hacking: security in practice
Despot’s Game [MOD,HACK] [UNLOCKED FULL VERSION]

https://external-preview.redd.it/T9xZIrodPG1lUXpWlzNPvNgxbZknZoHs_EM1MwUkaa4.jpg?width=640&crop=smart&auto=webp&s=d3c64a55ee8d85785a6c13789844cd86e7f714f9 submitted by /u/According-Bag2207
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TGA Weekly Newsletter [11/23/22]

https://cdn-images-1.medium.com/max/781/1*J9j5Q-jsU9HATIhqH9T4_g.jpeg
Hello! This is The Gray Area’s newsletter for 11/16/22 → 11/23/22, with the most popular posts of this week!

Continue reading on The Gray Area »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How To Spot An Email Scam Quickly

https://cdn-images-1.medium.com/max/800/1*J-qgmlcubX-9ymloIE83rg.jpeg
And what to do if you’ve responded to one

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
THE ANATOMY OF KERBEROS AUTHENTICATION (AD BASICS 0x1)

https://cdn-images-1.medium.com/max/960/0*Ez_CYfU-6HpaG2k5.jpg
Hi! My name is Hashar Mujahid and today we will see how Kerberos authentication works.

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

What does this REALLY mean?
https://www.reddit.com/r/redteamsec/comments/z2o6el/what_does_this_really_mean/

When a candidate has had senior level positions but the recruiter or hiring manager says "We are looking for someone more senior". It comes off like a catch-all for something else they were looking for. What does that really mean? Did the candidate miss "buzzwords"? What does that REALLY mean when the experience literally mirrors the job description and all questions were answered well during the interview (because the interviewer literally said 'you answered all the questions and gave us what we were looking for'). submitted by /u/XulaSLP07 (https://www.reddit.com/user/XulaSLP07)
[link] (https://www.reddit.com/r/redteamsec/comments/z2o6el/what_does_this_really_mean/) [comments] (https://www.reddit.com/r/redteamsec/comments/z2o6el/what_does_this_really_mean/)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Where Are We Heading With Data Privacy Regulations?

New laws have made the current US privacy landscape increasingly complex.

Top 10 Security Tools for Bug Bounty Hunters

Bug bounty hunting is a career that is known for the heavy use of security tools. These tools help hunters to find weaknesses and…Continue reading on Medium »
Read more...

Exploit Collector
Backdoor.Win32.Serman.a MVID-2022-0659 Unauthenticated Open Proxy

___________________________
@hacking_Attack
@Hacking_Video

Top 10 Security Tools for Bug Bounty Hunters
https://medium.com/@mindhackdiva/top-10-security-tools-for-bug-bounty-hunters-946dafc34d2d?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Bug bounty hunting is a career that is known for the heavy use of security tools. These tools help hunters to find weaknesses and…Continue reading on Medium » (https://medium.com/@mindhackdiva/top-10-security-tools-for-bug-bounty-hunters-946dafc34d2d?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Git Exposed — Um breve overview da vulnerabilidade.
https://gabrieldkgh.medium.com/git-exposed-um-breve-overview-da-vulnerabilidade-585214a17915?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

No momento que atacamos uma aplicação em um pentest black box, bug bounty ou em CTF’s, nós não conseguimos ler o código-fonte do back-end…Continue reading on Medium » (https://gabrieldkgh.medium.com/git-exposed-um-breve-overview-da-vulnerabilidade-585214a17915?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Stegowiper : A Powerful And Flexible Tool To Apply Active Attacks For Disrupting Stegomalware

Over the last 10 years, many threat groups have employed stegomalware or other steganography-based techniques to attack organizations from all sectors and in all regions of the world. Some examples are: APT15/Vixen Panda, APT23/Tropic Trooper, APT29/Cozy Bear, APT32/OceanLotus, APT34/OilRig, APT37/ScarCruft, APT38/Lazarus Group, Duqu Group, Turla, Vawtrack, Powload, Lokibot, Ursnif, IceID, etc.

Our research (see APTs/) shows that most groups are employing very simple techniques (at least from an academic perspective) and known tools to circumvent perimeter defenses, although more advanced groups are also using steganography to hide C&C communication and data exfiltration. We argue that this lack of sophistication is not due to the lack of knowledge in steganography (some APTs, like Turla, have already experimented with advanced algorithms), but simply because organizations are not able to defend themselves, even against the simplest steganography techniques.

For this reason, we have created stegoWiper, a tool to blindly disrupt any image-based stegomalware, by attacking the weakest point of all steganography algorithms: their robustness. We have checked that it is capable of disrupting all steganography techniques and tools (Invoke-PSImage, F5, Steghide, openstego, …) employed nowadays, as well as the most advanced algorithms available in the academic literature, based on matrix encryption, wet-papers, etc. (e.g. Hill, J-Uniward, Hugo). In fact, the more sophisticated a steganography technique is, the more disruption stegoWiper produces.

Moreover, our active attack allows us to disrupt any steganography payload from all the images exchanged by an organization by means of a web proxy ICAP (Internet Content Adaptation Protocol) service (see c-icap/), in real time and without having to identify whether the images contain hidden data first. Usage & ParametersstegoWiper v0.1 - Cleans stego information from image files
(png, jpg, gif, bmp, svg)

Usage: ${myself} [-hvc <comment] Options:
-h Show this message and exit
-v Verbose mode
-c <commentAdd <commentto output image file Examples – Breaking steganographystegowiper.sh -c "stegoWiped" ursnif.png ursnif_clean.png
The examples/ directory includes several base images that have been employed to hide secret information using different steganography algorithms, as well as the result of cleanign them with stegoWiper. How it works?stegoWiper removes all metadata comments from the input file, and also adds some imperceptible noise to the image (it doesn’t matter if it really includes a hidden payload or not). If the image does contain a steganographic payload, this random noise alters it, so if you try to extract it, it will either fail or be corrupted, so steganomalware fails to execute.

We have tested several kinds (Uniform, Poisson, Laplacian, Impulsive, Multiplicative) and levels of noise, and the best one in terms of payload disruption and reducing the impact on the input image is the Gaussian one (see tests/ for a summary of our experiments). It is also worth noting that, since the noise is random and distributed all over the image, attackers cannot know how to avoid it. This is important because other authors have proposed deterministic alterations (such as clearing the least significant bit of all pixels), so the attackers can easily bypass them (e.g. just by using the second least significaby bit). Author & licenseThis project has been developed by Dr. Alfonso Muñoz and Dr. Manuel Urueña The code is released under the GNU General Public License v3. Click Here To Download

hacking: security in practice
Old password protected .rar files - Forgotten password - Alternative to Brute Force using unprotected files?

Hi all! I've been sorting through some of my old files and I found three .rar files that are password protected. I am not 100% sure of the contents, though I believe they may contain some old files I'd like to recover.

I believe that I have a few of the files that may be saved in the files also saved elsewhere. Is there a way that I can use these non-protected files to possibly find a way to get into the protected .rar files?

I've been running multiple instances of a brute force program one of the files, but it's getting into longer and more complicated passwords and I'd like to speed the process if possible.

Thanks!

submitted by /u/Private0Malley
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video