Hacking on Medium
クリプトのセキュリティ概説

https://cdn-images-1.medium.com/max/2240/1*aPIHEeZMoOgWB_jDrmLQdQ.png
ハッカーは今年、dAppsから20億ドル以上を盗みました。クリプトのエコシステムが成長し、より多くの悪意のある人々を引き寄せるにつれ、問題は悪化の一途をたどるでしょう。何かを変えなければなりません。一歩下がって過去の失敗を振り返り、この業界におけるセキュリティの扱い方を変えるとき…

Continue reading on boarding bridge »

___________________________
@hacking_Attack
@Hacking_Video

Firing 8 Account Takeover Methods
https://0xmaruf.medium.com/firing-8-account-takeover-methods-77e892099050?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello! this is Md Maruf Hosan a bug bounty hunter from Bangladesh.
I am gonna be firing some account takeover methodsContinue reading on Medium » (https://0xmaruf.medium.com/firing-8-account-takeover-methods-77e892099050?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Researchers find 633% increase in cyber-attacks aimed at open source repositories

Researchers find 633% increase in cyber-attacks aimed at open source repositoriesPost Views: 2 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes Researchers warn that there has been a 633% year-over-year increase in cyber-attacks launched against open source software repositories.Open source components, frameworks, libraries, and whole platforms are relied upon by organizations during multiple stages of the software development lifecycle. These components provide the lynchpins for communication, software capabilities, security, and user interactions – and as they are developed and reviewed by communities, open source promotes innovation in the software space.

However, the other side of the coin is that open source contributors are volunteers; therefore, security issues can sometimes slip through the net. Furthermore, IT teams may not be aware of what open source software is in use and so they might easily miss patch alerts and upgrades that impact their business.

New research suggests that cyber-attackers – well aware of organizational reliance on open source software – are increasing their attempts to compromise repositories year on year.

According to Sonatype’s 8th Annual State of the Software Supply Chain report, known attacks against open source repositories have increased by 633% year-over-year, and there has been an annual, overall increase of 742% since 2019.

After analyzing data from public and proprietary sources, the software supply chain security firm said that the popularity and growth of open source software continues to climb. The four main ecosystems – Java, JavaScript, Python, and .NET – tied to open source development are set to go beyond three trillion downloads in the near future.

However, this popularity has security ramifications.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Technical debt“The amount of third-party code flowing through software supply chains occurs on a massive scale,” the researchers said. “Yet published code accrues technical debt over time, creating the potential for compounded security vulnerabilities, if not kept up-to-date.”

According to the researchers, 1.2 billion Java dependencies known to be vulnerable, for example, are downloaded each month while new, patched, or improved versions are ignored.

Sonatype said this is a prime example of “non-optimal consumption behaviors as the root of open source risk”.

“This is in contrast to public discussion, which often associates security risk with open source maintainers,” the report added.
Trending: How to Exploit “improper error handling” in Web Applications Trending: Offensive Security Tool: VLANPWN Risky businessRisky behavior is not necessarily anyone’s fault. Developers tasked with managing dependencies face more complexity in their roles than ever, with the average Java application containing 148 dependencies – 20 more than 2021’s average – and going through an average ten updates a year.

Each dependency could contain vulnerabilities, so developers must track potentially thousands of changes per year, per app. Therefore, mistakes will be made.

Brian Fox, co-founder and CTO of Sonatype said that “the overwhelming tide of dependency intelligence that developers must interpret in their daily development process is at odds with prioritizing good software quality”.

It is, therefore, critical that education on the potential risk of outdated, vulnerable open source software is understood, [...]

___________________________
@hacking_Attack
@Hacking_Video

and teams should consider adopting automation to lighten the load.

Fox added: “[The] sobering reality demonstrates the immediate need for organizations to prioritize software supply management so that they can better deal with security risk, increase developer efficiency, and enable faster innovation.”

​
Trending: Critical RCE Vulnerability Found in vm2 Sandbox Library Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: portswigger.net Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-8-300x150.png MyDeal data breach impacts 2.2M users, stolen data for sale onlineOctober 18, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-7-1-300x150.png Microsoft 365 Message Encryption Can Leak Sensitive InfoOctober 17, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-6-300x150.png GitLab patches RCE bug in GitHub import functionOctober 14, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-5-300x150.png New npm timing attack could lead to supply chain attacksOctober 13, 2022
Reading Time: 4 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Researchers find 633% increase in cyber-attacks aimed at open source repositories first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
A New Attack Surface on MS Exchange Part 4 - ProxyRelay

https://external-preview.redd.it/aSwD1p5vengcPfsYNo0cLLZTGWWP5t3b7MRNelqU1f8.jpg?width=640&crop=smart&auto=webp&s=cefe17004eb5bc6c5a4b197fe441b7a032f90308 submitted by /u/CyberMasterV
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Working with "signature" headers

When using some public apis, I've seen some that have a "signature" header. In the use cases I've used them in, I'm usually taking my private/secret key of an API key I've generated for the site and signing some info of the request to show I'm really the one making the request. Recently when looking at the network calls for a website, I noticed the requests have a "signature" header with the format:



I'm curious if there is a way to reverse engineer this signature? Is this a standard format? With the signatures I've worked with in the past, I was in possession of a secret key. If there's some kind of key being used here, I'm assuming I should be able to find it as the signature is being generated from the client side.

Is this too difficult a problem to solve/complex enough not to attempt? Are there too many variables to consider (eg which signature method was used, which inputs were used, were inputs converted to Base64, etc)?

I'm guessing part-3is a salt or something, and part-2is the actual signature. Not sure about the other parts though.

submitted by /u/argetlam5
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How I managed to take down arbitrary posts on HackerNews

submitted by /u/AdQuirky9181
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Cybersecurity LinkedIn Skill Assessment Answer 2022

Q1. According to the shared responsibility model, which cloud computing model places the most responsibility on the cloud service provider…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
2 Billion USD stolen within one year— Blockchain Bridges explained

https://cdn-images-1.medium.com/max/2076/1*Th2hpLJZTD0aAhn74Pbe_w.png
What do the latest BNB, Ronin, Nomad and Harmony exploit have in common? They all trace back to cross-chain breaches. But what are…

Continue reading on Pulsar Systems »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Finding $10K+ SQL Injection Vulnerabilities

https://cdn-images-1.medium.com/max/1200/1*9UnPwTDmsHLmM5EBntx-8w.jpeg
TL;DR-What is SQL, how do websites use it, how can you exploit it, and lastly, how can you profit from it?

Continue reading on The Gray Area »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Developing Undetectable Malware with Dart

https://cdn-images-1.medium.com/max/600/1*du3mWoiacuRzWVW8Aise_A.gif
In this article, I will briefly describe how to start developing, undetectable, cross-platform malware using the dart language. The aim is…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Can you explain the $100 million Mango hack to me?;

https://cdn-images-1.medium.com/max/1456/0*Y-ymgtlu2bL3jc0o.png
In this edition:

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video