Hacking on Medium
SMB Enumeration for Beginners

https://cdn-images-1.medium.com/max/768/0*LDs1eNiYAXtc4V-0.png
Before Interacting with any service it is better to understand what it actually is and what it’s use. So lets dig in..

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The 20 Biggest Hacking Attacks of All Time

https://cdn-images-1.medium.com/max/600/1*BA3XUEnvCydW55FI4gjlWg.jpeg
There's little doubt that the internet has transformed the modern world as we know it, and mostly in a positive way. From the ability to…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
XSS: Attackers gaining access!

Have you heard about the term Vulnerability? Surely, you must have. In this field of internet and networking, it is a term that plays a…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
It Appears Crypto Exchange Hacks Are No Longer A Mystery — It’s Becoming Clear That It’s An Inside…

https://cdn-images-1.medium.com/max/640/0*N9iiGol_8Mnc3LIH
In recent years, there have been a number of high-profile hacks of cryptocurrency exchanges and wallets. These hacks have led to the loss…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Novesh Cybersecurity Solutions, is it a good fit?

At Novesh, whether you are a small to medium sized company and do not currently have an Information Security Team, we can help by being…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Cyber Security Bootcamp #1

https://cdn-images-1.medium.com/max/1800/0*b1B85b2HVigI39pm.jpg
โครงการที่ดีมากทีสุดในตอนนี้ ด้าน CyberSecurity ในประเทศไทย

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Creating a HACKING WORDLIST??

https://cdn-images-1.medium.com/max/1139/1*M_q371QEb03q3QqDh6COkQ.gif
Hey hi everyone I’m Hrisikesh, aka VirusZzWarning, back with another crazy blog. In this blog, I will tell you about a tool that will help…

Continue reading on System Weakness »

___________________________
@hacking_Attack
@Hacking_Video

Get Blind XSS within 5 Minutes — $100

Hello Boss….Continue reading on Medium »
Read more...

Get Blind XSS within 5 Minutes — $100
https://medium.com/@NarayananM/get-blind-xss-within-5-minutes-100-9718bd056570?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello Boss….Continue reading on Medium » (https://medium.com/@NarayananM/get-blind-xss-within-5-minutes-100-9718bd056570?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Accessing files on a locked 2008 iPod

As the title suggest, I have an old 2008 iPod that I’d like to be able to pull my files from. Unfortunately I was locked out of it due to too many failed passcode attempts and of course also no longer have the iTunes account connected to it many, many years ago.

Presumably the files still exist on the device, so is there any way to access them without the info/unlocking it?

submitted by /u/SeeMeAfterschool
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Does anybody know how to hack into Canvas and to change my grades

Juts wondering if anybody here knows how to do that. There’s the duo authentication app that’s comes with it so I’m not sure how I would get around that.

submitted by /u/KeepItRolling_69
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

VuCSA - Vulnerable Client-Server Application - Made For Learning/Presenting How To Perform Penetration Tests Of Non-Http Thick Clients
http://www.kitploit.com/2022/11/vucsa-vulnerable-client-server.html

___________________________
@hacking_Attack
@Hacking_Video

Vulnerable Client-Server Application Vulnerable client-server application (VuCSA) is made for learning/presenting how to perform penetration tests of non-http thick clients. It is written in Java (with JavaFX graphical user interface). Currently the vulnerable application (https://www.kitploit.com/search/label/Vulnerable%20Application) contains the following challenges: Buffer Over-read (simulated) Command Execution SQL Injection Enumeration XML Horizontal Access (https://www.kitploit.com/search/label/Access) Control Vertical Access Control If you want to know how to solve these challenges, take a look at the PETEP website (http://petep.warxim.com/methodology/), which describes how to use the open-source tool PETEP to exploit them. Tip: Before you start hacking, do not forget to check the data structure of messages bellow.
How to Run In order to run the vulnerable (https://www.kitploit.com/search/label/Vulnerable) server and client, you can use one of releases on GitHub or run gradle assemble, which creates distribution packages (for both Windows (https://www.kitploit.com/search/label/Windows) and Unix). These packages contain sh/bat scripts (https://www.kitploit.com/search/label/Scripts) that will run the server and client using JVM. Project Structure Project is divided into three modules: vucsa-common - common functionality for both client and server (including protocol processing utilities) vucsa-client - vulnerable client with JavaFX GUI vucsa-server - vulnerable server for terminal use Data Structure Messages transmitted between server and client have the following simple format: [type][target][length][payload]
32b 32b 32b ???
These four parts have the following meaning: type - type of the message (used for serialization/deserialization) target - target handler that will receive the message length - length of the payload payload - data serialized into bytes

Download Vucsa (https://github.com/Warxim/vucsa)

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Malicious proof-of-concepts are exposing GitHub users to malware and more

Malicious proof-of-concepts are exposing GitHub users to malware and morePost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes Malicious proof-of-concepts (PoCs) are potentially exposing GitHub users to malware and other malfeasance, researchers have found.In a paper titled ‘How security professionals are being attacked: A study of malicious CVE proof of concept exploits in GitHub’, researchers from Leiden University in the Netherlands recently detailed how thousands of PoCs for known vulnerabilities contain dangerous elements that do more than billed.

Instead of performing an innocuous operation, these exploits could open the door to potential attack. Qualitative and quantitativeThe team – Soufian El Yadmani, Robin The, and Olga Gadyatskaya – collected publicly available PoCs shared on GitHub for CVEs discovered between 2017 and 2021.

In total they studied 47,313 repositories that contained PoCs for at least one CVE from the target period, in what they called “the first large-scale qualitative and quantitative investigation of malicious PoCs”.

They found that of the 47,313 GitHub repositories they had downloaded and checked, 4,893 (10.3%) were malicious.

“The purpose of our research was to investigate how big the problem of fake and malicious PoCs for CVE exploits is, since it is our understanding that this is a problem that hasn’t been tackled by anyone before,” El Yadmani told The Daily Swig.

“As a researcher and senior security researcher at Darktrace myself, we rely on sources like GitHub and Exploit-DB for these kinds of PoCs since the knowledge shared by other researchers speaks the same language as we do, which is programming.

“About a year ago I noticed that the topic of malicious PoCs was increasingly spoken about on Twitter, but it was only about specific cases, and it was not clear how large the problem actually was.

“Since there was no clear indication of how many PoCs were malicious, we chose to investigate the issue ourselves.”
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Impressive varietyEl Yadmani told The Daily Swig that the most interesting finding was the variation in fake and malicious PoCs that the team encountered.

“In some the attackers were trying to plant malware on users’ machines, while in others, they tried to open backdoors using CobaltStrike, for example,” he said.

“What’s surprising is that in some cases we found fake and harmless PoCs that included memes; the most interesting finding was that some of these people invested a lot of time in their PoCs, while their only purpose was to educate the community about how they should not blindly trust PoCs from other people.”
Trending: Exploit XSS Injections in a one-line powerful Technique
Trending: Recon Tool: Hakrawler ​Impact radiusThe research paper (PDF) also goes on to lay out recommendations for detecting malicious PoCs by analysing source code for malicious calls to servers as well as extracting hexadecimal payloads and Base64-encoded scripts that contains malicious instructions, “which could be exfiltrating information, downloading malicious files from the internet or containing a backdoor”.

“Ignoring this problem can cause damage that ranges from infecting yourself as [a] user, to infecting your company and likely your customers as well if it’s a more sophisticated attack,” El Yadmani warned.

“Pen testers and developers should always read the code before running it, but in CVE PoCs it can be tricky and challeng[...]

___________________________
@hacking_Attack
@Hacking_Video

ing in some cases.

“That’s why we wanted to introduce an approach that helps [with] detecting suspicious behaviors in PoCs, automatically. We also want to invest more time in suggesting automated solutions that can help flagging malicious PoCs.

“Our research is also an invitation to other researchers, either in academia or [the] industry, to invest more time in producing solutions for this problem.”
Trending: Exploited Windows zero-day lets JavaScript files bypass security warnings Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: portswigger.net Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/Images-for-the-News-posts-7-300x150.png Dropbox discloses breach after hacker stole 130 GitHub repositoriesNovember 2, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/Images-for-the-News-posts-6-300x150.png SQLite patches 22-year-old code execution, a DoS vulnerabilityNovember 1, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-5-1-300x150.png OpenSSL Gives Heads Up to Critical Vulnerability DisclosureOctober 31, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-4-1-300x150.png GitHub patches bug called repojacking that could allow access to another user’s repoOctober 28, 2022
Reading Time: 3 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Malicious proof-of-concepts are exposing GitHub users to malware and more first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video