Hacking on Medium
Instagram Bug : $45,000 awarded to an Indian Student

https://cdn-images-1.medium.com/max/2600/1*YoJOwxKMIQiG6jYdn43BEw.jpeg
An Indian Student found a bug in Instagram

Continue reading on Medium »

hacking: security in practice
Am I allowed to participate in the programs in bugcrowd?

As long as I stay within scope can I participate in all the searchable programs on bugcrowd? Do some require an invite? I'm a bit lost.

I can see that they have people that have recently joined some programs but cannot see a join button or on some it is greyed out could someone please let me know if I can pentest these companies? Thanks

submitted by /u/Sysxinu
[link] [comments]

hacking: security in practice
Dr Linton Salmon - The DARPA SSITH Program at DEFCON - DEF CON 27 Voting Village

https://youtu.be/tGRPYVRZ7pU

Worth the watch

submitted by /u/Phantasius224
[link] [comments]

hacking: security in practice
Obfuscation ever too deep?

Could it be reasoned that the ease of hacking of an obfuscation compares equally with the obfuscation's use? Such as Pig Latin is easy to use, but just as easy to hack. Could an obfuscation that's painful to decrypt at user level be as painful to hack, or would it just not even be desirable to use on either end at all? I have an obfuscation which has been gnarly to produce and will undoubtedly be painful to use at root and user level, although that's essentially the idea behind it.

​

Thank You

a.△

submitted by /u/Snoo_82970
[link] [comments]

hacking: security in practice
Crypto Trading Firm Wintermute Loses $160 Million in Hacking Incident

https://external-preview.redd.it/zb91mNp_lw_qqW_E-ZwFZ4ko97uyTCqGmpuJMmmJNMk.jpg?width=640&crop=smart&auto=webp&s=a0a2c6059be2f3a5ac9ab778ad6993e711b9cdc4 submitted by /u/cheeztoshobo
[link] [comments]

hacking: security in practice
Pulling info off of a rfid keypad w/o a programed fob.

What do I need to get info off of a rfid keypad in order to create my own fob or way of unlocking it. Trying to get into a cool rooftop hangout area in town

submitted by /u/Acrobatic_Ad_4774
[link] [comments]

Black Hat Ethical Hacking
Twitter failed to log you out of all devices after password resets

Twitter failed to log you out of all devices after password resetsPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Patreon-1.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes Twitter logged out some users after addressing a bug where some Twitter accounts remained logged on some mobile devices after voluntary password resets.“That means that if you proactively changed your password on one device, but still had an open session on another device, that session may not have been closed. Web sessions were not affected and were closed appropriately,” Twitter explained.

There are some potential privacy risks for Twitter users who were affected by this bug, including having their accounts accessed by others who got their hands on devices that remained logged in without the user’s knowledge.

Because of this, the company reached out to those who might have been impacted and logged them out of their accounts on all active sessions across all devices.

“We have directly informed the people we were able to identify who may have been affected by this, proactively logged them out of open sessions across devices, and prompted them to log in again,” the company added

“We realize this may be inconvenient for some, but it was an important step to keep your account safe and secure from potential unwanted access.”
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course
We fixed a bug that didn't close all active logged in sessions on Android and iOS after an account's password was reset. To keep your account safe, we logged some of you out. You can log back in to keep using Twitter.

For more details on what happened: https://t.co/OmjLKOe5bs

— Twitter Support (@TwitterSupport) September 21, 2022
In July, Twitter was hit by a data breach after threat actors put up for sale a database of phone numbers and email addresses linked to 5.4 million Twitter accounts stolen in December 2021.

The vulnerability the attacker used to collect the data is one disclosed to Twitter through HackerOne on January 1st and fixed on January 13th, as first reported by Restore Privacy.

BleepingComputer verified with some of the Twitter users listed in a small sample of data shared by the hacker that the leaked private info (email addresses and phone numbers) was accurate.

One month later, Twitter confirmed the reports, saying the threat actor used the zero-day vulnerability patched in January to collect private user information.
Trending: Find Hidden Info using Google Dorking manually, and Automated using Pagodo
Trending: Offensive Security Tool: fuxploider As part of the disclosure, Twitter told BleepingComputer that they had begun sending out notifications to alert impacted users that the data breach exposed their phone numbers or email address.

Since July, hacked verified Twitter accounts are also being used to send fake but well-written suspension messages that attempt to steal other verified users’ credentials.
Trending: Microsoft Teams stores auth tokens as cleartext in Windows, Linux, Macs
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Ima[...]

Black Hat Ethical Hacking
OSINT Tool: Social Hunter

OSINT Tool: Social HunterPost Views: 15 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes Social HunterWhen you prepare special crafted targeted Phishing attacks as part of your Red Teaming process and/or Pentesting Solutions, unlike the automated easy to spot ones, you have to spend time prior of the attack performing OSINT, getting to study your targets so you can then prepare the correct templates, trackers and scenarios.

Social Hunter by utkusen, crawls the given URL(s) and finds broken social media links that can be hijacked. Broken social links may allow an attacker to conduct phishing attacks. It also can cost a loss of the company’s reputation. Broken social media hijack issues are usually accepted on the bug bounty programs.

Currently, it supports Twitter, Facebook, Instagram and Tiktok without any API keys.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course
Trending: Recon Tool: ZenBuster
Trending: Offensive Security Tool: Offensive-Azure InstallationFrom BinaryYou can download the pre-built binaries from the releases page and run. For example: wget https://github.com/utkusen/socialhunter/releases/download/v0.1.1/socialhunter_0.1.1_Linux_amd64.tar.gztar xzvf socialhunter_0.1.1_Linux_amd64.tar.gz./socialhunter --helpFrom Source1. Install Go on your system

2. Run: go get -u github.com/utkusen/socialhunterUsagesocialhunter requires 2 parameters to run:

-f : Path of the text file that contains URLs line by line. The crawl function is path-aware. For example, if the URL is https://utkusen.com/blog, it only crawls the pages under /blog path

-w : The number of workers to run (e.g -w 10). The default value is 5. You can increase or decrease this by testing out the capability of your system.
Clone the repo from here: GitHub Link
Trending: How to Exploit “improper error handling” in Web Applications https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/dnsReaper-300x150.png Offensive Security Tool: dnsReaperSeptember 16, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/fuxploider-300x150.png Offensive Security Tool: fuxploiderSeptember 9, 2022
Reading Time: 2 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/ZenBuster-300x150.png Recon Tool: ZenBusterSeptember 2, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/CrossLinked-300x150.png Recon Tool: CrossLinkedAugust 26, 2022
Reading Time: 2 minutes https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post OSINT Tool: Social Hunter first appeared on Black Hat Ethical Hacking.

ges-for-the-News-posts-8-300x150.png Rockstar parent company hacked again as 2K Support sends users malwareSeptember 21, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/2-300x150.png Revolut hack: personal and banking data exposedSeptember 20, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Images-for-the-News-posts-3-300x150.png GTA 6 source code and videos leaked after Rockstar Games hackSeptember 19, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Images-for-the-News-posts-2-300x150.png Uber hacked, internal systems breached and vulnerability reports stolenSeptember 16, 2022
Reading Time: 3 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Twitter failed to log you out of all devices after password resets first appeared on Black Hat Ethical Hacking.

Why website use API on login and sign-up page ?
https://www.reddit.com/r/Pentesting/comments/xku5pw/why_website_use_api_on_login_and_signup_page/

submitted by /u/ahmedapdulrasool (https://www.reddit.com/user/ahmedapdulrasool)
[link] (https://www.reddit.com/r/Pentesting/comments/xku5pw/why_website_use_api_on_login_and_signup_page/) [comments] (https://www.reddit.com/r/Pentesting/comments/xku5pw/why_website_use_api_on_login_and_signup_page/)

Hacking on Medium
Exploiting NFS shares to gain root access

https://cdn-images-1.medium.com/max/777/0*y-ygwZS9qMCDgROS.jpg
Recently, while performing a network-level penetration testing activity for one of the clients, I came across a vulnerability that was…

Continue reading on Medium »

Hacking on Medium
Important parts of the GTA 6 game were stolen and then made public by a hacker

https://cdn-images-1.medium.com/max/780/0*C_gci91VcxtB2Tu6.jpg
The leak that reached the Internet contains more than 90 video clips from the game

Continue reading on Medium »

Hacking on Medium
Benefits of Storage and warehouse services in uk

https://cdn-images-1.medium.com/max/990/1*cz87a-qm-NFIKd9PY1GfQg.png
With the increase of business people all over the globe, the need for storage is also increasing at a high rate. Whether you have regular…

Continue reading on Medium »

hacking: security in practice
Resetting vending machine NFC key data

Years ago I got a key for vending machines to grab coffee and a friend of a friend had taken the key, modified and made it possible through Mifare Classic Tools on Smartphone to bring the Key to the phone via NFC, reset it and in practice have infinite money. Anyone know the process to change the key? the friend I'm talking about I have no more way to contact him otherwise I would have asked him

submitted by /u/itsm3tt
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video