Hacking on Medium
Information Gathering, is it Important?

Information Gathering, this word is familiar to warriors in cyber security. True? Because there is a saying that “Information is Power”.

Continue reading on Medium »

Dark Reading: Attacks/Breaches
NIST Finally Retires SHA-1, Kind Of

SHA-1 was deprecated in 2011. NIST has set the hashing algorithm's final retirement date to Dec. 31, 2030.

Black Hat Ethical Hacking
Hackers leak personal info allegedly stolen from 5.7M Gemini users

Hackers leak personal info allegedly stolen from 5.7M Gemini usersPost Views: 21 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes Multiple posts on hacker forums offered to sell a database allegedly from Gemini containing phone numbers and email addresses of 5.7 million users.Gemini crypto exchange announced this week that customers were targeted in phishing campaigns after a threat actor collected their personal information from a third-party vendor.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Funds and account data secureThe Gemini product security team published a short notice that an unnamed third-party vendor suffered an “incident” that allowed an unauthorized actor to collect email addresses and incomplete phone numbers belonging to some Gemini customers.

As a result of the breach, customers of the crypto exchange received phishing emails. The goal of the attacker has not been disclosed but such access to accounts and financial information is typically what threat actors are after.

In its short report, Gemini underlines that account information and its systems have not been impacted and that funds and customer accounts “remain secure.”
Trending: Exploit XSS Injections in a one-line powerful Technique Trending: Offensive Security Tool: Pycrypt Hackers advertise Gemini databaseThe notification comes after multiple posts on a hacker forum offered to sell a database allegedly from Gemini containing phone numbers and email addresses of 5.7 million users.

An early attempt to monetize the database was in September. The author did not mention how fresh the info was but asked for 30 bitcoins (about $520,000 at the current exchange rate).
https://www.bleepstatic.com/images/news/u/1100723/2022/GeminiDB_30BTC.png
<figcaptionPost on hacker forum asking for 30 bitcoins for Gemini database with 5.7 million emails
source: KELA
In October, another post was published from a different alias claiming that the data was from September.

Yet another post under a different username (now banned on the forum) appeared in mid-November, offering databases from multiple crypto exchanges, including one from Gemini that supposedly had the same type of information for 5.7 million users.

It appears that none of the attempts to monetize the database worked as yet another announcement appeared on a different forum offering the information for free.

The author of the post shared the format of the phone numbers, specifying that the three digits in the middle are missing.
https://www.bleepstatic.com/images/news/u/1100723/2022/GeminiDB_leak.jpg
<figcaptionPost allegedly leaking Gemini database with 5.7 million emails and partial phone numbers
source: BleepingComputer
Gemini advises its customers to rely on strong authentication methods and recommends activating two-factor authentication (2FA) protection and/or the use of hardware security keys to access their accounts.

The company also provides the steps necessary for changing the email address associated with the Gemini account. ​Trending: Kali Linux 2022.4 – New Release adds 6 new tools, Kali NetHunter Update, Azure Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: bleepingcomputer.com Source Link[...]

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-posts-2-300x150.png Microsoft patches Windows zero-day used to drop ransomwareDecember 15, 2022
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-posts-1-300x150.png Apple security update fixes new iOS zero-day used to hack iPhonesDecember 14, 2022
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-posts-300x150.png New Python malware backdoors VMware ESXi servers for remote accessDecember 13, 2022
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/1-300x150.png JSON syntax hack allowed SQL injection payloads to be smuggled past WAFsDecember 12, 2022
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Hackers leak personal info allegedly stolen from 5.7M Gemini users first appeared on Black Hat Ethical Hacking.

hacking: security in practice
Phone number

Anyone have a free way to look up a number and see who it is? I’m being harassed and I’m trying to figure out by who

submitted by /u/KastBoogie
[link] [comments]

hacking: security in practice
How do I break through the password page?

https://external-preview.redd.it/IHIlxM6BC4ApTSvGz022I0--tRiFz95Fdzh4pNbXin4.jpg?width=640&crop=smart&auto=webp&s=05024df16e646327d9a70eb17a51938985d07bd5 I was part of this event but I did not get a password

submitted by /u/DaSovietBoi
[link] [comments]

Deep Web
This is a community for fellow Community Members to interact and share:

* Awareness of Scam, phishing, shady websites on the clear net.

* Discuss Experiences both good and bad with clear net websites.

* Discuss clear net trending topics and news.

https://www.reddit.com/r/clearnet/comments/zlcyii/rclearnet_has_been_created/

submitted by /u/phaevor
[link] [comments]

AzureHound - Azure Data Exporter For BloodHound
http://www.kitploit.com/2022/12/azurehound-azure-data-exporter-for.html

The BloodHound (https://www.kitploit.com/search/label/BloodHound) data collector for Microsoft (https://www.kitploit.com/search/label/Microsoft) Azure Get AzureHound Release Binaries Download the appropriate binary (https://www.kitploit.com/search/label/Binary) for your platform from one of our Releases (https://github.com/BloodHoundAD/AzureHound/releases). Rolling Release The rolling release contains pre-built binaries that are automatically kept up-to-date (https://www.kitploit.com/search/label/Up-to-date) with the main branch and can be downloaded from here (https://github.com/BloodHoundAD/AzureHound/releases/tag/rolling). Warning: The rolling release may be unstable. Compiling Prerequisites Go 1.18 (https://go.dev/dl/) or later To build this project from source run the following: go build -ldflags="-s -w -X github.com/bloodhoundad/azurehound/constants.Version=`git describe tags --exact-match 2> /dev/null || git rev-parse HEAD`" Usage Quickstart Print all Azure (https://www.kitploit.com/search/label/Azure) Tenant data to stdout ❯ azurehound list -u "$USERNAME" -p "$PASSWORD" -t "$TENANT" Print all Azure Tenant data to file ❯ azurehound list -u "$USERNAME" -p "$PASSWORD" -t "$TENANT" -o "mytenant.json" Configure and start data collection service for BloodHound Enterprise ❯ azurehound configure
(follow prompts)

❯ azurehound start CLI ❯ azurehound --help
AzureHound vx.x.x
Created by the BloodHound Enterprise team - https://bloodhoundenterprise.io

The official tool for collecting Azure data for BloodHound and BloodHound Enterprise

Usage:
azurehound [command]

Available Commands:
completion Generate the autocompletion script for the specified shell
configure Configure AzureHound
help Help about any command
list Lists Azure Objects
start Start Azure data collection service for BloodHound Enterprise

Flags:
-c, --config string AzureHound configuration file (default: /Users/dlees/.config/azurehound/config.json)
-h, --help help for azurehound
--json Output logs as json
-j, --jwt string Use an acquired JWT to authenticate into Azure
--log- file string Output logs to this file
--proxy string Sets the proxy URL for the AzureHound service
-r, --refresh-token string Use an acquired refresh token to authenticate into Azure
-v, --verbosity int AzureHound verbosity level (defaults to 0) [Min: -1, Max: 2]
--version version for azurehound

Use "azurehound [command] --help" for more information about a command.


Download AzureHound (https://github.com/BloodHoundAD/AzureHound)

Hacking on Medium
XRAY GUI Starter Web Vulnerability Scanner

https://cdn-images-1.medium.com/max/1263/1*5iPTRtfGhJ5NpEsXnWr-SA.png
xray is an excellent web vulnerability scanning tool, But only the command line version, Start via config.yaml file. In many cases, it is…

Continue reading on Medium »

Hacking on Medium
Serangan Brute Force: Cara kerja, Metode Serangan, dan Tutorial Brute Force menggunakan Tools…

https://cdn-images-1.medium.com/max/2600/0*YIb5wdbm71VVsVTy
Brute Force Attack yaitu merupakan metode yang dilakukan oleh peretas dalam upaya memasuki akses akun korban secara paksa dengan mencoba…

Continue reading on Medium »

Dark Reading: Attacks/Breaches
Live From London: Next-Gen Cybersecurity Takes Stage at Black Hat Europe

Check out our slideshow detailing the emerging cybersecurity trends in cloud, creating a defensible Internet, malware evolution, and more that lit up audiences in London.