Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Setting up FoxyProxy with Burp Suite for Chrome
https://cdn-images-1.medium.com/max/2494/1*bZe5NmNHy62gSmLXEoGBvQ.png
I just wasted a bunch of time trying to set up FoxyProxy with Burp so I am writing this article to hopefully save you some time and…
Continue reading on Medium »
Setting up FoxyProxy with Burp Suite for Chrome
https://cdn-images-1.medium.com/max/2494/1*bZe5NmNHy62gSmLXEoGBvQ.png
I just wasted a bunch of time trying to set up FoxyProxy with Burp so I am writing this article to hopefully save you some time and…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
The Dark Side of Cybersecurity: The World of Black-Hat Hackers
https://cdn-images-1.medium.com/max/2600/0*7hd6kmpj7fp53GDz
An in-depth post on threats posed by black-hat hackers, corruption and deceit in the cybersecurity field.
Continue reading on The Gray Area »
The Dark Side of Cybersecurity: The World of Black-Hat Hackers
https://cdn-images-1.medium.com/max/2600/0*7hd6kmpj7fp53GDz
An in-depth post on threats posed by black-hat hackers, corruption and deceit in the cybersecurity field.
Continue reading on The Gray Area »
BBJ-101:Continue reading on Medium » (https://medium.com/@robinthehood257/bug-bounty-journey-40a66145e2b5?source=rss------bug_bounty-5)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Deep Web
Weird
What are some weird or dark subjects you have seen on the deep web?
submitted by /u/BxBBA
[link] [comments]
Weird
What are some weird or dark subjects you have seen on the deep web?
submitted by /u/BxBBA
[link] [comments]
ChatGPT
https://www.reddit.com/r/Pentesting/comments/zpjsb9/chatgpt/
<!-- SC_OFF -->Hey guys , what are your thoughts on chatgpt and how it tends to hide info when asked about payloads or hot topics about hacking, it may answer sometimes tho <!-- SC_ON --> submitted by /u/azersebei (https://www.reddit.com/user/azersebei)
[link] (https://www.reddit.com/r/Pentesting/comments/zpjsb9/chatgpt/) [comments] (https://www.reddit.com/r/Pentesting/comments/zpjsb9/chatgpt/)
https://www.reddit.com/r/Pentesting/comments/zpjsb9/chatgpt/
<!-- SC_OFF -->Hey guys , what are your thoughts on chatgpt and how it tends to hide info when asked about payloads or hot topics about hacking, it may answer sometimes tho <!-- SC_ON --> submitted by /u/azersebei (https://www.reddit.com/user/azersebei)
[link] (https://www.reddit.com/r/Pentesting/comments/zpjsb9/chatgpt/) [comments] (https://www.reddit.com/r/Pentesting/comments/zpjsb9/chatgpt/)
Server version Header is visible on some files.
https://www.reddit.com/r/Pentesting/comments/zpk7oo/server_version_header_is_visible_on_some_files/
https://www.reddit.com/r/Pentesting/comments/zpk7oo/server_version_header_is_visible_on_some_files/
submitted by /u/diiidaaadooo (https://www.reddit.com/user/diiidaaadooo)
[link] (https://www.reddit.com/gallery/zpk0ix) [comments] (https://www.reddit.com/r/Pentesting/comments/zpk7oo/server_version_header_is_visible_on_some_files/)
[link] (https://www.reddit.com/gallery/zpk0ix) [comments] (https://www.reddit.com/r/Pentesting/comments/zpk7oo/server_version_header_is_visible_on_some_files/)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Starter guide to dirb
dirb is not a vulnerability scanner instead it scan for content(files,folder) that may have some vulnerability.
Continue reading on Medium »
Starter guide to dirb
dirb is not a vulnerability scanner instead it scan for content(files,folder) that may have some vulnerability.
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
How to remove a hacker from my phone
How to remove a hacker from my phone: Your telephone contains a portion of your most private and delicate information. Models incorporate…
Continue reading on Medium »
How to remove a hacker from my phone
How to remove a hacker from my phone: Your telephone contains a portion of your most private and delicate information. Models incorporate…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Cyber Forensics Investigation Course in Delhi
https://cdn-images-1.medium.com/max/820/1*Xl4Jbh81EU1t-sxbvEzzIg.jpeg
Cyber Forensics Investigation Course in Delhi
Continue reading on Medium »
Cyber Forensics Investigation Course in Delhi
https://cdn-images-1.medium.com/max/820/1*Xl4Jbh81EU1t-sxbvEzzIg.jpeg
Cyber Forensics Investigation Course in Delhi
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Black Hat Ethical Hacking
Glupteba malware is back in action after Google disruption
Glupteba malware is back in action after Google disruptionPost Views: 9 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes The Glupteba malware botnet has sprung back into action, infecting devices worldwide after its operation was disrupted by Google almost a year ago.In December 2021, Google managed to cause a massive disruption to the blockchain-enabled botnet, securing the court orders to take control of the botnet’s infrastructure and filing complaints against two Russian operators.
Nozomi now reports that blockchain transactions, TLS certificate registrations, and reverse engineering Glupteba samples show a new, large-scale Glupteba campaign that started in June 2022 and is still ongoing.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Hiding in the blockchainGlupteba is a blockchain-enabled, modular malware that infects Windows devices to mine for cryptocurrency, steal user credentials and cookies, and deploy proxies on Windows systems and IoT devices.
These proxies are later sold as ‘residential proxies’ to other cybercriminals.
The malware is predominantly distributed through malvertising on pay-per-install (PPI) networks and traffic distribution systems (TDS) pushing installers disguised as free software, videos, and movies.
Glupteba utilizes the Bitcoin blockchain to evade disruption by receiving updated lists of command and control servers it should contact for commands to execute.
The botnet’s clients retrieve the C2 server address using a discover function that enumerates Bitcoin wallet servers, retrieves their transactions, and parses them to find an AES encrypted address.
https://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/discover-function.png
<figcaptionDiscover function used for retrieving C2 domains (Nozomi)
This strategy has been employed by Glupteba for several years now, offering resilience against takedowns.
That’s because blockchain transactions cannot be erased, so C2 address takedown efforts have a limited impact on the botnet.
Moreover, without a Bitcoin private key, law enforcement cannot plant payloads onto the controller address, so sudden botnet takeovers or global deactivations like the one that impacted Emotet in early 2021 are impossible.
The only downside is that the Bitcoin blockchain is public, so anyone can access it and scrutinize transactions to gather information.
Trending: A primer on OS Command Injection Attacks
Trending: Digital Forensics Tool: Email Analyzer The return of GluptebaNozomi reports that Glupteba continues to use the blockchain in the same way, today, so its analysts scanned the entire blockchain to unearth hidden C2 domains.
The effort was immense, involving the scrutiny of 1,500 Glupteba samples uploaded to VirusTotal to extract wallet addresses and attempt to decrypt transaction payload data using keys associated with the malware.
Finally, Nozomi used passive DNS records to hunt for Glupteba domains and hosts and examined the latest set of TLS certificates used by the malware to uncover more information about its infrastructure.
The Nozomi investigation identified 15 Bitcoin addresses used in four Glupteba campaigns, with the most recent one starting in June 2022, six months after Google’s disruption. This campaign is still underway.
This campaign uses more Bitcoin addresses than past operations, giving the botnet even more resilience.
https://www.bleepstatic.com/images/news/u/1220909/Diagrams/campaigns(1).png
<figcaptionBlockchain transaction diag[...]
Glupteba malware is back in action after Google disruption
Glupteba malware is back in action after Google disruptionPost Views: 9 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes The Glupteba malware botnet has sprung back into action, infecting devices worldwide after its operation was disrupted by Google almost a year ago.In December 2021, Google managed to cause a massive disruption to the blockchain-enabled botnet, securing the court orders to take control of the botnet’s infrastructure and filing complaints against two Russian operators.
Nozomi now reports that blockchain transactions, TLS certificate registrations, and reverse engineering Glupteba samples show a new, large-scale Glupteba campaign that started in June 2022 and is still ongoing.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Hiding in the blockchainGlupteba is a blockchain-enabled, modular malware that infects Windows devices to mine for cryptocurrency, steal user credentials and cookies, and deploy proxies on Windows systems and IoT devices.
These proxies are later sold as ‘residential proxies’ to other cybercriminals.
The malware is predominantly distributed through malvertising on pay-per-install (PPI) networks and traffic distribution systems (TDS) pushing installers disguised as free software, videos, and movies.
Glupteba utilizes the Bitcoin blockchain to evade disruption by receiving updated lists of command and control servers it should contact for commands to execute.
The botnet’s clients retrieve the C2 server address using a discover function that enumerates Bitcoin wallet servers, retrieves their transactions, and parses them to find an AES encrypted address.
https://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/discover-function.png
<figcaptionDiscover function used for retrieving C2 domains (Nozomi)
This strategy has been employed by Glupteba for several years now, offering resilience against takedowns.
That’s because blockchain transactions cannot be erased, so C2 address takedown efforts have a limited impact on the botnet.
Moreover, without a Bitcoin private key, law enforcement cannot plant payloads onto the controller address, so sudden botnet takeovers or global deactivations like the one that impacted Emotet in early 2021 are impossible.
The only downside is that the Bitcoin blockchain is public, so anyone can access it and scrutinize transactions to gather information.
Trending: A primer on OS Command Injection Attacks
Trending: Digital Forensics Tool: Email Analyzer The return of GluptebaNozomi reports that Glupteba continues to use the blockchain in the same way, today, so its analysts scanned the entire blockchain to unearth hidden C2 domains.
The effort was immense, involving the scrutiny of 1,500 Glupteba samples uploaded to VirusTotal to extract wallet addresses and attempt to decrypt transaction payload data using keys associated with the malware.
Finally, Nozomi used passive DNS records to hunt for Glupteba domains and hosts and examined the latest set of TLS certificates used by the malware to uncover more information about its infrastructure.
The Nozomi investigation identified 15 Bitcoin addresses used in four Glupteba campaigns, with the most recent one starting in June 2022, six months after Google’s disruption. This campaign is still underway.
This campaign uses more Bitcoin addresses than past operations, giving the botnet even more resilience.
https://www.bleepstatic.com/images/news/u/1220909/Diagrams/campaigns(1).png
<figcaptionBlockchain transaction diag[...]