Hacking on Medium
WAF bypasses via 0days

https://cdn-images-1.medium.com/max/2322/1*MUZyAlfoZqWLA0QZLGPGCQ.png
based on findings from a live hacking event

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
CATS : REST API Fuzzer And Negative Testing Tool For OpenAPI Endpoints

CATS , REST API fuzzer and negative testing tool. Run thousands of self-healing API tests within minutes with no coding effort!

* Comprehensive: tests are generated automatically based on a large number scenarios and cover every field and header
* Intelligent: tests are generated based on data types and constraints; each Fuzzer has specific expectations depending on the scenario under test
* Highly Configurable: high amount of customization: you can filter specific Fuzzers, HTTP response codes, HTTP methods, request paths, provide business context and a lot more
* Self-Healing: as tests are generated, any OpenAPI spec change is picked up automatically
* Simple to Learn: flat learning curve, with intuitive configuration and syntax
* Fast: automatic process for write, run and report tests which covers thousands of scenarios within minutes OverviewBy using a simple and minimal syntax, with a flat learning curve, CATS (Contract Auto-generated Tests for Swagger) enables you to generate thousands of API tests within minutes with no coding effort. All tests are generated, run and reported automatically based on a pre-defined set of 93 Fuzzers. The Fuzzers cover a wide range of boundary testing and negative scenarios from fully random large Unicode values to well crafted, context dependant values based on the request data types and constraints. Even more, you can leverage the fact that CATS generates request payloads dynamically and write simple end-to-end functional tests. InstallationHomebrewbrew tap endava/tap
brew install cats ManualCATS is bundled both as an executable JAR or a native binary. The native binaries do not need Java installed.

After downloading your OS native binary, you can add it in PATH so that you can execute it as any other command line tool:

sudo cp cats /usr/local/bin/cats

You can also get autocomplete by downloading the cats_autocomplete script and do:

source cats_autocomplete

To get persistent autocomplete, add the above line in ~/.zshrcor ./bashrc, but make sure you put the fully qualified path for the cats_autocompletescript.

You can also check the cats_autocompletesource for alternative setup.

There is no native binary for Windows, but you can use the uberjar version. This requires Java 17+ to be installed.

You can run it as java -jar cats.jar.

Head to the releases page to download the latest version: https://github.com/Endava/cats/releases. BuildYou can build CATS from sources on you local box. You need Java 17+. Maven is already bundled.

Before running the first build, please make sure you do a ./mvnw clean. CATS uses a fork ok OKHttpClientwhich will install locally under the 4.10.0-CATSversion, so don’t worry about overriding the official versions.

You can use the following Maven command to build the project: ./mvnw package -Dquarkus.package.type=uber-jarYou will end up with a cats-runner.jarin the targetfolder. You can run it wih java -jar cats-runner.jar ....

You can also build native images using a GraalVM Java version. ./mvnw package -PnativeNote: You will need to configure Maven with a Github PAT with read-packagesscope to get some dependencies for the build. Notes on Unit TestsYou may see some ERRORlog messages while running the Unit Tests. Those are expected behaviour for testing the negative scenarios of the Fuzzers. Running CATSBlackbox modeBlackbox mode means that CATS doesn’t need any specific context. You just need to provide the service URL, the OpenAPI spec and most probably authentication headers.

cats –contract=openapi.yaml –server=http://localhost:8080 –headers=headers.yml –bla[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
CATS : REST API Fuzzer And Negative Testing Tool For OpenAPI Endpoints

___________________________
@hacking_Attack
@Hacking_Video

WAF bypasses via 0days
https://terjanq.medium.com/waf-bypasses-via-0days-d4ef1f212ec?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

based on findings from a live hacking eventContinue reading on Medium » (https://terjanq.medium.com/waf-bypasses-via-0days-d4ef1f212ec?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

WAF bypasses via 0days

based on findings from a live hacking eventContinue reading on Medium »
Read more...

hacking: security in practice
A technical analysis of the leaked LockBit 3.0 builder

https://external-preview.redd.it/4Q1GwOlb4tTbiflkcaUQuqxW7v5WxOZgdgniadgllro.jpg?width=640&crop=smart&auto=webp&s=ada614e22cea233a1c15c530a18baadc6d263a36 submitted by /u/CyberMasterV
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
EP 123: NEWSWIRES - Investing in the stock market can be very profitable. Especially if you can see into the future. This is a story of how a group of traders and hackers got together to figure out a way to see into the future and make a lot of money from that (Darknet Diaries)

https://external-preview.redd.it/qYxcPavFJmKe63G_3PKpTxV-qJhgAX5Le8FeGsOQNn4.jpg?width=640&crop=smart&auto=webp&s=2f07b96deb5693c46ff7c638d7b7d23e14d30eae submitted by /u/DrinkMoreCodeMore
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Uber hacker arrested

https://external-preview.redd.it/63pbl0ExOg3gQ5-t8g9NtHm2vfdCvspG8isrwuR7MQc.jpg?width=108&crop=smart&auto=webp&s=1d4a5c9a40a04f4770010d84ce42904c3559a9b7 submitted by /u/DrinkMoreCodeMore
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Airgeddon not supported on WSL?

New to Kali and I thought I'd have a look at this. I'm running using WSL2. Does this mean I would need to run a live boot or similar to access the tool?

submitted by /u/originaldigga
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What Is Initial Access? MITRE ATT&CK® Initial Access Tactic | TA0001

https://external-preview.redd.it/l4XNEICXeW4eYQliTFGvEcgG0xDXFuqEQrtNifdKWTs.jpg?width=640&crop=smart&auto=webp&s=bc0bbdc936dae28784fe3ec4346b47f981a67bf7 submitted by /u/Cultural_Budget6627
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What got you into "hacking" and what do you do with it?

I've recently learned that computers are kinda important to the world.

Also data security.

Also cyber warfare is a thing I guess.

Anyway what about you?

submitted by /u/SeriouslySally36
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What would you like to see in a college-level cyber security course?

submitted by /u/IMCHillen
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Arbitrary File Corruption: End-to-End Encrypted Messaging Application
https://nmochea.medium.com/arbitrary-file-corruption-end-to-end-encrypted-messaging-application-674963dceef8?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video