Hacking Articles Tips Tricks Videos Tutorials

Git Exposed — Um breve overview da vulnerabilidade.
https://gabrieldkgh.medium.com/git-exposed-um-breve-overview-da-vulnerabilidade-585214a17915?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Medium

Git Exposed — Um breve overview da vulnerabilidade.

No momento que atacamos uma aplicação em um pentest black box, bug bounty ou em CTF’s, nós não conseguimos ler o código-fonte do back-end…

7 viewsedited 17:33

Hacking Articles Tips Tricks Videos Tutorials

7 views17:33

Hacking Articles Tips Tricks Videos Tutorials

No momento que atacamos uma aplicação em um pentest black box, bug bounty ou em CTF’s, nós não conseguimos ler o código-fonte do back-end…Continue reading on Medium » (https://gabrieldkgh.medium.com/git-exposed-um-breve-overview-da-vulnerabilidade-585214a17915?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Medium

Git Exposed — Um breve overview da vulnerabilidade.

No momento que atacamos uma aplicação em um pentest black box, bug bounty ou em CTF’s, nós não conseguimos ler o código-fonte do back-end…

10 viewsedited 17:33

Hacking Articles Tips Tricks Videos Tutorials

Kali Linux Tutorials
Stegowiper : A Powerful And Flexible Tool To Apply Active Attacks For Disrupting Stegomalware

Over the last 10 years, many threat groups have employed stegomalware or other steganography-based techniques to attack organizations from all sectors and in all regions of the world. Some examples are: APT15/Vixen Panda, APT23/Tropic Trooper, APT29/Cozy Bear, APT32/OceanLotus, APT34/OilRig, APT37/ScarCruft, APT38/Lazarus Group, Duqu Group, Turla, Vawtrack, Powload, Lokibot, Ursnif, IceID, etc.

Our research (see APTs/) shows that most groups are employing very simple techniques (at least from an academic perspective) and known tools to circumvent perimeter defenses, although more advanced groups are also using steganography to hide C&C communication and data exfiltration. We argue that this lack of sophistication is not due to the lack of knowledge in steganography (some APTs, like Turla, have already experimented with advanced algorithms), but simply because organizations are not able to defend themselves, even against the simplest steganography techniques.

For this reason, we have created stegoWiper, a tool to blindly disrupt any image-based stegomalware, by attacking the weakest point of all steganography algorithms: their robustness. We have checked that it is capable of disrupting all steganography techniques and tools (Invoke-PSImage, F5, Steghide, openstego, …) employed nowadays, as well as the most advanced algorithms available in the academic literature, based on matrix encryption, wet-papers, etc. (e.g. Hill, J-Uniward, Hugo). In fact, the more sophisticated a steganography technique is, the more disruption stegoWiper produces.

Moreover, our active attack allows us to disrupt any steganography payload from all the images exchanged by an organization by means of a web proxy ICAP (Internet Content Adaptation Protocol) service (see c-icap/), in real time and without having to identify whether the images contain hidden data first. Usage & ParametersstegoWiper v0.1 - Cleans stego information from image files
(png, jpg, gif, bmp, svg)

Usage: ${myself} [-hvc <comment] Options:
-h Show this message and exit
-v Verbose mode
-c <commentAdd <commentto output image file Examples – Breaking steganographystegowiper.sh -c "stegoWiped" ursnif.png ursnif_clean.png
The examples/ directory includes several base images that have been employed to hide secret information using different steganography algorithms, as well as the result of cleanign them with stegoWiper. How it works?stegoWiper removes all metadata comments from the input file, and also adds some imperceptible noise to the image (it doesn’t matter if it really includes a hidden payload or not). If the image does contain a steganographic payload, this random noise alters it, so if you try to extract it, it will either fail or be corrupted, so steganomalware fails to execute.

We have tested several kinds (Uniform, Poisson, Laplacian, Impulsive, Multiplicative) and levels of noise, and the best one in terms of payload disruption and reducing the impact on the input image is the Gaussian one (see tests/ for a summary of our experiments). It is also worth noting that, since the noise is random and distributed all over the image, attackers cannot know how to avoid it. This is important because other authors have proposed deterministic alterations (such as clearing the least significant bit of all pixels), so the attackers can easily bypass them (e.g. just by using the second least significaby bit). Author & licenseThis project has been developed by Dr. Alfonso Muñoz and Dr. Manuel Urueña The code is released under the GNU General Public License v3. Click Here To Download

Kali Linux Tutorials

Stegowiper : A Powerful And Flexible Tool To Apply Active Attacks

Over the last 10 years, many threat groups have employed stegomalware or other steganography-based techniques to attack organizations

11 views17:42

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Old password protected .rar files - Forgotten password - Alternative to Brute Force using unprotected files?

Hi all! I've been sorting through some of my old files and I found three .rar files that are password protected. I am not 100% sure of the contents, though I believe they may contain some old files I'd like to recover.

I believe that I have a few of the files that may be saved in the files also saved elsewhere. Is there a way that I can use these non-protected files to possibly find a way to get into the protected .rar files?

I've been running multiple instances of a brute force program one of the files, but it's getting into longer and more complicated passwords and I'd like to speed the process if possible.

Thanks!

submitted by /u/Private0Malley
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

From the hacking community on Reddit

Explore this post and more from the hacking community

10 viewsedited 19:07

Hacking Articles Tips Tricks Videos Tutorials

8 views19:07

Hacking Articles Tips Tricks Videos Tutorials

Photo

hacking: security in practice
How the FBI Stumbled in the War on Cybercrime

https://external-preview.redd.it/JE3hh67D56kr5uTQ6zojj2ln1lt0FY4bCwupuEPjO8w.jpg?width=640&crop=smart&auto=webp&s=31d564ed4d1c527d4a073590e5d7134bd78f722c submitted by /u/DrinkMoreCodeMore
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

How the FBI Stumbled in the War on Cybercrime

Posted in r/hacking by u/DrinkMoreCodeMore • 2 points and 0 comments

8 viewsedited 19:07

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Specify rkhunter directory?

I boot a live persistent USB of Kali in a windows machine. I wanna check the windows file system for rootkits etc., NOT the live Linux system. I mount the windows partition with

mount /dev/sda2 /mnt/tmpdr

Where /dev/sda2 is the windows partition. Is there anyway to ask rkhunter to search that location? If not, how would one go about diagnosing a system using a live USB running Linux?

submitted by /u/MasterLin87
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Specify rkhunter directory?

I boot a live persistent USB of Kali in a windows machine. I wanna check the windows file system for rootkits etc., NOT the live Linux system. I...

9 viewsedited 19:08

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Looking to find them

I have had several Brute Force on a account(no success), how can I find out where its coming from so I can get them back?

submitted by /u/Nearby-Cause323
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Looking to find them

I have had several Brute Force on a account(no success), how can I find out where its coming from so I can get them back?

7 viewsedited 19:08

Hacking Articles Tips Tricks Videos Tutorials

6 views19:10

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
10 Linux Commands Every Cybersecurity Students Want to Know.

https://cdn-images-1.medium.com/max/600/0*T_YCl2p3PAJaRZkq.gif
Hello guys 👋, this is our first blog for cybersecurity . As u know Being an IT professional it is always good to know the basic Linux…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Medium

10 Linux Commands Every Cybersecurity Students Want to Know.

Hello guys 👋, this is our first blog for cybersecurity . As u know Being an IT professional it is always good to know the basic Linux…

5 viewsedited 19:10