A Hands-On Field Guide to latest techniques used by security researchers and bug bounty huntersContinue reading on Medium » (https://medium.com/@reconshell.com/web-application-advanced-hacking-702e5eec88a?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Web Application Advanced Hacking

A Hands-On Field Guide to latest techniques used by security researchers and bug bounty huntersContinue reading on Medium »
Read more...

hacking: security in practice
Can TCP be used for DDoS amplification attacks or is it only UDP?

I'm searching online and it seems to only mention DDoS but not much about specifically amplification attacks.

submitted by /u/gtrman571
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How do you get started into hacking?

No i do not intend to use hacking for malicious purposes, i want to learn the art of breaking apart things and finding the flaw into them.
The reason I want to get into this is because at one time I managed to login to a faulty website just by copy pasting the userid which was stored in the cookie as the url parameter, and once I got in the site the exhilaration I felt was tremendous, it's what i'd imaging doing drugs would feel like
I'd love to get to the basics of hacking and break things and find flaws in them
any advice would be very much appreciated

submitted by /u/KoalaHot795
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
NFC attacks with smart watch possible?

I have a Galaxy Watch 4 and its running Wear OS. It has wifi, bluetooth and nfc. Is it possible for an app to weaponize these things (mainly nfc)?

submitted by /u/LinuxHeki
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Simple way to hack a database

https://cdn-images-1.medium.com/max/600/0*lJ4DXCQE_wvleeeY.jpg
Intro

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Web Application Advanced Hacking

https://cdn-images-1.medium.com/max/616/1*2XB6sHskZkuDvrtZ59K52g.jpeg
A Hands-On Field Guide to latest techniques used by security researchers and bug bounty hunters

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Web3世界，谁来为我的钱包安全负责？

https://cdn-images-1.medium.com/max/1078/0*dlAmBT1oUHw7PAmN
Blockchain 行业从诞生到现在，安全话题几乎围绕着每个人。虽然越来越多的人进入了这个领域，但安全问题并没有因此而减少，随着应用场景的增多越来越多的安全事件随之出现。安全可以说是区块链行业需要从底层解决的一个巨大问题，没有安全保障海量的互联网用户就不可能进入 Web3…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Bug Bounty Tips and Getting Persistence With Electron Applications

By repacking asar files, electron applications, and other bug bounty tips. Starring Signal, Discord, Nordpass, and moreContinue reading on InfoSec Write-ups »
Read more...

Black Hat Ethical Hacking
Attackers bypass Coinbase and MetaMask 2FA via TeamViewer, fake support chat

Attackers bypass Coinbase and MetaMask 2FA via TeamViewer, fake support chatPost Views: 2 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes A crypto-stealing phishing campaign is underway to bypass multi-factor authentication and gain access to accounts on Coinbase, MetaMask, Crypto.com, and KuCoin and steal cryptocurrency.​

The threat actors abuse the Microsoft Azure Web Apps service to host a network of phishing sites and lure victims to them via phishing messages impersonating bogus transaction confirmation requests or suspicious activity detection.

For example, one of the phishing emails seen in the attacks pretended to be from Coinbase, which says they locked the account due to suspicious activity.
https://www.bleepstatic.com/images/news/u/1220909/Phishing/phishing-email(4).png
<figcaptionPhishing email impersonating Coinbase
Source: PIXM
When the targets visit the phishing site, they are presented with a chat window supposedly for ‘customer support,’ controlled by a scammer who directs visitors through a multi-step defrauding process.

PIXM has been tracking this campaign since 2021 when the threat group targeted only Coinbase. Recently, PIXM’s analysts noticed an expansion in the campaign’s targeting scope to include MetaMask, Crypto.com, and KuCoin.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Bypassing 2FAThe first phase of the attack in the fake crypto exchange phishing sites involves a bogus login form followed by a two-factor authentication prompt.

Regardless of the credentials entered during this stage, they will still be stolen by the threat actors. The page then proceeds to a prompt asking for the 2FA code needed to access the account.
https://www.bleepstatic.com/images/news/u/1220909/Website%20snaps/2fa-page.png
<figcaption2FA step of the phishing site
Source: PIXM
The attackers try out the entered credentials on the legitimate website, triggering the sending of a 2FA code to the victim, who then enters a valid 2FA on the phishing site.

The threat actors then attempt to use the entered 2FA code to log in to the victim’s account as long as they act before the timer runs out.

It should be noted that the MetaMask phishing attacks are targeting recovery phrases, rather than credentials or 2FA codes. Chatting with scammersRegardless of whether a 2FA code works, the researchers say that the scammers trigger the next attack stage, which is to launch on-screen chat support.

This is done by displaying a fake error message stating the account has been suspended due to suspicious activity and asking the visitor to contact support to resolve the matter.
https://www.bleepstatic.com/images/news/u/1220909/Website%20snaps/fake-error.png
<figcaptionGenerating a fake login error
Source: PIXM
In this support chat, the threat actors start a conversation with the targeted victim to keep them around in case different credentials, recovery phrases, or 2FA codes are needed for the threat actors to log in to the account.

“They will prompt the user for their username, password, and 2-Factor authentication code directly in the chat,” explains the new PIXM report.

“The criminal will then take this directly to a browser on their machine and again try to access the users account.”

For successfully breached accounts, the victim is still engaged with customer support in case they need to confirm fund transfers while the crooks empty their wallets.

However, for accounts they cannot[...]

breach through the support chat, the threat actors switch to an alternative method to authenticate their device as “trustworthy” for the cryptocurrency platform.
Trending: How to Exploit “improper error handling” in Web Applications Trending: Recon Tool: Maigret Remote trickeryTo overcome the authenticated device obstacle, the attackers convince the victim to download and install the ‘TeamViewer’ remote access app.

Next, the scammers ask the victims to log in to their cryptocurrency wallet or exchange accounts, and while they do so, the threat actors add a random character in the password field to cause a login failure.

The attacker then asks the victim to paste the password on the TeamViewer chat, uses the password (minus the random character) to login on to their device, and then snatches the device confirmation link sent to the victim to authenticate their device as trusted.
https://www.bleepstatic.com/images/news/u/1220909/Software/trusted-device.png
Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/Images-for-the-News-posts-5-1-300x150.png AXLocker – a new ransomware that encrypts yours files, and then steals your Discord accountNovember 21, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/Images-for-the-News-posts-4-1-300x150.png Google Roulette: Developer console trick can trigger XSS in Chromium browsersNovember 18, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/Images-for-the-News-posts-8-1-300x150.png Updated RapperBot malware targets game servers in DDoS attacksNovember 17, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/Images-for-the-News-posts-6-1-300x150.png Mastodon users vulnerable to password-stealing attacksNovember 16, 2022
Reading Time: 3 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Attackers bypass Coinbase and MetaMask 2FA via TeamViewer, fake support chat first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Bug Bounty Tips and Getting Persistence With Electron Applications
https://infosecwriteups.com/bug-bounty-tips-and-getting-persistence-with-electron-applications-c538d4dda446?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

By repacking asar files, electron applications, and other bug bounty tips. Starring Signal, Discord, Nordpass, and moreContinue reading on InfoSec Write-ups » (https://infosecwriteups.com/bug-bounty-tips-and-getting-persistence-with-electron-applications-c538d4dda446?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

OTP BYPASS RESPONSE MANIPULATION
https://medium.com/@milanjain7906/otp-bypass-response-manipulation-bb3bed07de5c?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video