Pivoting Over Challenge Based Enterprise WiFi Network
https://www.reddit.com/r/redteamsec/comments/y2qz4c/pivoting_over_challenge_based_enterprise_wifi/

submitted by /u/tbhaxor (https://www.reddit.com/user/tbhaxor)
[link] (https://tbhaxor.com/pivoting-over-peap-mschapv2-wifi-network/) [comments] (https://www.reddit.com/r/redteamsec/comments/y2qz4c/pivoting_over_challenge_based_enterprise_wifi/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What can I do to make cryptography and enumeration easier?

I've been doing tryhackme and starting hack the box for roughly 2 months. I understand concepts such as gaining access and prelivalge escalation, but unfortunately struggle with the beginning steps like enumeration. I know what to do normally (Use Nmap, enum4linux, etc), but when I gain too little information I get stuck. I try using guides, but struggle with understanding how they were able to find so much information in massive rooms. I hope I'm not to vague and don't mean to upset anyone with these simple questions. I'm just concerned I'm not progressing in my learning path.

submitted by /u/Power_level_9000_spy
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Core isolation - Memory integrity on or of?

Im studying ethical hacking on my own (literally just started), downloaded VirtualBox, created a Vmachine with kali to start learning and noticed it turned on core isolation on my pc.

I use this pc for gaming as well, and i kinda noticed a bit of overheating and a few fps drops but nothing really alarming. checked my cpu monitoring app and told me it couldn't read my cpu stats because of the core isolation, so i investigated what it is.

I understand it protects my host machine from malware or dangerous stuff that could happened on my VM (i think?), but as im just starting in this world i figured maybe there wouldn't be a problem to have it turned off, just for my peace of mind? as i said, there are not really any alarming behaviors on my host machine.

i probably should get another computer learn this sort of things without risking my main machine i guess, but for now i just have the one. is core isolation a must have for any ethical hacking activity? or is it ok for me to turn it off in the meantime?

submitted by /u/GODstonn
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Can i locate my little sisters stalker using their IP? (or VPN)

Hi all, as the title suggests, I am trying to identify the person who has been stalking my sister for the last three years. Things have escalated with each passing day, and now the person is also harassing her best friend. This person has made multiple "tribute" pages, made multiple accounts to message her to explain in detail how he is going to SA her, sent her upskirt shots of her sitting, Made public 'upskirt" posts of her und*rage, and much worse. The threats are horrific and the girls now have reason to believe that they know their addresses, but police refuse to help without "more evidence". We have responded to the stalker with a grabify link and captured two IP addresses, once through an instagram link and also safari. but i fear that they may be using a VPN.

Please, tell me there's something i can do. I have absolutely zero knowledge with this stuff, so I am hopeful one of you fine folks can at least give me some pointers. I appreciate it, as all i want in this world is to protect my family. Thank you all in advance.

submitted by /u/mtn_mama
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
AWS S3 bucket Misconfigurations and Exploitations

https://cdn-images-1.medium.com/max/600/1*Fn8KIESISWySftKiFMq8IQ.png
— — — — — — — — — - AWS S3 bucket Misconfigurations — — — —— —

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hackers Using Vishing to Trick Victims into?

https://cdn-images-1.medium.com/max/728/0*EcmDZPMR03g7WfMz.jpg
Malicious actors are resorting to voice phishing (vishing) tactics to dupe victims into installing Android malware on their devices, new…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

OSCP : Complete Guide Part-1

Hi everyone, so I’m sharing some resources & tools information which will be helpful in your OSCP journey. If you have a career in…Continue reading on Medium »
Read more...

AWS S3 bucket Misconfigurations and Exploitations
https://akash-venky091.medium.com/aws-s3-bucket-misconfigurations-and-exploitations-6d89546eec54?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

— — — — — — — — — - AWS S3 bucket Misconfigurations — — — —— —Continue reading on Medium » (https://akash-venky091.medium.com/aws-s3-bucket-misconfigurations-and-exploitations-6d89546eec54?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

OSCP : Complete Guide Part-1
https://medium.com/@sumitcfe/oscp-complete-guide-part-1-1ed24e47fcbd?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hi everyone, so I’m sharing some resources & tools information which will be helpful in your OSCP journey.
If you have a career in…Continue reading on Medium » (https://medium.com/@sumitcfe/oscp-complete-guide-part-1-1ed24e47fcbd?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
New npm timing attack could lead to supply chain attacks

New npm timing attack could lead to supply chain attacksPost Views: 6 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes Security researchers have discovered an npm timing attack that reveals the names of private packages so threat actors can release malicious clones publicly to trick developers into using them instead.The attack relies on a small time difference in the return of a “404 Not Found” error when searching for a private compared to a non-existent package in the repository.

While the response time difference is only a few hundred milliseconds, it is enough to determine whether a private package exists to perform package impersonation attacks.

Organizations create private packages for internal projects and certain software products to minimize the risk of their development teams falling for typosquatting attacks, and to keep their code and functions secret.

Keeping private packages private is crucial for organizations using them. Otherwise, attackers can create clones or typosquatted packages that hackers could trick employees of organizations into downloading and using in software projects.

If the developers and internal software testers don’t discover the compromise, the products could reach end users, achieving a supply chain compromise.

In a report by Aqua Security’s threat research team, who shared its findings with BleepingComputer before publication, attackers are increasingly focusing on supply chain attacks, fueling a rise of 300% in associated activities in 2021.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Timing attack detailsnpm includes a registry API that allows users to download existing packages, check for the existence of packages, and receive information about all packages under a specific scope.

When using the npm registry to download a package that does not exist or is set to private, the website will return a 404 HTTP error code, indicating that the package could not be found.
https://www.bleepstatic.com/images/news/u/1220909/Website%20snaps/not-found.png
___________________________
@hacking_Attack
@Hacking_Video

ould be very stealthy, as an old copy of a package that used to be public may still retain enough functionality to work as intended in the software product that uses it.
Trending: A primer on OS Command Injection Attacks
Trending: OSINT Tool: ProtOSINT GitHub will not fix the issueAqua Security disclosed the bug to GitHub on March 8th, 2022, but was told on March 25th that it would not be fixed due to architectural limitations.

“Because of these architectural limitations, we cannot prevent timing attacks from determining whether a specific private package exists on npm,” GitHub told Aqua Security.

The researchers say that organizations can take preventive action by frequently searching npm for suspicious packages that spoof their private packages with duplicate or similar names.

Additionally, organizations can create public packages that spoof their private packages as placeholders since npm doesn’t allow uploading same-name packages on public repositories.
Trending: Microsoft SQL servers hacked with FARGO ransomware attacks Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-4-300x150.png Critical RCE Vulnerability Found in vm2 Sandbox LibraryOctober 12, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-3-300x150.png Zimbra remote code execution vulnerability actively exploited in the wildOctober 11, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-2-1-300x150.png Intel confirms leaked Alder Lake BIOS Source Code is authenticOctober 10, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-1-1-300x150.png Linux Kernel 5.19.12 bug could damage Intel laptop displaysOctober 7, 2022
Reading Time: 3 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post New npm timing attack could lead to supply chain attacks first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
could one clone a 5g sim card using the £5 card reader on ebay so that they could have the same internet data on their phone and ipad at the same time ? And would it support 5g?

Wondering if it would be possible hypothetically obvcourse 😊 Would only work if it would do 5g Don't care about calls or texts only Internet

submitted by /u/jsadecki
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
can they track me

So actually my friend saw my college professor 's password while he's typing, after a couple of tries he was able to login to his Gmail there was no 2fa,i was trying to tease him and unfortunately sent a group email to whole college , now my friend is worried whether they can exactly pin point his location. (He didn't use any vpn)

submitted by /u/Parking-Math-7056
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video