hacking: security in practice
Could you theoretically use a tv remote to hack devices?

Like each button could each be a simple command like for example, turn on/off, copy and paste, etc etc, also yes you can access at least some devices because “Most devices come equipped with a feature called HDMI-CEC, which lets you control interconnected devices using a single remote.” (source: https://www.reliancedigital.in/solutionbox/how-to-use-your-tv-remote-to-control-other-devices/) and if we can’t do that, then could you connect a flipper zero with the tv remote so that the flipper zero will transport the commands to the actual devices

submitted by /u/bubblegumpopcorn1231
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Malicious extension lets attackers control Google Chrome remotely

https://cdn-images-1.medium.com/max/2560/0*WAelq49f0UY1YU3a.jpg
Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Many Cyber Criminals Return After Ransomware Payments Are Made

https://cdn-images-1.medium.com/max/1813/0*zESknp1jIF5laxKv.jpg
Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
FTX Telegram Admin Claims the Exchange has Been Hacked and Mobile App has Malware

https://cdn-images-1.medium.com/max/1600/0*cT6g23VvvULJyoUy
A telegram administrator on the FTX official group chat claims the exchange has been hacked, and its website and mobile app have been…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Mobile App Scanner to Find Security Vulnerabilities

https://cdn-images-1.medium.com/max/1280/0*Oome9Bt9WxlJYppS
The usage of mobile phones is increasing so are the apps for mobile phones. But with these comes a big problem or putting your data at…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

autoSSRF - Smart Context-Based SSRF Vulnerabiltiy Scanner
http://www.kitploit.com/2022/11/autossrf-smart-context-based-ssrf.html

___________________________
@hacking_Attack
@Hacking_Video

autoSSRF is your best ally for identifying SSRF vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) at scale. Different from other ssrf automation (https://www.kitploit.com/search/label/Automation) tools, this one comes with the two following original features : Smart fuzzing on relevant SSRF GET parameters When fuzzing, autoSSRF only focuses on the common parameters related to SSRF (?url=, ?uri=, ..) and doesn’t interfere with everything else. This ensures that the original URL is still correctly understood by the tested web-application, something that might doesn’t happen with a tool which is blindly spraying (https://www.kitploit.com/search/label/Spraying) query parameters. Context-based dynamic (https://www.kitploit.com/search/label/Dynamic) payloads generation For the given URL : https://host.com/?fileURL=https://authorizedhost.com, autoSSRF would recognize authorizedhost.com as a potentially white-listed host for the web-application, and generate payloads dynamically based on that, attempting to bypass the white-listing validation. It would result to interesting payloads such as : http://authorizedhost.attacker.com, http://authorizedhost%252F@attacker.com, etc. Furthermore, this tool guarantees almost no false-positives. The detection relies on the great ProjectDiscovery’s interactsh (https://github.com/projectdiscovery/interactsh), allowing autoSSRF to confidently identify out-of-band DNS/HTTP interactions.
Usage python3 autossrf.py -h This displays help for the tool. usage: autossrf.py [-h] [--file FILE] [--url URL] [--output] [--verbose]

options:
-h, --help show this help message and exit
--file FILE, -f FILE file of all URLs to be tested against SSRF
--url URL, -u URL url to be tested against SSRF
--output, -o output file path
--verbose, -v activate verbose mode Single URL target: python3 autossrf.py -u https://www.host.com/?param1=X¶m2=Y¶m2=Z Multiple URLs target with verbose: python3 autossrf.py -f urls.txt -v Installation 1 - Clone git clone https://github.com/Th0h0/autossrf.git 2 - Install requirements Python libraries : cd autossrf
pip install -r requirements.txt Interactsh-Client : go install -v github.com/projectdiscovery/interactsh/cmd/interactsh-client@latest License autoSSRF is distributed (https://www.kitploit.com/search/label/Distributed) under MIT License (https://github.com/Th0h0/autossrf/blob/master/LICENSE.md).

Download Autossrf (https://github.com/Th0h0/autossrf)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
autoSSRF - Smart Context-Based SSRF Vulnerabiltiy Scanner

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-JaILtfigUubebTUNqpF1TWzOVEKQhY3xq7ywDG_35FE-KFLxsIDQkQz7aHeulzlY1zHT8q-1xlVHRRsUAd_bd9IY_jKYjfESkoFZQmTI5lP_2sB0KKu_CoeJzJUohlD7cjqa6Bgpf1lJTPg42seSD_JQrb5b2tI5mSoVVGUSs0ivfXLX-PBjIKCTgg/w640-h274/SSRF.png
autoSSRF is your best ally for identifying SSRF vulnerabilities at scale. Different from other ssrf automation tools, this one comes with the two following original features :

*
Smart fuzzing on relevant SSRF GET parameters

When fuzzing, autoSSRF only focuses on the common parameters related to SSRF (?url=, ?uri=, ..) and doesn’t interfere with everything else. This ensures that the original URL is still correctly understood by the tested web-application, something that might doesn’t happen with a tool which is blindly spraying query parameters.

*
Context-based dynamic payloads generation

For the given URL : https://host.com/?fileURL=https://authorizedhost.com, autoSSRF would recognize authorizedhost.com as a potentially white-listed host for the web-application, and generate payloads dynamically based on that, attempting to bypass the white-listing validation. It would result to interesting payloads such as : http://authorizedhost.attacker.com, http://authorizedhost%252F@attacker.com, etc.
Furthermore, this tool guarantees almost no false-positives. The detection relies on the great ProjectDiscovery’s interactsh, allowing autoSSRF to confidently identify out-of-band DNS/HTTP interactions.
Usage

python3 autossrf.py -h

This displays help for the tool.

usage: autossrf.py [-h] [--file FILE] [--url URL] [--output] [--verbose]

options:
-h, --help show this help message and exit
--file FILE, -f FILE file of all URLs to be tested against SSRF
--url URL, -u URL url to be tested against SSRF
--output, -o output file path
--verbose, -v activate verbose mode

Single URL target:

python3 autossrf.py -u https://www.host.com/?param1=X¶m2=Y¶m2=Z

Multiple URLs target with verbose:

python3 autossrf.py -f urls.txt -v

Installation

1 - Clone

git clone https://github.com/Th0h0/autossrf.git

2 - Install requirements

Python libraries :

cd autossrf
pip install -r requirements.txt

Interactsh-Client :

go install -v github.com/projectdiscovery/interactsh/cmd/interactsh-client@latest

License

autoSSRF is distributed under MIT License.
Download Autossrf

___________________________
@hacking_Attack
@Hacking_Video

Bug Zero at a Glance [Week 5–11 November]

Bug Zero is happy to be a part of #GEW2022Continue reading on Bug Zero »
Read more...

Bug Zero at a Glance [Week 5–11 November]
https://blog.bugzero.io/bug-zero-at-a-glance-week-5-11-november-354a2325a07?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Bug Zero is happy to be a part of #GEW2022Continue reading on Bug Zero » (https://blog.bugzero.io/bug-zero-at-a-glance-week-5-11-november-354a2325a07?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

New here !
https://www.reddit.com/r/Pentesting/comments/yt8168/new_here/

submitted by /u/Cryptonoob9988 (https://www.reddit.com/user/Cryptonoob9988)
[link] (https://www.reddit.com/r/Pentesting/comments/yt8168/new_here/) [comments] (https://www.reddit.com/r/Pentesting/comments/yt8168/new_here/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Kali Linux airodump-ng doesn't show ESSID's (

I'm pretty new here, so bear with me.
When running airodump-ng wlan0mon in Kali, it picks up several AP's, including my own router. The BSSID's of all AP's are shown without an issue. All of the ESSID's are displayed as /u/osciiator
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Wagyu XSS

Hi everyone, so I have been working on this tool for a few months now and it’s still very early stages but I thought I’d share it with everyone!

Wagyu is a dynamic cross-site scripting payload delivery system with team server abilities. I’m super excited for where this app is heading and all your guys support would be greatly appreciated.

All suggestions and improvements are encouraged, you can check it out here: Wagyu XSS

submitted by /u/JamiP42
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video