Hacking on Medium
Utilizing a Password Manager

https://cdn-images-1.medium.com/max/600/0*CSLye4Tvu-GCGF8Z
I’m sure you’re aware that passwords should be secure, but you’re also especially aware that typing out those incredibly complicated…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
October becomes worst month in DeFi history as hackers steal $718M across 11 protocols

https://cdn-images-1.medium.com/max/600/0*i-0PyiaIMxfhd_LS
DeFi protocols have lost $718 million in the first two weeks of October alone, while $3 billion has been lost to 125 crypto hacks in total…

Continue reading on The Capital »

___________________________
@hacking_Attack
@Hacking_Video

What is Session ID / Session Token ? Authorization Tokens (Part 1) (WebApp Pentesting)

SYNOPSIS : HTTP & it’s behaviourContinue reading on System Weakness »
Read more...

___________________________
@hacking_Attack
@Hacking_Video

WordPress Subdomain Takeover on Bugcrowd Private Program

Hello guys👋👋, Prajit here from the BUG XS Team, recently I got a valid WordPress Subdomain Takeover on a Bugcrowd private program, in…Continue reading on Medium »
Read more...

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
MyDeal data breach impacts 2.2M users, stolen data for sale online

MyDeal data breach impacts 2.2M users, stolen data for sale onlinePost Views: 13 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes Woolworths’ MyDeal subsidiary has disclosed a data breach affecting 2.2 million customers, with the hacker trying to sell the stolen data on a hacker forum.MyDeal is an Australian retail marketplace that connects online shoppers with local retailers.

Retail giant Woolworths purchased 80% of the company in September but said their systems are on a completely different platform and unaffected by the incident.

Last Friday, MyDeal stated that it suffered a breach after a hacker used compromised user credentials to access the company’s Customer Relationship Management (CRM) system, allowing the threat actor to view and export customer information.

The company says that 2.2 million customers were impacted by the data breach, with information such as names, email addresses, phone numbers, delivery addresses, and in some cases, birth dates exposed in the attack.

For 1.2 million customers, only the email addresses were exposed in the breach.

However, MyDeal states that no payment information, government IDs, or account passwords were exposed.

MyDeal has already begun to send data breach notifications to affected customers and say that customers who do not receive one were not affected.
Aw man, I'm pwned again! Thanks @mydealaustralia 🤦‍♂️ pic.twitter.com/3PKMJXJJfe

— Troy Hunt (@troyhunt) October 17, 2022
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Hacker starts selling MyDeal dataOn Sunday, the hacker behind the MyDeal breach began selling the stolen data on a hacking forum for $600.

The hacker claims that the data currently consists of 1 million entries but that the number of exposed customers will increase as they finish parsing the database.
https://www.bleepstatic.com/images/news/security/d/data-breaches/m/mydeal/mydeal-forum-post.jpg
Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-7-1-300x150.png Microsoft 365 Message Encryption Can Leak Sensitive InfoOctober 17, 2022
Reading Time: 4 minutes

* https://www.black[...]

___________________________
@hacking_Attack
@Hacking_Video

hatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-6-300x150.png GitLab patches RCE bug in GitHub import functionOctober 14, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-5-300x150.png New npm timing attack could lead to supply chain attacksOctober 13, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-4-300x150.png Critical RCE Vulnerability Found in vm2 Sandbox LibraryOctober 12, 2022
Reading Time: 3 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post MyDeal data breach impacts 2.2M users, stolen data for sale online first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

How I exploited Blind SQLi without using any tool!— StackZero

Hi hackers! Here is another article that will show how to exploit a WELL KNOWN vulnerability in practice.Continue reading on InfoSec Write-ups »
Read more...

___________________________
@hacking_Attack
@Hacking_Video

xnLinkFinder - A Python Tool Used To Discover Endpoints (And Potential Parameters) For A Given Target
http://www.kitploit.com/2022/10/xnlinkfinder-python-tool-used-to.html

___________________________
@hacking_Attack
@Hacking_Video

Find Links from a specific target - Detailed Ideally, provide scope prefix (-sp) with the primary domain (including schema), and a scope filter (-sf) to filter the results only to relevant domains (this can be a file or in scope domains). Also, you can pass cookies and customer headers to ensure you find links only available to authorised users. Specifying the User Agent (-u desktop mobile) will first search for all links using desktop User Agents, and then try again using mobile user agents. There could be specific endpoints that are related to the user agent given. Giving a depth value (-d) will keep sending request to links found on the previous depth search to find more links. python3 xnLinkFinder.py -i target.com -sp target_prefix.txt -sf target_scope.txt -spo -inc -vv -H 'Authorization: Bearer XXXXXXXXXXXXXX' -c 'SessionId=MYSESSIONID' -u desktop mobile -d 10
Find Links from a list of URLs - Basic If you have a file of JS file URLs for example, you can look for links in those: python3 xnLinkFinder.py -i target_js.txt
Find Links from a files in a directory - Basic If you have a files, e.g. JS files, HTTP responses, etc. you can look for links in those: python3 xnLinkFinder.py -i ~/Tools/waymore/results/target.com
NOTE: Sub directories are also checked. The -mfs option can be specified to skip files over a certain size. Find Links from a Burp project - Basic In Burp, select the items you want to search by highlighting the scope for example, right clicking and selecting the Save selected items. Ensure that the option base64-encode requests and responses option is checked before saving. To get all links from the file (even with HUGE files, you'll be able to get all the links): python3 xnLinkFinder.py -i target_burp.xml
NOTE: xnLinkFinder makes the assumption that if the first line of the file passed with -i starts with ___________________________
@hacking_Attack
@Hacking_Video

If a link is found that has no domain, e.g. /path/to/example.js then giving passing -sp http://www.target.com will result in teh output http://www.target.com/path/to/example.js and if Depth (-d) is >1 then a request will be able to be made to that URL to search for more links. If a file of domains are passed using -sp then the output will include each domain followed by /path/to/example.js and increase the chance of finding more links. If you use -sp but still want the original link of /path/to/example.js (without a domain) additionally returned in the output, the pass the argument -spo. Always use the Scope Filter argument -sf. This will ensure that only relevant domains are returned in the output, and more importantly if Depth (-d) is >1 then out of scope targets will not be searched for links or parameters. This can be one scope domain, or a file containing multiple scope domains. Below are examples of the format used (no schema or path should be included): target.*
target-payments.com
static.target-cdn.com
THIS IS FOR FILTERING THE LINKS DOMAIN ONLY. If you want to filter the final output in any way, use -ra. It's always a good idea to use https://regex101.com/ to check your Regex expression is going to do what you expect. Use the -v option to have a better idea of what the tool is doing. If you have problems, use the -vv option which may show errors that are occurring, which can possibly be resolved, or you can raise as an issue on github. Pass cookies (-c), headers (-H) and regex (-ra) values within single quotes, e.g. -ra '/api/v[0-9]\.[0-9]\*' Set the -o option to give a specific output file name for Links, rather than the default of output.txt. If you plan on running a large depth of searches, start with 2 with option -v to check what is being returned. Then you can increase the Depth, and the new output will be appended to the existing file, unless you pass -ow. Set the -op option to give a specific output file name for Potential Parameters, rather than the default of parameters.txt. Any output will be appended to the existing file, unless you pass -ow. If using a high Depth (-d) be wary of some sites using dynamic links so will it will just keep finding new ones. If no new links are being found, then xnlLinkFinder will stop searching. Providing the Stop flags (s429, s403, sTO, sCE) should also be considered. If you are finding a large number of links (especially if the Depth (-d value is high), and have limited resources, the program will stop when it reaches the memory Threshold (-m) value and end gracefully with data intact before getting killed. If you decide to cancel xnLinkFinder (using Ctrl-C) in the middle of running, be patient and any gathered data will be saved before ending gracefully. Using the -orig option will show the URL where the link was found. This can mean you have duplicate links in the output if the same link was found on multiple sources, but it will suffixed with the origin URL in square brackets. When making requests, xnLinkFinder will use a random User-Agent from the current group, which defaults to desktop. If you have a target that could have different links for different user agent groups, the specify -u desktop mobile for example (separate with a space). The mobile user agent option is an combination of mobile-apple, mobile-android and mobile-windows. When -i has been set to a directory, the contents of the files in the root of that directory will be searched for links. Files in sub-directories are not searched. Any files that are over the size set by -mfs (default: 500 MB) will be skipped. When using the -replay-proxy option, sometimes requests can take longer. If you start seeing more Request Timeout errors (you'll see errors if you use -v or -vv options) then consider using -t to raise the timeout limit. If you know a target will only have ASCII characters in links and parameters then consider passing -ascii-only. This can eliminate a number of false positives

___________________________
@hacking_Attack
@Hacking_Video

that can sometimes get returned from binary data. Issues If you come across any problems at all, or have ideas for improvements, please feel free to raise an issue on Github. If there is a problem, it will be useful if you can provide the exact command you ran and a detailed description of the problem. If possible, run with -vv to reproduce the problem and let me know about any error messages that are given. TODO I seem to have completed all the TODO's I originally had! If you think of any that need adding, let me know 落 Example output Active link finding for a domain:

___________________________
@hacking_Attack
@Hacking_Video

Piped input and output:

___________________________
@hacking_Attack
@Hacking_Video

Good luck and good hunting! If you really love the tool (or any others), or they helped you find an awesome bounty, consider BUYING ME A COFFEE! (https://ko-fi.com/xnlh4ck3r) ☕ (I could use the caffeine!)落 /XNL-h4ck3r


Download xnLinkFinder (https://github.com/xnl-h4ck3r/xnLinkFinder)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Vögel stabilizer app is crap and doesn't work

Basically what says in the title. Every time I'm trying to use the app, it says "access denied", not paring with the device at all. Does anyone know how can I either force the app to connect to the stabilizer (which, according to reviews is utter shit) or somehow hack into the device to make it work? I'd love to know if there are any apps that could replace the faulty one. Thanks in advance

submitted by /u/RayMCS
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Genshin Impact Art Stolen Via AI, Thief Claims To Be Artist

https://external-preview.redd.it/TVNM9MHBlOx84zZX-_7wVR9X9HXiqABcnYP5qXVb9aY.jpg?width=640&crop=smart&auto=webp&s=a1c85fcb69b551686c76304df35b0fc1944ebc81 submitted by /u/dyebiging
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video