XSS is Dead!!! NaN…You don't get it.Continue reading on Medium » (https://thilakesh0079.medium.com/cookie-parameter-to-xss-bounty-writeups-2-7bff96e798c9?source=rss------bug_bounty-5)

hacking: security in practice
evilgophish Now Supports SMS Campaigns

https://external-preview.redd.it/fIx_KTzgP85cB5Nl8Kd0JYEa8h6Zn9WLpJME5546_FQ.jpg?width=640&crop=smart&auto=webp&s=f7b580e673a45958c76f9f44b3c827623b0bc17e submitted by /u/edreatingmonkey
[link] [comments]

hacking: security in practice
PCredz - This tool extracts Credit card numbers, NTLM(DCE-RPC, HTTP, SQL, LDAP, etc), Kerberos (AS-REQ Pre-Auth etype 23), HTTP Basic, SNMP, POP, SMTP, FTP, IMAP, etc from a pcap file or from a live interface.

https://external-preview.redd.it/NKLgvbiEBfAE3QZRjQci4gdng51mJwS7yR1s7NvMk1o.jpg?width=640&crop=smart&auto=webp&s=80d3e7162416336c5e978558a7827188059718df submitted by /u/DrinkMoreCodeMore
[link] [comments]

Black Hat Ethical Hacking
GTA 6 source code and videos leaked after Rockstar Games hack

GTA 6 source code and videos leaked after Rockstar Games hackPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Patreon-1.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes Grand Theft Auto 6 gameplay videos and source code have been leaked after a hacker allegedly breached Rockstar Game’s Slack server and Confluence wiki.The videos and source code were first leaked on GTAForums yesterday, where a threat actor named ‘teapotuberhacker’ shared a link to a RAR archive containing 90 stolen videos.

The videos appear to be created by developers debugging various features in the game, such as camera angles, NPC tracking, and locations in Vice City. In addition, some of the videos contain voiced conversations between the protagonist and other NPCs.
https://www.bleepstatic.com/images/news/security/g/gcore/rar-archive.jpg
<figcaptionRAR archive containing the 90 leaked GTA 6 videos
The hacker claims to have stolen “GTA 5 and 6 source code and assets, GTA 6 testing build,” but is trying to extort Rockstar Games to prevent further data from being released.

However, the threat actor says they are accepting offers over $10,000 for the GTA V source code and assets but are not selling the GTA 6 source code at this time.
https://www.bleepstatic.com/images/news/security/g/gcore/telegram.jpg
<figcaptionSelling GTA V source code on Telegram
Source: BleepingComputer
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course
After forum members showed disbelief that the hack was real, the threat actor claimed he was behind the recent cyberattack on Uber and leaked screenshots of source code from both Grand Theft Auto V and Grand Theft Auto 6 as further proof.

Rockstar games have not released a statement or responded to our email about the attack at this time. However, Bloomberg’s Jason Schreier confirmed the leak was valid after speaking to sources at Rockstar.
Not that there was much doubt, but I’ve confirmed with Rockstar sources that this weekend’s massive Grand Theft Auto VI leak is indeed real. The footage is early and unfinished, of course. This is one of the biggest leaks in video game history and a nightmare for Rockstar Games

— Jason Schreier (@jasonschreier) September 18, 2022
The leaked videos have since made it onto YouTube and Twitter, with Rockstar Games issuing DMCA infringement notices and takedown requests to get the videos offline.
https://www.bleepstatic.com/images/news/security/g/gcore/youtube-takedown-requests.jpg
<figcaptionLeaked GTA 6 video taken down on YouTube
Source: BleepingComputer
“This video is no longer available due to a copyright claim by Take 2 Interactive,” reads a copyright claim by Take 2 Interactive, the owner of Rockstar Games. These takedown demands lend further validity to the fact that the leaked GTA 6 videos are real.

However, Rockstar Game’s efforts come too late, as the threat actor and others had already started leaking the stolen GTA 6 videos and portions of the source code on Telegram.

For example, the threat actor leaked a GTA 6 source code file today that is 9,500 lines long and appears to be related to executing scripts for various in-game actions.
Trending: Find Hidden Info using Google Dorking manually, and Automated using Pagodo
Trending: Offensive Security Tool: fuxploider Claims to be behind Uber attackThe hacker hasn’t shared details on how they gained access to the GTA 6 videos and source code other than claiming to have stolen them from Rockstar’s Slack and Confluence servers.

The threat actor also claims to be the same hacker, named ‘TeaPots[...]

,’ behind the recent Uber cyberattack, but BleepingComputer could not confirm whether these claims are valid.

However, during the cyberattack on Uber, the threat actor also gained access to the company’s Slack server and other internal services after performing a social engineering attack on an employee.

While there are not enough details about the Rockstar Games hack, the types of servers accessed and the very public announcements are similar to the Uber hacker’s tactics.
Trending: Microsoft Teams stores auth tokens as cleartext in Windows, Linux, Macs
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Images-for-the-News-posts-2-300x150.png Uber hacked, internal systems breached and vulnerability reports stolenSeptember 16, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Images-for-the-News-posts-1-2-300x150.png Microsoft Teams stores auth tokens as cleartext in Windows, Linux, MacsSeptember 15, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Images-for-the-News-posts-1-1-300x150.png Zero-day in WPGateway WordPress plugin actively exploited in thousands WordPress sitesSeptember 14, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/intro-1656368006-300x150.jpg A new Browser-in-the-Browser attack led hackers steal Steam accountsSeptember 13, 2022
Reading Time: 4 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post GTA 6 source code and videos leaked after Rockstar Games hack first appeared on Black Hat Ethical Hacking.

How I Found My FIRST Vulnerability/Bug Bounty and How You Can Too: Part 1

How to start ethically hacking websitesContinue reading on InfoSec Write-ups »
Read more...

How I Found My FIRST Vulnerability/Bug Bounty and How You Can Too: Part 2

Simple hacks!Continue reading on InfoSec Write-ups »
Read more...

Hacking on Medium
Binary Exploitation: Heap Overflow to Overwrite GOT

https://cdn-images-1.medium.com/max/807/1*EneYqBG5gd4TxOjyAWNj0w.png
Heap overflow attack and overwrite Global Offset Table in a simple binary exploitation challenge

Continue reading on Medium »

Hacking on Medium
Hackers Had Access to LastPass’s Development Systems for?

https://cdn-images-1.medium.com/max/728/0*PFo-X4Pvwh2TSfti.jpg
Password management solution LastPass shared more details pertaining to the security incident last month, disclosing that the threat actor…

Continue reading on Medium »

Hacking on Medium
Attacktive Directory on TryHackMe Writeup/Walkthrough

https://cdn-images-1.medium.com/max/935/1*HVEX4kNsZ0cp2YdsAxMhxQ.png
Attacktive Directory on Tryhackme

Continue reading on Medium »

Hacking on Medium
North Korean Hackers Spreading Trojanized Versions of?

https://cdn-images-1.medium.com/max/728/0*qC-0qUacUBqTN6iY.jpg
A threat with a North Korea nexus has been found leveraging a “novel spear phish methodology” that involves making use of trojanized…

Continue reading on Medium »

Hacking on Medium
Blue TryHackMe Writeup/Walkthrough

https://cdn-images-1.medium.com/max/936/1*4__ODSTTvUzCGKaafCWCyg.png
In this TryHackME — Blue Writeup we will learn how a small blip in the system can get it hacked. The purpose of this blog is to…

Continue reading on Medium »

Kali Linux Tutorials
Crosslinked : LinkedIn Enumeration Tool

CrossLinked is a LinkedIn enumeration tool that uses search engine scraping to collect valid employee names from an organization. This technique provides accurate results without the use of API keys, credentials, or accessing LinkedIn directly!

Install

Install the last stable release from PyPi:

pip3 install crosslinked

Or, install the most recent code from GitHub:

git clone https://github.com/m8sec/crosslinked
cd crosslinked
python3 setup install

Prerequisite

CrossLinked assumes the organization’s account naming convention has already been identified. This is required for execution and should be added to the CMD args based on your expected output. See the Naming Formatand Example Usagesections below:

Naming Format

{f}.{last} = j.smith
{first.{last} = john.smith
CMP{first}{l} = CMP\johns
{f}{last}@company.com = jsmith@company.com

Search

By default, CrossLinked will use googleand bingsearch engines to identify employees of the target organization. After execution, two files (names.txt & names.csv) will appear in the current directory, unless modified in the CMD args.

* names.txt – List of unique user accounts in the specified format.
* names.csv – Raw search data. See the Parsesection below for more.

Example Usage

python3 crosslinked.py -f ‘{first}.{last}@domain.com’ company_name

python3 crosslinked.py -f ‘domain{f}{last}’ -t 15 -j 2 company_name

Parse

Account naming convention changed after execution and now your hitting CAPTCHA requests? No Problem!

CrossLinked v0.2.0 now includes a names.csvoutput file, which stores all scraping data including: first name, last name, job title, and url. This can be ingested and parsed to reformat user accounts as needed.

Example Usage

python3 crosslinked.py -f ‘{f}{last}@domain.com’ names.csv

Additional Options

Proxy Rotation

The latest version of CrossLinked provides proxy support to rotate source addresses. Users can input a single proxy with --proxy 127.0.0.1:8080or use multiple via --proxy-file proxies.txt.

cat proxies.txt
127.0.0.1:8080
socks4://111.111.111.111
socks5://222.222.222.222
python3 crosslinked.py –proxy-file proxies.txt -f ‘{first}.{last}@company.com’ -t 10 “Company”

Usage

positional arguments:
company_name Target company name
optional arguments:
-h, –help show help message and exit
-t TIMEOUT Max timeout per search (Default=15)
-j JITTER Jitter between requests (Default=1)
Search arguments:
–search ENGINE Search Engine (Default=’google,bing’)
Output arguments:
-f NFORMAT Format names, ex: ‘domain{f}{last}’, ‘{first}.{last}@domain.com’
-o OUTFILE Change name of output file (omit_extension)
Proxy arguments:
–proxy PROXY Proxy requests (IP:Port)
–proxy-file PROXY Load proxies from file for rotation
Download