Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
activating gift cards on my own?

Dear r/hacking,

As per my current profession I am made to handle a large amount of gift cards and vouchers, placing them in stores.

Think Netflix, Apple store, Amazon, Disney+, Steam, you name it.

I am not paid enough to take the job seriously, and with how many cards I handle noone would care if a few items were to fall into my pockets, but they are worthless if they aren't activated by store emplyees through the exchange of money.

I was wondering if there is any way to activate them myself, without going through a store's system?

I am based in the EU if it makes any difference.

Thanks in advance

submitted by /u/WarmenBright
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

activating gift cards on my own?

Dear r/hacking, As per my current profession I am made to handle a large amount of gift cards and vouchers, placing them in stores. Think...

9 viewsedited 09:25

ALEX2 Orderbook: Testnet with Bug Bounty rewards and more

Testnet of a decentralized exchange from the ALEX2 project.Continue reading on Medium »
Read more...

10 views09:29

Hacking Articles Tips Tricks Videos Tutorials

11 views09:31

Hacking Articles Tips Tricks Videos Tutorials

14 views09:31

Hacking Articles Tips Tricks Videos Tutorials

Photo

Black Hat Ethical Hacking
OSINT Tool: Blackbird

OSINT Tool: BlackbirdPost Views: 18 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes BlackbirdBlackbird by p1ngul1n0, is an OSINT (Open-source intelligence) tool to search fast for accounts by username across 153 sites. When performing Pentesting, and Social Engineering attacks, this recon step is very crucial when you want to conduct targeted attacks, and find active profiles on various social media sites, so you can tweak the approach and maximize the outcome of that attack. The name of the tool is based on the Lockheed SR-71 “Blackbird” a long range, high-altitude, Mach 3+ strategic reconnaissance aircraft developed and manufactured by the American aerospace company Lockheed Corporation.

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/blackbird_web-1024x494.png
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course SetupClone the repositorygit clone https://github.com/p1ngul1n0/blackbirdcd blackbirdInstall requirementspip install -r requirements.txtTrending: Offensive Security Tool: Offensive-Azure UsageSearch by usernamepython blackbird.py -u usernameRun WebServerpython blackbird.py --webAccess http://127.0.0.1:9797 on the browser Read results filepython blackbird.py -f username.jsonList supported sitespython blackbird.py --list-sitesUse proxypython blackbird.py -u crash --proxy http://127.0.0.1:8080Show all resultsBy default only found accounts will be shown, however you can use the argument below to see them. python blackbird.py -u crash --show-allSupported Social NetworksIt is up to you for how you wish to use this toolkit. Each module can be ran independently, or you can install it as a package and use it in that way. Each module is exported to a script named the same as the module file. For example:

1. Facebook
2. YouTube
3. Twitter
4. Telegram
5. TikTok
6. Tinder
7. Instagram
8. Pinterest
9. Snapchat
10. Reddit
11. Soundcloud
12. Github
13. Steam
14. Linktree
15. Xbox Gamertag
16. Twitter Archived
17. Xvideos
18. PornHub
19. Xhamster
20. Periscope
21. Ask FM
22. Vimeo
23. Twitch
24. Pastebin
25. WordPress Profile
26. WordPress Site
27. AllMyLinks
28. Buzzfeed
29. JsFiddle
30. Sourceforge
31. Kickstarter
32. Smule
33. Blogspot
34. Tradingview
35. Internet Archive
36. Alura
37. Behance
38. MySpace
39. Disqus
40. Slideshare
41. Rumble
42. Ebay
43. RedBubble
44. Kik
45. Roblox
46. Armor Games
47. Fortnite Tracker
48. Duolingo
49. Chess
50. Shopify
51. Untappd
52. Last FM
53. Cash APP
54. Imgur
55. Trello
56. Minecraft
57. Patreon
58. DockerHub
59. Kongregate
60. Vine
61. Gamespot
62. Shutterstock
63. Chaturbate
64. ProtonMail
65. TripAdvisor
66. RapidAPI
67. HackTheBox
68. Wikipedia
69. Buymeacoffe
70. Arduino
71. League of Legends Tracker
72. Lego Ideas
73. Fiverr
74. Redtube
75. Dribble
76. Packet Storm Security
77. Ello
78. Medium
79. Hackaday
80. Keybase
81. HackerOne
82. BugCrowd
83. OneCompiler
84. TryHackMe
85. Lyrics Training
86. Expo
87. RAWG
88. Coroflot
89. Cloudflare
90. Wattpad
91. Mixlr
92. ImageShack
93. Freelancer
94. Dev To
95. BitBucket
96. Ko Fi
97. Flickr
98. HackerEarth
99. Spotify
100. Snapchat Stories
101. Audio Jungle
102. Avid Community
103. Bandlab
104. Carrd
105. CastingCallClub
106. Coderwall
107. Codewars
108. F3
109. Gab
110. Issuu
111. Steemit
112. Venmo
113. MODDB
114. COLOURlovers
115. Scheme Color
116. Roblox Trade
117. Aethe[...]

17 views09:31

Hacking Articles Tips Tricks Videos Tutorials

Photo

Black Hat Ethical Hacking
Browser-powered desync: New class of HTTP request smuggling attacks showcased at Black Hat USA

Browser-powered desync: New class of HTTP request smuggling attacks showcased at Black Hat USAPost Views: 50 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Patreon-1.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes A new class of HTTP request smuggling attack allowed a security researcher to compromise multiple popular websites including Amazon and Akamai, break TLS, and exploit Apache servers.Speaking at Black Hat USA yesterday (August 10), James Kettle unveiled research that opens the new frontier in HTTP request smuggling – browser-powered desync attacks.

The briefing and it’s whitepaper, titled ‘Browser-Powered Desync Attacks: A New Frontier in HTTP Request Smuggling’, builds on Kettle’s previous research into desync attacks.

Traditional desync attacks poison the connection between a front-end and back-end server and are therefore impossible on websites that don’t use a front-end/back-end architecture.

However this new technique causes a desync between the front-end and the browser, allowing an attacker to “craft high-severity exploits without relying on malformed requests that browsers will never send”, Kettle noted.

This can expose a whole new range of websites to server-side request smuggling and enables an attacker to perform client-side variations of these attacks by inducing a victim’s browser to poison its own connection to a vulnerable web server.

Kettle demonstrated how he was able to turn a victim’s web browser into a desync delivery platform, shifting the request smuggling frontier by exposing single-server websites and internal networks.

He was able to combine cross-domain requests with server flaws to poison browser connection pools, install backdoors, and release desync worms – in turn compromising targets including Amazon, Apache, Akamai, Varnish, and multiple web VPNs.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course DiscoveryKettle told attendees at the 25th anniversary of the annual hacking conference that four separate vulnerabilities led to the discovery of browser-powered desync attacks.

The first, involving request validation, leverages a technique in which an attacker can use two requests down the same connection with a valid host header in order to gain access to the host in the second request, because the reverse proxy only validates the first host.

The second, first-request routing, is a closely related flaw which occurs when the front-end uses the first request’s Host header to decide which back-end to route the request to, and then routes all subsequent requests from the same client connection down the same back-end connection.

Kettle also discovered a technique to detect connection-locked request smuggling by using a delay and reading the data early to decide if the front-end is using the Content-Length header.

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/819f-article-220810-james-k-1024x576.jpg
James Kettle presents at the annual hacking conference held in Las Vegas
If it is using the Content-Length it will time out, which will signify the difference between connection-locked HTTP/1 request smuggling and harmless HTTP pipelining.

A fourth vulnerability caused a desync known as CL.0/H2.0. Kettle was able to use this to compromise Amazon users’ accounts, enabling him to steal users’ requests and add them to his shopping list. He could capture all their requests, including tokens which could have enabled him to impersonate those users.

Speaking[...]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking

Browser-powered desync: New class of HTTP request smuggling attacks showcased at Black Hat USA | Black Hat Ethical Hacking

A new class of HTTP request smuggling attack allowed a security researcher to compromise multiple popular websites including Amazon and Akamai, break TLS, and exploit Apache servers.

16 viewsedited 09:31

Hacking Articles Tips Tricks Videos Tutorials

Black Hat Ethical Hacking OSINT Tool: Blackbird OSINT Tool: BlackbirdPost Views: 18 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Patreon.png Subscribe to Patreon to watch this episode. Reading Time: 3 Minutes BlackbirdBlackbird…

rhub
118. BugBounty
119. Huntr
120. Universocraft
121. Wireclub
122. AminoApps
123. Trakt
124. Giphy
125. Minecraft List
126. SEOClerks
127. Mix
128. Codecademy
129. Bandcamp
130. Poshmark
131. hackster
132. BodyBuilding
133. Mastodon
134. IFTTT
135. Anime Planet
136. Destructoid
137. Gitee
138. Teknik
139. BitChute
140. The Tatto Forum
141. NPM
142. PyPI
143. HackenProof
144. VKontakte
145. about me
146. Dissenter
147. Designspiration
148. Fark
149. mmorpg
150. Pikabu
151. Playstation Network
152. Warrior Forum
153. Pixilart Export ReportThe results can be exported as a PDF Report.

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/blackbird_report_pdf_cover.png https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/blackbird_report_pdf_results.png Export ReportWhen possible Blackbird will extract the user’s metadata, bringing data such as name, bio, location and profile picture.

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/blackbird_metadata.png Random UserAgentBlackbird uses a random UserAgent from a list of 1000 UserAgents in each request to prevent blocking. Supersonic speedBlackbird sends async HTTP requests, allowing a lot more speed when discovering user accounts. JSON TemplateBlackbird uses JSON as a template to store and read data.

The data.json file store all sites that blackbird verify. Params* app – Site name
* url
* valid – Python expression that returns True when user exists
* id – Unique numeric ID
* method – HTTP method
* json – JSON body POST (needs to be escaped, use this: https://codebeautify.org/json-escape-unescape)
* {username} – Username place (URL or Body)
* response.status – HTTP response status
* responseContent – Raw response body
* soup – Beautifulsoup parsed response body
* jsonData – JSON response body
* metadada – a list of objects to be scraped ExamplesGET

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/GET-1024x610.png

POST JSON

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/POST-JSON-1024x508.png

GET with Metadata extraction

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/GET-with-Metadata-extraction-919x1024.png DisclaimerThis or previous program is for Educational purpose ONLY. Do not use it without permission. The usual disclaimer applies, especially the fact that the author is not liable for any damages caused by direct or indirect use of the information or functionality provided by these programs. The author or any Internet provider bears NO responsibility for content or misuse of these programs or any derivatives thereof. By using these programs you accept the fact that any damage (dataloss, system crash, system compromise, etc.) caused by the use of these programs its your responsibility.
Clone the repo from here: GitHub Link
Trending: Write up: Find Hidden Info using Google Dorking manually, and Automated using Pagodo https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Offensive-Azure-300x150.png Offensive Security Tool: Offensive-AzureAugust 5, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Pretender-300x150.png Offensive Security Tool: PretenderJuly 29, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/DDoS-Layer7-bheh-300x150.png Offensive Security Tool: DDoS-Layer7-bhehJuly 28, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/GitHacker-300x150.png Offensive Security Tool: GitHackerJuly 22, 2022
Reading Time: 3 minutes https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post OSINT Tool[...]

___________________________
@hacking_Attack
@Hacking_Video

11 viewsedited 09:31

Hacking Articles Tips Tricks Videos Tutorials

Black Hat Ethical Hacking
Browser-powered desync: New class of HTTP request smuggling attacks showcased at Black Hat USA

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking

Browser-powered desync: New class of HTTP request smuggling attacks showcased at Black Hat USA | Black Hat Ethical Hacking

A new class of HTTP request smuggling attack allowed a security researcher to compromise multiple popular websites including Amazon and Akamai, break TLS, and exploit Apache servers.

6 viewsedited 09:31

Hacking Articles Tips Tricks Videos Tutorials

: Blackbird first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

7 viewsedited 09:31

Hacking Articles Tips Tricks Videos Tutorials

ALEX2 Orderbook: Testnet with Bug Bounty rewards and more
https://medium.com/@Crypto_Davy_ENG/alex2-orderbook-testnet-with-bug-bounty-rewards-and-more-5f77731c3ba1?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video