hacking: security in practice
Is consulting good in cybersecurity

Hey all,

I'll soon be graduated and I'm already actively looking for jobs in cybersecurity. My master was centered around software system security and my thesis around arm64 kernel integrity.

I'm not really attracted by consulting but want to be sure that I'm not missing anything. What do you think about consulting in cybersecurity ?

I ideally would like to, just like my master thesis, work on securing OSes. Do you have any suggestion of similar jobs ?

Thanks all :D

submitted by /u/Bwapie
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Do you store your salt with the hashed salted password in 2022

I am working on updating password management for the application I work on. I'm wondering what the best practices are currently, and whether or not mixing something known is safe or not.

submitted by /u/StornZ
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Can your hacking server be hacked through listeners

I guys, I hope this is the right place to ask such question.

Anyone knows if there are known security flaws for listeners such as netcat, socat, or the multihandler from metasploit?

Let's say I have a kali server, running listeners 24/7 in order to catch possible new connections and make them persistent.

Is there any known exploits that may actually be used against this server? I mean a listener is a service as much as http, ssh, smb, ...

submitted by /u/Professional-Ad-5714
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Fallout (Level-2) CTF

https://cdn-images-1.medium.com/max/612/1*URg8nyslPysumDN_MWFW5Q.jpeg
Fallout Smart Contract CTF (Rubixi Hack)

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Pickle Rick TryHackMe Walkthrough

https://cdn-images-1.medium.com/max/811/1*S3Q30JGkREx1OLxIOPuQ1g.png
Pickle Rick on Tryhackme

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
HTB — Backdoor

https://cdn-images-1.medium.com/max/695/0*kGwRXZbhbziTKsoi
wordpress | LFI | pid’s | gdbserver | misconfiguration | screen

Continue reading on stolabs »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Grupo de ransomware filtra archivos robados de Cisco

https://cdn-images-1.medium.com/max/1716/0*r90g2RRXr9XkWHqS
Cisco admitió el 10 de agosto que había detectado una brecha de seguridad el 24 de mayo. La admisión fue motivada por un grupo de…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Common mistakes that are making your web apps insecure, and how to fix them.

https://cdn-images-1.medium.com/max/2600/1*K--C6DY3s43i464yEOHxYA.jpeg
A successful web app must be reliable, secure, and fast. Compromising on any of these qualities can result in a catastrophe…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
NATO documents from Portugal were stolen and put up for sale on the dark web.

https://cdn-images-1.medium.com/max/2600/1*eGHkpxzlnzwfR6yBG1JgWw.jpeg
In August, a group of hackers put secret military documents up for sale on the Internet. Among them are data on the modern weapons systems…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Red Team Part 5 — Intro to C2 | TryHackMe

https://cdn-images-1.medium.com/max/2000/0*ct-G4Bbw7YwjijPm.png
Hello world and welcome to HaXeZ where today we’re going to be getting a bit more technical and looking at C2s. To clarify, C2 is short…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Red Team Part 3 — Red Team Threat Intel | TryHackMe

https://cdn-images-1.medium.com/max/1964/0*kkVojXNl2ecKHvRw.png
Hello world and welcome to HaXeZ, in this post we’re going to be walking through the 3rd Red Team challenge in the Red Team Fundamentals…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Any known case studies on a beacon’s logic executing from within a GPU compute shader?
https://www.reddit.com/r/redteamsec/comments/xdlssd/any_known_case_studies_on_a_beacons_logic/

I’ve been tinkering with writing a chess engine as this fun security engineering project write-up where the vulnerable chess web app uses peer-to-peer and the attacker exploits the victim peer, the pieces start breaking the rules, we use memory forensics to try to analyze and detect the exploitation heuristically via dynamic run-time analysis with baselining… Anyway, I digress. As part of this project I’m thinking a lot about chess engines and wonder: Hmm, I could probably write a chess sim inside a GPU compute shader to calculate a large number of variations in parallel. Then it struck me: If I can do that, couldn’t we write beacons which mostly execute their malicious code within a GPU shader, then pass the I/O in and out of a more benign process? You’d still need to do some stuff on the CPU (any effects on target), but with popular C2 frameworks you have this significant, sort of robust beacon agent code injected in a process to be detected. Sleep masking hides it from memory scanning kinda sorta, but not really against good defensive techniques. Seems like you could hide most of that memory signature inside a GPU compute shader and have much less “robust” code (essentially attack surface for defenders to use for detection) in RAM. Doubt any EDRs out there are scanning VRAM… Even if you did zero processing in a shader, even just hiding data in VRAM when not in-use (example: sleep masking) seems interesting on its own. Maybe someone’s heard of such a thing? Google is terrible with results when “GPU” and “red team” point to non-cyber branding slang. Google Scholar also turned up nothing. submitted by /u/Jonathan-Todd (https://www.reddit.com/user/Jonathan-Todd)
[link] (https://www.reddit.com/r/redteamsec/comments/xdlssd/any_known_case_studies_on_a_beacons_logic/) [comments] (https://www.reddit.com/r/redteamsec/comments/xdlssd/any_known_case_studies_on_a_beacons_logic/)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Bishop Fox Releases Cloud Enumeration Tool CloudFox

CloudFox is a command-line tool to help penetration testers understand unknown cloud environments.