Hey Everyone!Continue reading on Medium » (https://medium.com/@codingkarma/not-so-obvious-php-vulnerabilities-388a3b7bf2dc?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Big Bounty Recon — Automate GHDB techniques

In this tutorial I want to tell you how to use Big Bounty Recon hacking tool as information gathering tool with google hacking database.Continue reading on Medium »
Read more...

Not So Obvious PHP Vulnerabilities

Hey Everyone!Continue reading on Medium »
Read more...

hacking: security in practice
Why is it there are all these stickers at hacker spaces that say “put Kevin back?”

Like what’s the deal? Did Mitnick do something worth being put back? I mean what happened I don’t get it.

submitted by /u/notburneddown
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
10 New Hacker Types to Be Careful

https://cdn-images-1.medium.com/max/600/0*qdbuo2XyzaiTDSZx.jpg
10 New Hacker Types are,

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
大型Defi橋樑遭盜，上億美金不知去向？去中心化行業現危機？

https://cdn-images-1.medium.com/max/1100/1*Niiy618Hikk422rA0F2jEw.png
黑客從所謂「區塊鏈橋樑」Horizon偷取了價值1億美元的加密貨幣，這只是本年度去中心化金融世界之中其中一次大型的搶劫案 — — 支持加密貨幣遊戲Axie…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Lucifer- Penetration Testing Tool for Automated Network Penetration Testing

https://cdn-images-1.medium.com/max/1024/0*ax9cCCggC3Fw8R3I.png
Lucifer — A Powerful Penetration Tool For Automating Penetration Tasks Such As Local Privilege Escalation, Enumeration, Exfiltration

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Top 25 Cybersecurity and Ethical Hacking Interview Questions With Answers

https://cdn-images-1.medium.com/max/640/0*fHRq9hm7odoLy7we.png
Top 25 Cybersecurity Interview Questions With Answers

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Here are some tips to keep your Facebook ID safe from hacking

https://cdn-images-1.medium.com/max/600/1*GxnDpsOjdlgAhRfeo7sWkQ.jpeg
বর্তমানে অনেক কম ইন্টারনেট ইউজার রয়েছেন যারা ফেসবুক সম্পর্কে জানেন না । ফেসবুক ইউজার যেমন দিন দিন বাড়ছে তেমনি বাড়ছে ফেসবুক প্রতারনাও ।…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Sextortion Scam | How it happens | How to Protect | Expert Byte by Mohit Yadav

https://cdn-images-1.medium.com/max/640/0*xDqWWPK9bIEWO75n.png
What is Sextortion Scam and how to protect yourself from a Sextortion scam?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Nimc2 - A C2 Fully Written In Nim

https://blogger.googleusercontent.com/img/a/AVvXsEgbUBkjnui51_MxKT9krwsTbURAUvoyXZaE6iSAzRup0I3fnUxbkkXYuVCZYYqHDxj8ZsGFo61M_XlJ7p82mkshNZTqfg5BeORjM4Pd1kwzFJsuQAUfz2Gtlrdrb_na0iLvR329yKcRIPQDFYsoIoRIHz4M_vpSWNX0m4vP9LqsxAoLPCXmYpSV9TNI=w640-h378
nimc2 is a very lightweight C2 written fully in nim (implant & server). If you want to give it a try check out the wiki to learn how to install and use nimc2. It's features include:

* Windows & Linux implant generation
* TCP socket communication (with HTTP communication coming soon)
* Ability to create as many listeners as you want
* A nice task system
* Easy to use CLI
* Loot system
* ...and a lot more features coming soon
Join the nimc2 discord server to discuss about this project.

Wiki

Getting started

* Installation
* Nimc2 crash course
* FAQs

Guides

* Managing listeners
* Creating implants
* Interacting and managing clients

Operating System support

The server is fully supported on Linux but unknown on Windows. The client is fully supported on Windows, with lack of features on Linux.

Server Support

All server features are available on both Linux and Windows platforms. You might need to install additional dependencies on both platform for cross-platform compilation (check installation wiki page)

Command Support
Feature Windows Support Linux Support shell command
✅

✅
cmd command
✅

❌
info command
✅

⚠️
msgbox command
✅

❌
processes command
✅

❌
tokeninfo command
✅

❌
download command
✅

✅
upload command
✅

✅
screenshot command
✅

❌
✅ yes, complete

⚠️ yes, but partially

❌ no, does not work at all

Support Me

You can support me by becoming a patreon at https://www.patreon.com/d4rckh (You also get some exclusive things)
Download Nimc2

___________________________
@hacking_Attack
@Hacking_Video

Pentest internships
https://www.reddit.com/r/Pentesting/comments/vn9pu6/pentest_internships/

Hello guys just want to ask your advice on how do you guys find pentesting internships, like what platforms would you use to find such opportunities, most of the time I can only find pentesting roles for people working full time. Im looking for internships in Singapore by the way. Any tips and tricks will be greatly appreciated thanks!! submitted by /u/Da1k0nBacon (https://www.reddit.com/user/Da1k0nBacon)
[link] (https://www.reddit.com/r/Pentesting/comments/vn9pu6/pentest_internships/) [comments] (https://www.reddit.com/r/Pentesting/comments/vn9pu6/pentest_internships/)

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Dozens of cryptography libraries vulnerable to private key theft

Dozens of cryptography libraries vulnerable to private key theftPost Views: 25
Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes
According to Konstantinos Chalkias, a cryptographer at MystenLabs who discovered and reported the vulnerability, attackers could exploit the bug to steal private keys from cryptocurrency wallets.
A poor implementation of Ed25519, a popular digital signature algorithm, has left dozens of cryptography libraries vulnerable to attacks.

Some but not yet all of the vulnerable technologies have been patched. Where’s your Ed at?Ed25519 is often used as a modern replacement for the Elliptic Curve Digital Signature Algorithm (ECDSA). Ed25519 is more open, secure, and faster than ECDSA, which is why it has become very popular in many sectors, especially in blockchain and cryptocurrency platforms.

“The main benefits against ECDSA is that EdDSA sig[nature]s are deterministic and users don’t need [access to] a secure Random Number Generator [RNG] to sign a transaction,” Chalkias told The Daily Swig. “Why is this useful? because a user’s laptop or IoT device might not have a good source of entropy or support a weak RNG function.”

Numerous security incidents have shown that poor random generation can result in private keys being leaked or stolen. One notable example was the private key leaks of PlayStation 3, whose technology relies on the ECDSA algorithm.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png Pre-computing public keysThe standard specification of Ed25519 message signing involves providing the algorithm with a message and private key. The function will use the private key to compute the public key and sign the message. Some libraries provide a variant of the message signing function that also takes the pre-computed public key as an input parameter. There are some benefits to this implementation.

“Recomputing the public key each time would result in a slower algorithm (it adds an extra scalar to elliptic curve point multiplication to derive the public key, which reduces the speed by almost 2x, potentially making it even slower than ECDSA),” Chalkias said.

“And generally, in cryptography, it’s good hygiene to avoid accessing the private key many times. If we allowed the public key derivation on each signing invocation, then this implies we need to access it twice, once to sign, and once to derive the public key.”

However, the modification also creates a security loophole in the library.

Chalkias found that some libraries were allowing arbitrary public keys as inputs without checking if the input public key corresponds to the input private key. This shortcoming means that an attacker could use the signing function as an Oracle, perform crypto-analysis and ultimately get at secrets. For example, an attacker who can’t access the private key but can access the signing mechanism through an API call could use several public keys and messages to gradually build up insights into private key parameters.
Trending: Internet scans find 1.6 million secrets leaked by websites Trending: Recon Tool: JFScan Libraries at riskChalkias initially found 26 libraries that were vulnerable to the attack. The list was later extended to 40 libraries. The security researcher also found several online services that were vulnerable to the same kind of attack, including a fintech API.

“In some applications when keyGen fails or a clean-up process deletes [...]

___________________________
@hacking_Attack
@Hacking_Video