hacking: security in practice
Possible email verification phishing attempt through iOS?

Hello reddit 👋

A family member recently sent me a message asking about a notification they are receiving on iPhone. It's a pretty standard Gmail popup asking for account rights, as you'd find with any other time an app tries to access your Gmail account.

However, the rights request is sent by "iOS"...not Apple. So in the main flag of the notification, it shows "iOS wants to access your Gmail account". They claim they've done nothing that would logically trigger this and also strangely, in the footnote, it indicates "see iOS's privacy policy". Would this not say Apple instead of iOS?

Anyway, long story short, I wonder if this is some type of sophisticated phishing attempt using malware to produce these notifications. We both live in a country that has been the target of many cyber attacks of late and they work in a particularly "valuable" industry.

Sorry in advance if this seems a bit vague, I've attempted to research this but as of current there doesn't seem to be anyone else posting / writing about this.

submitted by /u/deazy97
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dismember - Scan Memory For Secrets And More
http://www.kitploit.com/2022/11/dismember-scan-memory-for-secrets-and.html

___________________________
@hacking_Attack
@Hacking_Video

Dismember is a command-line toolkit for Linux that can be used to scan the memory of all processes (or particular ones) for common secrets (https://www.kitploit.com/search/label/Secrets) and custom regular expressions, among other things. It will eventually become a full /proc toolkit. Using the grep command, it can match a regular expression (https://www.kitploit.com/search/label/Regular%20Expression) across all memory for all (accessible) processes. This could be used to find sensitive data in memory, identify a process by something included in its memory, or to interrogate a processes' memory for interesting information. There are many built-in patterns included via the scan command, which effectively works as a secret scanner (https://www.kitploit.com/search/label/Scanner) against the memory on your machine. Dismember can be used to search memory of all processes it has access to, so running it as root is the most effective method. Commands are also included to list processes, explore process status and related information, draw process trees, and more...
Main Commands Command Description grep Search process memory for a given string or regex scan Search process memory for a set of predefined secret patterns Utility Commands Command Description files Show a list of files being accessed by a process find Find a PID given a process name. If multiple processes match, the first one is returned. info Show information about a process kernel Show information about the kernel kill Kill a process (or processes) using SIGKILL list List all processes currently available on the system resume Resume a suspended process using SIGCONT suspend Suspend a process using SIGSTOP (use 'dismember resume' to leave suspension) tree Show a tree diagram (https://www.kitploit.com/search/label/Diagram) of a process and all children (defaults to PID 1). Installation Grab a binary from the latest release (https://github.com/liamg/dismember/releases/latest) and add it to your path. Usage Examples Search for a pattern in a process by PID # search memory owned by process 1234
dismember grep -p 1234 'the password is .*' Search for a pattern in a process by name # search memory owned by processes named "nginx" for a login form submission
dismember grep -n nginx 'username=liamg&password=.*' Search for a pattern across all processes # find a github api token across all processes
dismember grep 'gh[pousr]_[0-9a-zA-Z]{36}' Search for secrets in memory across all processes # search all accessible memory for common secrets
dismember scan FAQ Isn't this information all just sitting in /proc? Pretty much. Dismember just reads and presents it for the most part. If you can get away with grep whatever /proc/[pid]/blah then go for it! I built this as an educational experience because I couldn't sleep one night and stayed up late reading the proc man-pages (I live an extremely rock 'n' roll lifestyle). It's not a replacement for existing tools, but perhaps it can complement them. Do you know how horrific some of these commands seem when read out of context? Yes (https://twitter.com/liam_galvin/status/1540375769049960448).

Download Dismember (https://github.com/liamg/dismember)

___________________________
@hacking_Attack
@Hacking_Video

Encryption which i don't know help please
https://www.reddit.com/r/Pentesting/comments/yvwpmw/encryption_which_i_dont_know_help_please/

Do anyone have idea about this encryption start with = “U2FsdGVk5X11” submitted by /u/l_l__R4v4N__l__l (https://www.reddit.com/user/l_l__R4v4N__l__l)
[link] (https://www.reddit.com/r/Pentesting/comments/yvwpmw/encryption_which_i_dont_know_help_please/) [comments] (https://www.reddit.com/r/Pentesting/comments/yvwpmw/encryption_which_i_dont_know_help_please/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to Protect My Twitter Account From Hackers

https://cdn-images-1.medium.com/max/1000/1*Gi9DoGyFJcqr5j4PEKDr6g.jpeg
Twitter is a social media platform that allows users to send and receive short messages, known as tweets. Users can follow other users to…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Handling User Access

https://cdn-images-1.medium.com/max/867/1*eASvAk0pYLn6sxfbROHtnA.png
There are different type of user:

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Game Hacking Academy

https://cdn-images-1.medium.com/max/772/0*WJUwC44czakBKd_C.jpg
Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
All Legit CreditCard Banks PayPal wu cashapp zelle blank atm cc ssn id dL fullz criminal records…

HOT DEALS!!!!! WhatsApp:+1(202) 503–9187? HOT DEALS!!ICQ:740 976 941 Email: albertgonzalez0001@gmail.com CASH TEAM WELCOME TO MY WORLD…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Check Out The Full Speaker Line-Up of IWCON 2022

https://cdn-images-1.medium.com/max/2600/0*mhyXZ4Gx2R39JzeR
Book your seats for the coolest, most value-packed cybersecurity event of 2022!

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Bugcrowd Earns CREST Accreditation for Pen Testing

.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Swimlane Introduces Low-Code, Automation Approach to OT Security

Automating security for OT infrastructure can help organizations combat a rising volume of cyber threats in an era when security professionals are in short supply.

KitPloit - PenTest Tools!
Dismember - Scan Memory For Secrets And More

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg3HLOoTulgmqDZZ0fhgI2hve0yZQrOMmveSvymJf8arD4LCwmD8U9Vl562V61pVhKTd6HtSkTaR-WkDTjVlb0g1xXMV4n-4gHLWbvP8PQgo43a_qRE_aUEEl3mO-BFf7HZMZivFuU9PXCBKa-0zlbJA86Z1bVUXmgYj99TLJjux1KS4jYQBaeJK_0OEw/w640-h256/dismember.gif Dismember is a command-line toolkit for Linux that can be used to scan the memory of all processes (or particular ones) for common secrets and custom regular expressions, among other things.

It will eventually become a full /proctoolkit.

Using the grepcommand, it can match a regular expression across all memory for all (accessible) processes. This could be used to find sensitive data in memory, identify a process by something included in its memory, or to interrogate a processes' memory for interesting information.

There are many built-in patterns included via the scancommand, which effectively works as a secret scanner against the memory on your machine.

Dismember can be used to search memory of all processes it has access to, so running it as root is the most effective method.

Commands are also included to list processes, explore process status and related information, draw process trees, and more... Main CommandsCommand Description grepSearch process memory for a given string or regex scanSearch process memory for a set of predefined secret patterns Utility CommandsCommand Description filesShow a list of files being accessed by a process findFind a PID given a process name. If multiple processes match, the first one is returned. infoShow information about a process kernelShow information about the kernel killKill a process (or processes) using SIGKILL listList all processes currently available on the system resumeResume a suspended process using SIGCONT suspendSuspend a process using SIGSTOP (use 'dismember resume' to leave suspension) treeShow a tree diagram of a process and all children (defaults to PID 1). InstallationGrab a binary from the latest release and add it to your path. Usage ExamplesSearch for a pattern in a process by PID# search memory owned by process 1234
dismember grep -p 1234 'the password is .*'Search for a pattern in a process by name# search memory owned by processes named "nginx" for a login form submission
dismember grep -n nginx 'username=liamg&password=.*'Search for a pattern across all processes# find a github api token across all processes
dismember grep 'gh[pousr]_[0-9a-zA-Z]{36}'Search for secrets in memory across all processes# search all accessible memory for common secrets
dismember scanFAQIsn't this information all just sitting in /proc?

Pretty much. Dismember just reads and presents it for the most part. If you can get away with grep whatever /proc/[pid]/blahthen go for it! I built this as an educational experience because I couldn't sleep one night and stayed up late reading the procman-pages (I live an extremely rock 'n' roll lifestyle). It's not a replacement for existing tools, but perhaps it can complement them.

Do you know how horrific some of these commands seem when read out of context? Yes. Download Dismember

___________________________
@hacking_Attack
@Hacking_Video

Web App pentesting/Bug Bounty Bible
https://medium.com/@saitle74/web-app-pentesting-bug-bounty-bible-986fa5a87953?source=rss------bug_bounty-5

Wassup everyone, I hope you all are doing great at your lives and I know you all might be brutally cussing me right now for not uploading…Continue reading on Medium » (https://medium.com/@saitle74/web-app-pentesting-bug-bounty-bible-986fa5a87953?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Web App pentesting/Bug Bounty Bible

Wassup everyone, I hope you all are doing great at your lives and I know you all might be brutally cussing me right now for not uploading…Continue reading on Medium »
Read more...

P1 Bug Bounties: What is an IDOR, and how does IDOR == $$$?

TL;DR- A brief post about what an IDOR is, and what they mean to the bug-hunting world.Continue reading on The Gray Area »
Read more...