By repacking asar files, electron applications, and other bug bounty tips. Starring Signal, Discord, Nordpass, and moreContinue reading on InfoSec Write-ups » (https://infosecwriteups.com/bug-bounty-tips-and-getting-persistence-with-electron-applications-c538d4dda446?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

OTP BYPASS RESPONSE MANIPULATION
https://medium.com/@milanjain7906/otp-bypass-response-manipulation-bb3bed07de5c?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hii, all! Scriptkiddie is back with a new hacking story. So a few days ago, I was hunting on one of the website where I am able to bypass…Continue reading on Medium » (https://medium.com/@milanjain7906/otp-bypass-response-manipulation-bb3bed07de5c?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

OTP BYPASS WithOUT RESPONSE MANIPULATION

Hii, all! Scriptkiddie is back with a new hacking story. So a few days ago, I was hunting on one of the website where I am able to bypass…Continue reading on Medium »
Read more...

hacking: security in practice
GlacierCTF

Hey everyone!

We are the CTF-Team of the technical University of Graz (Austria). We are hosting our first CTF this weekend and would love for everyone cybersecurity interested to join.

There will be 1500€ in prizes for the best teams! Everyone is welcome, there will be beginner and advanced challenges in categories like PWN, Crypto, Web or Misc.

See you on Friday :)

https://ctf.glacierctf.com/

submitted by /u/king_yumanji
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
SSRF via DNS Rebinding (CVE-2022–4096)

https://cdn-images-1.medium.com/max/1000/0*zsc_3dnU9kq9sY99.png
Hello everyone myself Basavaraj , Today in this writeup I will explain about my 2nd CVE i.e CVE-2022–4096

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The Dark Side of Permits (EIP2612)

https://cdn-images-1.medium.com/max/964/1*_RLKRHgqGQixgOS47Ryyvw.png
Last week Uniswap introduced Permit2 that is a game-changer and the new chapter for all future dapps.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
OTP BYPASS WithOUT RESPONSE MANIPULATION

https://cdn-images-1.medium.com/max/1000/1*oaDyMAFriILcMIgUHIatqA.png
Hii, all! Scriptkiddie is back with a new hacking story. So a few days ago, I was hunting on one of the website where I am able to bypass…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Stegowiper - A Powerful And Flexible Tool To Apply Active Attacks For Disrupting Stegomalware
http://www.kitploit.com/2022/11/stegowiper-powerful-and-flexible-tool.html

___________________________
@hacking_Attack
@Hacking_Video

Over the last 10 years, many threat groups have employed stegomalware or other steganography-based techniques (https://www.kitploit.com/search/label/Techniques) to attack organizations from all sectors and in all regions of the world. Some examples are: APT15/Vixen Panda, APT23/Tropic Trooper, APT29/Cozy Bear, APT32/OceanLotus, APT34/OilRig, APT37/ScarCruft, APT38/Lazarus Group, Duqu Group, Turla, Vawtrack, Powload, Lokibot, Ursnif, IceID, etc.
Our research (see APTs/ (https://github.com/mindcrypt/stegowiper/blob/main/APTs)) shows that most groups are employing very simple techniques (at least from an academic perspective) and known tools to circumvent perimeter defenses, although more advanced groups are also using steganography (https://www.kitploit.com/search/label/Steganography) to hide C&C communication and data exfiltration. We argue that this lack of sophistication is not due to the lack of knowledge in steganography (some APTs, like Turla, have already experimented with advanced algorithms), but simply because organizations are not able to defend themselves, even against the simplest steganography techniques.For this reason, we have created stegoWiper, a tool to blindly disrupt any image-based stegomalware, by attacking the weakest point of all steganography algorithms: their robustness. We have checked that it is capable of disrupting all steganography techniques and tools (Invoke-PSImage, F5, Steghide, openstego, ...) employed nowadays, as well as the most advanced algorithms available in the academic literature, based on matrix encryption, wet-papers, etc. (e.g. Hill, J-Uniward, Hugo). In fact, the more sophisticated a steganography technique is, the more disruption stegoWiper produces.Moreover, our active attack allows us to disrupt any steganography payload from all the images exchanged by an organization by means of a web proxy ICAP (Internet Content Adaptation Protocol) service (see c-icap/ (https://github.com/mindcrypt/stegowiper/blob/main/c-icap)), in real time (https://www.kitploit.com/search/label/Real%20Time) and without having to identify whether the images contain hidden data first.Usage & ParametersstegoWiper v0.1 - Cleans stego information from image files
(png, jpg, gif, bmp, svg)

Usage: ${myself} [-hvc ]

Options:
-h Show this message and exit
-v Verbose mode
-c Add to output image file
Examples - Breaking steganographystegowiper.sh -c "stegoWiped" ursnif.png ursnif_clean.png
The examples/ (https://github.com/mindcrypt/stegowiper/blob/main/examples) directory (https://www.kitploit.com/search/label/Directory) includes several base images that have been employed to hide secret information using different steganography algorithms, as well as the result of cleanign them with stegoWiper.How it works?stegoWiper removes all metadata comments from the input file, and also adds some imperceptible noise to the image (it doesn't matter if it really includes a hidden payload or not). If the image does contain a steganographic payload, this random noise alters it, so if you try to extract it, it will either fail or be corrupted, so steganomalware fails to execute.We have tested several kinds (Uniform, Poisson, Laplacian, Impulsive, Multiplicative) and levels of noise, and the best one in terms of payload disruption and reducing the impact on the input image is the Gaussian one (see tests/ (https://github.com/mindcrypt/stegowiper/blob/main/tests) for a summary of our experiments). It is also worth noting that, since the noise is random and distributed (https://www.kitploit.com/search/label/Distributed) all over the image, attackers cannot know how to avoid it. This is important because other authors have proposed deterministic alterations (such as clearing the least significant bit of all pixels), so the attackers can easily bypass them (e.g. just by using the second least significaby bit).Author & licenseThis project has been developed by Dr. Alfonso

___________________________
@hacking_Attack
@Hacking_Video

Muñoz and Dr. Manuel Urueña The code is released under the GNU General Public License v3.

Download Stegowiper (https://github.com/mindcrypt/stegowiper)

___________________________
@hacking_Attack
@Hacking_Video

SSRF via DNS Rebinding (CVE-2022–4096)

Hello everyone myself Basavaraj , Today in this writeup I will explain about my 2nd CVE i.e CVE-2022–4096Continue reading on Medium »
Read more...

SSRF via DNS Rebinding (CVE-2022–4096)
https://basu-banakar.medium.com/ssrf-via-dns-rebinding-cve-2022-4096-b7bf75928bb2?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello everyone myself Basavaraj , Today in this writeup I will explain about my 2nd CVE i.e CVE-2022–4096Continue reading on Medium » (https://basu-banakar.medium.com/ssrf-via-dns-rebinding-cve-2022-4096-b7bf75928bb2?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video