hacking: security in practice
What are methods in figuring out who is behind creating multiple social media accounts to slander someone?

Are there ways to figure out who is behind fake slander accounts besides the obvious reporting of them and new accounts appear after.

Edit: have been dealing with new accounts for 6 months

submitted by /u/Alone_Analysis_5157
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

OWASP Risk Calculator

OWASP Risk Rating Methodology In general terms, OWASP Risk Rating Methodology takes us through a series of steps that can use to calculate…Continue reading on Medium »
Read more...

OWASP Risk Calculator
https://medium.com/@capturethebugs/owasp-risk-calculator-800daafb42a8?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

OWASP Risk Rating Methodology
In general terms, OWASP Risk Rating Methodology takes us through a series of steps that can use to calculate…Continue reading on Medium » (https://medium.com/@capturethebugs/owasp-risk-calculator-800daafb42a8?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What can I do with a spare router?

I found a new router in my house. Is it possible to set a evil twin AP can from this router that can be used for phishing like we do when we use fluxion, airgeddon? And what other things can be done :)

submitted by /u/TemporaryAbrocoma468
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is there any way to establish a secure connection in LAN (WPA-2)

I am doing research on how to establish secure connection in WPA-2 wifi network, note that I want to establish a secure connection only inside LAN. I am planning to deploy/host a web app in LAN (it will not be hosted on the internet) for local usage,as many unknown devices will connect to it, so that I want to establish secure connection in LAN.

Some comman techniques that I already know but are useless for me:

1.
Use WPA-3 as it provides protection from MITM attacks (I want to use WPA-2 only)

2.
Create your own CA certificate and install it in the devices to establish HTTPS connection (not possible in my case as many unknown devices will connect to the network and modern browsers don't allow this)

3.
Using crypto.js framework in the web app (It doesn't encrypts the HTTP headers, only body is encrypted)
I did researched a lot on this topic but most of the techniques are useless in my case, if someone know a better way to establish a secure connection in LAN then please comment down below.

submitted by /u/MrEquinox98
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Question about command injection
https://www.reddit.com/r/Pentesting/comments/x27d5f/question_about_command_injection/

Hi! I just started pentesting and was trying out using DVWA. I researched quite alot online but I am unable to find out if there are methods that we can run commands as root using the command injection? If I am unable to run as root, may I check what are the possible exploitations that I can run regarding command injection (like how is being able to run arbitrary commands harmful to the OS?) Thanks in advance :) submitted by /u/needyandconfused (https://www.reddit.com/user/needyandconfused)
[link] (https://www.reddit.com/r/Pentesting/comments/x27d5f/question_about_command_injection/) [comments] (https://www.reddit.com/r/Pentesting/comments/x27d5f/question_about_command_injection/)

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
crAPI : Completely Ridiculous API

crAPI (completely ridiculous API) will help you to understand the ten most critical API security risks. crAPI is vulnerable by design, but you’ll be able to safely run it to educate/train yourself.

crAPI is modern, built on top of a microservices architecture. When time has come to buy your first car, sign up for an account and start your journey. To know more about crAPI, please check crAPI’s overview.

QuickStart Guide

Docker

You’ll need to have Docker installed and running on your host system.

Using prebuilt images

You can use prebuilt images generated by our CI workflow.

* To use the latest stable version.
* Linux Machine
curl -o docker-compose.yml https://raw.githubusercontent.com/OWASP/crAPI/main/deploy/docker/docker-compose.yml
docker-compose pull
docker-compose -f docker-compose.yml –compatibility up -d

* Windows Machine

curl.exe -o docker-compose.yml https://raw.githubusercontent.com/OWASP/crAPI/main/deploy/docker/docker-compose.yml
docker-compose pull
docker-compose -f docker-compose.yml –compatibility up -d

To use the latest development version

* Linux Machine

curl -o docker-compose.yml https://raw.githubusercontent.com/OWASP/crAPI/develop/deploy/docker/docker-compose.yml
VERSION=develop docker-compose pull
VERSION=develop docker-compose -f docker-compose.yml –compatibility up -d

* Windows Machine

curl.exe -o docker-compose.yml https://raw.githubusercontent.com/OWASP/crAPI/develop/deploy/docker/docker-compose.yml
set “VERSION=develop”
docker-compose pull
docker-compose -f docker-compose.yml –compatibility up -d
Download

___________________________
@hacking_Attack
@Hacking_Video

Best 26 cybersecurity: YouTube channels
https://medium.com/@rajeevranjancom/best-26-cybersecurity-youtube-channels-8a1d643ac484?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

1. Infosec Institute  — Cybersecurity awareness.
2. Black Hat — Technical cybersecurity conferences.
3. Bugcrowd  — Bug bounty methodology…Continue reading on Medium » (https://medium.com/@rajeevranjancom/best-26-cybersecurity-youtube-channels-8a1d643ac484?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

WinAPI and P/Invoke in C#
https://www.reddit.com/r/redteamsec/comments/x27gmy/winapi_and_pinvoke_in_c/

Covers how you can use WinAPI in C# for red team tooling. https://crypt0ace.github.io/posts/WinAPI-and-PInvoke-in-CSharp/ submitted by /u/Potential_Waltz7400 (https://www.reddit.com/user/Potential_Waltz7400)
[link] (https://www.reddit.com/r/redteamsec/comments/x27gmy/winapi_and_pinvoke_in_c/) [comments] (https://www.reddit.com/r/redteamsec/comments/x27gmy/winapi_and_pinvoke_in_c/)

___________________________
@hacking_Attack
@Hacking_Video

Google Launches New Open Source Bug Bounty to Tackle Supply Chain Attacks
https://www.reddit.com/r/redteamsec/comments/x284av/google_launches_new_open_source_bug_bounty_to/

submitted by /u/anusec (https://www.reddit.com/user/anusec)
[link] (https://thehackernews.com/2022/08/google-launches-new-open-source-bug.html) [comments] (https://www.reddit.com/r/redteamsec/comments/x284av/google_launches_new_open_source_bug_bounty_to/)

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Malware campaign relies on spaces images from James Webb telescope

Malware campaign relies on spaces images from James Webb telescopePost Views: 2 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Patreon-1.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes Threat analysts have spotted a new malware campaign dubbed ‘GO#WEBBFUSCATOR’ that relies on phishing emails, malicious documents, and space images from the James Webb telescope to spread malware.The malware is written in Golang, a programming language that is gaining popularity among cybercriminals because it is cross-platform (Windows, Linux, Mac) and offers increased resistance to reverse engineering and analysis.

In the recent campaign discovered by researchers at Securonix, the threat actor drops payloads that are currently not marked as malicious by antivirus engines on the VirusTotal scanning platform.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Infection chainThe infection starts with a phishing email with an attached malicious document, “Geos-Rates.docx”, which downloads a template file.

That file contains an obfuscated VBS macro that auto-executes if macros are enabled in the Office suite. The code then downloads a JPG image (“OxB36F8GEEC634.jpg”) from a remote resource (“xmlschemeformat[.]com”), decodes it into an executable (“msdllupdate.exe”) using certutil.exe, and launches it.
https://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/vbs.jpg
Malware functionsBased on what could be deduced via dynamic malware analysis, the executable achieves persistence by copying itself to ‘%%localappdata%%\microsoft\vault\’ and adding a new registry key.

Upon execution, the malware establishes a DNS connection to the command and control (C2) server and sends encrypted queries.

“The encrypted messages are read in and unencrypted on the C2 server, thus revealing its original contents,” explains Securonix in the report.
In the case with GO#WEBBFUSCATOR, communication with the C2 server is implemented using `TXT-DNS` requests using `nslookup` requests to the attacker-controlled name server. All information is encoded using Base64.
The C2 may respond to the malware by setting time intervals between connection requests, changing the nslookup timeout, or sending out commands to execute through the Windows cmd.exe tool.

During testing, Securonix observed the threat actors running arbitrary enumeration commands on its test systems, a standard first reconnaissance step.

The researchers note that the domains used for the campaign were registered recently, the oldest one on May 29, 2022.

Securonix has provided a set of indicators of compromise (IoCs) that includes both network and host-based indicat[...]

___________________________
@hacking_Attack
@Hacking_Video

ors.
Trending: WordPress sites hacked with fake Cloudflare DDoS alerts pushing malware
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-5-1-300x150.png Windows malware delays coinminer install by a month to evade detectionAugust 30, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-2-2-300x150.png Critical command injection vulnerability discovered in Bitbucket Server and Data CenterAugust 29, 2022
Reading Time: 2 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-1-4-300x150.png Twilio hackers hit over 130 orgs in massive Okta phishing attackAugust 26, 2022
Reading Time: 5 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-8-300x150.png Hackers use AiTM attack to monitor Microsoft 365 accounts for BEC scamsAugust 25, 2022
Reading Time: 4 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Malware campaign relies on spaces images from James Webb telescope first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hackers hide malware in James Webb telescope images

https://external-preview.redd.it/ji2YQnl89r1zuCkg91AobfCSvSBuwOUdGoT4wZGlV-E.jpg?width=640&crop=smart&auto=webp&s=4b32ee9e4f8f50974064580973f1fb3dfa57ff34 submitted by /u/Seytonic
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How to check if I have monitor mode and packet injection enabled on my pc? (windows)

I have a windows btw (I'm sorry if this is a stupid question. I tried searching it on Google but couldn't find anything I can understand).

submitted by /u/_-psyduck-_
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video