Sites often use HTTP or URL parameters to redirect users to a specified URL without any user action. While this behavior can be useful, it…Continue reading on Medium » (https://sl4x0.medium.com/all-about-open-redirects-d69cf6726122?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
So, if a company gives out work tablets or laptops to employees, what is the degree of risk and likelihood in that computer/tablet/laptop being used by a threat actor in a cyberattack?

You would think that this would be an issue as many companies do this, so how are they defended?

I'm asking for college. It's one of the discussion post things we have to write about based around Network Security.

submitted by /u/ZenithCrests
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
is there any way to hack emails other than phishing?

until recently afaik you could hack Gmail accounts by brute forcing smtp ( I could be wrong I only read they fixed it in may 2022 ), and that got me wondering is there any way to hack emails other than phishing?

also ik that its illegal to hack even your own account so how can I legally try it out? ( if there is anything at all that can be done )

submitted by /u/Fuck_Life_421
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Does anyone know any good virus maker tools for free?

They seem like fund and i would like to try them out with my other devices.

submitted by /u/Yeetler69
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Why Browser Anti-Fingerprinting Techniques Are Not Effective

https://external-preview.redd.it/2zKINZZLinpulz4as85CenEFk3UFJ4tPegSSlgM1Pu8.jpg?width=640&crop=smart&auto=webp&s=6adbe54968da6185e23cfa8231924c2330737ea7 submitted by /u/iamvalentin
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How do i get into hacking and programming?

Man, i'm 16 and i love tech and hacking shit, but i dunno how to hack or to program... I don't know where to read things about it, where to search, HOW to search, etc... Can you dudes help me?

submitted by /u/Chumaludo_Plays
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hashcat: If one has the progress percent before a crash, can one restart at roughly that percent?

I was running hashcat on some digests and got to about 26%, saying Progress.........: 863477760/3313552704 (26.06%). Accidentally hit 'q' for quit right after hitting 's' for status.

Assuming hashcat runs through the same possibilities in the same order for a given command (no parallelism other than within the GPU), I should be able to skip to, say, 25% and continue, right? If so, how might one do this?

(I'm cracking legally acquired, publicly available hashes.)

submitted by /u/gnulynnux
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Looking for thoughts, advice, or known prior art of building an alternative to hooking: behavior baseline by predicting a limited subset of machine code's probable control flow in memory at runtime.
https://www.reddit.com/r/redteamsec/comments/xfeocn/looking_for_thoughts_advice_or_known_prior_art_of/

Hooking is pretty easy to beat. It's efficient, low overhead, but unreliable. It also results in very low resolution scrutiny of program behavior. I think I have an idea, not to replace hooking, but maybe add a more resilient redundant behavior analysis mechanism. Computational overhead is my primary concern, and also I'm unsure how often you can halt a process's normal execution flow to do this without noticeable performance impact. To be honest, I'm actually not even sure how, without implementing this in the kernel, you would, at some interval, redirect the instruction pointer to your analysis code (by force, not by hooking) and also protect it from attacker modification. But I think the idea itself is interesting enough to be discussion-worthy. I think the defender's best option to deal with higher end EDR evasion and obfuscation techniques is to analyze the control flow of the x86 machine code at run-time to build a baseline and detect when there's significant deviation. We know the control flow is unpredictable (https://www.reddit.com/r/cybersecurity/comments/qopemf/i_attempted_to_diagram_everything_ive_learned/), but it should be fairly predictable outside of malicious activity and a few edge-cases (JIT compilation, like in a browser). So I propose this idea of, at a set interval, decode a limited number of instructions ahead of the current IP, disassemble them, and map that disassembly to a behavior baseline. Make sure the control flow matches the baseline - a baseline generated and extrapolated on and broadened by comparing analysis of the same process on hundreds or thousands of hosts in a network.. The next interval, test your last prediction; make sure the IP is within the predicted control flow range. If not, log an alert to a SIEM. Maybe it's a false positive, but the SIEM's logic or some SOAR solution can at least more carefully scrutinize the process / host, maybe treat any other alerts from that host with higher sensitivity. These baselines could also be used as signatures. An attacker might re-write the implementation of a PowerShell command to evade improving PS auditing apparatuses, for example. Or Python, or any other LOLBIN vector. Or they might just do some unhooking on the mechanisms that perform that auditing. This measure would potentially be resistant to those evasion vectors along with control flow obfuscation. You would either identify a baseline that matches some other known baseline (like a PowerShell command, or a Python interpreter) or worse, one that doesn't match any baseline. submitted by /u/Jonathan-Todd (https://www.reddit.com/user/Jonathan-Todd)
[link] (https://www.reddit.com/r/redteamsec/comments/xfeocn/looking_for_thoughts_advice_or_known_prior_art_of/) [comments] (https://www.reddit.com/r/redteamsec/comments/xfeocn/looking_for_thoughts_advice_or_known_prior_art_of/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Anonymous IP logger?

New to hacking here

I want to make an title. I was using iplogger .org, but if you just hold the link then the preview exposes what youre doing. I tried using TinyURL but URL shorteners don’t hide the preview. How can I make this, with the average user having no idea that I got their IP address (preferrable with some sort of software thing like iplogger .org where it shows the location and such)?

submitted by /u/Legend5V
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
AndroRAT

I have an old android phone I’m t trying to mess around androRAT with, but when I get to systemctl status apache2.service it says “disabled” & “inactive.” Is there something else to use

submitted by /u/Dchemist909
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
The Uber hack is quite severe and wide ranging. Wishing their blue teams the best of luck and love during this understandably difficult period.

https://external-preview.redd.it/lw02mVmhV3Z_uCaxo6WTlqXUhdBfCGd22AqlF9DEvGU.jpg?width=108&crop=smart&auto=webp&s=be64f7d22a443d50f8dfe0c36df0890b5cb80b66 submitted by /u/GeniusDodo
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Proxy POC

So me and a friend of mine are working on a AITM proxy POC with python. They are stating that we should use flask but I’m not really sure that would work. Does anyone know of any example proxies we may be able to study from?

submitted by /u/KingA1mighty
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
REQUEST Mentorship RESPONSE $$ :)

Good day everyone,

Al lot of the time, you hear a successful people talk about how lucky they were having a mentor in some shape. I'm just going to pretty much throw out there I have decent understanding of service security so a decent time in fundamentals, however with all the information that are there I am unable to find a ride methodology without constantly getting stuck somewhere to become a full webApp and mobile hacker. This is the only work I can do as I'm suffering from a disability which also left me in a wheelchair. So i have time.

I guess what I'm saying is I'm looking more for an experienced coach, that gets paid. I know this is a long shot and im sure the responses will range from take the xyz path to you need to figure it out youself etc. The thing is like I said I have a lot of time since my accident so I have an account at HTB Codecademy THM havent started many of the Udemy courses by zSecurity cause i dont know which ones will waste time and which will get me closer to the goal im trying to reach.

for example. I learned JS on codecademy, just to realize i should have done HTML CSS websites interactive with JS instead as i can just console.log('disappointment') now after another thing completed that didn't get me a step closer but mentally 2 steps back because of frustration.

Well, its 6 am and Ill take a go at OWASP 10 on THM even tho i was thinking if i became a full stack dev. id know the ins and outs of what to look for so ya... there goes my dilemma.

If anyone is interested to make some money on the side let me know.

Thanks

submitted by /u/Gammasntax
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Coding in movies vs real life 😂

https://external-preview.redd.it/gnUxv1bCadAUCMAM3lGfQEbae3joMSZQ8w947_78ikc.jpg?width=320&crop=smart&auto=webp&s=b77e27b30f522da441ca1a1624ff7c288441414d submitted by /u/PoeticHerald
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Cross-site request forgery (CSRF) Explained and Exploited I
https://infosecwriteups.com/cross-site-request-forgery-csrf-explained-and-exploited-i-db464a61a582?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hi! This blog will teach you how CSRF attacks happen and how we can prevent them.Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/cross-site-request-forgery-csrf-explained-and-exploited-i-db464a61a582?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video