05:19

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Free and Anonymous VOIP services

Are there any free and Anonymous VOIP services which offer phone numbers for use without asking for any personal information. The free part is not 100% necessary but would be preferable. I basically want a burner phone number which I can use to login to sites which require a phone number for verifying identity. I do not wish to give away my actual phone number to some less than trustworthy sites which I might need to visit.

submitted by /u/juggernaut_2000
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Free and Anonymous VOIP services

Are there any free and Anonymous VOIP services which offer phone numbers for use without asking for any personal information. The free part is not...

4 viewsedited 05:20

Hacking Articles Tips Tricks Videos Tutorials

4 views06:17

Hacking Articles Tips Tricks Videos Tutorials

Photo

Kali Linux Tutorials

GraphqlThreatMatrix : GraphQL Threat Framework

graphql-threat-matrix was built for bug bounty hunters, security researchers and hackers to assist with uncovering vulnerabilities.

4 viewsedited 06:17

Hacking Articles Tips Tricks Videos Tutorials

3 views06:17

Hacking Articles Tips Tricks Videos Tutorials

Photo

Kali Linux Tutorials
Malicious-Pdf : Generate A Bunch Of Malicious Pdf Files With Phone-Home Functionality

Malicious-Pdf Generate ten different malicious pdf files with phone-home functionality. Can be used with Burp Collaborator or Interact.sh

Used for penetration testing and/or red-teaming etc. I created this tool because i needed a third party tool to generate a bunch of PDF files with various links.

Usage

python3 malicious-pdf.py burp-collaborator-url

Output will be written as: test1.pdf, test2.pdf, test3.pdf etc in the current directory.

Do not use the https:// etc prefix on the url argument.

Purpose

* Test web pages/services accepting PDF-files
* Test security products
* Test PDF readers
* Test PDF converters
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

Malicious-Pdf : Generate A Bunch Of Malicious Pdf Files

Malicious-Pdf Generate ten different malicious pdf files with phone-home functionality. Can be used with Burp Collaborator or Interact.sh

3 viewsedited 06:17

Hacking Articles Tips Tricks Videos Tutorials

Kali Linux Tutorials Graphql-Threat-Matrix : GraphQL Threat Framework Used By Security Professionals graphql-threat-matrix was built for bug bounty hunters, security researchers and hackers to assist with uncovering vulnerabilities across multiple GraphQL…

4 views06:17

Hacking Articles Tips Tricks Videos Tutorials

/s.w.org/images/core/emoji/14.0.0/72x72/274c.png https://s.w.org/images/core/emoji/14.0.0/72x72/274c.png https://s.w.org/images/core/emoji/14.0.0/72x72/2705.png https://s.w.org/images/core/emoji/14.0.0/72x72/26a0.png https://s.w.org/images/core/emoji/14.0.0/72x72/274c.png For Penetration TestersUse graphw00f to fingerprint a target GraphQL API and determine the backend implementation. Download

___________________________
@hacking_Attack
@Hacking_Video

4 viewsedited 06:17

Hacking Articles Tips Tricks Videos Tutorials

5 views06:57

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
Chasing my true passion: Hacking

Since being just a few weeks into my Software Engineering Bootcamp — Telegraph Academy (Hack Reactor) — I have had no question that what…

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

5 viewsedited 06:57

Hacking Articles Tips Tricks Videos Tutorials

5 views08:19

Hacking Articles Tips Tricks Videos Tutorials

Photo

Black Hat Ethical Hacking
Internet scans find 1.6 million secrets leaked by websites

Internet scans find 1.6 million secrets leaked by websitesPost Views: 17
Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes
Security researchers have apparently discovered more than 1.6 million secrets leaked by websites, including more than 395,000 exposed by the one million most popular domains.
Modern web applications typically embed API keys, cryptographic secrets, and other credentials within JavaScript files in client-side source code.

Aided by a tool developed specifically for the task, researchers from RedHunt Labs sought information disclosure vulnerabilities via a “non-intrusive” probe of millions of website home pages and exceptions thrown by debug pages used in popular frameworks.

“The number of secrets exposed via the front end of hosts is alarmingly huge,” said Pinaki Mondal, security researcher at RedHunt Labs, in a blog post.

“Once a valid secret gets leaked, it paves the path for lateral movement amongst attackers, who may decide to abuse the business service account leading to financial losses or total compromise.” Millions of secretsThe first of two mammoth scans focused on the one million most heavily trafficked websites. It yielded 395,713 secrets, three quarters of which (77%) were related to Google services reCAPTCHA, Google Cloud, or Google OAuth.

Google’s reCAPTCHA alone accounted for more than half (212,127) of these secrets – and the top five exposed secret types was completed by messaging app LINE and Amazon Web Services (AWS).

Phase two, which involved scanning around 500 million hosts, surfaced 1,280,920 secrets, most commonly pertaining to Stripe, followed by Google reCAPTCHA, Google Cloud API, AWS, and Facebook.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png A majority of exposures across both phases – 77% – occurred in frontend JavaScript files.

Most JavaScript was served through content delivery networks (CDNs), with the Squarespace CDN leading the way with over 197,000 exposures.

Mondal blamed the “decades”-old problem of leaked secrets on the “complexities of the software development lifecycle”, adding: “As the code-base enlarges, developers often fail to redact the sensitive data before deploying it to production.” ‘Non-intrusive’ researchThe RedHunt Labs research team told The Daily Swig that they are still “continuously reporting the secrets through automation to their source domains provided they have an email [address] mentioned on their home page”.

The researchers said they had encountered no legal problems related to the research so far.

“We received a few abuse reports against the boxes on which the scan was run and we have handled them,” they said.

The “extremely non-intrusive” process involved no “more than a few HTTP requests per domain” and no written actions – “only read requests to HTTP URLs and JavaScript files were sent”.
Trending: New Linux rootkit, Syslogk uses magic packets to trigger backdoor The captured secrets, meanwhile, are “stored on an encrypted volume with access to very limited folks” and “will be disposed of after a month”, added the researchers.

Red Hunt Labs has open-sourced the tool developed for the research and created a demonstration video: Called HTTPLoot, it can crawl and scrape URLs asynchronously, check for leaked secrets in JavaScript files, find and complete forms to trigger error/debug pages, extract secrets from debug pages, and automatically detect tech stacks.
Trending: Offe[...]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking

Internet scans find 1.6 million secrets leaked by websites | Black Hat Ethical Hacking

Security researchers have apparently discovered more than 1.6 million secrets leaked by websites, including more than 395,000 exposed by the one million most popular domains.

8 viewsedited 08:19

Hacking Articles Tips Tricks Videos Tutorials

Black Hat Ethical Hacking Internet scans find 1.6 million secrets leaked by websites Internet scans find 1.6 million secrets leaked by websitesPost Views: 17 Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png…

nsive Security Tool: Mobile Security Framework (MobSF)
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Redhunt Labs has set out four best practices for preventing and mitigating leaked secrets, including setting restrictions on access keys, centrally managing secrets in a restricted environment or config file, setting up alerts for leaked secrets, and continuously monitoring source code for information leakage issues.
Trending: Write up: Find hidden and encrypted secrets from any website Source: portswigger.net Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/malicious-chrome-extensions-feature-90x90.jpg Google Chrome extensions can be fingerprinted to track you online24 hours ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/android_malware-700x394-1-90x90.jpg New MaliBot Android banking malware spreads as a crypto miner4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Cisco_Systems_Bug-90x90.jpg Cisco Secure Email bug can let attackers bypass authentication5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/android-malware-90x90.jpg Android malware on the Google Play Store gets 2 million downloads6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Linux-90x90.jpg New Linux rootkit, Syslogk uses magic packets to trigger backdoor1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Header-Python-Packages-Blog-Final-Image-90x90.jpg PyPI package ‘keep’ mistakenly included a password stealer1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/venom_superhero_movie_tom11_hardy-wallpaper-1920x1080-980x551-1-90x90.jpg This new Linux malware is ‘almost impossible’ to detect2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/ran-download-33-1-e1639685560151-90x90.jpeg Black Basta Ransomware Teams Up with Malware Stalwart Qbot2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/InstallerFileTakeOver-Zero-Day-Security-Vulnerability-All-Windows-OS-Versions-90x90.jpg New ‘DogWalk’ Windows zero-day bug gets free unofficial patches2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/ipad_update_1200x675-90x90.jpg Security Fixes Won’t Require Full iOS Update in iOS 16, Will Be Installed Automatically2 weeks ago
The post Internet scans find 1.6 million secrets leaked by websites first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

4 viewsedited 08:19

Hacking Articles Tips Tricks Videos Tutorials

4 views09:21

Hacking Articles Tips Tricks Videos Tutorials

Photo

hacking: security in practice
New method to force machine account to authenticate somewhere using Microsoft's Distributed File System (MS-DFSNM) protocol on \PIPE\netdfs.

https://external-preview.redd.it/j8ICZku9_kDS9iNRqTQsxFCYh8GLC8xxHTHKdTMMcrk.png?width=640&crop=smart&auto=webp&s=72130e19cabf10efdcc389d8ea1d83c2351c1e46 submitted by /u/Podalirius_
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

New method to force machine account to authenticate somewhere...

Posted in r/hacking by u/Podalirius_ • 7 points and 2 comments

4 viewsedited 09:21

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Log4j Vulnerability and Cloud Guard AppSec Machine Learning based Approach for Preemptive Prevention

submitted by /u/xkristineeeeese
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Log4j Vulnerability and Cloud Guard AppSec Machine Learning based...

Posted in r/hacking by u/xkristineeeeese • 21 points and 10 comments

4 viewsedited 09:21

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
How to remote access a smart phone on my wifi

I have been using remote software with google desktop but it only allows for remote access to a computer and not a phone. Can I remote access a smartphone on my wifi network (both phones are mine) I have MAC address the password. But I want to feel like I’m in watch dogs.

submitted by /u/EnvironmentalAd3385
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

How to remote access a smart phone on my wifi

I have been using remote software with google desktop but it only allows for remote access to a computer and not a phone. Can I remote access a...

5 viewsedited 09:21

About

Blog

Apps

Platform