hacking: security in practice
Can someone confirm that this is a XSS Vulnerability

https://external-preview.redd.it/s_kn5NM0-IMgL0_6Y2Ycfh47nMlAMT2iFu-vAKQhlxU.png?width=640&crop=smart&auto=webp&s=8bc2a895ac212d1f5806c039366b55a22c1f39fc submitted by /u/Putrid-Soft3932
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Vodafone to introduce persistent user tracking

https://external-preview.redd.it/zf995t8oAYuTF6Jz-GcE5dgzd-ugTI_gD_C-DBVL7jk.jpg?width=640&crop=smart&auto=webp&s=c95ab906567ef87dac3b4ad5026bba84e411bb7b submitted by /u/DonutAccomplished422
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
OfficerBreaker - pptx/docx/xlsx password remover

Hi everyone!

In case you ever forget the password for any Microsoft Office file (pptx/xlsx/docx) you locked I built a tool that removes the password from the file without cracking it.

How does it work?

All pptx/xlsx/docx files are part of the Office Open XML format family (for further reading please refer to OOXML Format Family -- ISO/IEC 29500 and ECMA 376 ).

For example, a standard .pptx file will have the following file tree structure: myFile.pptx . ├── docProps │ ├── app.xml │ ├── core.xml │ ├── custom.xml │ └── thumbnail.jpeg ├── ppt │ ├── handoutMasters │ ├── media │ ├── media │ ... │ ... │ ... │ └── presentation.xml ├── _rels │ ├── .rels └── [Content_Types].xml We can see this structure by opening the file using a program like 7zip or by changing the filetype to .zip and then opening it.

Each OOXML file type contains an .xml file with settings and preferences, including read-only protection. In our example the security element will be located inside presentation.xmlfile which is located inside the pptfolder of myFile.pptx.

Inside presentation.xmlthere is a specific element we will focus on called p:modifyVerifier which should look like this:

python The file editing is protected by a password which was salted and hashed which makes it nearly impossible to crack within reasonable time. But instead of trying to crack the password, we can just... Remove it. :shrug:

Turns out that simply deleting the security element p:modifyVerifier as a whole will make myFile.pptxbehave as if it never had any password at all. This kind of security measure is a bit like the photo in the title of this repository - a good lock placed on the door handle... :sweat_smile:

The program will create a copy of presentation.xml, parse it and delete the security element. Once the element is deleted, the copied presentation.xmlwill be replaced with the original presentation.xmlwhich will effectively remove the password from myFile.pptx.

What makes this whole thing worse is the fact that we could simply remove the password created by the author, alter the file in some way and then return the original password of the author by inserting the same security element which was removed. This hurts the integrity of the whole OOXML format family.

Future changes / possible deprecation

Future versions of OOXML file type may make drastic changes of naming convention of elements or/and structure of the folders or/and files. This might make this repo deprecated but not obsolete if the same security measures will be taken in future versions. If a "lock with different name" (the hashing) will be placed on the "door handle" (removable .xmlelement), the file still could be altered/edited without a password. All that's needed is to find the new security element and simply remove it from the file.

https://github.com/nedlir/OfficerBreaker

submitted by /u/Comfortable-Ad-2379
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

$$$ bounty in less 3 minutes from a google dork

~ Hi Bug Bounty Hunters & CyberSecurity folks!!! It’s been long since i dropped a bug bounty writeup.Continue reading on Medium »
Read more...

My Bug Bounty Resources

Hello Amazing People,Continue reading on Medium »
Read more...

Un3xpected DoS Attack on Profile Pictur3
https://infosecwriteups.com/un3xpected-dos-attack-on-profile-pictur3-b957979dcc7?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hey Everyone, Hope y’all doing gr3at and aw3some!Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/un3xpected-dos-attack-on-profile-pictur3-b957979dcc7?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Google Hacking — how to fix

https://cdn-images-1.medium.com/max/1200/1*YpJi7aaXOYijDHZ80nXNJw.png
Search engines doing really great job in indexing content. Of course everyone wants to be at the top of the search results. But sometimes…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to start a career in cyber security 2022

https://cdn-images-1.medium.com/max/800/0*H4Fbg9C623lalIG5.png
Categories CAREER IN CYBER SECURITYCYBER SECURITY

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Un3xpected DoS Attack on Profile Pictur3

https://cdn-images-1.medium.com/max/1920/1*QTqKFIrMTfCY40AYA2ZAYA.png
Hey Everyone, Hope y’all doing gr3at and aw3some!

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Setting iOS App Testing Environment with Burp-suite & Corellium

https://cdn-images-1.medium.com/max/2000/0*dyEVZAUVojC7CpBK
Corellium iOS App Testing with Burp-suite

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
modDetective - Tool That Chronologizes Files Based On Modification Time In Order To Investigate Recent System Activity

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgqJtKPfbIhQBZqfVy4DUHEh8KlINCjJkOp1c9sN4Xb2hVIxz5RbmYOpxw5G8vFic45mJN3woPRpG4E7DzuDdksByD3D0N3xO8KLEnpUd2N4lddF7SKw3yR54K8JI11-RgX97TodUDc-NEbZoZdY5cA5K1eQ1OPfB__XenOt3JPjBBISL0BRlDNySAW/w640-h216/modDetective.png
modDetective is a small Python tool that chronologizes files based on modification time in order to investigate recent system activity. This can be used in CTF's in order to pinpoint where escalation and attack vectors may exist.
https://camo.githubusercontent.com/d212edb00617235c0c2216b103990e653ef49ed6a1b92d8a7292b074547f735b/68747470733a2f2f61736369696e656d612e6f72672f612f3234343734312e737667

To see the tool in its most useful form, try running the command as follows: python3 modDetective.py -i /usr/share,/usr/lib,/lib. This will ignore the /usr/lib, /usr/share, and /lib directories, which tend not to have anything of interest. Also note that by default the "dynamic" directories are ignored (/proc, /sys, /run, /snap, /dev).

What is modDetective Doing?

modDetective is very elementary in how it operates. It simply walks the filesystem, with bounds determined by user specified options (-i is for ignore, meaning the tool will walk every directory EXCEPT for the ones specified in the -i option, and -e is for exclusive, meaning the tool will ONLY walk the directories specified). While walking, it picks up the modification times of each file, then orders these modification times in order to output them chronologically.

Additionally, in the output you will potentially see some files highlighted red. These files are denoted as "Indicators of User Activity," Since recent modifications to these files indicate that a user is currently active. As of now, these files include .swp files, .bash_history, .python_history and .viminfo. This list will be extended as I brainstorm more files that indicate present user activity.

Requirements

modDetective currently works only with python3; python2 compatability will be completed shortly (hence the lack of f strings). Standard libraries should be fine.
Download modDetective

___________________________
@hacking_Attack
@Hacking_Video