Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Chasing my true passion: Hacking
Since being just a few weeks into my Software Engineering Bootcamp — Telegraph Academy (Hack Reactor) — I have had no question that what…
Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖
___________________________
@hacking_Attack
@Hacking_Video
Chasing my true passion: Hacking
Since being just a few weeks into my Software Engineering Bootcamp — Telegraph Academy (Hack Reactor) — I have had no question that what…
Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
Photo
Black Hat Ethical Hacking
Internet scans find 1.6 million secrets leaked by websites
Internet scans find 1.6 million secrets leaked by websitesPost Views: 17
Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes
Security researchers have apparently discovered more than 1.6 million secrets leaked by websites, including more than 395,000 exposed by the one million most popular domains.
Modern web applications typically embed API keys, cryptographic secrets, and other credentials within JavaScript files in client-side source code.
Aided by a tool developed specifically for the task, researchers from RedHunt Labs sought information disclosure vulnerabilities via a “non-intrusive” probe of millions of website home pages and exceptions thrown by debug pages used in popular frameworks.
“The number of secrets exposed via the front end of hosts is alarmingly huge,” said Pinaki Mondal, security researcher at RedHunt Labs, in a blog post.
“Once a valid secret gets leaked, it paves the path for lateral movement amongst attackers, who may decide to abuse the business service account leading to financial losses or total compromise.” Millions of secretsThe first of two mammoth scans focused on the one million most heavily trafficked websites. It yielded 395,713 secrets, three quarters of which (77%) were related to Google services reCAPTCHA, Google Cloud, or Google OAuth.
Google’s reCAPTCHA alone accounted for more than half (212,127) of these secrets – and the top five exposed secret types was completed by messaging app LINE and Amazon Web Services (AWS).
Phase two, which involved scanning around 500 million hosts, surfaced 1,280,920 secrets, most commonly pertaining to Stripe, followed by Google reCAPTCHA, Google Cloud API, AWS, and Facebook.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png A majority of exposures across both phases – 77% – occurred in frontend JavaScript files.
Most JavaScript was served through content delivery networks (CDNs), with the Squarespace CDN leading the way with over 197,000 exposures.
Mondal blamed the “decades”-old problem of leaked secrets on the “complexities of the software development lifecycle”, adding: “As the code-base enlarges, developers often fail to redact the sensitive data before deploying it to production.” ‘Non-intrusive’ researchThe RedHunt Labs research team told The Daily Swig that they are still “continuously reporting the secrets through automation to their source domains provided they have an email [address] mentioned on their home page”.
The researchers said they had encountered no legal problems related to the research so far.
“We received a few abuse reports against the boxes on which the scan was run and we have handled them,” they said.
The “extremely non-intrusive” process involved no “more than a few HTTP requests per domain” and no written actions – “only read requests to HTTP URLs and JavaScript files were sent”.
Trending: New Linux rootkit, Syslogk uses magic packets to trigger backdoor The captured secrets, meanwhile, are “stored on an encrypted volume with access to very limited folks” and “will be disposed of after a month”, added the researchers.
Red Hunt Labs has open-sourced the tool developed for the research and created a demonstration video: Called HTTPLoot, it can crawl and scrape URLs asynchronously, check for leaked secrets in JavaScript files, find and complete forms to trigger error/debug pages, extract secrets from debug pages, and automatically detect tech stacks.
Trending: Offe[...]
___________________________
@hacking_Attack
@Hacking_Video
Internet scans find 1.6 million secrets leaked by websites
Internet scans find 1.6 million secrets leaked by websitesPost Views: 17
Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes
Security researchers have apparently discovered more than 1.6 million secrets leaked by websites, including more than 395,000 exposed by the one million most popular domains.
Modern web applications typically embed API keys, cryptographic secrets, and other credentials within JavaScript files in client-side source code.
Aided by a tool developed specifically for the task, researchers from RedHunt Labs sought information disclosure vulnerabilities via a “non-intrusive” probe of millions of website home pages and exceptions thrown by debug pages used in popular frameworks.
“The number of secrets exposed via the front end of hosts is alarmingly huge,” said Pinaki Mondal, security researcher at RedHunt Labs, in a blog post.
“Once a valid secret gets leaked, it paves the path for lateral movement amongst attackers, who may decide to abuse the business service account leading to financial losses or total compromise.” Millions of secretsThe first of two mammoth scans focused on the one million most heavily trafficked websites. It yielded 395,713 secrets, three quarters of which (77%) were related to Google services reCAPTCHA, Google Cloud, or Google OAuth.
Google’s reCAPTCHA alone accounted for more than half (212,127) of these secrets – and the top five exposed secret types was completed by messaging app LINE and Amazon Web Services (AWS).
Phase two, which involved scanning around 500 million hosts, surfaced 1,280,920 secrets, most commonly pertaining to Stripe, followed by Google reCAPTCHA, Google Cloud API, AWS, and Facebook.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png A majority of exposures across both phases – 77% – occurred in frontend JavaScript files.
Most JavaScript was served through content delivery networks (CDNs), with the Squarespace CDN leading the way with over 197,000 exposures.
Mondal blamed the “decades”-old problem of leaked secrets on the “complexities of the software development lifecycle”, adding: “As the code-base enlarges, developers often fail to redact the sensitive data before deploying it to production.” ‘Non-intrusive’ researchThe RedHunt Labs research team told The Daily Swig that they are still “continuously reporting the secrets through automation to their source domains provided they have an email [address] mentioned on their home page”.
The researchers said they had encountered no legal problems related to the research so far.
“We received a few abuse reports against the boxes on which the scan was run and we have handled them,” they said.
The “extremely non-intrusive” process involved no “more than a few HTTP requests per domain” and no written actions – “only read requests to HTTP URLs and JavaScript files were sent”.
Trending: New Linux rootkit, Syslogk uses magic packets to trigger backdoor The captured secrets, meanwhile, are “stored on an encrypted volume with access to very limited folks” and “will be disposed of after a month”, added the researchers.
Red Hunt Labs has open-sourced the tool developed for the research and created a demonstration video: Called HTTPLoot, it can crawl and scrape URLs asynchronously, check for leaked secrets in JavaScript files, find and complete forms to trigger error/debug pages, extract secrets from debug pages, and automatically detect tech stacks.
Trending: Offe[...]
___________________________
@hacking_Attack
@Hacking_Video
Black Hat Ethical Hacking
Internet scans find 1.6 million secrets leaked by websites | Black Hat Ethical Hacking
Security researchers have apparently discovered more than 1.6 million secrets leaked by websites, including more than 395,000 exposed by the one million most popular domains.
Hacking Articles Tips Tricks Videos Tutorials
Black Hat Ethical Hacking Internet scans find 1.6 million secrets leaked by websites Internet scans find 1.6 million secrets leaked by websitesPost Views: 17 Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png…
nsive Security Tool: Mobile Security Framework (MobSF)
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?
If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Redhunt Labs has set out four best practices for preventing and mitigating leaked secrets, including setting restrictions on access keys, centrally managing secrets in a restricted environment or config file, setting up alerts for leaked secrets, and continuously monitoring source code for information leakage issues.
Trending: Write up: Find hidden and encrypted secrets from any website Source: portswigger.net Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/malicious-chrome-extensions-feature-90x90.jpg Google Chrome extensions can be fingerprinted to track you online24 hours ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/android_malware-700x394-1-90x90.jpg New MaliBot Android banking malware spreads as a crypto miner4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Cisco_Systems_Bug-90x90.jpg Cisco Secure Email bug can let attackers bypass authentication5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/android-malware-90x90.jpg Android malware on the Google Play Store gets 2 million downloads6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Linux-90x90.jpg New Linux rootkit, Syslogk uses magic packets to trigger backdoor1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Header-Python-Packages-Blog-Final-Image-90x90.jpg PyPI package ‘keep’ mistakenly included a password stealer1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/venom_superhero_movie_tom11_hardy-wallpaper-1920x1080-980x551-1-90x90.jpg This new Linux malware is ‘almost impossible’ to detect2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/ran-download-33-1-e1639685560151-90x90.jpeg Black Basta Ransomware Teams Up with Malware Stalwart Qbot2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/InstallerFileTakeOver-Zero-Day-Security-Vulnerability-All-Windows-OS-Versions-90x90.jpg New ‘DogWalk’ Windows zero-day bug gets free unofficial patches2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/ipad_update_1200x675-90x90.jpg Security Fixes Won’t Require Full iOS Update in iOS 16, Will Be Installed Automatically2 weeks ago
The post Internet scans find 1.6 million secrets leaked by websites first appeared on Black Hat Ethical Hacking.
___________________________
@hacking_Attack
@Hacking_Video
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?
If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Redhunt Labs has set out four best practices for preventing and mitigating leaked secrets, including setting restrictions on access keys, centrally managing secrets in a restricted environment or config file, setting up alerts for leaked secrets, and continuously monitoring source code for information leakage issues.
Trending: Write up: Find hidden and encrypted secrets from any website Source: portswigger.net Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/malicious-chrome-extensions-feature-90x90.jpg Google Chrome extensions can be fingerprinted to track you online24 hours ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/android_malware-700x394-1-90x90.jpg New MaliBot Android banking malware spreads as a crypto miner4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Cisco_Systems_Bug-90x90.jpg Cisco Secure Email bug can let attackers bypass authentication5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/android-malware-90x90.jpg Android malware on the Google Play Store gets 2 million downloads6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Linux-90x90.jpg New Linux rootkit, Syslogk uses magic packets to trigger backdoor1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Header-Python-Packages-Blog-Final-Image-90x90.jpg PyPI package ‘keep’ mistakenly included a password stealer1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/venom_superhero_movie_tom11_hardy-wallpaper-1920x1080-980x551-1-90x90.jpg This new Linux malware is ‘almost impossible’ to detect2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/ran-download-33-1-e1639685560151-90x90.jpeg Black Basta Ransomware Teams Up with Malware Stalwart Qbot2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/InstallerFileTakeOver-Zero-Day-Security-Vulnerability-All-Windows-OS-Versions-90x90.jpg New ‘DogWalk’ Windows zero-day bug gets free unofficial patches2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/ipad_update_1200x675-90x90.jpg Security Fixes Won’t Require Full iOS Update in iOS 16, Will Be Installed Automatically2 weeks ago
The post Internet scans find 1.6 million secrets leaked by websites first appeared on Black Hat Ethical Hacking.
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
New method to force machine account to authenticate somewhere using Microsoft's Distributed File System (MS-DFSNM) protocol on \PIPE\netdfs.
https://external-preview.redd.it/j8ICZku9_kDS9iNRqTQsxFCYh8GLC8xxHTHKdTMMcrk.png?width=640&crop=smart&auto=webp&s=72130e19cabf10efdcc389d8ea1d83c2351c1e46 submitted by /u/Podalirius_
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
New method to force machine account to authenticate somewhere using Microsoft's Distributed File System (MS-DFSNM) protocol on \PIPE\netdfs.
https://external-preview.redd.it/j8ICZku9_kDS9iNRqTQsxFCYh8GLC8xxHTHKdTMMcrk.png?width=640&crop=smart&auto=webp&s=72130e19cabf10efdcc389d8ea1d83c2351c1e46 submitted by /u/Podalirius_
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
New method to force machine account to authenticate somewhere...
Posted in r/hacking by u/Podalirius_ • 7 points and 2 comments
hacking: security in practice
Log4j Vulnerability and Cloud Guard AppSec Machine Learning based Approach for Preemptive Prevention
submitted by /u/xkristineeeeese
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Log4j Vulnerability and Cloud Guard AppSec Machine Learning based Approach for Preemptive Prevention
submitted by /u/xkristineeeeese
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Log4j Vulnerability and Cloud Guard AppSec Machine Learning based...
Posted in r/hacking by u/xkristineeeeese • 21 points and 10 comments
hacking: security in practice
How to remote access a smart phone on my wifi
I have been using remote software with google desktop but it only allows for remote access to a computer and not a phone. Can I remote access a smartphone on my wifi network (both phones are mine) I have MAC address the password. But I want to feel like I’m in watch dogs.
submitted by /u/EnvironmentalAd3385
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
How to remote access a smart phone on my wifi
I have been using remote software with google desktop but it only allows for remote access to a computer and not a phone. Can I remote access a smartphone on my wifi network (both phones are mine) I have MAC address the password. But I want to feel like I’m in watch dogs.
submitted by /u/EnvironmentalAd3385
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
How to remote access a smart phone on my wifi
I have been using remote software with google desktop but it only allows for remote access to a computer and not a phone. Can I remote access a...
Vulnhub .ova to ISO image file converter
https://www.reddit.com/r/Pentesting/comments/vh8wwt/vulnhub_ova_to_iso_image_file_converter/
I’m setting up a cyber lab on ESXi, but I can’t really find any ISO images. I tried importing .ova files from Vulnhub but always get an error. Next I’m going to try to convert the .ova files to an ISO image. Is there any recommended software for this? submitted by /u/DigitalQuinn1 (https://www.reddit.com/user/DigitalQuinn1)
[link] (https://www.reddit.com/r/Pentesting/comments/vh8wwt/vulnhub_ova_to_iso_image_file_converter/) [comments] (https://www.reddit.com/r/Pentesting/comments/vh8wwt/vulnhub_ova_to_iso_image_file_converter/)
___________________________
@hacking_Attack
@Hacking_Video
https://www.reddit.com/r/Pentesting/comments/vh8wwt/vulnhub_ova_to_iso_image_file_converter/
I’m setting up a cyber lab on ESXi, but I can’t really find any ISO images. I tried importing .ova files from Vulnhub but always get an error. Next I’m going to try to convert the .ova files to an ISO image. Is there any recommended software for this? submitted by /u/DigitalQuinn1 (https://www.reddit.com/user/DigitalQuinn1)
[link] (https://www.reddit.com/r/Pentesting/comments/vh8wwt/vulnhub_ova_to_iso_image_file_converter/) [comments] (https://www.reddit.com/r/Pentesting/comments/vh8wwt/vulnhub_ova_to_iso_image_file_converter/)
___________________________
@hacking_Attack
@Hacking_Video
reddit
Vulnhub .ova to ISO image file converter
I’m setting up a cyber lab on ESXi, but I can’t really find any ISO images. I tried importing .ova files from Vulnhub but always get an error....
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Tails 4.18 OS — Live System
https://cdn-images-1.medium.com/max/600/1*b31hiO4ynbDLRrXWEFF4aQ.png
Tails 4.18 OS — Live System: Leave no trace on the computer
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Tails 4.18 OS — Live System
https://cdn-images-1.medium.com/max/600/1*b31hiO4ynbDLRrXWEFF4aQ.png
Tails 4.18 OS — Live System: Leave no trace on the computer
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Tails 4.18 OS — Live System
Tails 4.18 OS — Live System: Leave no trace on the computer
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Social Engineering | All in one tool for Phishing by Zphisher | Best tool for Phishing
https://cdn-images-1.medium.com/max/640/0*IExC6QXL0gYDG2aH.png
Social Engineering | All in one tool for Phishing by Zphisher | Best tool for Phishing
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Social Engineering | All in one tool for Phishing by Zphisher | Best tool for Phishing
https://cdn-images-1.medium.com/max/640/0*IExC6QXL0gYDG2aH.png
Social Engineering | All in one tool for Phishing by Zphisher | Best tool for Phishing
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Social Engineering | All in one tool for Phishing by Zphisher | Best tool for Phishing
Social Engineering | All in one tool for Phishing by Zphisher | Best tool for Phishing
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
OWASP Top 10: #1 — Injection
https://cdn-images-1.medium.com/max/600/1*1fOyXpTbDTDzc3baL-roiw.png
The only Top 10 list that actually f*cking matters.
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
OWASP Top 10: #1 — Injection
https://cdn-images-1.medium.com/max/600/1*1fOyXpTbDTDzc3baL-roiw.png
The only Top 10 list that actually f*cking matters.
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
OWASP Top 10: #1 — Injection
The only Top 10 list that actually f*cking matters.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
How to Identify Your Phone Got Hacked and How to Avoid It?
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
How to Identify Your Phone Got Hacked and How to Avoid It?
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
How to Identify Your Phone Got Hacked and How to Avoid It?
Without your knowledge, phone hacking can endanger your identity and privacy. Hacking techniques are always evolving and improving, making them more difficult to detect. This means that any amount of cyberattacks might blind the ordinary user. Fortunately…
Java Application -Server Side Template Injection
Description:Continue reading on Medium »
Read more...
Description:Continue reading on Medium »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
I made a script to brick any windows PC
Here is the link to the script
https://github.com/SomeoneAlt-86/pc-killer
So the way it works is lowering the system memory to very low so that windows is unable to boot once restarted.
submitted by /u/Ambitious-Cod-7354
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
I made a script to brick any windows PC
Here is the link to the script
https://github.com/SomeoneAlt-86/pc-killer
So the way it works is lowering the system memory to very low so that windows is unable to boot once restarted.
submitted by /u/Ambitious-Cod-7354
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
I made a script to brick any windows PC
Here is the link to the script [https://github.com/SomeoneAlt-86/pc-killer](https://github.com/SomeoneAlt-86/pc-killer) So the way it works is...
Msprobe - Finding All Things On-Prem Microsoft For Password Spraying And Enumeration
http://www.kitploit.com/2022/06/msprobe-finding-all-things-on-prem.html
___________________________
@hacking_Attack
@Hacking_Video
http://www.kitploit.com/2022/06/msprobe-finding-all-things-on-prem.html
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
Msprobe - Finding All Things On-Prem Microsoft For Password Spraying And Enumeration