Hacking on Medium
DawgCTF 2021 WALKTHROUGH

https://cdn-images-1.medium.com/max/956/1*vduP3vz_Lnz5q-16iOjUlQ.png
This is a new experience for me. I only focus on the forensic challenges.

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Языки программирования для хакеров

https://cdn-images-1.medium.com/max/1280/1*dpNjU7V_7Lumf8vbNDySgQ.jpeg
5 лучших языков программирования для хакинга

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to find an individual’s IP address || What is my IP Address in Public? #IPAddress

https://cdn-images-1.medium.com/max/1000/0*XIyeDl6IKn6G5zmE.jpg
How to find an individual’s IP address step by step

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hacking the campus, part II

https://cdn-images-1.medium.com/max/1776/1*EV5Zd6OjcpjppnbdOk5obw.png
By Sofia Lundmark, Emma Blomquist and Romina Rodela

Continue reading on Youth Plan »

___________________________
@hacking_Attack
@Hacking_Video

My First Bug Bounty Reward

The happiest moment for any hunter. What I did, a few strategies and resources to start withContinue reading on InfoSec Write-ups »
Read more...

How I got my first Hall of Fame in Bugcrowd

Hello everyone. My name is Anishka Shukla. I am a security researcher, penetration tester and bug bounty hunter. I am into penetration…Continue reading on Medium »
Read more...

My First Bug Bounty Reward

The happiest moment for any hunter. What I did, a few strategies and resources to start withContinue reading on InfoSec Write-ups »
Read more...

3 Traits of a Good Ethical Hacker

In this article, we are going to discuss 3 important traits of any ethical hacker, bug bounty hunter, or penetration tester.Continue reading on The Startup »
Read more...

My First Bug Bounty Reward
https://infosecwriteups.com/my-first-bug-bounty-reward-7abbdd9ab037?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

The happiest moment for any hunter. What I did, a few strategies and resources to start withContinue reading on InfoSec Write-ups » (https://infosecwriteups.com/my-first-bug-bounty-reward-7abbdd9ab037?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

How I got my first Hall of Fame in Bugcrowd
https://anishkashukla.medium.com/how-i-got-my-first-hall-of-fame-in-bugcrowd-9ba792302aa0?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello everyone. My name is Anishka Shukla. I am a security researcher, penetration tester and bug bounty hunter. I am into penetration…Continue reading on Medium » (https://anishkashukla.medium.com/how-i-got-my-first-hall-of-fame-in-bugcrowd-9ba792302aa0?source=rss------bug_bounty-5)

3 Traits of a Good Ethical Hacker
https://medium.com/swlh/3-traits-of-a-good-ethical-hacker-adf137dacfe3?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

In this article, we are going to discuss 3 important traits of any ethical hacker, bug bounty hunter, or penetration tester.Continue reading on The Startup » (https://medium.com/swlh/3-traits-of-a-good-ethical-hacker-adf137dacfe3?source=rss------bug_bounty-5)

Baserunner - A Tool For Exploring Firebase Datastores

A tool for exploring and exploiting Firebase datastores.Set up git clone https://github.com/iosiro/baserunner.git cd baserunner npm install npm run build npm start Go to http://localhost:3000 in your browser. Usage The Baserunner interface looks like this: First, use the configuration textbox to load a Firebase configuration JSON structure from the app you'd like to test. It looks like this: { "apiKey": "API_KEY", "authDomain": "PROJECT_ID.firebaseapp.com", "databaseURL": "https://PROJECT_ID.firebaseio.com", "projectId": "PROJECT_ID", "storageBucket": "PROJECT_ID.appspot.com", "messagingSenderId": "SENDER_ID", "appId": "APP_ID", "measurementId": "G-MEASUREMENT_ID", "databaseURL": "https://PROJECT_ID.firebasedatabase.app/"} Then log in as a regular user, either with email and password or with a mobile phone number. When logging in with a mobile phone number, complete the CAPTCHA before submitting your number. You then be prompted for an OTP from your SMS. Enter this without completing the CAPTCHA to finish logging in. Note that you can skip this step to test queries without authentication. Finally, you can use the query interface to submit queries to the application's Cloud Firestore. Baserunner provides a number of template queries for common actions. Click on one of them to load it in the textbox, and replace the values that look ==LIKE THIS== with valid names of collections, IDs, fields, etc. As there is no way of getting a list of available collection using the Firebase JavaScript SDK, you will need to guess these, or source their names from the application's front-end JavaScript. FAQ How do I tell if an app is using Cloud Firestore or Realtime Database? Applications using Realtime Database will have a databaseURL key in their configuration objects. Applications without this key can be assumed to use Cloud Firestore. Note that it is possible for Firebase applications to use both datastores, so when in doubt, run both types of queries. I'm getting blocked by CORS! To function as intended, Baserunner expects applications to accept requests from localhost, which is enabled by default. Therefore, Baserunner cannot be used as a hosted application. Should requests from localhost be disallowed by the application you're testing, a version of Baserunner with a reduced featureset can still be run by opening dist/index.html in your browser. Note that this way of running Baserunner only supports email + password login and not phone login. How do I know what collections to query for? Cloud Firestore: For security reasons, Firebase's client-side JavaScript API does not provide a mechanism for listing collections. You will need to deduce these from looking at the target application's JavaScript code and making educated guesses. Realtime Database: As this datastore is represented as a JSON object, you can use the provided "Realtime Database Read datastore" query to attempt to view the entire thing. Note that this may fail depending on the rules configured. Can I see the results of previous queries? While only the latest query result is displayed on the Baserunner page, all results are logged to the browser console. When running Realtime Database queries, I get an error that says the client is offline. Try rerunning the query. Download Baserunner
Read more...

___________________________
@hacking_Attack
@Hacking_Video