Hacking on Medium
Top 25 Cybersecurity and Ethical Hacking Interview Questions With Answers

https://cdn-images-1.medium.com/max/640/0*fHRq9hm7odoLy7we.png
Top 25 Cybersecurity Interview Questions With Answers

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Here are some tips to keep your Facebook ID safe from hacking

https://cdn-images-1.medium.com/max/600/1*GxnDpsOjdlgAhRfeo7sWkQ.jpeg
বর্তমানে অনেক কম ইন্টারনেট ইউজার রয়েছেন যারা ফেসবুক সম্পর্কে জানেন না । ফেসবুক ইউজার যেমন দিন দিন বাড়ছে তেমনি বাড়ছে ফেসবুক প্রতারনাও ।…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Sextortion Scam | How it happens | How to Protect | Expert Byte by Mohit Yadav

https://cdn-images-1.medium.com/max/640/0*xDqWWPK9bIEWO75n.png
What is Sextortion Scam and how to protect yourself from a Sextortion scam?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Nimc2 - A C2 Fully Written In Nim

https://blogger.googleusercontent.com/img/a/AVvXsEgbUBkjnui51_MxKT9krwsTbURAUvoyXZaE6iSAzRup0I3fnUxbkkXYuVCZYYqHDxj8ZsGFo61M_XlJ7p82mkshNZTqfg5BeORjM4Pd1kwzFJsuQAUfz2Gtlrdrb_na0iLvR329yKcRIPQDFYsoIoRIHz4M_vpSWNX0m4vP9LqsxAoLPCXmYpSV9TNI=w640-h378
nimc2 is a very lightweight C2 written fully in nim (implant & server). If you want to give it a try check out the wiki to learn how to install and use nimc2. It's features include:

* Windows & Linux implant generation
* TCP socket communication (with HTTP communication coming soon)
* Ability to create as many listeners as you want
* A nice task system
* Easy to use CLI
* Loot system
* ...and a lot more features coming soon
Join the nimc2 discord server to discuss about this project.

Wiki

Getting started

* Installation
* Nimc2 crash course
* FAQs

Guides

* Managing listeners
* Creating implants
* Interacting and managing clients

Operating System support

The server is fully supported on Linux but unknown on Windows. The client is fully supported on Windows, with lack of features on Linux.

Server Support

All server features are available on both Linux and Windows platforms. You might need to install additional dependencies on both platform for cross-platform compilation (check installation wiki page)

Command Support
Feature Windows Support Linux Support shell command
✅

✅
cmd command
✅

❌
info command
✅

⚠️
msgbox command
✅

❌
processes command
✅

❌
tokeninfo command
✅

❌
download command
✅

✅
upload command
✅

✅
screenshot command
✅

❌
✅ yes, complete

⚠️ yes, but partially

❌ no, does not work at all

Support Me

You can support me by becoming a patreon at https://www.patreon.com/d4rckh (You also get some exclusive things)
Download Nimc2

___________________________
@hacking_Attack
@Hacking_Video

Pentest internships
https://www.reddit.com/r/Pentesting/comments/vn9pu6/pentest_internships/

Hello guys just want to ask your advice on how do you guys find pentesting internships, like what platforms would you use to find such opportunities, most of the time I can only find pentesting roles for people working full time. Im looking for internships in Singapore by the way. Any tips and tricks will be greatly appreciated thanks!! submitted by /u/Da1k0nBacon (https://www.reddit.com/user/Da1k0nBacon)
[link] (https://www.reddit.com/r/Pentesting/comments/vn9pu6/pentest_internships/) [comments] (https://www.reddit.com/r/Pentesting/comments/vn9pu6/pentest_internships/)

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Dozens of cryptography libraries vulnerable to private key theft

Dozens of cryptography libraries vulnerable to private key theftPost Views: 25
Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes
According to Konstantinos Chalkias, a cryptographer at MystenLabs who discovered and reported the vulnerability, attackers could exploit the bug to steal private keys from cryptocurrency wallets.
A poor implementation of Ed25519, a popular digital signature algorithm, has left dozens of cryptography libraries vulnerable to attacks.

Some but not yet all of the vulnerable technologies have been patched. Where’s your Ed at?Ed25519 is often used as a modern replacement for the Elliptic Curve Digital Signature Algorithm (ECDSA). Ed25519 is more open, secure, and faster than ECDSA, which is why it has become very popular in many sectors, especially in blockchain and cryptocurrency platforms.

“The main benefits against ECDSA is that EdDSA sig[nature]s are deterministic and users don’t need [access to] a secure Random Number Generator [RNG] to sign a transaction,” Chalkias told The Daily Swig. “Why is this useful? because a user’s laptop or IoT device might not have a good source of entropy or support a weak RNG function.”

Numerous security incidents have shown that poor random generation can result in private keys being leaked or stolen. One notable example was the private key leaks of PlayStation 3, whose technology relies on the ECDSA algorithm.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png Pre-computing public keysThe standard specification of Ed25519 message signing involves providing the algorithm with a message and private key. The function will use the private key to compute the public key and sign the message. Some libraries provide a variant of the message signing function that also takes the pre-computed public key as an input parameter. There are some benefits to this implementation.

“Recomputing the public key each time would result in a slower algorithm (it adds an extra scalar to elliptic curve point multiplication to derive the public key, which reduces the speed by almost 2x, potentially making it even slower than ECDSA),” Chalkias said.

“And generally, in cryptography, it’s good hygiene to avoid accessing the private key many times. If we allowed the public key derivation on each signing invocation, then this implies we need to access it twice, once to sign, and once to derive the public key.”

However, the modification also creates a security loophole in the library.

Chalkias found that some libraries were allowing arbitrary public keys as inputs without checking if the input public key corresponds to the input private key. This shortcoming means that an attacker could use the signing function as an Oracle, perform crypto-analysis and ultimately get at secrets. For example, an attacker who can’t access the private key but can access the signing mechanism through an API call could use several public keys and messages to gradually build up insights into private key parameters.
Trending: Internet scans find 1.6 million secrets leaked by websites Trending: Recon Tool: JFScan Libraries at riskChalkias initially found 26 libraries that were vulnerable to the attack. The list was later extended to 40 libraries. The security researcher also found several online services that were vulnerable to the same kind of attack, including a fintech API.

“In some applications when keyGen fails or a clean-up process deletes [...]

___________________________
@hacking_Attack
@Hacking_Video

the privKey for this user, then the app usually retries keyGen. But in the meantime and for a few sec[ond]s, the DB [database] still stored the old userID, pubKeyOld>, and this allowed a narrow window for race condition attacks before the DB gets updated with the new pubKey (a scenario that, surprisingly, we managed to exploit with significant probability),” Chalkias noted.

Since his report, several libraries have implemented fixes and workarounds, including ed25519-elisabeth, PASETO, and Trezor wallet.

“A few libraries [have] already provided either fixes (if they were vulnerable) or proactively added extra checks that the stored pub key corresponds to the private keys,” Chalkias concluded. Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Trending: Write up: How to schedule tasks the right way in Linux, using crontab
Source: portswigger.net Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/ezgif.com-gif-maker-90x90.jpg Researchers crack MEGA’s ‘privacy by design’ storage, encryption1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/f9ed623c5c-90x90.jpg Google Warns Spyware Being Deployed Against Android, iOS Users2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/170720-poulsen-fancy-bear-tease_zzzwzw-90x90.jpg Fancy Bear Uses Nuke Threat Lure to Exploit 1-Click Bug5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/intro_toddycat_apt-800x450-1-90x90.jpg Elusive ToddyCat APT Targets Microsoft Exchange Servers6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/office-365-90x90.jpg Office 365 Config Loophole Opens OneDrive, SharePoint Data to Ransomware Attack1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/cyber-1-90x90.jpg Internet scans find 1.6 million secrets leaked by websites1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/malicious-chrome-extensions-feature-90x90.jpg Google Chrome extensions can be fingerprinted to track you online1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/android_malware-700x394-1-90x90.jpg New MaliBot Android banking malware spreads as a crypto miner2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Cisco_Systems_Bug-90x90.jpg Cisco Secure Email bug can let attackers bypass authentication2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/android-malware-90x90.jpg Android malware on the Google Play Store gets 2 million downloads2 weeks ago
The post Dozens of cryptography libraries vulnerable to private key theft first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Nimc2 - A C2 Fully Written In Nim
http://www.kitploit.com/2022/06/nimc2-c2-fully-written-in-nim.html

___________________________
@hacking_Attack
@Hacking_Video

nimc2 is a very lightweight C2 written fully in nim (implant & server). If you want to give it a try check out the wiki (https://github.com/d4rckh/nimc2/wiki) to learn how to install and use nimc2. It's features include: Windows & Linux implant generation TCP socket communication (https://www.kitploit.com/search/label/Socket%20Communication) (with HTTP communication coming soon) Ability to create as many listeners as you want A nice task system Easy to use CLI Loot system ...and a lot more features coming soon
Join the nimc2 (https://discord.gg/dUwqQzk5UM)discord (https://www.kitploit.com/search/label/Discord) server to discuss about this project. Wiki Getting started Installation (https://github.com/d4rckh/nimc2/wiki/Installation) Nimc2 crash course (https://github.com/d4rckh/nimc2/wiki/Usage) FAQs (https://github.com/d4rckh/nimc2/wiki/FAQs) Guides Managing listeners (https://github.com/d4rckh/nimc2/wiki/Managing-listeners) Creating implants (https://github.com/d4rckh/nimc2/wiki/Creating-implants) Interacting and managing clients (https://github.com/d4rckh/nimc2/wiki/Interacting-and-managing-clients) Operating System support The server is fully supported on Linux but unknown on Windows. The client (https://www.kitploit.com/search/label/Client) is fully supported on Windows, with lack of features on Linux. Server Support All server features are available on both Linux and Windows (https://www.kitploit.com/search/label/Windows) platforms. You might need to install additional dependencies on both platform for cross-platform compilation (check installation wiki page) Command Support Feature Windows Support Linux Support shell command ✅ ✅ cmd command ✅ ❌ info command ✅ ⚠️ msgbox command ✅ ❌ processes command ✅ ❌ tokeninfo command ✅ ❌ download command ✅ ✅ upload command ✅ ✅ screenshot command ✅ ❌ ✅ yes, complete⚠️ yes, but partially❌ no, does not work at allSupport Me You can support me by becoming a patreon at https://www.patreon.com/d4rckh (You also get some exclusive things)

Download Nimc2 (https://github.com/d4rckh/nimc2)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Identifying hackers on your device?

How do you identify that a certain account, or device, has been compromised? Is there any specific software for this? This activity has been going on for more than 2 years, minimum.

I have strong reasons to believe certain members of my family and people in my building have compromised my social media accounts and potentially devices, how do I verify this?

I need this data so I can make an important decision on it.

submitted by /u/ModernSchizoid
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
is hacking: the art of exploitation still relevant?

so I'm thinking about getting hacking: the art of exploitation (second edition) but idk if it's still relevant or not
if not what do u guys suggest to help me start with exploit development
thanks in advance

submitted by /u/Artemis-4rrow
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
just bought a new Acer nitro 5 and it came with windows, should I switch to Linux?

My new Acer nitro 5 came with Linux, my old notebook (reeeeeeally old one, like 10 years old) had zorin os, I really enjoyed Linux, I really think my overall knowledge increased when I started to use it, the question is, does switching the os can out the warranty in danger? I've switched distros before, I've had some problems doing it too, never really something I couldnt get around of, but is there a risk in doing it? Is it really worth the switch? Considering I've already used and enjoyed Linux (more the windows for sure!!!).

submitted by /u/tim-leary
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hacking dog park key fob?

I have a keychain that when we would enter the dog park security gate it would unlock and allow entrance.

Can I make it so I am admin so. Can enter the dog park whenever?

submitted by /u/Fizzeek
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
CLI software vulnerability assessment

Hey everyone, I want to test the security of a CLI software, can you recommend me any resources or courses?

submitted by /u/hazemslife
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video