Dark Reading: Attacks/Breaches
Prevention Takes Priority Over Response

Cybersecurity teams continue to emphasize intrusion prevention over incident response, despite US government action.

Hacking on Medium
Hackers Claim Theft of Police Info in China’s Largest Data Leak

https://cdn-images-1.medium.com/max/1200/0*9tkG32dzmfWHLiiX.jpg
Here are the key facts of this story, as agreed upon by the Guardian, Reuters, asiaMarkets, and FT.

Continue reading on Improve the News »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
7+3 Vulnerable Apps To Get Started With Android Penetration Testing

https://cdn-images-1.medium.com/max/1280/1*o6FpNDrO6BHRMnZW16sMkQ.png
There are currently 3.8 billion smartphone users in the world and this number is doomed to rise in the next years.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
AstraLocker cierra y publica sus claves de descifrado

https://cdn-images-1.medium.com/max/1568/0*4jnAF_p_dxAmWVre
PUBLICADO EN 6 JULIO, 2022POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
CrackQL - GraphQL Password Brute-Force And Fuzzing Utility

https://blogger.googleusercontent.com/img/a/AVvXsEgFVmUBDDQP3wgV0lUmJmRUSok2fYnB37fNyhLnV3C8p8Czy16AMK-Hkmphu1P4SeiCvxovoJkYHGGBn1ar-62RvfG9RC0LUMrffJsBuWxpTFlglUB_2bqsKXqfD-sB6gsNxDv-jw2Lnf5uRs2QwXGjuym4wzkglfmxQqfvW5HBlnyYrfBokSwfmsFr=w640-h284 CrackQL is a GraphQL password brute-force and fuzzing utility.

CrackQL is a versatile GraphQL penetration testing tool that exploits poor rate-limit and cost analysis controls to brute-force credentials and fuzz operations. How it works?CrackQL works by automatically batching a single GraphQL query or mutation into several alias operations. It determines the number of aliases to use based on the CSV input variables. After programmatically generating the batched GraphQL document, CrackQL then batches and sends the payload(s) to the target GraphQL API and parses the results and errors. Attack Use CasesCrackQL can be used for a wide range of GraphQL attacks since it programmatically generates payloads based on a list of dynamic inputs. Defense EvasionUnlike Burp Intruder which sends a request for each unique payload, CrackQL evades traditional API HTTP rate-limit monitoring defenses by using multiple alias queries to stuff large sets of credentials into single HTTP requests. To bypass query cost analysis defenses, CrackQL can be optimized into using a series of smaller batched operations (-b) as well as a time delay (-D). Password Spraying Brute-forcingCrackQL is perfect against GraphQL deployments that leverage in-band GraphQL authentication operations (such as the GraphQL Authentication Module). The below password spraying example works against DVGA with the sample-inputs/users-and-passwords.csvdictionary.

sample-queries/login.graphql mutation {
login(username: {{username|str}}, password: {{password|str}}) {
accessToken
}
} Two-factor Authentication OTP BypassIt is possible to use CrackQL to bypass two-factor authentication by sending all OTP (One Time Password) tokens

sample-queries/otp-bypass.graphql mutation {
twoFactor(otp: {{otp|int}}) {
accessToken
}
} User Account EnumerationCrackQL can also be used for enumeration attacks to discover valid user ids, usernames and email addresses

sample-queries/enumeration.graphql query {
signup(email: {{email|str}}, password: {{password|str}}) {
user {
email
}
}
} Insecure Direct Object ReferenceCrackQL could be used to iterate over a large number of potential unique identifiers in order to leak object information

sample-queries/idor.graphql query {
profile(uuid: {{uuid|int}}) {
name
email
picture
}
} General FuzzingCrackQL can be used for general input fuzzing operations, such as sending potential SQLi and XSS payloads. InputsCrackQL will generate payloads based on input variables defined by a CSV file. CrackQL requires the CSV header to match the input name.

sample-inputs/usernames_and_passwords.csv username, password
admin, admin
admin, password
admin, pass
admin, pass123
admin, password123
operator, operator
operator, password
operator, pass
operator, pass123
operator, password123 Valid input types* str* int* floatInstallationRequirements* Python3
* Requests
* GraphQL
* Jinja Clone Repositorygit clone git@github.com:nicholasaleks/CrackQL.gitGet Dependenciespip install -r requirements.txtRun CrackQLpython3 CrackQL.py -hConfiguration
Use config.pyto set HTTP cookies and headers if the endpoint requires authentication. Maintainers* Nick Aleks
* Dolev Farhi MentionsDownload CrackQL

___________________________
@hacking_Attack
@Hacking_Video

CrackQL - GraphQL Password Brute-Force And Fuzzing Utility
http://www.kitploit.com/2022/07/crackql-graphql-password-brute-force.html

___________________________
@hacking_Attack
@Hacking_Video

CrackQL is a GraphQL password brute-force (https://www.kitploit.com/search/label/Brute-force) and fuzzing utility. CrackQL is a versatile GraphQL penetration testing (https://www.kitploit.com/search/label/Penetration%20Testing) tool that exploits poor rate-limit and cost analysis controls to brute-force credentials (https://www.kitploit.com/search/label/Credentials) and fuzz operations.
How it works? CrackQL works by automatically batching a single GraphQL query or mutation into several alias operations. It determines the number of aliases to use based on the CSV input variables. After programmatically generating the batched GraphQL document, CrackQL then batches and sends the payload(s) to the target GraphQL API and parses the results and errors. Attack Use Cases CrackQL can be used for a wide range of GraphQL attacks since it programmatically generates payloads based on a list of dynamic inputs. Defense Evasion Unlike Burp Intruder (https://portswigger.net/burp/documentation/desktop/tools/intruder) which sends a request for each unique payload, CrackQL evades traditional API HTTP rate-limit monitoring defenses by using multiple alias queries to stuff large sets of credentials into single HTTP requests. To bypass query cost analysis defenses, CrackQL can be optimized into using a series of smaller batched operations (-b) as well as a time delay (-D). Password Spraying Brute-forcing CrackQL is perfect against GraphQL deployments that leverage in-band GraphQL authentication operations (such as the GraphQL Authentication Module (https://www.graphql-modules.com/docs#authentication-module)). The below password spraying example works against DVGA (https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application) with the sample-inputs/users-and-passwords.csv dictionary. sample-queries/login.graphql mutation {
login(username: {{username|str}}, password: {{password|str}}) {
accessToken
}
}
Two-factor Authentication OTP Bypass It is possible to use CrackQL to bypass two-factor authentication by sending all OTP (One Time Password) tokens sample-queries/otp-bypass.graphql mutation {
twoFactor(otp: {{otp|int}}) {
accessToken
}
}
User Account Enumeration CrackQL can also be used for enumeration (https://www.kitploit.com/search/label/Enumeration) attacks to discover valid user ids, usernames and email addresses sample-queries/enumeration.graphql query {
signup(email: {{email|str}}, password: {{password|str}}) {
user {
email
}
}
}
Insecure Direct Object Reference CrackQL could be used to iterate over a large number of potential unique identifiers in order to leak object information sample-queries/idor.graphql query {
profile(uuid: {{uuid|int}}) {
name
email
picture
}
}
General Fuzzing CrackQL can be used for general input fuzzing operations, such as sending potential SQLi and XSS payloads. Inputs CrackQL will generate payloads based on input variables defined by a CSV file. CrackQL requires the CSV header to match the input name. sample-inputs/usernames_and_passwords.csv username, password
admin, admin
admin, password
admin, pass
admin, pass123
admin, password123
operator, operator
operator, password
operator, pass
operator, pass123
operator, password123
Valid input types str int float Installation Requirements Python3 Requests GraphQL Jinja Clone Repository git clone git@github.com:nicholasaleks/CrackQL.git Get Dependencies pip install -r requirements.txt Run CrackQL python3 CrackQL.py -h Configuration Use config.py to set HTTP cookies and headers if the endpoint requires authentication. Maintainers Nick Aleks (https://github.com/nicholasaleks) Dolev Farhi (https://github.com/dolevf) Mentions

Download CrackQL (https://github.com/nicholasaleks/CrackQL)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Vulnerability in Collaboration Tools : Why Corporate's datasets are Leaked

https://external-preview.redd.it/eYeH4oA7buofjQJtWrFbimb-2IdzGOFrqpcI-VX1RpI.jpg?width=640&crop=smart&auto=webp&s=f974d999b59205565d2fcb8eed514beee1055305 submitted by /u/Late_Ice_9288
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Security Advisory for CVE-2022-2274 : OpenSSL Remote Code Execution Vulnerability.

submitted by /u/Late_Ice_9288
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Getting Started with Kali Linux

https://cdn-images-1.medium.com/max/1365/0*zZ6ALoeBDpejBT47.png
author — — SATYAM PATHANIA

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Intro 8| Defend the Web

https://cdn-images-1.medium.com/max/700/0*Y7nx2i59Tv-87WR2.jpg
There are only 10 types of people in the world — those who understand binary, and those who don’t.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

OKEXCHAIN DOMAINS TESTNET GUIDE

They are holding a testnet program guys. participate and get airdrop. as they tweetContinue reading on Medium »
Read more...