The usage of mobile phones is increasing so are the apps for mobile phones. But with these comes a big problem or putting your data at…Continue reading on Medium » (https://kd-200.medium.com/mobile-app-scanner-to-find-security-vulnerabilities-6989cf552058?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Sandbox detection popularity

How common is it to find Sandbox detection in a malware? Recently, I've tested a pack of malware from malwarebazar in a vm to check how many an antivirus would detect, and I didn't really see many that would "realize" that they were run on a vm and stop. Is it more focused on detecting an analyzing software? From what I've read, checking for vm tools was a popular mechanism not so long ago.

submitted by /u/freir96
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How could I bypass firewalls to use torrent clients ??

I'm in college in a Tier 3 country. I want to pirate courses of torrents but they've a Sophos Firewall. Is there a way I could download torrents without using a VPN? (they're slow)

submitted by /u/twerking_pokemon
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Could you theoretically use a tv remote to hack devices?

Like each button could each be a simple command like for example, turn on/off, copy and paste, etc etc, also yes you can access at least some devices because “Most devices come equipped with a feature called HDMI-CEC, which lets you control interconnected devices using a single remote.” (source: https://www.reliancedigital.in/solutionbox/how-to-use-your-tv-remote-to-control-other-devices/) and if we can’t do that, then could you connect a flipper zero with the tv remote so that the flipper zero will transport the commands to the actual devices

submitted by /u/bubblegumpopcorn1231
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Malicious extension lets attackers control Google Chrome remotely

https://cdn-images-1.medium.com/max/2560/0*WAelq49f0UY1YU3a.jpg
Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Many Cyber Criminals Return After Ransomware Payments Are Made

https://cdn-images-1.medium.com/max/1813/0*zESknp1jIF5laxKv.jpg
Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
FTX Telegram Admin Claims the Exchange has Been Hacked and Mobile App has Malware

https://cdn-images-1.medium.com/max/1600/0*cT6g23VvvULJyoUy
A telegram administrator on the FTX official group chat claims the exchange has been hacked, and its website and mobile app have been…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Mobile App Scanner to Find Security Vulnerabilities

https://cdn-images-1.medium.com/max/1280/0*Oome9Bt9WxlJYppS
The usage of mobile phones is increasing so are the apps for mobile phones. But with these comes a big problem or putting your data at…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

autoSSRF - Smart Context-Based SSRF Vulnerabiltiy Scanner
http://www.kitploit.com/2022/11/autossrf-smart-context-based-ssrf.html

___________________________
@hacking_Attack
@Hacking_Video

autoSSRF is your best ally for identifying SSRF vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) at scale. Different from other ssrf automation (https://www.kitploit.com/search/label/Automation) tools, this one comes with the two following original features : Smart fuzzing on relevant SSRF GET parameters When fuzzing, autoSSRF only focuses on the common parameters related to SSRF (?url=, ?uri=, ..) and doesn’t interfere with everything else. This ensures that the original URL is still correctly understood by the tested web-application, something that might doesn’t happen with a tool which is blindly spraying (https://www.kitploit.com/search/label/Spraying) query parameters. Context-based dynamic (https://www.kitploit.com/search/label/Dynamic) payloads generation For the given URL : https://host.com/?fileURL=https://authorizedhost.com, autoSSRF would recognize authorizedhost.com as a potentially white-listed host for the web-application, and generate payloads dynamically based on that, attempting to bypass the white-listing validation. It would result to interesting payloads such as : http://authorizedhost.attacker.com, http://authorizedhost%252F@attacker.com, etc. Furthermore, this tool guarantees almost no false-positives. The detection relies on the great ProjectDiscovery’s interactsh (https://github.com/projectdiscovery/interactsh), allowing autoSSRF to confidently identify out-of-band DNS/HTTP interactions.
Usage python3 autossrf.py -h This displays help for the tool. usage: autossrf.py [-h] [--file FILE] [--url URL] [--output] [--verbose]

options:
-h, --help show this help message and exit
--file FILE, -f FILE file of all URLs to be tested against SSRF
--url URL, -u URL url to be tested against SSRF
--output, -o output file path
--verbose, -v activate verbose mode Single URL target: python3 autossrf.py -u https://www.host.com/?param1=X¶m2=Y¶m2=Z Multiple URLs target with verbose: python3 autossrf.py -f urls.txt -v Installation 1 - Clone git clone https://github.com/Th0h0/autossrf.git 2 - Install requirements Python libraries : cd autossrf
pip install -r requirements.txt Interactsh-Client : go install -v github.com/projectdiscovery/interactsh/cmd/interactsh-client@latest License autoSSRF is distributed (https://www.kitploit.com/search/label/Distributed) under MIT License (https://github.com/Th0h0/autossrf/blob/master/LICENSE.md).

Download Autossrf (https://github.com/Th0h0/autossrf)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
autoSSRF - Smart Context-Based SSRF Vulnerabiltiy Scanner

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-JaILtfigUubebTUNqpF1TWzOVEKQhY3xq7ywDG_35FE-KFLxsIDQkQz7aHeulzlY1zHT8q-1xlVHRRsUAd_bd9IY_jKYjfESkoFZQmTI5lP_2sB0KKu_CoeJzJUohlD7cjqa6Bgpf1lJTPg42seSD_JQrb5b2tI5mSoVVGUSs0ivfXLX-PBjIKCTgg/w640-h274/SSRF.png
autoSSRF is your best ally for identifying SSRF vulnerabilities at scale. Different from other ssrf automation tools, this one comes with the two following original features :

*
Smart fuzzing on relevant SSRF GET parameters

When fuzzing, autoSSRF only focuses on the common parameters related to SSRF (?url=, ?uri=, ..) and doesn’t interfere with everything else. This ensures that the original URL is still correctly understood by the tested web-application, something that might doesn’t happen with a tool which is blindly spraying query parameters.

*
Context-based dynamic payloads generation

For the given URL : https://host.com/?fileURL=https://authorizedhost.com, autoSSRF would recognize authorizedhost.com as a potentially white-listed host for the web-application, and generate payloads dynamically based on that, attempting to bypass the white-listing validation. It would result to interesting payloads such as : http://authorizedhost.attacker.com, http://authorizedhost%252F@attacker.com, etc.
Furthermore, this tool guarantees almost no false-positives. The detection relies on the great ProjectDiscovery’s interactsh, allowing autoSSRF to confidently identify out-of-band DNS/HTTP interactions.
Usage

python3 autossrf.py -h

This displays help for the tool.

usage: autossrf.py [-h] [--file FILE] [--url URL] [--output] [--verbose]

options:
-h, --help show this help message and exit
--file FILE, -f FILE file of all URLs to be tested against SSRF
--url URL, -u URL url to be tested against SSRF
--output, -o output file path
--verbose, -v activate verbose mode

Single URL target:

python3 autossrf.py -u https://www.host.com/?param1=X¶m2=Y¶m2=Z

Multiple URLs target with verbose:

python3 autossrf.py -f urls.txt -v

Installation

1 - Clone

git clone https://github.com/Th0h0/autossrf.git

2 - Install requirements

Python libraries :

cd autossrf
pip install -r requirements.txt

Interactsh-Client :

go install -v github.com/projectdiscovery/interactsh/cmd/interactsh-client@latest

License

autoSSRF is distributed under MIT License.
Download Autossrf

___________________________
@hacking_Attack
@Hacking_Video

Bug Zero at a Glance [Week 5–11 November]

Bug Zero is happy to be a part of #GEW2022Continue reading on Bug Zero »
Read more...

Bug Zero at a Glance [Week 5–11 November]
https://blog.bugzero.io/bug-zero-at-a-glance-week-5-11-november-354a2325a07?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video