Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Deobfuscating JS code of phishing page

Hello,

I was looking phishing pages on any.run and I've found a page with obfuscated javascript.

I've tried deobfuscating it with various techniques found on the web, but I can't do it.

Most of the time I get JS errors about syntax, but the code was copy/pasted directly from the source.

I managed to copy the source to ghostbin since pastebin deletes it: https://ghostbin[.]me/62eafa584c316

Can anyone with more experience help me on how to deobfuscate it?

For reference, this is the sandbox: https://app.any.run/tasks/3cbb9f96-7be2-4e42-9b1d-78e5a4163ed9/

Thanks!

submitted by /u/0811930
[link] [comments]

12 views13:24

hacking: security in practice
Possible vulnerability?

I am developing a python server (flask). I allow users to upload images and save them as they are in the server (metadata as is). The image name gets checked so there is almost impossible to 'Path Traversal' but file extension is easy to bypass ('image.php.png' is ok) and the metadata are not removed, file/image is saved as is or with minor edits in the filename (if '/' or '../' etc are found).

Then, the files are returned in base64 for using a helper functionality that uses base64 encoding to return the file to the frontend/client. For example:

import os import base64 def get_image(image_name): with open(os.path.join("uploads/" + image_name), "rb") as image: encoded_img = base64.b64encode(image.read()) return encoded_img.decode("utf-8")

Some images are used by the admins of the application as well and some others can be dissplayed to other users. Is there any realistic way of exploiting this? Thanks in advance!

submitted by /u/JuicyNatural
[link] [comments]

Possible vulnerability?

I am developing a python server (flask). I allow users to upload images and save them as they are in the server (metadata as is). The image name...

9 views13:24

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
word file hack?

im not a hacker but a quick question to you hackers, is there a way to access someone else’s word files from my laptop? i want to access my teachers files and want the answers to my exercises :)

submitted by /u/ResponsibleMuscle521
[link] [comments]

word file hack?

im not a hacker but a quick question to you hackers, is there a way to access someone else’s word files from my laptop? i want to access my...

11 views13:24

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
How’s Web 3.0 Going to be different?

It’s quite obvious that Tech powerhouses control and exploit user-generated data in Web 2.0. Everyone one knows that and can accurately decipher this exploitation techniques. End users will have complete control of the data they utilize in blockchain-powered web3

You will be able to pick what information you wish to share with businesses and advertising agencies in order to earn money which is I believe has been a huge Achilles Heel for privacy breeches in Web 2.0.

Furthermore, Web3 will not be controlled by a single body. As a consequence, decentralized apps (dApps) will not be banned or limited in any way.

Searching and connecting information efficiently

Web3 will allow you to search for information more effectively. When you search for anything on a search engine, it will provide more relevant results rather than the most popular pages that people click. The semantic web will aid in improving the interconnectedness of online data.

It will assist you in becoming more productive and saving time when looking for information.

However, various technologies such as blockchain, AI, and machine learning power Web3. It will make use of semantic data, 3D graphics, and more. Likely, less advanced devices will not be able to handle Web3. Users will need a device that has above-average specifications to use Web3.

submitted by /u/Communitybot1
[link] [comments]

How’s Web 3.0 Going to be different?

It’s quite obvious that Tech powerhouses control and exploit user-generated data in Web 2.0. Everyone one knows that and can accurately decipher...

9 views13:24

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
How often does malware not end up running the payload in it's own EXE or DLL?

What I'm trying to figure out is how often is malware in its entirety, for example: an infected PDF, a browser exploit, Javascript, or office macros, etc.

Is it even possible in most circumstances to embed the WHOLE virus in something like that? And if so, does it still need to extract into an EXE or DLL in the end?

To put it simply, does malware still, in the end, need to execute it's own process?

(I should be clear that I'm specifically talking about Windows malware.)

submitted by /u/HalcyonicFrankfurter
[link] [comments]

How often does malware not end up running the payload in it's own...

What I'm trying to figure out is how often is malware in its entirety, for example: an infected PDF, a browser exploit, Javascript, or office...

10 views13:24

Hacking Articles Tips Tricks Videos Tutorials

BlackStone - Pentesting Reporting Tool
http://www.kitploit.com/2022/08/blackstone-pentesting-reporting-tool.html

7 views13:41

Hacking Articles Tips Tricks Videos Tutorials

7 views13:41

About

Blog

Apps

Platform