Dark Reading: Attacks/Breaches
5 Ways Chess Can Inspire Strategic Cybersecurity Thinking

Rising interest in chess may feed the next generation of cybersecurity experts.

RasPwn issues or part of the experience?
https://www.reddit.com/r/Pentesting/comments/wf8gui/raspwn_issues_or_part_of_the_experience/

So I finally got a rpi 3b and put raspwn on an sd card, popped it in but when I booted into it it says "root account locked" and goes to a root shell. Is that part of the experience of it or do I have a problem? I'm not seeing the "RasPwn OS" network listed after a quick wifi check but maybe it's SSID is hidden? I don't have time to check on Kali right now so I posted here instead. Any advice is appreciated. Thank you, I'll post updates when as they happen ​ Edit: solved, I reflashed the sd card and it worked fine submitted by /u/Djcrafty (https://www.reddit.com/user/Djcrafty)
[link] (https://www.reddit.com/r/Pentesting/comments/wf8gui/raspwn_issues_or_part_of_the_experience/) [comments] (https://www.reddit.com/r/Pentesting/comments/wf8gui/raspwn_issues_or_part_of_the_experience/)

___________________________
@hacking_Attack
@Hacking_Video

Subdomain Takeover Tool
https://medium.com/@reconshell.com/subdomain-takeover-tool-a25b12b2a2e5?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

dnsReaper — subdomain takeover tool for attackers, bug bounty hunters and the blue team!Continue reading on Medium » (https://medium.com/@reconshell.com/subdomain-takeover-tool-a25b12b2a2e5?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

[Bugbounty]Blind XSS via header injection to log poisoning
https://medium.com/@kauenavarro/bugbounty-blind-xss-via-header-injection-to-log-poisoning-145f4cba356?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Olá, espero que você esteja bem e caçando!Continue reading on Medium » (https://medium.com/@kauenavarro/bugbounty-blind-xss-via-header-injection-to-log-poisoning-145f4cba356?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Explained: The Nomad Hack (August 2022)

https://external-preview.redd.it/lkm8-KQjcCKTraTdR9hpbYFcDeqZrz4aALPJk_0GG-4.jpg?width=320&crop=smart&auto=webp&s=73fa6431ebe3871c56240cfa030555970d69f17c submitted by /u/yintianshi
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Tips From a Google Cybersecurity Intern

https://external-preview.redd.it/QAdHoBiwf-LZ9MHp13USF0zLUkLTMjGVxp6FnVcnBiY.jpg?width=640&crop=smart&auto=webp&s=b31e961bfece6d974fc1bc807ad652abc9afe5d5 submitted by /u/relatableshirts
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Someone used my name to harass my ex and her family through emails.

They shared a lot of details down to some facts discussed recently with some friends. The family is in UK and the spammer sent two emails on the work email address of my ex's elder sister. They want to press charges on me. I am in Pakistan and don't know who did it. The email used had my name on it as well but it came from a spam email.

I am sorry if I am missing out on some facts. I have a couple of questions, what happens if we are not able to identify the perpetrator? Is it possible to find the location or device used of the perpetrator through the sent emails? Is it possible that if authorities are involved, I would have to submit my work and personal devices to them?

Update: The hacker just emailed me and the family saying he had access to my email because it had no 2FA. He mentioned my password as well. He said it's over now. Fucking hell.

submitted by /u/warLord23
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Subdomain Takeover Tool

dnsReaper — subdomain takeover tool for attackers, bug bounty hunters and the blue team!Continue reading on Medium »
Read more...

[Bugbounty]Blind XSS via header injection to log poisoning

Olá, espero que você esteja bem e caçando!Continue reading on Medium »
Read more...

Kali Linux Tutorials
Pinecone : A WLAN Red Team Framework

Pinecone is a WLAN networks auditing tool, suitable for red team usage. It is extensible via modules, and it is designed to be run in Debian-based operating systems. Pinecone is specially oriented to be used with a Raspberry Pi, as a portable wireless auditing box.

This tool is designed for educational and research purposes only. Only use it with explicit permission.

Installation

For running Pinecone, you need a Debian-based operating system (it has been tested on Raspbian, Raspberry Pi Desktop and Kali Linux). Pinecone has the following requirements:

* Python 3.5+. Your distribution probably comes with Python3 already installed, if not it can be installed using apt-get install python3.
* dnsmasq (tested with version 2.76). Can be installed using apt-get install dnsmasq.
* hostapd-wpe (tested with version 2.6). Can be installed using apt-get install hostapd-wpe. If your distribution repository does not have a hostapd-wpe package, you can either try to install it using a Kali Linux repository pre-compiled package, or compile it from its source code.

After installing the necessary packages, you can install the Python packages requirements for Pinecone using pip3 install -r requirements.txtin the project root folder.

Usage

For starting Pinecone, execute python3 pinecone.pyfrom within the project root folder:

root@kali:~/pinecone# python pinecone.py
[i] Database file: ~/pinecone/db/database.sqlite
pinecone >

Pinecone is controlled via a Metasploit-like command-line interface. You can type helpto get the list of available commands, or help 'command'to get more information about a specific command:

pinecone > help
Documented commands (type help ):
alias help load pyscript set shortcuts use
edit history py quit shell unalias
Undocumented commands:
back run stop
pinecone > help use
Usage: use module [-h]
Interact with the specified module.
positional arguments: module module ID
optional arguments:
-h, –help show this help message and exit

Use the command use 'moduleID'to activate a Pinecone module. You can use Tab auto-completion to see the list of current loaded modules:

pinecone > use
attack/deauth daemon/hostapd-wpe report/db2json scripts/infrastructure/ap
daemon/dnsmasq discovery/recon scripts/attack/wpa_handshake
pinecone > use discovery/recon
pcn module(discovery/recon) >

Every module has options, that can be seen typing help runor run --helpwhen a module is activated. Most modules have default values for their options (check them before running):

pcn module(discovery/recon) > help run
usage: run [-h] [-i INTERFACE]
optional arguments:
-h, –help show this help message and exit
-i INTERFACE, –iface INTERFACE
monitor mode capable WLAN interface (default: wlan0)

When a module is activated, you can use the run [options...]command to start its functionality. The modules provide feedback of their execution state:

pcn script(attack/wpa_handshake) > run -s TEST_SSID
[i] Sending 64 deauth frames to all clients from AP 00:11:22:33:44:55 on channel 1…
Sent 64 packets.
[i] Monitoring for 10 secs on channel 1 WPA handshakes between all clients and AP 00:11:22:33:44:55…
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Cdb : Automate Common Chrome Debug Protocol Tasks To Help Debug Web Applications

CDB is a Chrome Debug Protocol utility. The main goal of the tool is to automate common tasks to help debug web applications from the command-line and actively monitor and intercept HTTP requests and responses. This is particularly useful during penetration tests and other types of security assessments and investigations.

Quickstart

This tool is meant to be used as part of Pown.js but it can be invoked separately as an independent tool.

Install Pown first as usual:

$ npm install -g pown@latest

Invoke directly from Pown:

$ pown cdb

Library Use

Install this module locally from the root of your project:

$ npm install @pown/cdb –save

Once done, invoke pown cli:

$ POWN_ROOT=. ./node_modules/.bin/pown-cli cdb

Usage

pown cdb
Chrome Debug Protocol Tool
Commands:
pown cdb launch Launch server application such as chrome, firefox, opera and edge [aliases: start]
pown cdb navigate Go to the specified url [aliases: goto, go]
pown cdb network Chrome Debug Protocol Network Monitor [aliases: net, sniff, proxy, mon, monitor]
pown cdb cookies Dump current page cookies [aliases: cookie]
pown cdb screenshot Screenshot the current page [aliases: capture, shoot, shot]
Options:
–version Show version number [boolean]
–help Show help [boolean]

pown cdb navigate

pown cdb navigate
Go to the specified url
Options:
–version Show version number [boolean]
–help Show help [boolean]
–host, -H Remote debugging host [string] [default: “localhost”]
–port, -p Remote debugging port [number] [default: 9222]
–secure, -s HTTPS/WSS frontend [boolean] [default: false]

pown cdb network

pown cdb network
Chrome Debug Protocol Network Monitor
Options:
–version Show version number [boolean]
–help Show help [boolean]
–host, -H Remote debugging host [string] [default: “localhost”]
–port, -p Remote debugging port [number] [default: 9222]
–secure, -s HTTPS/WSS frontend [boolean] [default: false]
–output, -o Output directory/file [array] [default: []]
–blessed, -b Start with blessed ui [boolean] [default: false]
Download

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
American Express, Snapchat Open-Redirect Vulnerabilities Exploited in Phishing Scheme

Phishing operators are taking advantage of security bugs in the Amex and Snapchat websites (the latter is unpatched) to steer victims to phishing pages looking to harvest Google and Microsoft logins.