Hacking on Medium
IW Weekly #17: $30,000 Bounty, Instagram Account Takeover, AWS Security Series, Google…

https://cdn-images-1.medium.com/max/2000/1*M-4g3it7uwTdzT5XoAlhrQ.jpeg
Hey 👋

Continue reading on Medium »

Hacking on Medium
How to Clone a phone

https://cdn-images-1.medium.com/max/600/1*sJRM4yttHkhxyQCm85uwnA.jpeg
Phone cloning is copying the data and identity of one cell phone to another. Cloning can either be a backup of the entire phone, or it can…

Continue reading on Medium »

Hacking on Medium
How to Hire a hacker

https://cdn-images-1.medium.com/max/960/1*qNa_ODeMMdW_YxPgjk9ocg.jpeg
You can Hire a hacker to clone a Phone

Continue reading on Medium »

hacking: security in practice
Deobfuscating JS code of phishing page

Hello,

I was looking phishing pages on any.run and I've found a page with obfuscated javascript.

I've tried deobfuscating it with various techniques found on the web, but I can't do it.

Most of the time I get JS errors about syntax, but the code was copy/pasted directly from the source.

I managed to copy the source to ghostbin since pastebin deletes it: https://ghostbin[.]me/62eafa584c316

Can anyone with more experience help me on how to deobfuscate it?

For reference, this is the sandbox: https://app.any.run/tasks/3cbb9f96-7be2-4e42-9b1d-78e5a4163ed9/

Thanks!

submitted by /u/0811930
[link] [comments]

hacking: security in practice
Possible vulnerability?

I am developing a python server (flask). I allow users to upload images and save them as they are in the server (metadata as is). The image name gets checked so there is almost impossible to 'Path Traversal' but file extension is easy to bypass ('image.php.png' is ok) and the metadata are not removed, file/image is saved as is or with minor edits in the filename (if '/' or '../' etc are found).

Then, the files are returned in base64 for using a helper functionality that uses base64 encoding to return the file to the frontend/client. For example:
import os import base64 def get_image(image_name): with open(os.path.join("uploads/" + image_name), "rb") as image: encoded_img = base64.b64encode(image.read()) return encoded_img.decode("utf-8")
Some images are used by the admins of the application as well and some others can be dissplayed to other users. Is there any realistic way of exploiting this? Thanks in advance!

submitted by /u/JuicyNatural
[link] [comments]

hacking: security in practice
word file hack?

im not a hacker but a quick question to you hackers, is there a way to access someone else’s word files from my laptop? i want to access my teachers files and want the answers to my exercises :)

submitted by /u/ResponsibleMuscle521
[link] [comments]

hacking: security in practice
How’s Web 3.0 Going to be different?

It’s quite obvious that Tech powerhouses control and exploit user-generated data in Web 2.0. Everyone one knows that and can accurately decipher this exploitation techniques. End users will have complete control of the data they utilize in blockchain-powered web3

You will be able to pick what information you wish to share with businesses and advertising agencies in order to earn money which is I believe has been a huge Achilles Heel for privacy breeches in Web 2.0.

Furthermore, Web3 will not be controlled by a single body. As a consequence, decentralized apps (dApps) will not be banned or limited in any way.

Searching and connecting information efficiently

Web3 will allow you to search for information more effectively. When you search for anything on a search engine, it will provide more relevant results rather than the most popular pages that people click. The semantic web will aid in improving the interconnectedness of online data.

It will assist you in becoming more productive and saving time when looking for information.

However, various technologies such as blockchain, AI, and machine learning power Web3. It will make use of semantic data, 3D graphics, and more. Likely, less advanced devices will not be able to handle Web3. Users will need a device that has above-average specifications to use Web3.

submitted by /u/Communitybot1
[link] [comments]

hacking: security in practice
How often does malware not end up running the payload in it's own EXE or DLL?

What I'm trying to figure out is how often is malware in its entirety, for example: an infected PDF, a browser exploit, Javascript, or office macros, etc.

Is it even possible in most circumstances to embed the WHOLE virus in something like that? And if so, does it still need to extract into an EXE or DLL in the end?

To put it simply, does malware still, in the end, need to execute it's own process?

(I should be clear that I'm specifically talking about Windows malware.)

submitted by /u/HalcyonicFrankfurter
[link] [comments]

BlackStone - Pentesting Reporting Tool
http://www.kitploit.com/2022/08/blackstone-pentesting-reporting-tool.html

BlackStone project or "BlackStone Project" is a tool created in order to automate the work of drafting and submitting a report on audits of ethical hacking (https://www.kitploit.com/search/label/Hacking) or pentesting. In this tool we can register in the database the vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) that we find in the audit, classifying them by internal, external audit or wifi, in addition, we can put your description and recommendation, as well as the level of severity and effort for its correction. This information will then help us generate in the report a criticality table as a global summary of the vulnerabilities found. We can also register a company and, just by adding its web page, the tool will be able to find subdomains, telephone numbers, social networks, employee emails...

Docker Install Install Docker Install docker-compose Install BlackStone git clone https://github.com/micro-joan/BlackStone
cd BlackStone
docker-compose up -d
User: blackstone Password: blackstone Manual Install First we must download an Apache (https://www.kitploit.com/search/label/Apache) server to host the tool, in my case I use Mamp (I recommend following these steps): https://www.mamp.info/en/downloads/ We will download the content of this repository and we will have 2 folders (BlackStone and BBDD) Once the server starts we will go to c://MAMP/htdocs and paste all the contents of the downloaded folder "BlackStone" For the application to work we will have to import the database, we will go to our browser and write "localhost/phpMyAdmin/", you have the database connection file in the folder BlackStone/conexion.php We will create a database called blackstone and import the data from the downloaded BBDD folder Log in to BlackStone with the username (https://www.kitploit.com/search/label/Username) and password "blackstone" Use First you need to go to profile settings and add Hunter.io and haveibeenpwned.com tokens:

After having vulnerabilities in the database, we will go to the audited client and we will register a client along with their web page, once registered we can go to customer details and we can see the following information: THE USE OF THIS APPLICATION IS FOR PROFESSIONAL USE, THE AUTHOR IS NOT RESPONSIBLE FOR A MISUSE EMPLOYED
Name of business owner Social networks of the company owner Email and telephone number of the owner of the company Exposed password check on the company owner's deep web Subdomains of the website (https://www.kitploit.com/search/label/Website) as well as information of interest found in google Emails of company workers