hacking: security in practice
Want a Duplicate HID Prox II Card

I recently lost my apartment key which was a HID Prox II. I could probably clone my roommates card instead of paying the $80 for a new card. I was able to get the code on the back of his card.

What should I buy/do to make a clone?

submitted by /u/Domenick45Mann
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How difficult would it be to remotely turn on someone's camera without turning on the light indicator?

Using the average laptop running Windows, how difficult, if possible at all, would it be to turn on the camera without turning on the camera indicator light? Is the LED camera indicator's circuit run in parallel, meaning you could separately turn the indicator light on and off?

submitted by /u/TheHunter920
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to create a Facebook account that would last upto a

Many of us have tried to create accounts on Facebook and became frustrated because of bans,report and also delete/removal of Various…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Asia’s tech news, weekly: November 15th snapshot

https://cdn-images-1.medium.com/max/1440/1*RGge3eJQt5BJWD6PJTIN-w.jpeg
Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Web Application Advanced Hacking
https://medium.com/@reconshell.com/web-application-advanced-hacking-702e5eec88a?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

A Hands-On Field Guide to latest techniques used by security researchers and bug bounty huntersContinue reading on Medium » (https://medium.com/@reconshell.com/web-application-advanced-hacking-702e5eec88a?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Web Application Advanced Hacking

A Hands-On Field Guide to latest techniques used by security researchers and bug bounty huntersContinue reading on Medium »
Read more...

hacking: security in practice
Can TCP be used for DDoS amplification attacks or is it only UDP?

I'm searching online and it seems to only mention DDoS but not much about specifically amplification attacks.

submitted by /u/gtrman571
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How do you get started into hacking?

No i do not intend to use hacking for malicious purposes, i want to learn the art of breaking apart things and finding the flaw into them.
The reason I want to get into this is because at one time I managed to login to a faulty website just by copy pasting the userid which was stored in the cookie as the url parameter, and once I got in the site the exhilaration I felt was tremendous, it's what i'd imaging doing drugs would feel like
I'd love to get to the basics of hacking and break things and find flaws in them
any advice would be very much appreciated

submitted by /u/KoalaHot795
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
NFC attacks with smart watch possible?

I have a Galaxy Watch 4 and its running Wear OS. It has wifi, bluetooth and nfc. Is it possible for an app to weaponize these things (mainly nfc)?

submitted by /u/LinuxHeki
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Simple way to hack a database

https://cdn-images-1.medium.com/max/600/0*lJ4DXCQE_wvleeeY.jpg
Intro

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Web Application Advanced Hacking

https://cdn-images-1.medium.com/max/616/1*2XB6sHskZkuDvrtZ59K52g.jpeg
A Hands-On Field Guide to latest techniques used by security researchers and bug bounty hunters

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Web3世界，谁来为我的钱包安全负责？

https://cdn-images-1.medium.com/max/1078/0*dlAmBT1oUHw7PAmN
Blockchain 行业从诞生到现在，安全话题几乎围绕着每个人。虽然越来越多的人进入了这个领域，但安全问题并没有因此而减少，随着应用场景的增多越来越多的安全事件随之出现。安全可以说是区块链行业需要从底层解决的一个巨大问题，没有安全保障海量的互联网用户就不可能进入 Web3…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Bug Bounty Tips and Getting Persistence With Electron Applications

By repacking asar files, electron applications, and other bug bounty tips. Starring Signal, Discord, Nordpass, and moreContinue reading on InfoSec Write-ups »
Read more...

Black Hat Ethical Hacking
Attackers bypass Coinbase and MetaMask 2FA via TeamViewer, fake support chat

Attackers bypass Coinbase and MetaMask 2FA via TeamViewer, fake support chatPost Views: 2 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes A crypto-stealing phishing campaign is underway to bypass multi-factor authentication and gain access to accounts on Coinbase, MetaMask, Crypto.com, and KuCoin and steal cryptocurrency.​

The threat actors abuse the Microsoft Azure Web Apps service to host a network of phishing sites and lure victims to them via phishing messages impersonating bogus transaction confirmation requests or suspicious activity detection.

For example, one of the phishing emails seen in the attacks pretended to be from Coinbase, which says they locked the account due to suspicious activity.
https://www.bleepstatic.com/images/news/u/1220909/Phishing/phishing-email(4).png
<figcaptionPhishing email impersonating Coinbase
Source: PIXM
When the targets visit the phishing site, they are presented with a chat window supposedly for ‘customer support,’ controlled by a scammer who directs visitors through a multi-step defrauding process.

PIXM has been tracking this campaign since 2021 when the threat group targeted only Coinbase. Recently, PIXM’s analysts noticed an expansion in the campaign’s targeting scope to include MetaMask, Crypto.com, and KuCoin.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Bypassing 2FAThe first phase of the attack in the fake crypto exchange phishing sites involves a bogus login form followed by a two-factor authentication prompt.

Regardless of the credentials entered during this stage, they will still be stolen by the threat actors. The page then proceeds to a prompt asking for the 2FA code needed to access the account.
https://www.bleepstatic.com/images/news/u/1220909/Website%20snaps/2fa-page.png
<figcaption2FA step of the phishing site
Source: PIXM
The attackers try out the entered credentials on the legitimate website, triggering the sending of a 2FA code to the victim, who then enters a valid 2FA on the phishing site.

The threat actors then attempt to use the entered 2FA code to log in to the victim’s account as long as they act before the timer runs out.

It should be noted that the MetaMask phishing attacks are targeting recovery phrases, rather than credentials or 2FA codes. Chatting with scammersRegardless of whether a 2FA code works, the researchers say that the scammers trigger the next attack stage, which is to launch on-screen chat support.

This is done by displaying a fake error message stating the account has been suspended due to suspicious activity and asking the visitor to contact support to resolve the matter.
https://www.bleepstatic.com/images/news/u/1220909/Website%20snaps/fake-error.png
<figcaptionGenerating a fake login error
Source: PIXM
In this support chat, the threat actors start a conversation with the targeted victim to keep them around in case different credentials, recovery phrases, or 2FA codes are needed for the threat actors to log in to the account.

“They will prompt the user for their username, password, and 2-Factor authentication code directly in the chat,” explains the new PIXM report.

“The criminal will then take this directly to a browser on their machine and again try to access the users account.”

For successfully breached accounts, the victim is still engaged with customer support in case they need to confirm fund transfers while the crooks empty their wallets.

However, for accounts they cannot[...]