The Rise of Web 3.0 Security
https://shifacyclewala.medium.com/the-rise-of-web-3-0-security-d90373b64714?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Web3 Security introductionContinue reading on Medium » (https://shifacyclewala.medium.com/the-rise-of-web-3-0-security-d90373b64714?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

The Rise of Web 3.0 Security

Web3 Security introductionContinue reading on Medium »
Read more...

Kali Linux Tutorials
Wodat : Windows Oracle Database Attack Toolkit

Wodat is a simple port of the popular Oracle Database Attack Tool (ODAT) to C# .Net Framework. Credit to https://github.com/quentinhardy/odat as lots of the functionality are ported from his code.

* Perform password based attacks e.g. username as password, username list against given password, password list against given username, username:pass combolist.
* Test if a credential/connection string is working against target
* Brute force attacks to discover valid SID/ServiceNames
* Perform discovery of valid TNS listeners against provided target file or CIDR range
* More to come, I hope!
* DisclaimerI take not responsibility for your use of the software. Development is done in my personal capacity and carry no affiliation to my work. UsageThe general command line arguments required are as follow:
wodat.exe COMMAND ARGGUMENTS
COMMAND (ALL,BRUTECRED,BRUTESID,BRUTESRV,TEST,DISC)
-server:XXX.XXX.XXX.XXX -port:1520
-sid:AS OR -srv:AS
-user:Peter -pass:Password
To test if a specific credential set works.
wodat.exe TEST -server:XXX.XXX.XXX.XXX -port:1521 -sid:XE -user:peter -pass:pan
See the outline on modules for further usage. The tool will always first check if the TNS listener that is targeted works. ModulesBRUTESIDModule performs wordlist SID guessing attack if not successful will ask for brute force attack.
wodat.exe BRUTESID -server:XXX.XXX.XXX.XXX -port:1521 https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiDKAx6TZllxV-wMaezSbhJM3pTmaYW3CbUNctXgl3cfTHJ1bGDmFx70H3zp4Wi35qeToAclB7ErXbT68apwYL6izkwYcRRf17FB9NnTxn7plTJbTDRZAxSouvBJeCzHAAAtTBaLbNjHhPA85E_tJUzXn3kKF9GTkkcLoePw-4yufGFBUPCk_x3AJ10/s918/wodat1.png BRUTESRVModule performs wordlist ServiceName guessing attack if not successful will ask for brute force attack.
wodat.exe BRUTESRV -server:XXX.XXX.XXX.XXX -port:1521 BRUTECREDModule performs wordlist password based attack. The following options exist:
A - username:password combolist with no credentials given during arguments
B - username list with password given in arguments
C - password list with username given in arguments
D - username as password with username list provided
To perform a basic attack with a given file that has username:password combos.
wodat.exe BRUTECRED -server:XXX.XXX.XXX.XXX -port:1521 -sid:XE https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhDVyIychkovFHSYvbLP_1TYC8ddAgoz7cvKrVC45SGSPf2e5Mcc3EBH3EaTPGX8ubymlHtIS-u58T3rgNOAiM15Y6qnWCiKX9xsR7FTiUMBC48lnPs7x_MI5jOJ9TVOtgYcfN-RWBr2z8HEnFfv9jAoxNP7bqJ2bw96P34cxbiXFRQxu7iaKfeY7AB/s1248/wodat2.png TESTModule tests if the given connection string can connect successfully.
wodat.exe TEST -server:XXX.XXX.XXX.XXX -port:1521 -sid:XE -user:peter -pass:pan https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgaIGqB5kVnIjElHb7rdJxuuEB5f7zv6pS1veJ9ktmmTTb2HM6M3tdOizxyulDExMydiwrpVppZezmStOaffg8xspdSY2sR6tkA1YLImikimY3yOBXXlExkoxiGxHrnnOlotNhiNpzxk5637GQa-p-Sp8Qil7PKS6JYvA8FelxP_dNXMvOs5yXbZtxE/s1311/wodat3.png DISCModule will perform discovery against provided CIDR range or file with instances. Note, only instances with valid TNS listeners will be returned. Testing a network range will be much faster as it’s processed in parallel.
wodat.exe DISC
Instances to test must be formatted as per the below example targets.txt:
192.168.10.1
192.168.10.5,1521 https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhOrlW4a2P9AspeO5RrO18-zdjQF5NA_lEiXRLM_9VN1Aa8Y8yblCux6il1eHt4QICLM_M4UanwA--y91BiJ3Wvbn119VlqFymIfYu1VkIfhL-jxjwpeIV31GQaIXVFnBBD1amA4QKb10hdUnfCmq86TMJU0oU7zOZHWDhn7cbwfkvEzJ5wUaIeZHXY/s950/wodat4.png ALLNot implemented yet. RECONNot implemented yet. Setup and RequirementsYou can grab automated release build from the GitHub Actions or build yourself using the following commands:
nuget restore wodat.sln
msbuild wodat.sln -t:rebuild -property:Co[...]

___________________________
@hacking_Attack
@Hacking_Video

nfiguration=Release
Some general notes: The Oracle.ManagedDataAccess.dlllibrary will have to be copied with the binary. I’m looking at ways of embedding it. Todo* Handle SYSDBA and SYSOPER connections
* Implement outstanding modules
* Various validation, error handling code still needs to be done
* Some minor known bugfixes
* Add options to check against built in lists for SID, ServiceNames or common credentials ChangelogVersion 0.1 – Base toolkit and functionality Version 0.2 – Several bugfixes, improved socket connection and added RECON module Click Here To Download
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Do all pen testing jobs require travel?
https://www.reddit.com/r/Pentesting/comments/z23nno/do_all_pen_testing_jobs_require_travel/

Hi. I would like to know if all pen testing jobs require traveling? Especially in NYC because that where I live at. submitted by /u/ELIDAL99 (https://www.reddit.com/user/ELIDAL99)
[link] (https://www.reddit.com/r/Pentesting/comments/z23nno/do_all_pen_testing_jobs_require_travel/) [comments] (https://www.reddit.com/r/Pentesting/comments/z23nno/do_all_pen_testing_jobs_require_travel/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
DCSnoop - DNS Cache Snooping Tool

This is now my second post about the DNS Cache Snooping tool I've been making and I have now managed to upload a skeleton of the code on the github page located at https://github.com/benjibrown/DCSnoop. For those wondering, this tools uses nslookup to send a non recursive query to a dns server to determine if a url is cached.

submitted by /u/Ok-Chipmunk4539
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Passkeys vs Hardware Token

I just watched the WWDC22 (I know, I'm a bit behind) and the talked about passkeys. I haven't really paid much mind to it until now. So essentially, passkeys are using a public-private key pair (I'm very familiar with this concept and I absolutely love cryptography) and it is as if your phone has a built-in hardware token, such as a YubiKey. Yes, I am aware that hardware tokens, like YubiKeys are primarily for MFA rather than the first (and only) factor when using passkeys.

1. Please correct me if I have any of the above wrong.
2. So are passkeys implemented via software ONLY? Or is there a TPM involved?
3. Do I have a separate public/private key pair for each different account?
4. Apple syncs my private key(s) to their server? Assuming for contingency reasons in case we lose our phone where all those private keys are saved locally. Wouldn't this also pose a vulnerability? Perhaps hackers can centrally target Apple servers for user private keys? What's the standard encryption is being used in transit?

submitted by /u/D1CCP
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Have you guys ever used bright security ?

What are your impressions about the product? My company is currently thinking about hiring this product so I really would like to know more about it and if it’s worth the money or there are better options when the subject is using a Dast

submitted by /u/xetoile
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
New Hacktoria OSINT CTF walk through -The Killer Clown

As promised. I had fun with this one and I am excited to do more. Enjoy!

Until next time!

https://github.com/s1l1c0np1r4t3/Hacktoria-CTF-WriteUps/blob/main/Easy/TheKillerClown.md

submitted by /u/s1l1c0np1r4t3
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Receive spoofed emails?

hello everyone. So basically:

I want to have a email from a custom domain from like [sea_championship@cool-domain.xyz](mailto:sea_championship@cool-domain.xyz)
and be able to RECIEVE and SEND emails. Anyone know something like this?

submitted by /u/Sea_Championship_915
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
A Pictorial Guide to Installing Kali Linux on your Android Device

https://cdn-images-1.medium.com/max/702/1*ob-71EVzFrSKEmp-XZ8O_g.jpeg
Installing Kali Linux on an Android Device is a simple process that could be completed in less than 30mins when done correctly.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The Rise of Web 3.0 Security

https://cdn-images-1.medium.com/max/760/1*VS-3l1gQO7rW-vLy5BYa4g.jpeg
Web3 Security introduction

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
El malware infostealer de Aurora es cada vez más adoptado por las bandas cibernéticas

https://cdn-images-1.medium.com/max/1709/0*jMN0ix8eW6TPtQNk
Los ciberdelincuentes recurren cada vez más a un nuevo ladrón de información basado en Go llamado ‘Aurora’ para robar información…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Telegram +1( 202) 503 9187 Earn BiG Bucks Transfer Cashapp Zelle Paypal Bank WU Cloned cc and atm…

ALBERT’S CASH TEAM SERVICE WORLDWIDE(GET RICH NOW/SOLVE ALL PROBLEM NOW)

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video