Hacking on Medium
Breaking down the three types of Cyber Threat Intelligence: Strategic TI and which audience will…

https://cdn-images-1.medium.com/max/2600/1*INjWybKplIUdlWHoTvp8lA.jpeg
In this set of three posts I plan to give a basic overview of each “level” of cyber threat intelligence and why each one matters for both…

Continue reading on Hunter Strategy »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Intermediate Nmap: Try Hack Me

https://cdn-images-1.medium.com/max/918/1*0fqGUR7Ytd6Wr_MGxMDc3A.png
Today we will be taking a look at a new box on Try Hack Me, Intermediate Nmap. This is rated as an easy box.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Piratas informáticos utilizan notificaciones falsas de CircleCI para piratear cuentas de GitHub

https://cdn-images-1.medium.com/max/1173/0*GURYy8DNzEa-3eFz
GitHub ha publicado un aviso que detalla lo que puede ser una campaña de phishing en curso dirigida a sus usuarios para robar credenciales…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe Regular Expressions | Write-up

https://cdn-images-1.medium.com/max/600/0*yXdC7HhQC5X_9Cw-
Hi all, today I’m going to cover Regular Expressions room in TryHackMe.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Improving the hunting of exposed information of our organization through a free account of…

The following information is only for educational purposes, the autor is not responsable for the use given to the information provided in…Continue reading on Medium »
Read more...

Improving the hunting of exposed information of our organization through a free account of…
https://medium.com/@Mado_CyberTips/improving-the-hunting-of-exposed-information-of-our-organization-through-a-free-account-of-f3569226c0b7?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

The following information is only for educational purposes, the autor is not responsable for the use given to the information provided in…Continue reading on Medium » (https://medium.com/@Mado_CyberTips/improving-the-hunting-of-exposed-information-of-our-organization-through-a-free-account-of-f3569226c0b7?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
App Developers Increasingly Targeted via Slack, DevOps Tools

Slack, Docker, Kubernetes, and other applications that allow developers to collaborate have become the latest vector for software supply chain attacks.

Hacking on Medium
DerpnStink: VulnHub

https://cdn-images-1.medium.com/max/956/1*LBGitskPvVwe3A50ZF5MQw.png
Today we are going to take a look at DerpNStink on VulnHub. As usual we will start off with an NMAP scan of the Vulnerable Machine.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
CTF - Blank php pages intended?

Hi there, Im currently stumped working on a VM based CTF. I have discovered a web server running on port 80, and have enumerated several .php pages including a login.php page. However, the php pages are all blank and return nothing. I've tried the other possible attack vectors ( as far as my knowledge goes) to no avail, and I am thinking that these php files might be the key. AFAIK, accessing pages such as the login.php are usually crucial in finding a vulnerability and solving a CTF. I was wondering if anyone else had encountered a similar situation where they could not get access php pages, and if this behavior is intended or perhaps a configuration mishap (as this is on a locally hosted VM, although the rest of the VM and web pages served seem to work fine)
Thanks!!

submitted by /u/Slayre77
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to exploit a stored XSS vulnerability on DVWA — StackZero

https://cdn-images-1.medium.com/max/930/0*3wvZ2bdkfows74Gv.jpg
This is a walkthrough in exploiting stored XSS on DVWA, with the side effect of letting a deeper understanding of that vulnerability.

Continue reading on InfoSec Write-ups »

Hacking on Medium
An Electronics Project for Sailboat Racing

https://cdn-images-1.medium.com/max/1260/1*jwJzwo7IDr5pPyXgxMalaA.png
I’ve always thought it was fun to do small electronics hardware hacking projects. I also really enjoy sailing. Then I had an idea…

Continue reading on Medium »

Kali Linux Tutorials
Kam1n0 : Assembly Analysis Platform

Kam1n0 v2.x is a scalable assembly management and analysis platform. It allows a user to first index a (large) collection of binaries into different repositories and provide different analytic services such as clone search and classification. It supports multi-tenancy access and management of assembly repositories by using the concept of Application. An application instance contains its own exclusive repository and provides a specialized analytic service. Considering the versatility of reverse engineering tasks, Kam1n0 v2.x server currently provides three different types of clone-search applications: Asm-Clone, Sym1n0, and Asm2Vec, and an executable classification based on Asm2Vec. New application type can be further added to the platform.

A user can create multiple application instances. An application instance can be shared among a specific group of users. The application repository read-write access and on-off status can be controlled by the application owner. Kam1n0 v2.x server can serve the applications concurrently using several shared resource pools.

Kam1n0 was developed by Steven H. H. Ding and Miles Q. Li under the supervision of Benjamin C. M. Fung of the Data Mining and Security Lab at McGill University in Canada. It won the second prize at the Hex-Rays Plug-In Contest 2015. If you find Kam1n0 useful, please cite our paper:

* S. H. H. Ding, B. C. M. Fung, and P. Charland. Kam1n0: MapReduce-based Assembly Clone Search for Reverse Engineering. In Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (SIGKDD), pages 461-470, San Francisco, CA: ACM Press, August 2016.
* S. H. H. Ding, B. C. M. Fung, and P. Charland. Asm2Vec: boosting static representation robustness for binary clone search against code obfuscation and compiler optimization. In Proceedings of the 40th IEEE Symposium on Security and Privacy (S&P), 18 pages, San Francisco, CA: IEEE Computer Society, May 2019. Asm-CloneAsm-Clone applications try to solve the efficient subgraph search problem (i.e. graph isomorphism problem) for assembly functions (<1.3s<30ms

* Application Type: Asm-Clone
* The original clone search service used in Kam1n0 v1.x.
* Currently support Meta-PC, ARM, PowerPC, and TMS320c6 (experimental).
* Support subgraph clone search within a certain assembly code family.
* + Good interpretability of the result: breaks down to subgraphs.
* + Accurate for searching within the given code family.
* + Good for differing various patches or versions for big binaries.
* – Relatively more sensitive to instruction set changes, optimizations, and obfuscation.
* – Need to pre-define the syntax of the assembly code language.
* – Need to have assembly code of the same chosen family in the repository. Sym1n0Semantic clone search by differentiated fuzz testing and constraint solving. An efficient and scalable dynamic-static hybrid approach (<1s<100ms

* Application Type: Sym1n0 (v2 only)
* Clone search by both symbolic execution and concrete execution.
* Differentiate functions based on their different I/O behavior.
* Clone search conducted on the abstract syntax graph constructed from Vex IR (powered by LibVex).
* + Clone search across different assembly code families.
* For example, indexed x86 binaries but the query is ARM code.

* + Subgraph clone search.
* + Support a wide range of families throub LibVex.
* x86, AMD64, MIPS32, MIPS64, PowerPC32, PowerPC64, ARM32, and ARM64.

* + An efficient dynamic-static hybrid approach.
* + Ideal for analyzing firmware compiled for different processors.
* – Sensitive to heavy graph manipulation (such as a full flattening).
* – Sensitive to large scale breakdown of basic block integrity. Asm2VecAsm2Vec leverages representation learning. It understands the lexical semantic relationship of assembly code. For example, xmm*regi[...]