hacking: security in practice
Someone Online Knew My Details

I was playing a game online with randomers. One randomer who never moved during the game for like 10 minutes suddenly messages the chat saying the City in which I live in. Then they said the mobile network provider I use.

I left the game before they could say anything more personal.

Should I be worried?

submitted by /u/Astapore
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Basic XSS Bypasses

Alert(1)Continue reading on Medium »
Read more...

Dark Reading: Attacks/Breaches
APT Groups Swarming on VMware Servers with Log4Shell

CISA tells organizations running VMware servers without Log4Shell mitigations to assume compromise.

Dark Reading: Attacks/Breaches
Why We're Getting Vulnerability Management Wrong

Security is wasting time and resources patching low or no risk bugs. In this post, we examine why security practitioners need to rethink vulnerability management.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Łamanie Hashy

Uwaga! Jeśli w artykule pojawia się znak ” — “, pamiętaj że są to dwa myślniki obok siebie, bez spacji.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
https://webdevelopmentcompany2016.blogspot.com/2022/06/free-cccam-generator.html

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Basic XSS Bypasses

https://cdn-images-1.medium.com/max/1212/1*zeiqpkSeh7J0preXWc4dEQ.png
Alert(1)

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Start Your Career in Cybersecurity: Hackaday Ghidra Exercises Walkthrough Part 1A

https://cdn-images-1.medium.com/max/800/1*5XyX3Fy7xHRnLTfT8JMIYQ.jpeg
Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Jak dostać się do komputera zabezpieczonego hasłem? Część 1/3 - Linux

Uwaga! Jeśli w artykule pojawia się znak ” — “, pamiętaj że są to dwa myślniki obok siebie, bez spacji.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The Myth of the Free Market

https://cdn-images-1.medium.com/max/640/1*11C8eY2TaCV2KcQCjAp-vQ.jpeg
Basic Rules of the Economy — a simple primer

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Your Cryptocurrency Marketing Plan

https://cdn-images-1.medium.com/max/640/1*b6moAe-O7nd8JBlz8cLRYQ.jpeg
Your Cryptocurrency Marketing Plan

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Authcov - Web App Authorisation Coverage Scanning

https://blogger.googleusercontent.com/img/a/AVvXsEj36bLS8fHyV6OFhURu8yMRi3wBjqDbo4-m_w3SIjXvrZ1WsvL1YvkwaFCVVx4p7yU_gJGrw_n-JT2DkuduNQt2SpMc6mwVm9On71_k17RYcdFdHtoOR0E4aW34KQ3eUQCzYsPFCH58rGvNIPqS_gK6qkgL0CEx1G7WWmTcOI0ZkyKJiMZG4L6Oab-n=w640-h248 Web app authorisation coverage scanning. IntroductionAuthCov crawls your web application using a Chrome headless browser while logged in as a pre-defined user. It intercepts and logs API requests as well as pages loaded during the crawling phase. In the next phase it logs in under a different user account, the "intruder", and attempts to access each of one of the API requests or pages discovered previously. It repeats this step for each intruder user defined. Finally it generates a detailed report listing the resources discovered and whether or not they are accessible to the intruder users.
An example report generated from scanning a local Wordpress instance: https://blogger.googleusercontent.com/img/a/AVvXsEiMm2q5T0X4N44wLimfLmNdLZ8Z1rS2IHj6wM4G-Q0mGjN_QI-_hHxFK6LN0Ok-7GVFVpxvV70bbCZ7dI4u9dWfR33EiVdql-d6D72YDSKsGyLLh7B6KppwB4xk_W6vhjmTRcSGzGgv5GJdfXCAa7OoHnzFqcYD72I3-5HR5AbDupRD8TNVT1-Li8VM=w640-h422 Features* Works with single-page-applications and traditional multi-page-applications
* Handles token-based and cookie-based authentication mechanisms
* Generates an in-depth report in HTML format
* Screenshots of each page crawled can be viewed in the report InstallationInstall the latest node version. Then run: $ npm install -g authcovUsage1. Generate a config for the site you want to scan [NOTE: It has to end in .mjsextension]: $ authcov new myconfig.mjs1. Update the values in myconfig.mjs
2. Test your configuration values by running this command to ensure the browser is logging in successfully. $ authcov test-login myconfig.mjs --headless=false 1. Crawl your site: $ authcov crawl myconfig.mjs1. Attempt intrusion against the resources discovered during the crawling phase: $ authcov intrude myconfig.mjs1. View the generated report at: ./tmp/report/index.htmlConfigurationThe following options can be set in your config file:
option type description baseUrl string The base URL of the site. This is where the crawler will start from. crawlUser object The user to crawl the site under. Example: {"username": "admin", "password": "1234"}intruders array The users who will intrude on the api endpoints and pages discovered during the crawling phase. Generally these will be users the same or less privilege than the crawlUser. To intrude as a not-logged-in user, add a user with the username "Public" and password null. Example: [{"username": "john", "password": "4321"}, {"username": "Public", "password": null}]type string Is this a single-page-application (i.e. javascript frontend which queries an API backend) or a more "traditional" multi-page-application. (Choose "mpa"or "spa"). authenticationType string Does the site authenticate users by using the cookies sent by the browser, or by a token sent in a request header? For an MPA this will almost always be set to "cookie". In an SPA this could be either "cookie"or "token". authorisationHeaders array Which request headers are needed to be sent in order to authenticate a user? If authenticationType=cookie, then this should be set to ["cookie"]. If authenticationType=token, then this will be something like: ["X-Auth-Token"]. maxDepth integer The maximum depth with which to crawl the site. Recommend starting at 1 and then try crawling at higher depths to make sure the crawler is able to finish fast enough. verboseOutput boolean Log at a verbose level, useful for debugging. saveRespon[...]

___________________________
@hacking_Attack
@Hacking_Video