Cookie Tracking and Stealing using Cross-Site Scripting
https://www.reddit.com/r/Pentesting/comments/virb7t/cookie_tracking_and_stealing_using_crosssite/

___________________________
@hacking_Attack
@Hacking_Video

submitted by /u/Arth_K (https://www.reddit.com/user/Arth_K)
[link] (https://medium.com/@coderarth/cookie-tracking-and-stealing-using-cross-site-scripting-4159111b1a12) [comments] (https://www.reddit.com/r/Pentesting/comments/virb7t/cookie_tracking_and_stealing_using_crosssite/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Malware analysis tools

Malware samples

Hi all,

I have to test few malware analysis tools for my organisation.

1st - Soc radar

2nd - any.run

3rd - Joe sandbox

How do I compare them ? I suspect I should run few malware files and then compare the results. Is that right approach ?

If yes, how do I get some sample malicious executable files to test.

Some of the parameters to test them. Please let me know if I missed some.

a) Ease of use b) TTP and Mitre mapping correctness c) Static analysis capabilities d) Dynamic execution capabilities e) IOC collection

Appreciate any input.

Thanks

submitted by /u/Illustrious_Value765
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hire A Hacker

https://cdn-images-1.medium.com/max/2600/1*mDcIkL2U8qPl483IjAMtSw.jpeg
Phones Spy is a group of hackers for hire. They are online 24 hours a day, 7 days a week, 365 days a year. Really. Literally always online…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe: Simple CTF— Walkthrough

https://cdn-images-1.medium.com/max/835/1*AggGjpqsxtY1RUd-iobLiA.png
Hi! I am making these walkthroughs to keep myself motivated to learn cyber security, and ensure that I remember the knowledge gained by…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hack Like A Jedi | Kenobi | TryHackMe

https://cdn-images-1.medium.com/max/1964/0*fH0Mq7JniHyP3G0M.png
Hello World and welcome to HaXeZ, in this post we’re going to be channeling our inner Jedi and taking on the TryHackMe Kenobi room. This…

Continue reading on System Weakness »

___________________________
@hacking_Attack
@Hacking_Video

Pwning.eth Earns Whitehat Hall Of Fame NFT For Aurora Find

Pwning.eth has earned a Whitehat Hall of Fame NFT for his recent critical bug find in Aurora, forever securing his spot in hacking history…Continue reading on Immunefi »
Read more...

Black Hat Ethical Hacking
Recon Tool: JFScan

Recon Tool: JFScanPost Views: 14
Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 4 Minutes GitHub Link
JFScan by nullt3r, is a super-fast port scanning and service discovery using Masscan and Nmap. Scan large networks with Masscan and use Nmap’s scripting abilities to discover information about services. It also allows you to generate a report so you can analyze it and spend time focusing on the results in a stylish manner. DescriptionKilling features* Perform a large-scale scans using Nmap! Allows you to use Masscan to scan targets and execute Nmap on detected ports with custom settings. Nmap on steroids. *
* Scans targets in variety of formats, including domain names!
* Results can be produced in domain:port format.
* It works in stdin/stdout mode, allowing you to stream results to/from other tools.
* Auto-adjusts a packet rate for masscan so you don’t have to (disable it by –disable-auto-rate).
* Produces a standard Nmap XML report.
* Fully supports IPv6.
* Supports scope control, only targets defined in scope will be scanned.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course
The JFScan is a wrapper around a super-fast port scanner Masscan. It’s designed to simplify work when scanning for open ports on targets in a variety of formats. The JFScan accepts a target in the following forms: URL, domain, or IP (including CIDR). You can specify a file with targets using argument or use stdin. It also allows you to output only the results and chain it with other tools like Nuclei. The domain:port output of JFScan is crucial if you want to discover vulnerabilities in web applications as the virtual host decides which content will be served.

Finally, it can scan discovered ports with Nmap. You can also define custom options and use Nmap’s amazing scripting capabilities.

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/usage1.png

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/usage2.png
JFScans logic of input and output processing:

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/logic-of-input-and-output-processing.png
Trending: Offensive Security Tool: Mobile Security Framework (MobSF) Usagehttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/usage.png ExampleScan targets for only for ports 80 and 443 with rate of 10 kpps: $ jfscan -p 80,443 --targets targets.txt -r 10000Scan targets for top 1000 ports: $ jfscan --top-ports 1000 1.1.1.1/24You can also specify targets on stdin and pipe it to nuclei: $ cat targets.txt | jfscan --top-ports 1000 -q | httpx -silent | nucleiOr as positional parameter: $ jfscan --top-ports 1000 1.1.1.1/24 -q | httpx -silent | nucleiOr everything at once, the JFScan just does not care and scans all the targets specified: $ echo target1 | jfscan --top-ports 1000 target2 --targets targets.txt -q | httpx -silent | nucleiUtilize nmap to gather more info about discovered services: $ cat targets.txt | jfscan -p 0-65535 --nmap --nmap-options="-sV --scripts ssh-auth-methods"The targets.txt can contain targets in the following forms (IPv6 similarly): http://domain.com/domain.com1.2.3.41.2.3.0/241.1.1.1-1.1.1.30Trending: Write up: Find hidden and encrypted secrets from any website Installation1. Before installation, make sure you have the latest version of Masscan installed (tested version is 1.3.2).

First, install a libpcap-dev (Debian based distro) or libcap-devel (Centos based distro): sudo apt install libpcap-devNext, clone the official repository an[...]

___________________________
@hacking_Attack
@Hacking_Video

d install: sudo apt-get --assume-yes install git make gccgit clone https://github.com/robertdavidgraham/masscancd masscanmakesudo make install2. The Masscan requires root permissions to run. Since running binaries under root is not good idea, we will set a CAP_NET_RAW capability to the binary: sudo setcap CAP_NET_RAW+ep /usr/bin/masscan3. For installation of JFscan a python3 and pip3 is required. sudo apt install python3 python3-pipInstall JFScan: $ git clone https://github.com/nullt3r/jfscan.git$ cd jfscan$ pip3 install .If you can’t run the jfscan directly from command line you should check if $HOME/.local/bin is in your path.

Add the following line to your ~/.zshrc or ~/.bashrc: export PATH="$HOME/.local/bin:$PATH"* When scanning smaller network ranges, you can just use nmap directly, there is no need to use JFScan. You can reach up to 70% of the speed of JFScan using the following options: nmap -Pn -n -v yourTargetNetwork/26 -p- --min-parallelism 64 --min-rate 20000 --min-hostgroup 64 --randomize-hosts -sS -sVAs always, expect some false positives/negatives. DisclaimerAs always, you are responsible for your own actions. Attacking targets without prior mutual consent is illegal.
Trending: Recon Tool: Domain Analyzer https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/lupo-90x90.png Digital Forensics Tool: Lupo – Malware IOC Extractor6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Mobile-Security-Framework-MobSF-90x90.png Offensive Security Tool: Mobile Security Framework (MobSF)7 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/metabigor-90x90.png OSINT Tool: Metabigor2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Domain-Analyzer-90x90.png Recon Tool: Domain Analyzer3 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/deepsleep-90x90.png Offensive Security Tool: DeepSleep4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/qsreplace-90x90.png Recon Tool: qsreplace4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/Arjun-90x90.png Offensive Security Tool: Arjun1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/Dorks-collections-list-90x90.png Recon Tool: Dorks collections list1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/malicious-pdf-90x90.png Offensive Security Tool: malicious-pdf1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/scanmycode-90x90.png Static Code Analysis Tool: scanmycode-ce2 months ago
The post Recon Tool: JFScan first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Pwning.eth Earns Whitehat Hall Of Fame NFT For Aurora Find
https://medium.com/immunefi/pwning-eth-earns-whitehat-hall-of-fame-nft-for-aurora-find-fd4c52c4a025?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Pwning.eth has earned a Whitehat Hall of Fame NFT for his recent critical bug find in Aurora, forever securing his spot in hacking history…Continue reading on Immunefi » (https://medium.com/immunefi/pwning-eth-earns-whitehat-hall-of-fame-nft-for-aurora-find-fd4c52c4a025?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

WEF - Wi-Fi Exploitation Framework
http://www.kitploit.com/2022/06/wef-wi-fi-exploitation-framework.html

___________________________
@hacking_Attack
@Hacking_Video

A fully offensive framework to the 802.11 networks and protocols with different types of attacks for WPA and WEP, automated (https://www.kitploit.com/search/label/Automated) hash cracking, bluetooth hacking and much more. I recommend you my alfa adapter: Alfa AWUS036ACM, which works really great with both, 2.4 and 5 Ghz Tested and supported in Kali Linux, Parrot OS, Arch Linux and Ubuntu *However it's not finished and may have issues, try it at your own risk.* If you have any issue please, contact me or create a issue
SUPPORTED ATTACKS: Deauthentication Attack Authentication Attack Beacon Flood Attack PKMID Attack EvilTwin Attack Passive/Stealthy Attack Pixie Dust Attack Null Pin Attack Chopchop Attack Replay Attack Michael Exploitation (https://www.kitploit.com/search/label/Exploitation) Attack Caffe-Latte Attack Jamming, Reading and Writing bluetooth connections GPS Spoofing with HackRF FEATURES: Log generatorWPA/WPA2, WPS and WEP AttacksAuto handshake crackingMultiple templates for EvilTwin attackCheck monitor mode and it status2Ghz and 5Ghz attacksCustom wordlist selectorAuto detect requirementsBluetooth (https://www.kitploit.com/search/label/Bluetooth) support (Jamming, Reading, Writing)USAGE: Common usage of the framework wef -i wlan0 # Your interface name might be different or wef --interface wlan0 Once the application is working, type 'help' to view more functions and useful info. If you don't want to scan APs with every attack you can do something like this: set name my-wifi # To especify the name to attack
set time 60 # To define the total duration of the attacks that ask for the time
set packets 15 # To define the amount of packets that some attacks will send REQUIREMENTS: Don't install them manually, WEF takes care of that if you don't already have them aircrack-ng
reaver
mdk4
macchanger
hashcat
xterm
hcxtools
pixiewps
python3
btlejack
crackle
php
hostadp
dnsmasq
INSTALLATION: Checkout the Wiki (https://github.com/D3Ext/WEF/wiki/Installation) DEMO: Demo on a Parrot OS with Kitty terminal

___________________________
@hacking_Attack
@Hacking_Video