ses boolean Save the response bodies from API endpoints so you can view them in the report. saveScreenshots boolean Save browser screenshots for the pages crawled so you can view them in the report. clickButtons boolean (Experimental feature) on each page crawled, click all the buttons on that page and record any API requests made. Can be useful on sites which have lots of user interactions through modals, popups etc. xhrTimeout integer How long to wait for XHR requests to complete while crawling each page. (seconds) pageTimeout integer How long to wait for page to load while crawling. (seconds) headless boolean Set this to false for the crawler to open a chrome browser so you can see the crawling happening live. unAuthorizedStatusCodes array The HTTP response status codes that decide whether or not an API endpoint or page are authorized for the user requesting it. Optionally define a function responseIsAuthorised to determine if a request was authorized. Example: [401, 403, 404]ignoreLinksIncluding array Do not crawl URLs containing any strings in this array. For example, if set to ["/logout"]then the url: http://localhost:3000/logout will not be crawled. Optionally define a function ignoreLink(url) below to determine if a URL should be crawled or not. ignoreAPIrequestsIncluding array Do not record API records made to URLs which contain any of the the strings in this array. Optionally define a function ignoreApiRequest(url) to determine if a request should be recorded or not. ignoreButtonsIncluding array If clickButtons set to true, then do not click buttons who's outer HTML contains any of the strings in this array. Optionally define a function ignoreButton(url) below. loginConfig object Configure how the browser will login to your web app. Optionally define an async function loginFunction(page, username, password). (More about this below). cookiesTriggeringPage string (optional) when authenticationType=cookie, this will set a page so that the intruder will browse to this page and then capture the cookies from the browser. This can be useful if the site sets the path field on cookies. Defaults to options.baseUrl. tokenTriggeringPage string (optional) when authenticationType=token, this will set a page so that the the intruder will browse to this page and then capture the authorisationHeaders from the intercepted API requests. This can be useful if the site's baseUrl does not make any API requests and so cannot capture the auth headers from that page. Defaults to options.baseUrl.
Configuring the Login

There are two ways to configure the login in your config file:

1. Using the default login mechanism which uses puppeteer to enter the username and password into the specified inputs and then click the specified submit button. This can be configured by setting the loginConfigoption in your config file like this. See this example too. "loginConfig": {
"url": "http://localhost/login",
"usernameXpath": "input[name=email]",
"passwordXpath": "input[name=password]",
"submitXpath": "#login-button"
}1. If your login form is more complex and involves more user interaction then you can define your own puppeteer function in your config file like this. See this example too. "loginFunction": async function(page, username, password){
await page.goto('http://localhost:3001/users/sign_in');
await page.waitForSelector('input[type=email]');
await page.waitForSelector('input[type=password]');

await page.type('input[type=email]', username);
await page.type('input[type=password]', password);

await page.tap('input[type=submit]');
await page.waitFor(500);

return;
}Don't foget to run the authcov test-logincommand in headful mode in order to verify the browser logs in successfully. ContributingClone the repo and run npm install. Best to use node version 17.1.0.

Unit Tests

Unit tests: $ npm test test/unitEnd2End tests:

First download and run the example app. [...]

___________________________
@hacking_Attack
@Hacking_Video

Then run the tests: $ npm test test/e2eDownload Authcov

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Why hasn’t the Advanced Encryption Standard(AES) never been compromised?

It’s believed the AES-256 is vulnerable if an attacker can access a user's key. This is why AES is just one aspect of keeping data secure.

There has yet to be a single instance of AES-256 ever being hacked into, at least non ever documented, but that hasn't been for a lack of trying.

The first crack attempts at AES was in 2011, against AES-128 encryption where a biclique attack was used. Biclique is around four times faster at attacking encryption than the standard brute force attack seen most often. It failed.

However a team of Microsoft and Dutch researchers have released a report detailing a theoretical attack on the Advanced Encryption Standard (AES).

The attack, to be presented in early December, utilizes a complex process known as biclique analysis that advances a technique that originally targeted just hashing algorithms.

I also want to address the elephant in the room, which is ‘military-grade’ doesn’t actually exist. At least not in the terms “average handy thinks it is”

The US military uses the military-grade AES encryption algorithm on two fronts. The first being secret (unclassified) information is specific to AES-128.

The second is for top-secret (classified) information, which uses AES-256. Whenever information is handled on both levels through a single entity, AES-256 is adopted as the standard AES encryption algorithm.

Encryption is basically chopping up information into something incoherent.

Military-grade encryption is AES-256, which differs from AES-128 and AES-192 by having a larger key size in the AES encryption algorithm.

Essentially, AES-256 uses more processing power to encrypt and decrypt information making it more difficult for intruders to crack.

But lets be honest, It would take upwards of a billion years for an attack to force its way through a 126-bit key, let alone AES-128. So long as the data encryption has been implemented properly, there is no known attack that would compromise the protection afforded by AES.

submitted by /u/Simonvilla1
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Threat Intelligence Services Are Universally Valued by IT Staff

Most of those surveyed are concerned about AI-based attacks and deepfakes, but suggest that their organization is ready.

Hacking on Medium
HackThisSite Extended Basic 13 Mission

https://cdn-images-1.medium.com/max/700/0*YQhdHgy3Rl6bRtOC.jpg
Problem

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Enumeration of Email address using registration functionality API in WealthSimple

https://cdn-images-1.medium.com/max/1341/1*1MnMXqoH1nifxFI5ahytQQ.png
Description

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
WealthSimple Application fails to protect against password spraying

https://cdn-images-1.medium.com/max/1341/1*jtzgBQxsZ56VHbKOseCUUA.png
WealthSimple application allows a user to login by using the API “https://api.production.wealthsimple.com/v1/oauth/v2/token". There are 2…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

DEF CON Groups VR Events
https://www.reddit.com/r/Pentesting/comments/vk582t/def_con_groups_vr_events/

___________________________
@hacking_Attack
@Hacking_Video

submitted by /u/NeverDoubtGreatness (https://www.reddit.com/user/NeverDoubtGreatness)
[link] (https://www.dcgvr.org/cfp.html) [comments] (https://www.reddit.com/r/Pentesting/comments/vk582t/def_con_groups_vr_events/)

___________________________
@hacking_Attack
@Hacking_Video

How I stopped hunting on HackerOne after years because they stole my $50k. And so should you.
https://medium.com/@skavans_/how-i-stopped-hunting-on-hackerone-after-years-because-they-stole-my-50k-and-so-should-you-7328b8af30f1?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

You may have heard about Belarusian security researcher xnwup and the story of blocking his $25k on HackerOne. It was pretty resonant at…Continue reading on Medium » (https://medium.com/@skavans_/how-i-stopped-hunting-on-hackerone-after-years-because-they-stole-my-50k-and-so-should-you-7328b8af30f1?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

How I stopped hunting on HackerOne after years because they stole my $50k. And so should you.

You may have heard about Belarusian security researcher xnwup and the story of blocking his $25k on HackerOne. It was pretty resonant at…Continue reading on Medium »
Read more...

hacking: security in practice
I am a troll

oh Great Londini expose me.

submitted by /u/AnonymousOldWanker
[link] [comments]

Kali Linux Tutorials
NodeSecurityShield : A Developer And Security Engineer Friendly Package For Securing NodeJS Applications

NodeSecurityShield is a Developer and Security Engineer friendly package for Securing NodeJS Applications.

Inspired by the log4J vulnerability (CVE-2021-44228) which can be exploited because an application can make arbitrary network calls.

We felt there is an need for an application to declare what privileges it can have so that exploitation of such vulnerabilities becomes harder.

To achieve this, NSS (Node Security Shield) has Resource Access Policy.

Resource Access Policy (RAP)

Resource Access Policy is similar to CSP(Content Security Policy).

It lets the developer/security engineer declare what resources an application should access. And Node Security Shield will enforce it.

Installation

Install Node Security Shield using npm

npm install nodesecurityshield

Usage

// Require Node Security Shield
let nodeSecurityShield = require(‘nodesecurityshield’);
// Enable Attack Monitoring and/or Blocking
nodeSecurityShield.enableAttackMonitoring(resourceAccessPolicy ,callbackFunction);

Sample resourceAccessPolicy

const resourceAccessPolicy = {
“outBoundRequest” : {
“blockedDomains” : [“.123.com”, “stats.abc.com”, ‘xyz.com’], “allowedDomains” : [“.domdog.io”]
}
};

Sample callbackFunction for Attack Monitoring

var callbackFunction = function (violationEvent) {
console.log(violationEvent);
}

Sample callbackFunction for Attack Blocking

var callbackFunction = function (violationEvent) {
throw new Error(“Request Blocked. It violates declared Resource Access Policy.”)
}

Integrating with Sentry

Sample resourceAccessPolicyto integrate with Sentry

const resourceAccessPolicy = {
“reportUriHosts” : [“ingest.sentry.io”],
“outBoundRequest” : {
“blockedDomains” : [“.123.com”, “stats.abc.com”, ‘xyz.com’], “allowedDomains” : [“.domdog.io”]
}
};

Features

* Attack Monitoring
* Outbound Network Calls

* Attack Blocking
* Outbound Network Calls
Download

Kali Linux Tutorials
Chlonium : Chromium Cookie Import / Export Tool

Chlonium is an application designed for cloning Chromium Cookies.

From Chromium 80 and upwards, cookies are encrypted using AES-256 GCM, with a state key which is stored in the Local State file. This state key is encrypted using DPAPI. This is a change from older versions, which used DPAPI to encrypt each cookie item in the cookie database. What this means is that if you have the state key, you will always be able to decrypt the cookie database offline, without needing continual access to DPAPI keys.

This essentially makes cookie databases “portable”, meaning they can be moved from machine to machine, provided you have dumped the state key. The cookies themselves need to be re-encrypted when they are imported, because the state keys will differ on each user profile & machine. This can be done using the same process as decryption, by first decrypting the state key from the “target” browser, and then re-encrypting each item with the new key.

The project is written in C# and has two separate components to it. The first component, chlonium.exeis the collector binary. It simply decrypts the state key and prints it. Keep a note of this key and you can decrypt cookies in the future by downloading the Cookiesdatabase file whenever you need updated cookies. By default it will attempt to decrypt the Chrome state key. If you want to dump the state key for another browser (e.g. Edge), you can specify a path to the key.

For example:

Chlonium.exe “c:\users\user\AppData\Local\Microsoft\Edge\User Data\Local State”
[+] Statekey = 3Cms3YxFXVyJRUbulYCnxqY2dO/jubDkYBQBoYIvqfc=

The second component, ChloniumUI.exeis the “importer” tool. This takes care of decrypting a given Cookies database file with a given state key, re-encrypting the values with the current users state key, and importing the cookies into your chosen browser. You run this on the machine you want to import the cookies into.

To use it, run the ChloniumUI.exeexecutable. Enter the previously extracted state key, choose the Cookiesfile you wish to import, and select the browser you wish the import the cookies into. Now click “Import Cookies” and the cookies will be imported. ChloniumUIcurrently supports three Chromium based browsers: Edge, Chrome and Vivaldi. Additional browsers can be added in Browsers.cs. This adds the unintended benefit of being able to import an Edge cookie file into Chrome, or vice versa (for example), though it’s probably not a good idea given that the user-agent will mismatch.

Important Note: When importing the cookie file into your browser, all old cookies are cleared! A backup is copied to the current directory (with relevant time stamp). If you need to restore the previous cookies, simply copy the backup file over the Cookiesfile. WhyTools such as Mimikatz and SharpChromium already have the capability to dump Chrome 80 cookies, why another tool?

This tool is specifically aimed at making it easier to import cookies into another browser. Whilst these tools do a great job of dumping Chromium cookies (and more!), I wanted to have something that let me easily import into another browser. Third-party cookie manager plugins exist, but I’ve always found these fiddly and prone to failure. CloniumUIis designed to make this process easier by importing the cookies directly into your browser’s sqlite database.

Whilst this project comes with the chlonium.execollector, which aids in dumping the state key, this is really only an example. Other tools such as Mimikatz will also dump the state key for you, in a potentially stealthier way (depending on your operating environment, execution method etc.). Additionally, SharpDPAPI will allow you to decrypt the Chromium state key file if you have DPAPI state keys, current password, [...]