A physical graffiti of LSASS: getting credentials from physical memory for fun and learning
https://www.reddit.com/r/redteamsec/comments/n8z0gi/a_physical_graffiti_of_lsass_getting_credentials/

submitted by /u/gid0rah (https://www.reddit.com/user/gid0rah)
[link] (https://adepts.of0x.cc/physical-graffiti-lsass/) [comments] (https://www.reddit.com/r/redteamsec/comments/n8z0gi/a_physical_graffiti_of_lsass_getting_credentials/)

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
iPhone Hack Allegedly Used to Spy on China’s Uyghurs

https://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg iPhone Hack Allegedly Used to Spy on China’s UyghursPost Views: 60
Reading Time: 1 Minute
U.S. intelligence said that the Chaos iPhone remote takeover exploit was used against the minority ethnic group before Apple could patch the problem.
In 2019, a Chinese security researcher working with the internet security and antivirus company Qihoo 360 unveiled an intricately woven exploit: One that would allegedly let a remote attacker easily jailbreak an iPhone X iOS 12.1.

The researcher, Qixun Zhao, dubbed the exploit Chaos, for good reason. As this proof-of-concept video allegedly shows, a successful exploit would allow a remote attacker to jailbreak an iPhoneX, with the targeted user none the wiser, allowing the intruder to gain access to a victim’s data, processing power and more. It worked as a drive-by malware download, only requiring that the iPhone user visit a web page containing Qixun’s malicious code.

It would have made a superb spying tool, seeing how it would let an attacker easily take control of even the newest, most up-to-date iPhones, enabling a snooper to read a victim’s messages and passwords and to track their location in near-real time.
See Also: Critical Cisco SD-WAN, HyperFlex Bugs Threaten Corporate Networks According to a report published by MIT Technology Review on Thursday, that’s exactly what happened: “Virtually overnight,” Chinese intelligence allegedly used the exploit as a weapon before Apple could fix the problem.

The publication said that, according to its sources, the U.S. has amassed details of how the Chaos exploit was used to hack China’s Uyghur Muslims — a common target of espionage campaigns. The claim is bolstered by earlier reporting: In August 2019, sources told TechCrunch that malicious websites used to hack into iPhones over two years were targeting the Uyghurs. Look-Alike ExploitsGoogle security researchers had found and disclosed the malicious websites a week before TechCrunch’s report, but they hadn’t initially known who the malicious sites were targeting. However, they knew that the code looked familiar: In an in-depth examination, Google noted how similar the malicious-sites exploit was to Chaos.

Now, MIT Technology Review has learned that the U.S. had come to the same conclusion, and that it had “quietly” informed Apple. Apple, which had been tracking the attack, had already come to the same conclusion on its own: That the Chaos exploit and the attacks on Uyghurs were “one and the same,” as the outlet puts it.

Prioritizing a difficult fix, Apple issued an update to patch the flaw in January 2019.

The patch arrived two months after Chaos had been unveiled at the inaugural Tianfu Cup: A Chinese hacking contest that came into being a few months after the country banned its cybersecurity research teams from competing in the Pwn2Own hacking competition…or, for that matter, in any global hacking or capture-the-flag competitions.
See Also: Offensive Security Tool: EyeWitness Keeping Security Know-How at Home?The ban on researchers attending foreign competitions apparently grew out of a distaste for giving away vulnerabilities – via disclosure in public to conference audiences or to hacking programs in real-time. Both the ban and the subsequent launch of the Tianfu Cup had followed close on the heels of an announcement from Qixun’s boss – Zhou Hongyi, the billionaire founder and CEO of Qihoo 360 – criticizing the export of vulnerabilities that, once made public, can “no longer be used.” Both the researchers and their know-how should “stay [...]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
iPhone Hack Allegedly Used to Spy on China’s Uyghurs

___________________________
@hacking_Attack
@Hacking_Video

First Bug Bounty Ever : SQL Injection!
https://veshraj77.medium.com/first-bug-bounty-ever-sql-injection-da4e64e30851?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Continue reading on Medium » (https://veshraj77.medium.com/first-bug-bounty-ever-sql-injection-da4e64e30851?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Unauthorized access to Django Admin Dashboard by endpoint leaked on GitHub
https://notifybugme.medium.com/unauthorized-access-to-django-admin-dashboard-by-endpoint-leaked-on-github-5336969ddbbc?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hi, everyoneContinue reading on Medium » (https://notifybugme.medium.com/unauthorized-access-to-django-admin-dashboard-by-endpoint-leaked-on-github-5336969ddbbc?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Unauthorized access to Django Admin Dashboard by endpoint leaked on GitHub

Hi, everyoneContinue reading on Medium »
Read more...

hacking: security in practice
I see a future NSA Computer Systems Security Manager!

https://external-preview.redd.it/E1cGDE3MaHrT10RxVdeXIgsPCj2CR-1EzkeLpmaXNVI.jpg?width=640&crop=smart&auto=webp&s=cde989e52f781f226679480c52c8bb11a975310d submitted by /u/DutchBakerery
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Can someone potentially hack in my iPhones camera?

I was closing an app and I noticed it came up at the top that the camera was used recently although I haven’t used the camera app for a long time now, I wasn’t paying attention if the green/orange dot was on the top of the phone.

Can someone potentially watch me and listen to me while I’m on my phone or when I’m not using it?

Really shaken up after seeing this.

submitted by /u/LifeisDankiThink
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Ransom group linked to Colonial Pipeline hack is new but experienced

https://external-preview.redd.it/Sl8DxveoSG1UXaxrnZH2DuRVr9H1L2XMYrxSTbf8omc.jpg?width=640&crop=smart&auto=webp&s=e78810e55018b23e519a388450bcb042b5684daf submitted by /u/standardworks
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
I got the email and paypal username of my scammer

1 guy make me pay me in advance via paypal (In friend/familiar papypal money shipping mode not shop) and never send me the item, (is like 10 $ value so police is not worth).

How can i Revenge or reclaim my money? at this moment i just subscribe his email to spam pages, but its too slow and I lose more time than him deleting the emails.

Send Tips, and sry for my bad English, is not my primary language

submitted by /u/alexmp00
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Dependency Managers Don’t Manage Your Dependencies

https://external-preview.redd.it/ggU56Hank3x_vtiLlog5lX0GQ2m4uw_daWVkP3rwU1Q.jpg?width=640&crop=smart&auto=webp&s=137619416c1e62a2818aded5731a00e02aa9ca5c submitted by /u/AdditionPartition
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Get Peoples Logins Using Zshadow and Set Tools On Kali Linux

submitted by /u/JeannaLeavy
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
scraping issue

[removed]

submitted by /u/JeannaLeavy
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video