IntroductionContinue reading on InfoSec Write-ups » (https://infosecwriteups.com/everything-about-path-traversal-vulnerability-c40ba5465bc4?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Using the undo-feature of Tinder for free (Tinder in "Grid Mode")

Hello everyone,

in my previous post I shared how you can unblur people that liked you on Tinder for free (bypassing their previous fix). In this guide, I will explain how one can achieve the functionality of the undo-feature for free. It's neither difficult nor very sophisticated but it works anyways.

​

TL;DR

Tinder doesn't check if you swiped left on a person. So if you've saved the profile data before you do so, you can still send a "Like" request to Tinder's API afterwards hence emulating the undo-feature which usually costs money.

A script that does this automatically as a proof of concept is at the end of this post at "Automated script for this"

​

What is the undo-feature?

When you dislike/swipe-left on a person you can't just change your mind and revoke that action. There is an undo button but you have to pay in order to use it. This feature is useful when you disliked someone by accident or changed your mind afterwards because e.g. Tinder told you "oops, you just missed a match".

​

How to undo for free?

A "Like" is a POST request to a specific URL with a specific body and your X-Auth-Token as a header. If you have the URL and body you can hence send a "Like" manually. But after swiping left you can't get this data afaik. So you just save it beforehand. That's all! Nothing fancy, just exploiting the fact that Tinder doesn't enforce any checks if you already swiped a profile.
The URL schema is the following: https://api.gotinder.co/like/** s_number mapping is saved as well.
2. If you put your x-auth-token and the path to an image (copy+paste or drag+drop) as arguments, it will send a "Like" to the profile the image belongs to. This is done by parsing the information from the file path and looking up the s_number.

So the usage would be like this:

* `python3 ./tinder-grid.py X-AUTH-TOKEN` - to download some profiles and
* `python3 ./tinder-grid.py X-AUTH-TOKEN "/path/to/an/image.jpeg"` - to like a person.

Link to the script: https://pastebin.com/tk8ykGjb

​

Disclaimer

I used it only on debian 11 but since it's python I guess it works elsewhere too...

submitted by /u/nachfarbensortiert [link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Are password manager on mobile safe?

Hey guys,

so until now i always used the good ol' paper and pen to write down and save my password but now i'm struggling accessing them if i'm not at home. My question is: are password manager on mobile "safe"?

If yes, what's the best application for password managing for android?

submitted by /u/Valrion06
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
looking for an apk editor, either for android or windows

As the title says, I am looking for an apk editor. Essentially I just need to edit the manifest of an app, kiwi browser. The last update allows only to be installed from android 6+. I need to install it on Android 5.

submitted by /u/FarVehicle5333
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
RazorBlack TryHackMe Writeup/Walkthrough

https://cdn-images-1.medium.com/max/938/1*wIAtLMHRaWLR39cz9gnUBQ.png
RazorBlack

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
whois @t0nberry— An Introduction

https://cdn-images-1.medium.com/max/600/1*q16gYFe_BLcPrWyQW_2d1A.jpeg
Around February 2022 I set out to learn Python. I’ve done a little programming in my career as a Mechanical Engineer using Matlab, VBA…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Thompsom CTF (THM)

https://cdn-images-1.medium.com/max/779/1*49QA_ip75hXwrI4U_mhCtA.png
Writeup thompsom.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to Get Started with Ethical Hacking

https://cdn-images-1.medium.com/max/1280/1*RqtadaYHoTFstWdvXHWC6Q.png
Let’s become a Hacker with a simple & straight guide!

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
PUBG Mobile 2.2 Cheat (for guest id)

https://cdn-images-1.medium.com/max/1280/1*gn3PKpF-SDQ8RVSYOrxDTg.jpeg
PUBG Mobile Latest 2.2 free Hack Download Play safe with our Cheat, without any ban, The esp. is safe up to 98%. Play as a Legit not a…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
In the Eye of the Amateur

https://cdn-images-1.medium.com/max/2600/1*u4-D49yiQmBhBamwvptA9g.jpeg
Old problem, different solution

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Simple CTF | TryHackMe Write-Up

https://cdn-images-1.medium.com/max/1232/0*r1WBjS8MX35yDvpi.png
TryHackMe Room:

Continue reading on System Weakness »

___________________________
@hacking_Attack
@Hacking_Video

Accidental Account takeover

Hello Security Community,Continue reading on InfoSec Write-ups »
Read more...

Pen-100 Question
https://www.reddit.com/r/Pentesting/comments/xzvtgv/pen100_question/

I am a bit stuck on the final exercise for Linux in Pen-100 and I feel like I have searched everywhere online for an answer. Without writing the actual question (I changed names and wording) here is what I am supposed to do: Use bob's access to add a user to the machine with credentials "jon:password". Give the new user the same permissions that belong to bob. Then run the newuser binary in Bob's /home to get the flag. Ok so I ran id on bob and saw he has sudo, and I have his password the only groups bob is a part of is his group and sudo I create the user: sudo useradd jon -G sudo -m and then run: sudo passwd jon and give the password I ran the binary and didnt get the flag so I thought "Ok maybe add him to bob's group" did that and nothing gave him a shell as well /bin/bash same as bob, still didnt work deleted the user and did all the same steps except adding -m ~bob so jon has access to bob's home dir and still nothing. Am I missing something here, I checked the group file and I cant seem to find a way to give jon the "same" access that this binary checks. ​ Thank you for your help! ​ edit: accidentally had an actual user's username in the question submitted by /u/Early_Lab183 (https://www.reddit.com/user/Early_Lab183)
[link] (https://www.reddit.com/r/Pentesting/comments/xzvtgv/pen100_question/) [comments] (https://www.reddit.com/r/Pentesting/comments/xzvtgv/pen100_question/)

___________________________
@hacking_Attack
@Hacking_Video