Hacking on Medium
During my Capture The Flag sessions, I have to navigate through a lot of config files which can…

The sum of small changes make a BIG difference so if you have other “quick-win” like that, you can share it in the commentary section.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The Tale Of SSRF To RCE on .GOV Domain

https://cdn-images-1.medium.com/max/1200/0*xAKYP_kYxvvBrXa-
Welcome back, I hope everyone is well. Without further hesitation let’s dive into it!

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hack Someone’s Phone Remotely Pt. 2

https://cdn-images-1.medium.com/max/2600/0*_e21ruzcqIoOQEUL
It would be best if you kept in mind the alerts and suspicious functioning of your phone to make sure that it is not hacked. But it is…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Is it possible to hack any device easily?

https://brandnews5.blogspot.com/2022/09/ubers-electronic-network-has-been.html

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
unblob : Extract files from any kind of container formats

unblob is an accurate, fast, and easy-to-use extraction suite. It parses unknown binary blobs for more than 30 different archive, compression, and file-system formats, extracts their content recursively, and carves out unknown chunks that have not been accounted for.

Unblob is free to use, licensed with the MIT license. It has a Command Line Interface and can be used as a Python library.
This turns unblob into the perfect companion for extracting, analyzing, and reverse engineering firmware images. Why unblob?One of the major challenges of embedded security analysis is the sound and safe extraction of arbitrary firmware.

Specialized tools that can extract information from those firmware images already exist, but we were carving for something smarter that could identify both start-offset and end-offset of a specific chunk (e.g. filesystem, compression stream, archive, …).

We stick to the format standard as much as possible when deriving these offsets, and we clearly define what we want out of identified chunks (e.g., not extracting meta-data to disk, padding removal). This strategy helps us feed known valid data to extractors and precisely identify chunks, turning unknown unknowns into known unknowns.

Given the modular design of unblob and the ever-expanding repository of supported formats, unblob could very well be used in areas outside embedded security such as data recovery, memory forensics, or malware analysis. Our Objectivesunblob has been developed with the following objectives in mind:

* Accuracy – chunk start offsets are identified using battle tested rules, while end offsets are computed according to the format’s standard without deviating from it. We minimize false positives as much as possible by validating header structures and discarding overlapping chunks.
* Security – unblob does not require elevated privileges to run. It’s heavily tested and has been fuzz tested against a large corpus of files and firmware images. We rely on up-to-date third party dependencies that are locked to limit potential supply chain issues. We use safe extractors that we audited and fixed where required (see path traversal in ubi_reader, path traversal in jefferson, integer overflow in Yara).
* Extensibility – unblob exposes an API that can be used to write custom format handlers and extractors in no time.
* Speed – we want unblob to be blazing fast, that’s why we use multi-processing by default, make sure to write efficient code, use memory-mapped files, and use Hyperscan as a high-performance matching library. Computation-intensive functions are written in Rust and called from Python using specific bindings. How does it work?unblob identifies known and unknown chunks of data within a file:

* known chunks are identified by finding the start offset using a search rule, and the end offset is computed based on the format standard. Unknown chunks represents unidentified chunks of data before, after, or between known chunks. Unknown chunks composed of known content (e.g., null padding, 0xFFpadding) are identified automatically and reported as such.
* unblob will carve out known chunks to disk and perform the extraction phase using the extractor assigned to a given handler. It will then walk the extracted content, looking for chunks in extracted files.
* a report on metadata can be generated by unblob, providing detailed information about identified chunks (format, offsets, size, entropy) and their extracted content if available (ownership, permissions, timestamps, …). Used technologies* unblob is written in Python.
* For quickly searching binary patterns in files, we use Hyperscan.
* For extracting recognized formats, we use all kinds of different Extractors.
* For ELF analysis, we are using LIEF with its Python bindings.
* For CPU-intensive tasks (e.g. entropy calculation), we use[...]

___________________________
@hacking_Attack
@Hacking_Video

Rust to speed things up.
* For the pretty command line interface, we are using the Click library.
* For structured logging, we are using the structlog library.
* For development and testing tools, see the Development page. Download

___________________________
@hacking_Attack
@Hacking_Video

EarlyBird Shellcode Injection in C#
https://www.reddit.com/r/redteamsec/comments/xfufqi/earlybird_shellcode_injection_in_c/

https://crypt0ace.github.io/posts/Shellcode-Injection-Techniques-Part-3/ submitted by /u/Potential_Waltz7400 (https://www.reddit.com/user/Potential_Waltz7400)
[link] (https://www.reddit.com/r/redteamsec/comments/xfufqi/earlybird_shellcode_injection_in_c/) [comments] (https://www.reddit.com/r/redteamsec/comments/xfufqi/earlybird_shellcode_injection_in_c/)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Hacker Pwns Uber Via Compromised Slack Account

A teen hacker reportedly social-engineered an Uber employee to hand over a Slack password, before burrowing deep into Uber's cloud and code repositories.

Dark Reading: Attacks/Breaches
Highlights of the 2022 Pwnie Awards

Since 2007, the Pwnies have celebrated the good, the bad, and the wacky in cybersecurity. Enjoy some of the best moments of this year's ceremony.

Dark Reading: Attacks/Breaches
Business Application Compromise & the Evolving Art of Social Engineering

Be wary of being pestered into making a bad decision. As digital applications proliferate, educating users against social engineering attempts is a key part of a strong defense.

hacking: security in practice
US border forces are seizing Americans' phone data and storing it for 15 years

https://external-preview.redd.it/f2ao-Uvct-mpjpnjbE55lOeX0qCnBxRfBqOno0IOY18.jpg?width=640&crop=smart&auto=webp&s=a759f4b5b9dbf60a31a8487199b781572ff4daac submitted by /u/WhoaEpic
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

https://b.thumbs.redditmedia.com/9YHGqBd3jEHw8DNmGp8MzgNQorUnAvUFMBDBy45oyUE.jpg I'm trying to find information on the following breach that I found on Intelx. Does anyone know its origin and what it contains (i.e. emails, passwords, other shit)? I don't have a paid subscription to Intelx, so I can't see the unredacted version.

NG[10F3A3C831473EB8A5E5E881697A5DFB] [2022-07-20T16_10_38.8203046].rar/FileGrabber/Users/HP/Documents/Yahoo Mail.txt

I've searched my usual sites but haven't found any information.

I'm interested in the Yahoo Mail.txt but here is the whole .rar

submitted by /u/Kimberlita
[link] [comments]

hacking: security in practice
OverTheWire natas level 11

When I replace the cookie data with the correct data and refreshed the page, nothing happen. The cookie data went back to the default. I googled the solution and found that the initial cookie data is different from mine. I tried to use the final cookie data in the googled solution but the results is still the same. How can I solve this?

submitted by /u/Vinc3w
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Legal Sites to Test SQL Injection

I am creating a self project for a SQLi Scanner and was wondering if there was a site that I can run my code on to see if it is vulnerable to SQLi. I was hoping there would be a better option than to create my own website from scratch.

submitted by /u/keepgrinding3
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

How many hours do you guys work per day?
https://www.reddit.com/r/Pentesting/comments/xfy55k/how_many_hours_do_you_guys_work_per_day/

Is it true that pen testers work 24 hours everyday? Or do you guys work from let’s say 7 to 3 pm. submitted by /u/ELIDAL99 (https://www.reddit.com/user/ELIDAL99)
[link] (https://www.reddit.com/r/Pentesting/comments/xfy55k/how_many_hours_do_you_guys_work_per_day/) [comments] (https://www.reddit.com/r/Pentesting/comments/xfy55k/how_many_hours_do_you_guys_work_per_day/)

___________________________
@hacking_Attack
@Hacking_Video