hacking: security in practice
There are many IP's with exposed credentials in web applications such as Django, many of which are of either Oauth or RESTfull API.

https://external-preview.redd.it/U8auC5sr4HwtPTIztYgkJ2afj-Wd60_hkC0T3u9NNU8.jpg?width=640&crop=smart&auto=webp&s=8a5281a44124830fab72df460c73546d0eb1a79f submitted by /u/Late_Ice_9288
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
TIL Gifs linked in messaging apps are tacking you

https://zerosecurity.org/2022/07/gifs-in-messaging-apps-are-tracking-you/

TL;DR: Giphy is owned by Facebook, and Tenor is owned by google

submitted by /u/LethalKnowledge
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Neopets data breach exposes personal data of 69 million members

https://external-preview.redd.it/GNwksqPvzQm_G-reaDPUdRYOjgJuAzrZJLOmiSbUu2Y.jpg?width=640&crop=smart&auto=webp&s=332405fcedeb49ecd0f14311c2913e37b6c75ccc submitted by /u/Late_Ice_9288
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Verifying digital signature offline

Is it possible to verify a digital signature offline, for example including a private key hardcoded in a local software, if yes is it safe to use?

submitted by /u/hazemslife
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Verifying digital signature offline

Is it possible to verify a digital signature offline, for example including a private key hardcoded in a local software, if yes is it safe to use?

submitted by /u/hazemslife
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Using Virtual Box with Fedora 36

https://cdn-images-1.medium.com/max/1913/1*bL2y8PiF7TvDWvqTs4NuXw.png
So I have always only used the most simple to use distros and all, so when I made a new setup I thought lets go with Fedora, which often…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
This Bugs Could Let Attackers Disrupt Vehicles Remotely

https://cdn-images-1.medium.com/max/728/0*RU3YRhOf2_8Em1DR
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning of a handful of unpatched security vulnerabilities in MiCODUS…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

HackerOne CTF: Postbook

I recently published an article on a CTF writeup, an introduction to the HackerOne CTF. You can find that article here. Today I am…Continue reading on Medium »
Read more...

HackerOne CTF: Postbook
https://tsitsiflora.medium.com/hackerone-ctf-postbook-6efd86ebf652?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

I recently published an article on a CTF writeup, an introduction to the HackerOne CTF. You can find that article here. Today I am…Continue reading on Medium » (https://tsitsiflora.medium.com/hackerone-ctf-postbook-6efd86ebf652?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Android App Pentest #1 Setup Certificate Burpsuite ke Emulator Android
https://medium.com/@anditorx/android-app-pentest-1-setup-certificate-burpsuite-ke-emulator-android-543bad8f35cc?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Burpsuite adalah tool yang sangat sering di gunakan untuk melakukan Penetration Test / Bug bounty. Burpsuite digunakan sebagai penengah…Continue reading on Medium » (https://medium.com/@anditorx/android-app-pentest-1-setup-certificate-burpsuite-ke-emulator-android-543bad8f35cc?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
ICMP type 13, 14

Looking for tools for gathering open source ICMP data I have tried Nping Neither converts the timestamp any tools for gathering and converting this open source information I have try’d online converters the time stamps don’t match up I heard it’s a bug in windows that’s obfuscating time stamp data any help would be appreciated. Looked into hping3 the output doesn’t look promising. Main objective is gathering Hosts exact UTC time

submitted by /u/Phantasius224
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Zero-day flaws in GPS tracker pose surveillance, fuel cut-off risks to vehicles

Zero-day flaws in GPS tracker pose surveillance, fuel cut-off risks to vehiclesPost Views: 18 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes
A raft of zero-day flaws found in a popular automotive GPS tracking device “could have disastrous and even life-threatening implications”, security researchers warn.

Six as-yet-unpatched vulnerabilities unearthed by BitSight researcher Pedro Umbelino affect the API server, GPS tracker protocol, and web server of the MV720 GPS tracker, which was developed by China-based company MiCODUS.

Successful abuse of the bugs could see attackers “cut fuel to an entire fleet of commercial or emergency vehicles”, use GPS data “to monitor and abruptly stop vehicles on dangerous highways”, or “track individuals or demand ransom payments to return disabled vehicles to working condition”, according to research (PDF) from BitSight.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Huge attack surfaceAccording to the cybersecurity firm, the MiCODUS MV720 provides theft protection and fleet management functionality to customers in at least in 169 countries, including a Fortune 50 energy company, a national military in South America, a federal government in Western Europe, a national law enforcement agency in Western Europe, and a nuclear power plant operator.

Alarmingly, BitSight said Umbelino also uncovered security issues associated with the firm’s cloud-based device management interface for the web, iOS, and Android, a finding which means other MiCODUS GPS tracking models could also be insecure. If MiCODUS’ own figures are accurate, that equates to 1.5 million potentially vulnerable devices worldwide.

With security patches yet to materialize, BitSight has urged users to “immediately stop using or disable any MiCODUS MV720 GPS trackers until a fix is made available”.

A security advisory from the US Cybersecurity and Infrastructure Security Agency (CISA) said that “no known public exploits specifically target these vulnerabilities” in the MV720 GPS tracker.
Trending: How Misconfigurations in Linux can leave you vulnerable to Attackers Trending: Recon Tool: WayMore Authentication issuesTwo critical authentication issues in the API server, both notching a CVSS score of 9.8, enable “an attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner’s mobile number”.

One bug relates to a hard-coded master password (CVE-2022-2107) and the other, resulting from improper authentication (CVE-2022-2141), potentially enables manipulator-in-the-middle (MitM) attacks.

The devices and the mobile interface are preconfigured with the default password ‘123456’, which BitSight classed as a high severity (CVSS 8.1) issue, although CISA declined to assign a CVE. “There is no mandatory rule to change the password nor is there any claiming process”, according to BitSight, which found that 94.5% of 1,000 responding device IDs still had the default password.

With the device ID easily predictable and the server seemingly lacking password brute force mitigations such as rate-limiting, attackers can easily access random GPS trackers.

A high severity (CVSS 7.5) reflected cross-site scripting (XSS) vulnerability affecting the main web server, meanwhile, could enable attackers to “fully compromise the device”.

The main web server also contains a pair of authenticated insecure direct object reference vulnerabilities, tracked as CVE-2022-34150 (CVSS 7.1) and CVE-2022-[...]

___________________________
@hacking_Attack
@Hacking_Video