This is my story of finding multiple bugs in Google’s acquisition chain to increase the severity and get a Nice catch by GOOGLEContinue reading on Medium » (https://parthdeshani.medium.com/got-nice-catch-by-google-5e6a8211371c?source=rss------bug_bounty-5)

Hacking on Medium
The Art of Reconnaissance| Introduction to Info Gathering & Reconnaissance

https://cdn-images-1.medium.com/max/848/1*3da9unOfANT1Og3F8UIdmw.jpeg
Introduction: Guide to Info Gathering & Recon for absolute beginner

Continue reading on Medium »

KitPloit - PenTest Tools!
Vulnerablecode - A Free And Open Vulnerabilities Database And The Packages They Impact And The Tools To Aggregate And Correlate These Vulnerabilities

https://1.bp.blogspot.com/-iPGNBqD8FB8/YH5lvJZPTFI/AAAAAAAAV68/boQXXAGoUCMUdahqlVN5jjW7gbT80XYuQCNcBGAsYHQ/w640-h336/vulnerablecode_6_README.png VulnerableCode is a free and open database of FOSS software package vulnerabilities and the tools to create and keep the data current.

It is made by the FOSS community to improve and secure the open source software ecosystem. Why?The existing solutions are commercial proprietary vulnerability databases, which in itself does not make sense because the data is about FOSS (Free and Open Source Software).

The National Vulnerability Database which is a primary centralized data source for known vulnerabilities is not particularly well suited to address FOSS security issues because:

1. It predates the explosion of FOSS software usage
2. It's data format reflects a commercial vendor-centric point of view in part due to the usage of CPE to map vulnerabilities to existing packages.
3. CPEs are just not designed to map FOSS to vulnerabilities owing to their vendor-product centric semantics. This makes it really hard to answer the fundamental questions "Is package foo vulnerable" and "Is package foo vulnerable to vulnerability bar?" HowVulnerableCode independently aggregates many software vulnerability data sources and supports data re-creation in a decentralized fashion. These data sources (see complete list here) include security advisories published by Linux and BSD distributions, application software package managers and package repositories, FOSS projects, GitHub and more. Thanks to this approach, the data is focused on specific ecosystems yet aggregated in a single database that enables querying a richer graph of relations between multiple incarnations of a package. Being specific increases the accuracy and validity of the data as the same version of an upstream package across different ecosystems may or may not be vulnerable to the same vulnerability.

The packages are identified using Package URL PURL as primary identifiers rather than CPEs. This makes answers to questions such as "Is package foo vulnerable to vulnerability bar?" much more accurate and easy to interpret.

The primary access to the data is through a REST API.

In addition, an emerging web interface goal is to support vulnerabilities data browsing and search and progressively to enable community curation of the data with the addition of new packages and vulnerabilities, and reviewing and updating their relationships.

We also plan to mine for vulnerabilities which didn't receive any exposure due to various reasons like but not limited to the complicated procedure to receive CVE ID or not able to classify a bug as a security compromise.

Recent presentations:

* Open Source Summit 2020 Setting up VulnerableCodeFirst clone the source code: git clone https://github.com/nexB/vulnerablecode.git
cd vulnerablecode Using Docker ComposeAn easy way to set up VulnerableCode is with docker containers and docker compose. For this you need to have the following installed.

* Docker Engine. Find instructions to install it here
* Docker Compose. Find instructions to install it here

Use sudo docker-compose upto start VulnerableCode. Then access VulnerableCode at http://localhost:8000/ or at http://127.0.0.1:8000/

Important: Don't forget to run sudo docker-compose up -d --no-deps --build webto sync your instance after every git pull.

Use sudo docker-compose exec web bashto access the VulnerableCode container. From here you can access manage.pyand run management commands to import data as specified [...]

Deep Web
didactic material about hacker

does anyone know any didactic material about hacker ?

submitted by /u/Trader_Kamikaze
[link] [comments]

Dark Reading: Attacks/Breaches
Supernova Malware Actors Masqueraded as Remote Workers to Access Breached Network

China-based Spiral group is believed to be behind year-long attack, which exploited a flaw in SolarWinds Orion technology to drop a Web shell.

hacking: security in practice
How simulate medium size company network and attack it?

I have project to make. I want to present threats and mechanisms how to protect against threats. My job is to prepare the environment (simulation?) and simulate attack and show how to defend.

At first I wanted to do everyhing in virtualbox as simple network but my profesor wants me to make it as security project for small/medium size company. I have no idea where to start and I'm looking for advice.

submitted by /u/mauwaw
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖

hacking: security in practice
Couple to Counter-Sue McDonald's Vendor Taylor over Potential IP Theft of Their QSR Solution: The Cold War Over Hacking McDonald’s Ice Cream Machines

https://external-preview.redd.it/EA1CCuzhHb-jsY46Ss-whcr_6Plzv3wbWW11WaL36z4.jpg?width=640&crop=smart&auto=webp&s=65d1367d364fa2cef0057f9bd0fd3cfe2cb4330d submitted by /u/greengobblin911
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖

CSRF TesGuide For Bug Bounty Hunters

What is it, how to test for it and even examples! We have it all …Continue reading on Medium »
Read more...

Hacking on Medium
Computer Hacking and Password Hacking

https://cdn-images-1.medium.com/max/800/1*b2N9DHRPo1MnxdNvz6gyKg.jpeg
. Computer hacking is the most well-known hacking system. So, in computer hacking, the hackers interfere in the computer systems and break…

Continue reading on Medium »

Hacking on Medium
SCOPE OF ETHICAL HACKERS IN PAKISTAN>>>>

WHAT IS ETHICAL HACKING??

Continue reading on Medium »

Hacking on Medium
CSRF TesGuide For Bug Bounty Hunters

https://cdn-images-1.medium.com/max/1201/0*UWRS585gWCSGuoEY.png
What is it, how to test for it and even examples! We have it all …

Continue reading on Medium »