IntroductionContinue reading on Medium » (https://medium.com/@capturethebugs/burp-suite-extensions-to-help-you-pentest-a37b6085d76f?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Burp Suite Extensions to help you Pentest

IntroductionContinue reading on Medium »
Read more...

hacking: security in practice
RFID tags

I'm thinking about getting a RFID key fob that has multiple keys. They offer ranges from uid, cuid, t5577, 8268, and ufuid. Could anyone help explain what these cards would do? So far, my research says that uid is better than ufuid and cuid is better than uid for size, but it has a little more encryption than the uid card. Also, simple examples (like usecase per card type) would be great if you can provide them!

submitted by /u/Its_GameOver
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Zero-day in WPGateway WordPress plugin actively exploited in thousands WordPress sites

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
(2022) Read This Before Going For The eJPT v1.0 Certification…

https://cdn-images-1.medium.com/max/600/1*HNe_nWgyz51tHiaFzH5fWA.png
Howdy Hackers !!!

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
EVERYTHING YOU NEED TO KNOW ABOUT SOCIAL ENGINEERING IN CYBERSECURITY

https://cdn-images-1.medium.com/max/1200/1*5OxsAke70VadQfm_hqNQLg.jpeg
“Amateurs hack systems, professionals hack people”- Bruce Schneier.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Pinecone : A WLAN Red Team Framework

Pinecone is a WLAN networks auditing tool, suitable for red team usage. It is extensible via modules, and it is designed to be run in Debian-based operating systems. Pinecone is specially oriented to be used with a Raspberry Pi, as a portable wireless auditing box.

This tool is designed for educational and research purposes only. Only use it with explicit permission. InstallationFor running Pinecone, you need a Debian-based operating system (it has been tested on Raspbian, Raspberry Pi Desktop and Kali Linux). Pinecone has the following requirements:

* Python 3.5+. Your distribution probably comes with Python3 already installed, if not it can be installed using apt-get install python3.
* dnsmasq (tested with version 2.76). Can be installed using apt-get install dnsmasq.
* hostapd-wpe (tested with version 2.6). Can be installed using apt-get install hostapd-wpe. If your distribution repository does not have a hostapd-wpe package, you can either try to install it using a Kali Linux repository pre-compiled package, or compile it from its source code.

After installing the necessary packages, you can install the Python packages requirements for Pinecone using pip3 install -r requirements.txtin the project root folder. UsageFor starting Pinecone, execute python3 pinecone.pyfrom within the project root folder:

root@kali:~/pinecone# python pinecone.py
[i] Database file: ~/pinecone/db/database.sqlite
pinecone >

Pinecone is controlled via a Metasploit-like command-line interface. You can type helpto get the list of available commands, or help 'command'to get more information about a specific command:

pinecone > help
Documented commands (type help ):
alias help load pyscript set shortcuts use
edit history py quit shell unalias
Undocumented commands:
back run stop
pinecone > help use
Usage: use module [-h]
Interact with the specified module.
positional arguments:
module module ID
optional arguments:
-h, –help show this help message and exit

Use the command use 'moduleID'to activate a Pinecone module. You can use Tab auto-completion to see the list of current loaded modules:

pinecone > use
attack/deauth daemon/hostapd-wpe report/db2json scripts/infrastructure/ap
daemon/dnsmasq discovery/recon scripts/attack/wpa_handshake
pinecone > use discovery/recon
pcn module(discovery/recon) >

Every module has options, that can be seen typing help runor run --helpwhen a module is activated. Most modules have default values for their options (check them before running):

pcn module(discovery/recon) > help run
usage: run [-h] [-i INTERFACE]
optional arguments:
-h, –help show this help message and exit
-i INTERFACE, –iface INTERFACE
monitor mode capable WLAN interface (default: wlan0)

When a module is activated, you can use the run [options...]command to start its functionality. The modules provide feedback of their execution state:

pcn script(attack/wpa_handshake) > run -s TEST_SSID
[i] Sending 64 deauth frames to all clients from AP 00:11:22:33:44:55 on channel 1…
……………………………………………………….
Sent 64 packets.
[i] Monitoring for 10 secs on channel 1 WPA handshakes between all clients and AP 00:11:22:33:44:55…

If the module runs in background (for example, scripts/infrastructure/ap), you can stop it using the stopcommand when the module is running:

pcn script(infrastructure/ap) > run
net.ipv4.ip_forward = 1
[i] Creating NAT rules in iptables for forwarding wlan0 -> eth0…
[i] Starting hostapd-wpe and dnsmasq…
Configuration file: ~/pinecone/tmp/hostapd-wpe.conf
Using interface wlan0 with hwaddr 00:11:22:33:44:55 and ssid “PINECONEWIFI”
wlan0: interface state UNINITIALIZED->ENABLED
wlan0: AP-ENABLED
pcn script(infrastructure/ap) > st[...]

op
[i] Stopping hostapd-wpe and dnsmasq…
net.ipv4.ip_forward = 0
[i] Flushing NAT table in iptables…

When you are done using a module, you can deactivate it by using the backcommand. You can also activate another module issuing the usecommand again.

Shell commands may be executed with the command shellor the !shortcut:

pinecone > !ls
LICENSE modules module_template.py pinecone pinecone.py README.md requirements.txt TODO.md

Currently, Pinecone reconnaissance SQLite database is stored in the db/ directory inside the project root folder. All the temporary files that Pinecone needs to use are stored in the tmp/ directory also under the project root folder. Download

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
One minute about Web App & API Protection - Part 1 (ModSecurity and WAF vendors)

In this series of videos we will talk about Web App & API Protection history, technology, requirements, challenges and solutions. We will make it short and informed. Please subscribe & like.

https://www.youtube.com/watch?v=5xGz50zz3nQ

submitted by /u/onirisapp
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How to create a CVE entry?

Hello fellow hacking enthusiasts,

I recently discovered a stored XSS vulnerability in a small paying web app that is used by not many users (maybe 200 or 300 active users).

I obviously will report it to the developers, but I want to know if it is possible to request a CVE ID? Or are CVEs reserved for bigger companies? If it is possible, how should I proceed? First report to the developers, then to MITRE (or another CNA)?

Thanks!

submitted by /u/ez-kiel
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Has anyone been able to successfully run opendrop on RPi 0 W?

Hey I'm trying to run opendrop, basically airdrop for raspberry pi. theoretically it should work since the 0 w uses the same net chip as the 3 b which is what the developers confirmed that works.

https://github.com/seemoo-lab/opendrop/issues/76 a dev said they weren't able to power the chip for owl to be used to I was just wondering if anyone else has successfully done it with their raspberry pi 0 w I'm currently stuck on installing owl

would love to have an airdropping keychain

submitted by /u/Plenty_Airline_5803
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Reverse shell

Is it possible to get a reverse shell on iPhone similar to how androRAT does with android?

submitted by /u/Dchemist909
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

SDomDiscover - A Easy-To-Use Python Tool To Perform DNS Recon

_ _ _ _ / _// _ \_ _ _ / _ \()\ _ _ _ \_ \/ / / / _ \/ _ `_ \/ / / / / _/ _/ _ \ | / / _ \/ _/ _/ / /_/ / /_/ / / / / / / /_/ / ( ) /_/ /_/ / |/ / _/ / /_/_/\_/_/ /_/ /_/_/_/_/\_/\_/|_/\_/_/ A easy-to-use python tool to perform dns recon with multiple optionsInstallation:It can be installed in any OS with python3Manual installationgit clone https://github.com/D3Ext/SDomDiscovercd SDomDiscoverpip3 install -r requirements.txtOne-linergit clone https://github.com/D3Ext/SDomDiscover && cd SDomDiscover && pip3 install -r requirements.txt && python3 SDomDiscover.pyUsage:Common usagesTo see the help panel and other parameterspython3 SDomDiscover.py -hMain usage of the tool to dump the valid domains in the SSL certificatepython3 SDomDiscover.py -d example.comUsed to perform all the queries and recognizementpython3 SDomDiscover.py -d domain.com --allDownload SDomDiscover
Read more...

I'm Hosting One on One talks to share insight and ideas about GraphQL security, send me a message if you are interested.
https://www.reddit.com/r/Pentesting/comments/xe0qm6/im_hosting_one_on_one_talks_to_share_insight_and/

I am a Security Researcher with Escape technologies, and after pentesting countless GraphQL endpoints I'd like to share this knowledge and hear your thoughts, what vulnerabilities you have encountered, are you involved in solutions and what tools do you use? feel free to message me here to setup a meeting. submitted by /u/MdotTIM (https://www.reddit.com/user/MdotTIM)
[link] (https://www.reddit.com/r/Pentesting/comments/xe0qm6/im_hosting_one_on_one_talks_to_share_insight_and/) [comments] (https://www.reddit.com/r/Pentesting/comments/xe0qm6/im_hosting_one_on_one_talks_to_share_insight_and/)

___________________________
@hacking_Attack
@Hacking_Video