Hacking on Medium
Phone Freedom

I was preparing to take my son to our first NBA game since last February. Our Phoenix Suns (2 in the west) v. the Utah Jazz (1). Big…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Solution for Terjanq x Intigriti’s 0421 challenge

This month’s Intigriti challenge was made by the amazing Terjanq. He made a cool write-up himself here! As expected, this challenge was out…
Read more...

KitPloit - PenTest Tools!
SniperPhish - The Web-Email Spear Phishing Toolkit

https://1.bp.blogspot.com/-6tuuzSJVshE/YIsG1eN-L8I/AAAAAAAAWAs/muJxfpD8o3wKeOtgzKGH4shQbdQr6zGbACNcBGAsYHQ/w640-h344/SniperPhish_02.png SniperPhish is a phishing toolkit for pentester or security professionals to enhance user awareness by simulating real-world phishing attacks. SniperPhish helps to combine both phishing emails and phishing websites you created to centrally track user actions. The tool is designed in a view of performing professional phishing exercise and would be reminded to take prior permission from the targeted organization to avoid legal implications. Installation1. Download the source code and put it in your web root folder
2. Open http://localhost/install in your browser and follow the steps for installation
3. After installation, open http://localhost/spear to login

Default login - Username: adminPassword: sniperphishMain Features* Web tracker code generation - track your website visits and form submissions independently
* Create and schedule Phishing mail campaigns
* Combine your phishing site with email campaign for centrally tracking
* An independent "Simple Tracker" module for quick tracking an email or web page visit
* Advance report generation - generate reports based on the tracking data you needed
* Custom tracker images and dynamic QR codes in messages
* Track phishing message replies Screenshotshttps://1.bp.blogspot.com/-s-zMNaDQDVk/YIsHC71oIZI/AAAAAAAAWAw/5SljmSFrZ8MEapB1hfVghKQk-2PNAhMjgCNcBGAsYHQ/w640-h344/SniperPhish_01.png https://1.bp.blogspot.com/-q9ul6oYQ7Zw/YIsHC_pZtAI/AAAAAAAAWA0/cRbhPCzpKZUbfhgoNzmm3JmI27gsPID_QCNcBGAsYHQ/w640-h344/SniperPhish_02.png Creating Web-Email CampaignWe create web tracker -> Add the web tracker to the phishing website -> create mail campaign with a link pointing to the phishing website -> start mail campaign. Creating a web tracker:1. Design your website in your favorite programming language. Make sure you provided unique "id" and "name" value for HTML fields such as text field, checkbox etc.
2. Generate web-tracker code Web Tracker -> New Tracker. The "Web Pages" tab list the pages you want to track
* To track form submission data, provide the "id" or "name" values of HTML fields present in your phishing site form.
* Repeat above for each page in your phishing site.

3. From the final output, copy the generated JavaScript link and add it under the section of each website page.
4. Finally, save the tracker created. Now the tracker is activated and listening in the background. Opening your phishing site or data submission is tracked. Creating an Email campaign:1. Go to Email Campaign -> User Groupand add target users
2. Go to Email Campaign -> Sender Listand configure Mail server details
3. Go to Email Campaign -> Email Templateand create mail template. When you add your phishing website link, make sure to append ?cid={{CID}}at the end. This is to distinguish each users. For example, http://yourphishingsite.com/login?cid={{CID}}4. Now go to Email Campaign -> Campaign List -> New Mail Campaignand select/fill the fields to create campaign.
5. Start Mail campaign Viewing combined Web-Email ResultOpen Web-MailCamp Dashboard -> Select Campaignand select Mail Campaign and Web Tracker you created. https://1.bp.blogspot.com/-qAXTVCi_0S8/YIwwkwvnk_I/AAAAAAAAWBE/KZ2pBbzW4ocxZrtDkRaheHPIrE9umT2nwCNcBGAsYHQ/w640-h268/SniperPhish_03.png More* SniperPhish website: https://sniperphish.com/
* SniperPhish demo: https://demo.sniperphish.com/spear/ SniperPhish honors contributions ofJoseph Nygil (@j_nygil) and Sreehari Haridas (@sr33h4ri) Download SniperPhish

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
Active Directory Enumeration: BloodHound

In the article, we will focus on the Active Directory Enumeration tool called BloodHound. It takes the data from any device on the network and then proceeds to plot the graph that can help the attacker to strategize their way to the Domain Admins. Table of Content Introduction Linux Installation

The post Active Directory Enumeration: BloodHound appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Survey Finds Broad Concern Over Third-Party App Providers Post-SolarWinds

Most IT and cybersecurity professionals think security is important enough to delay deployment of applications, survey data shows.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
MITRE Adds MacOS, More Data Types to ATT&CK Framework

Version 9 of the popular threat matrix will improve support for a variety of platforms, including cloud infrastructure.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
New Threat Group Carrying Out Aggressive Ransomware Campaign

UNC2447 observed targeting now-patched vulnerability in SonicWall VPN.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Ransomware Task Force Publishes Framework to Fight Global Threat

An 81-page report details how ransomware has evolved, along with recommendations on how to deter attacks and disrupt its business model.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How to stop ddosing

What is the best way to defend against ddosing? I have a vpn and that doesn’t work and I have changed my ip 4 times.

submitted by /u/my_cat_died_lol
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Vaf - Very Advanced (Web) Fuzzer

very advanced fuzzer compiling Install nim from nim-lang.org Run nimble build A vaf.exe file will be created in your directory ready to be usedusing vaf using vaf is simple, here's the current help text: Usage: vaf - very advanced fuzzer optionsOptions: -h, --help -u, --url=URL choose url, replace area to fuzz with -w, --wordlist=WORDLIST choose the wordlist to use -sc, --status=STATUS set on which status to print, set this param to 'any' to print on any status (default: 200) -pr, --prefix=PREFIX prefix, e.g. set this to / for content discovery if your url doesnt have a / at the end (default: ) -sf, --suffix=SUFFIX suffix, e.g. use this for extensions if you are doing content discovery (default: ) -pd, --postdata=POSTDATA only used if '-m post' is set (default: {}) -m, --method=METHOD suffix, e.g. use this for extensions if you are doing content discovery (default: get) -pif, --printifreflexive print only if the output reflected in the page, useful for finding xss -ue, --urlencode url encode the payloads -pu, --printurl prints the url that has been requested screenshots (with every status code printed, suffixes .php,.html and no prefixes) (with url printed, every status code printed, suffixes .php,.html and no prefixes) (post data fuzzing) examples Fuzz post data: vaf.exe -w example_wordlists\short.txt -u https://jsonplaceholder.typicode.com/posts -m post -sc 201 -pd "{\"title\": \"\"}" Fuzz GET URLs vaf.exe -w example_wordlists\short.txt -u https://example.org/ -sf .html tips Add a trailing , in the suffixes or prefixes argument to try the word without any suffix/prefix like this: -pf .php, or -sf .php, Use -pif with a bunch of xss payloads as the wordlist to find XSS Make an issue if you want to suggest a feature Download Vaf
Read more...

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
what are the limits to what i can say on here?

Theres a couple questions i wanna ask but wanna make sure I dont break any rules

submitted by /u/Different_Addition_2
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
Are there illegal cp websites outside the deepweb?

Ive been searching for my daily dose of porn and stumbeled upon a weird website which more appears to be a forum. It uses a word jailbait a lot which after some searching means a underage teenage girl. Of course before i searched that i decided to scroll thru the website and it appeard it may have underage teen girls in it but it was hard to tell. Now im curious if that is acctually cp on the clear web or some joke website. Also am i fucked. Im underage btw.

submitted by /u/KaiserXosta
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video