submitted by /u/_noraj_ (https://www.reddit.com/user/_noraj_)
[link] (https://www.acceis.fr/cracking-encrypted-archives-pkzip-zip-zipcrypto-winzip-zip-aes-7-zip-rar/) [comments] (https://www.reddit.com/r/Pentesting/comments/w3g98l/cracking_encrypted_archives_pkzip_zip_zipcrypto/)

___________________________
@hacking_Attack
@Hacking_Video

Maximizing the potential of the “Subfinder”

Hi guys, in this post I will be sharing about how to maximize the potential of subfinder. So, what is subfinder? and how to use it…Continue reading on Medium »
Read more...

Hacking on Medium
VulnHub BasicPentest | by Dungy

https://cdn-images-1.medium.com/max/600/1*IhKZeXaeTqKbTjuQVLkZNg.png
Hello friend, I’m Dungy a Software developer who is learning Penetration testing and practicing for the OSCP. Hope you like the write-up!

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Cyber Criminals attacked “Premint” a popular platform for NFTs

https://cdn-images-1.medium.com/max/640/0*az-6U5Ntk-MhcBQL.jpg
You know that NFTs are one of the greatest investments as a business anyone can try on. So, what would happen if the project gets into the…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Cleartrip is tripping over Data Breach a lot of people in Vain

https://cdn-images-1.medium.com/max/640/0*7v4RsZzb1HMrQi-h.png
You know that Cleartrip is one of the most popular Ticket Booking Sites that is used by several users to travel from one place to another…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
₹1 Crore lost by an Elderly as Social Engineering Introduced in Cyber Fraud Techniques

https://cdn-images-1.medium.com/max/640/0*zyxUFN9y-D7PVFvC.jpg
The technology and the companies are going forward to secure their various IT infrastructures by employing numerous methodologies of…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Maximizing the potential of the “Subfinder”

https://cdn-images-1.medium.com/max/1692/1*YX1KM1vfY2mgXPn-rNcapg.png
Hi guys, in this post I will be sharing about how to maximize the potential of subfinder. So, what is subfinder? and how to use it…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Analysis of Premint Malicious Code Injection

https://cdn-images-1.medium.com/max/960/1*wyBS-8MNEAfki-6vaBRCeg.png
This article contains submissions from Scam Sniffer, who is a partner of the SlowMist zone.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
$500K in Crypto and Fiat Currency — Seized by FBI from Hackers in North Korea

https://cdn-images-1.medium.com/max/1100/1*bNqoJvS2dY1JXOfy06ZRdw.jpeg
The US Department of Justice has seized and returned approximately $500,000 in fiat and cryptocurrency from a hacking group linked to the…

Continue reading on Ambros App »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
10 CYBER SECURITY MEASURES THAT EVERYONE SHOULD FOLLOW

https://cdn-images-1.medium.com/max/1200/0*4m2xHH9YGWO25Jr9
With more technological advancements breaking into the world, a gateway for hacking and online data theft has also opened. What now then?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
‘Password extraction risk’ in identity provider Okta disputed

‘Password extraction risk’ in identity provider Okta disputedPost Views: 10 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes
Security researchers claim to have uncovered serious security shortcomings in the systems of identity provider Okta.

Identity and access management specialist Authomize went public with four supposed vulnerabilities following an inconclusive disclosure process.

The vulnerabilities “grant threat actors with app admin privileges the ability to extract clear text passwords, impersonate any downstream user, and impersonate anyone in the hub or another spoke,” according to Authomize.

However, Okta remains unconvinced about the seriousness of these supposed flaws, telling The Daily Swig it has no plans to issue security updates in response to Authomize’s research. Users with any lingering concerns have the option to rachet up their default security settings, Okta advised.

Gal Diskin, CTO and co-founder of Authomize, said it was “working closely with Okta on improving the security of their customers.

“While we might disagree with their decision not to assign CVEs for our findings, the crucial point for us is that they are taking them seriously and that we are collaborating with them based on mutual professional respect,” he told The Daily Swig.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course
Diskin went on to claim that exploiting the flaws would not be difficult for even a modestly skilled attacker.

“If you have the right privileges/configuration [then you], and anyone with even limited technical skills, can carry out this exploitation,” he said.

Distin continued: “Attackers may use these flaws to: steal passwords for all employees, escalate privileges to super-admin, build persistent hidden backdoors, compromise all downstream apps to perform doxing, impersonation, theft, or for ransom purposes.

“Attackers can use super-admin privileges to perform destructive attacks against downstream apps connected to any IdP [identity provider],” he added. Underground chatterAsked directly, Authomize admitted it had no evidence of real world exploitation of the flaws it discusses. The security consultancy nonetheless argues that exploitation might have occurred “under the radar”.

“There have been certain unexplained password and username leaks that may end up being traced back to these issues,” Distin told The Daily Swig. “We’ve also heard from partners in threat intelligence firms that they see identity systems being widely discussed as targets in cybercriminal forums.”
Trending: How Misconfigurations in Linux can leave you vulnerable to Attackers Trending: Recon Tool: WayMore Potential for wider threatAuthomize reckons the security shortcomings it unearthed are particular to Okta – rather than being a generic issue that also affects other identity providers.

Distin told The Daily Swig: “From our research, it does not appear that other IdPs are similarly at risk.”

“That being said, there are certain attacks inherent to any IdPs such as impersonation via upstream IdPs, username manipulations in downstream apps, and various other misconfigurations that our research suggests requires persistent monitoring,” they concluded.

Okta, however, told The Daily Swig that the issues uncovered by Authomize are not particular to itself and can be addressed by following industry best practice.

“Authomize reached out to Okta with the technical details of their blog post,” Okta told The Daily Swig. “After thorough review, our determination is that t[...]

___________________________
@hacking_Attack
@Hacking_Video

he listed items are not unique to Okta and that applying security best-practices will mitigate any risks found with the items in the blog.

“Okta customers who want to increase the security of their organization can utilize our online product documentation to apply the most secure settings,” it added. ​Trending: Microsoft Teams security vulnerability left users open to XSS via flawed stickers feature Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: portswigger.net Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Images-for-the-News-posts-300x150.png ‘Endemic’ Log4j bug set to persist in the wild for at least a decadeJuly 19, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Untitled-design-1-300x150.png Emerging H0lyGh0st Ransomware Tied to North KoreaJuly 18, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/ezgif.com-gif-maker-3-1-300x150.jpg Microsoft Teams security vulnerability left users open to XSS via flawed stickers featureJuly 15, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Untitled-design-300x150.png Microsoft releases tweet-size exploit for macOS sandbox escape bugJuly 14, 2022
Reading Time: 4 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post ‘Password extraction risk’ in identity provider Okta disputed first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video