Hacking on Medium
How I Found A Simple Stored XSS

https://cdn-images-1.medium.com/max/800/0*FUl-Q8zErBsZcrWz.jpeg
This is the story of how I found my first Stored XSS (“Cross Site Scripting”) vulnerability in a bug bounty program and a walk through on…

Continue reading on Medium »

Hacking on Medium
SSRF & LFI In Uploads Feature

https://cdn-images-1.medium.com/max/782/0*VPehstiqBXel6nYY.png
Hello fellow hackers, today I will discuss how I found a Server-Side Request Forgery (SSRF) which lead to a Local File Inclusion (LFI)…

Continue reading on Medium »

Hacking on Medium
Por qué aumenta el ransomware en la educación y qué significa para 2023

https://cdn-images-1.medium.com/max/1728/0*lw82tmqYYjP4Gswb
La violación del Distrito Escolar Unificado de Los Ángeles (LAUSD) destaca la prevalencia de las vulnerabilidades de las contraseñas, ya…

Continue reading on Medium »

Hacking on Medium
Emotet Botnet distribuye archivos RAR protegidos con contraseña de desbloqueo automático para…

https://cdn-images-1.medium.com/max/1736/0*YZz1unWGMIFSh586
La notoria botnet Emotet se ha relacionado con una nueva ola de campañas de malspam que aprovechan los archivos protegidos con contraseña…

Continue reading on Medium »

https://b.thumbs.redditmedia.com/gjWCNDNHrbWfye2H-13tngPTcnWQIKmSq3DrWsjIHaI.jpg When using exiftool to see the metadata from a picture, i only see this information:

https://preview.redd.it/vacdyqqcitv91.png?width=824&format=png&auto=webp&s=b96a1ff9d7032188f93b95b16fde683b73b7c20b

Meanwhile, on the forensics tutorial i am following, they ran exiftool on the same photo and they ended up with many more additional information such as image description, make and camera info, and GPS Longitude/Latitude. How can i make the program show this additional information or which commands i need to use?

submitted by /u/bugst4rr
[link] [comments]

hacking: security in practice
How do you know if you can overwrite the return address on the stack when doing buffer overflow?

I know there are times where you cannot overwrite the return address on the stack but what are those conditions? I'm just not sure when you can and cannot overwrite it? Shouldn't you always be able to overwrite the RET address?

submitted by /u/klinky8
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

https://b.thumbs.redditmedia.com/PYvaROKdj0QrfVFz7vuCgv3Tz-TjxIwOkF9xbD3ljmM.jpg submitted by /u/LolDotHackMe
[link] [comments]

https://a.thumbs.redditmedia.com/4lbj-vKRo4yqDs5PBmQjHC_YWmj3m5xetKhXYCEBnX0.jpg Got a message on IG from someone I knew about me voting for them as a brand ambassador. They sent the link and when I clicked on it, it was a human verification page and then an IG log-in. I tried logging in but it wouldn’t go through.

I let the person know and they stated that I needed to turn off my 2-factor authorization in order for it to work. (I didn’t). A few moments later, I got a notification for an attempted sign in. I denier the request and changed my password.

Is this a new way of attempting to hack or am I just over thinking it? Then again, why would they need access to my account? First time I’ve ever encountered something like this.

submitted by /u/UrartuQueen
[link] [comments]

hacking: security in practice
Timeframe to mask attack 10 character password

How long would it take to mask attack a 10 character password that includes upper/lower case letters, numbers and special characters and one of the special characters is known (not its place in the password though) using 8 rtx 4090's?

submitted by /u/theboops79
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
It is very simple to show off a deep web Hacker for Hire Service for an iPhone using the hire a…

HACKSPYWARE is a Professional cell phone hacker for hire and Hiring an iPhone hacker. Cell phone hackers for hire have a tendency to…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Building Custom Malware With Python

https://cdn-images-1.medium.com/max/1600/1*DQv9W_g50Ml-iNNOjyp8gA.jpeg
Creating custom malware is tricky, so here’s a full walkthrough on the basics.

Continue reading on The Gray Area »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Was given a free pass to a local Cyber Security Summit, anyone here been to one of these? How was it?

Posted on /r/cybersecurity with no response, so figured I'd try here. I was approached online to see if I'd be willing to go to this Cyber Security Summit in Los Angeles late last week and I'm curious if anyone here's been to any of the events hosted by these people. I've been more of a DEF CON / HOPE type of goer, and compared to that this seems far more corporate CTO forward than anything else. Finally, since I've heard it's mostly like a vendor row in a previous post, is there at least some good swag that makes taking the 4:15AM train worth it?

submitted by /u/buzzbros2002
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Buffer overflow, canary enabled but program only seems to accept arguments as input

I've got a pretty tricky flag that I have been beating my head against for a while now and would love an explanation for how something like this would be possible. I have a program that when run, seemingly immediately cancels itself. File returns:
file.exe: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=60e0255339eac5de5c216aed54d2b55cfa3d7dda, not stripped
and Checksec returns:
Arch: amd64-64-little RELRO: Partial RELRO Stack: Canary found NX: NX enabled PIE: No PIE (0x400000)
As you can see, it has a canary enabled which is a problem considering the program accepts no input after running it. Usually I would either brute force the canary or grab it when it leaks then pass it to be input, but I don't see how it's possible to grab the leak and then put it in as an arg after the fact - but since the canary changes on execution you clearly have to do that. Everything looks like you'd expect when disassembling it in ghidra - except for the no input part. Here's the main func:
0x000000000040060e <+0: push rbp 0x000000000040060f <+1: mov rbp,rsp 0x0000000000400612 <+4: sub rsp,0x10 0x0000000000400616 <+8: mov DWORD PTR [rbp-0x4],edi 0x0000000000400619 <+11: mov QWORD PTR [rbp-0x10],rsi 0x000000000040061d <+15: mov rax,QWORD PTR [rbp-0x10] 0x0000000000400621 <+19: add rax,0x8 0x0000000000400625 <+23: mov rax,QWORD PTR [rax] 0x0000000000400628 <+26: mov rdi,rax 0x000000000040062b <+29: call 0x4005a7
and here's the evil func:

​
0x00000000004005a7 <+0: push rbp 0x00000000004005a8 <+1: mov rbp,rsp 0x00000000004005ab <+4: sub rsp,0x70 0x00000000004005af <+8: mov QWORD PTR [rbp-0x68],rdi 0x00000000004005b3 <+12: mov rax,QWORD PTR fs:0x28 0x00000000004005bc <+21: mov QWORD PTR [rbp-0x8],rax 0x00000000004005c0 <+25: xor eax,eax 0x00000000004005c2 <+27: mov DWORD PTR [rbp-0x54],0x0 0x00000000004005c9 <+34: mov rdx,QWORD PTR [rbp-0x68] 0x00000000004005cd <+38: lea rax,[rbp-0x50] 0x00000000004005d1 <+42: mov rsi,rdx 0x00000000004005d4 <+45: mov rdi,rax 0x00000000004005d7 <+48: mov eax,0x0 0x00000000004005dc <+53: call 0x4004b0
Any input would be greatly appreciated!

​

edit: this is what I get when I overflow:
$ ./malicious.exe aaAa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag *** stack smashing detected ***: terminated Aborted (core dumped)
​

submitted by /u/Cascodius
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Two Factor Code being sent unprompted

It started with my google account so I changed the password and a few account using the same password, now Im getting phone calls with 2 factor codes being sent via Phone calls but I have no Idea what account it is for. so something has been compromised, but what other step can I take if don't know what service is sending the 2 factor code.

submitted by /u/Famous-Error-2929
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Searching for a script

I am looking for a script to use in an online 2D MMO RPG where you can basically run dungeons automatically. Everyone who is willing to guide please let me know

submitted by /u/Ommarley
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Stepping Into Blockchains? It’s Time To Know the Basics…

There’s a huge fuss surrounding Blockchains nowadays. Many people talk about it but only a few have a real understanding of it.Continue reading on Bug Zero »
Read more...

Stepping Into Blockchains? It’s Time To Know the Basics…
https://blog.bugzero.io/stepping-into-blockchains-its-time-to-know-the-basics-6deaaf547e19?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video