Hacking on Medium
Łamanie Hashy

Uwaga! Jeśli w artykule pojawia się znak ” — “, pamiętaj że są to dwa myślniki obok siebie, bez spacji.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
https://webdevelopmentcompany2016.blogspot.com/2022/06/free-cccam-generator.html

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Basic XSS Bypasses

https://cdn-images-1.medium.com/max/1212/1*zeiqpkSeh7J0preXWc4dEQ.png
Alert(1)

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Start Your Career in Cybersecurity: Hackaday Ghidra Exercises Walkthrough Part 1A

https://cdn-images-1.medium.com/max/800/1*5XyX3Fy7xHRnLTfT8JMIYQ.jpeg
Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Jak dostać się do komputera zabezpieczonego hasłem? Część 1/3 - Linux

Uwaga! Jeśli w artykule pojawia się znak ” — “, pamiętaj że są to dwa myślniki obok siebie, bez spacji.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The Myth of the Free Market

https://cdn-images-1.medium.com/max/640/1*11C8eY2TaCV2KcQCjAp-vQ.jpeg
Basic Rules of the Economy — a simple primer

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Your Cryptocurrency Marketing Plan

https://cdn-images-1.medium.com/max/640/1*b6moAe-O7nd8JBlz8cLRYQ.jpeg
Your Cryptocurrency Marketing Plan

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Authcov - Web App Authorisation Coverage Scanning

https://blogger.googleusercontent.com/img/a/AVvXsEj36bLS8fHyV6OFhURu8yMRi3wBjqDbo4-m_w3SIjXvrZ1WsvL1YvkwaFCVVx4p7yU_gJGrw_n-JT2DkuduNQt2SpMc6mwVm9On71_k17RYcdFdHtoOR0E4aW34KQ3eUQCzYsPFCH58rGvNIPqS_gK6qkgL0CEx1G7WWmTcOI0ZkyKJiMZG4L6Oab-n=w640-h248 Web app authorisation coverage scanning. IntroductionAuthCov crawls your web application using a Chrome headless browser while logged in as a pre-defined user. It intercepts and logs API requests as well as pages loaded during the crawling phase. In the next phase it logs in under a different user account, the "intruder", and attempts to access each of one of the API requests or pages discovered previously. It repeats this step for each intruder user defined. Finally it generates a detailed report listing the resources discovered and whether or not they are accessible to the intruder users.
An example report generated from scanning a local Wordpress instance: https://blogger.googleusercontent.com/img/a/AVvXsEiMm2q5T0X4N44wLimfLmNdLZ8Z1rS2IHj6wM4G-Q0mGjN_QI-_hHxFK6LN0Ok-7GVFVpxvV70bbCZ7dI4u9dWfR33EiVdql-d6D72YDSKsGyLLh7B6KppwB4xk_W6vhjmTRcSGzGgv5GJdfXCAa7OoHnzFqcYD72I3-5HR5AbDupRD8TNVT1-Li8VM=w640-h422 Features* Works with single-page-applications and traditional multi-page-applications
* Handles token-based and cookie-based authentication mechanisms
* Generates an in-depth report in HTML format
* Screenshots of each page crawled can be viewed in the report InstallationInstall the latest node version. Then run: $ npm install -g authcovUsage1. Generate a config for the site you want to scan [NOTE: It has to end in .mjsextension]: $ authcov new myconfig.mjs1. Update the values in myconfig.mjs
2. Test your configuration values by running this command to ensure the browser is logging in successfully. $ authcov test-login myconfig.mjs --headless=false 1. Crawl your site: $ authcov crawl myconfig.mjs1. Attempt intrusion against the resources discovered during the crawling phase: $ authcov intrude myconfig.mjs1. View the generated report at: ./tmp/report/index.htmlConfigurationThe following options can be set in your config file:
option type description baseUrl string The base URL of the site. This is where the crawler will start from. crawlUser object The user to crawl the site under. Example: {"username": "admin", "password": "1234"}intruders array The users who will intrude on the api endpoints and pages discovered during the crawling phase. Generally these will be users the same or less privilege than the crawlUser. To intrude as a not-logged-in user, add a user with the username "Public" and password null. Example: [{"username": "john", "password": "4321"}, {"username": "Public", "password": null}]type string Is this a single-page-application (i.e. javascript frontend which queries an API backend) or a more "traditional" multi-page-application. (Choose "mpa"or "spa"). authenticationType string Does the site authenticate users by using the cookies sent by the browser, or by a token sent in a request header? For an MPA this will almost always be set to "cookie". In an SPA this could be either "cookie"or "token". authorisationHeaders array Which request headers are needed to be sent in order to authenticate a user? If authenticationType=cookie, then this should be set to ["cookie"]. If authenticationType=token, then this will be something like: ["X-Auth-Token"]. maxDepth integer The maximum depth with which to crawl the site. Recommend starting at 1 and then try crawling at higher depths to make sure the crawler is able to finish fast enough. verboseOutput boolean Log at a verbose level, useful for debugging. saveRespon[...]

___________________________
@hacking_Attack
@Hacking_Video

ses boolean Save the response bodies from API endpoints so you can view them in the report. saveScreenshots boolean Save browser screenshots for the pages crawled so you can view them in the report. clickButtons boolean (Experimental feature) on each page crawled, click all the buttons on that page and record any API requests made. Can be useful on sites which have lots of user interactions through modals, popups etc. xhrTimeout integer How long to wait for XHR requests to complete while crawling each page. (seconds) pageTimeout integer How long to wait for page to load while crawling. (seconds) headless boolean Set this to false for the crawler to open a chrome browser so you can see the crawling happening live. unAuthorizedStatusCodes array The HTTP response status codes that decide whether or not an API endpoint or page are authorized for the user requesting it. Optionally define a function responseIsAuthorised to determine if a request was authorized. Example: [401, 403, 404]ignoreLinksIncluding array Do not crawl URLs containing any strings in this array. For example, if set to ["/logout"]then the url: http://localhost:3000/logout will not be crawled. Optionally define a function ignoreLink(url) below to determine if a URL should be crawled or not. ignoreAPIrequestsIncluding array Do not record API records made to URLs which contain any of the the strings in this array. Optionally define a function ignoreApiRequest(url) to determine if a request should be recorded or not. ignoreButtonsIncluding array If clickButtons set to true, then do not click buttons who's outer HTML contains any of the strings in this array. Optionally define a function ignoreButton(url) below. loginConfig object Configure how the browser will login to your web app. Optionally define an async function loginFunction(page, username, password). (More about this below). cookiesTriggeringPage string (optional) when authenticationType=cookie, this will set a page so that the intruder will browse to this page and then capture the cookies from the browser. This can be useful if the site sets the path field on cookies. Defaults to options.baseUrl. tokenTriggeringPage string (optional) when authenticationType=token, this will set a page so that the the intruder will browse to this page and then capture the authorisationHeaders from the intercepted API requests. This can be useful if the site's baseUrl does not make any API requests and so cannot capture the auth headers from that page. Defaults to options.baseUrl.
Configuring the Login

There are two ways to configure the login in your config file:

1. Using the default login mechanism which uses puppeteer to enter the username and password into the specified inputs and then click the specified submit button. This can be configured by setting the loginConfigoption in your config file like this. See this example too. "loginConfig": {
"url": "http://localhost/login",
"usernameXpath": "input[name=email]",
"passwordXpath": "input[name=password]",
"submitXpath": "#login-button"
}1. If your login form is more complex and involves more user interaction then you can define your own puppeteer function in your config file like this. See this example too. "loginFunction": async function(page, username, password){
await page.goto('http://localhost:3001/users/sign_in');
await page.waitForSelector('input[type=email]');
await page.waitForSelector('input[type=password]');

await page.type('input[type=email]', username);
await page.type('input[type=password]', password);

await page.tap('input[type=submit]');
await page.waitFor(500);

return;
}Don't foget to run the authcov test-logincommand in headful mode in order to verify the browser logs in successfully. ContributingClone the repo and run npm install. Best to use node version 17.1.0.

Unit Tests

Unit tests: $ npm test test/unitEnd2End tests:

First download and run the example app. [...]

___________________________
@hacking_Attack
@Hacking_Video

Then run the tests: $ npm test test/e2eDownload Authcov

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Why hasn’t the Advanced Encryption Standard(AES) never been compromised?

It’s believed the AES-256 is vulnerable if an attacker can access a user's key. This is why AES is just one aspect of keeping data secure.

There has yet to be a single instance of AES-256 ever being hacked into, at least non ever documented, but that hasn't been for a lack of trying.

The first crack attempts at AES was in 2011, against AES-128 encryption where a biclique attack was used. Biclique is around four times faster at attacking encryption than the standard brute force attack seen most often. It failed.

However a team of Microsoft and Dutch researchers have released a report detailing a theoretical attack on the Advanced Encryption Standard (AES).

The attack, to be presented in early December, utilizes a complex process known as biclique analysis that advances a technique that originally targeted just hashing algorithms.

I also want to address the elephant in the room, which is ‘military-grade’ doesn’t actually exist. At least not in the terms “average handy thinks it is”

The US military uses the military-grade AES encryption algorithm on two fronts. The first being secret (unclassified) information is specific to AES-128.

The second is for top-secret (classified) information, which uses AES-256. Whenever information is handled on both levels through a single entity, AES-256 is adopted as the standard AES encryption algorithm.

Encryption is basically chopping up information into something incoherent.

Military-grade encryption is AES-256, which differs from AES-128 and AES-192 by having a larger key size in the AES encryption algorithm.

Essentially, AES-256 uses more processing power to encrypt and decrypt information making it more difficult for intruders to crack.

But lets be honest, It would take upwards of a billion years for an attack to force its way through a 126-bit key, let alone AES-128. So long as the data encryption has been implemented properly, there is no known attack that would compromise the protection afforded by AES.

submitted by /u/Simonvilla1
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Threat Intelligence Services Are Universally Valued by IT Staff

Most of those surveyed are concerned about AI-based attacks and deepfakes, but suggest that their organization is ready.

Hacking on Medium
HackThisSite Extended Basic 13 Mission

https://cdn-images-1.medium.com/max/700/0*YQhdHgy3Rl6bRtOC.jpg
Problem

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Enumeration of Email address using registration functionality API in WealthSimple

https://cdn-images-1.medium.com/max/1341/1*1MnMXqoH1nifxFI5ahytQQ.png
Description

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video