The happiest moment for any hunter. What I did, a few strategies and resources to start withContinue reading on InfoSec Write-ups » (https://infosecwriteups.com/my-first-bug-bounty-reward-7abbdd9ab037?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

How I got my first Hall of Fame in Bugcrowd
https://anishkashukla.medium.com/how-i-got-my-first-hall-of-fame-in-bugcrowd-9ba792302aa0?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello everyone. My name is Anishka Shukla. I am a security researcher, penetration tester and bug bounty hunter. I am into penetration…Continue reading on Medium » (https://anishkashukla.medium.com/how-i-got-my-first-hall-of-fame-in-bugcrowd-9ba792302aa0?source=rss------bug_bounty-5)

3 Traits of a Good Ethical Hacker
https://medium.com/swlh/3-traits-of-a-good-ethical-hacker-adf137dacfe3?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

In this article, we are going to discuss 3 important traits of any ethical hacker, bug bounty hunter, or penetration tester.Continue reading on The Startup » (https://medium.com/swlh/3-traits-of-a-good-ethical-hacker-adf137dacfe3?source=rss------bug_bounty-5)

Baserunner - A Tool For Exploring Firebase Datastores

A tool for exploring and exploiting Firebase datastores.Set up git clone https://github.com/iosiro/baserunner.git cd baserunner npm install npm run build npm start Go to http://localhost:3000 in your browser. Usage The Baserunner interface looks like this: First, use the configuration textbox to load a Firebase configuration JSON structure from the app you'd like to test. It looks like this: { "apiKey": "API_KEY", "authDomain": "PROJECT_ID.firebaseapp.com", "databaseURL": "https://PROJECT_ID.firebaseio.com", "projectId": "PROJECT_ID", "storageBucket": "PROJECT_ID.appspot.com", "messagingSenderId": "SENDER_ID", "appId": "APP_ID", "measurementId": "G-MEASUREMENT_ID", "databaseURL": "https://PROJECT_ID.firebasedatabase.app/"} Then log in as a regular user, either with email and password or with a mobile phone number. When logging in with a mobile phone number, complete the CAPTCHA before submitting your number. You then be prompted for an OTP from your SMS. Enter this without completing the CAPTCHA to finish logging in. Note that you can skip this step to test queries without authentication. Finally, you can use the query interface to submit queries to the application's Cloud Firestore. Baserunner provides a number of template queries for common actions. Click on one of them to load it in the textbox, and replace the values that look ==LIKE THIS== with valid names of collections, IDs, fields, etc. As there is no way of getting a list of available collection using the Firebase JavaScript SDK, you will need to guess these, or source their names from the application's front-end JavaScript. FAQ How do I tell if an app is using Cloud Firestore or Realtime Database? Applications using Realtime Database will have a databaseURL key in their configuration objects. Applications without this key can be assumed to use Cloud Firestore. Note that it is possible for Firebase applications to use both datastores, so when in doubt, run both types of queries. I'm getting blocked by CORS! To function as intended, Baserunner expects applications to accept requests from localhost, which is enabled by default. Therefore, Baserunner cannot be used as a hosted application. Should requests from localhost be disallowed by the application you're testing, a version of Baserunner with a reduced featureset can still be run by opening dist/index.html in your browser. Note that this way of running Baserunner only supports email + password login and not phone login. How do I know what collections to query for? Cloud Firestore: For security reasons, Firebase's client-side JavaScript API does not provide a mechanism for listing collections. You will need to deduce these from looking at the target application's JavaScript code and making educated guesses. Realtime Database: As this datastore is represented as a JSON object, you can use the provided "Realtime Database Read datastore" query to attempt to view the entire thing. Note that this may fail depending on the rules configured. Can I see the results of previous queries? While only the latest query result is displayed on the Baserunner page, all results are logged to the browser console. When running Realtime Database queries, I get an error that says the client is offline. Try rerunning the query. Download Baserunner
Read more...

___________________________
@hacking_Attack
@Hacking_Video

Baserunner - A Tool For Exploring Firebase Datastores
http://www.kitploit.com/2021/05/baserunner-tool-for-exploring-firebase.html

___________________________
@hacking_Attack
@Hacking_Video

A tool for exploring and exploiting (https://www.kitploit.com/search/label/Exploiting) Firebase (https://www.kitploit.com/search/label/Firebase) datastores.
Set up
git clone https://github.com/iosiro/baserunner.git cd baserunner npm install npm run build npm start Go to http://localhost:3000 (http://localhost:3000/) in your browser.
Usage
The Baserunner interface looks like this:

___________________________
@hacking_Attack
@Hacking_Video

First, use the configuration textbox to load a Firebase configuration JSON structure from the app you'd like to test. It looks like this: {
"apiKey": "API_KEY",
"authDomain": "PROJECT_ID.firebaseapp.com",
"databaseURL": "https://PROJECT_ID.firebaseio.com",
"projectId": "PROJECT_ID",
"storageBucket": "PROJECT_ID.appspot.com",
"messagingSenderId": "SENDER_ID",
"appId": "APP_ID",
"measurementId": "G-MEASUREMENT_ID",
"databaseURL": "https://PROJECT_ID.firebasedatabase.app/"
} Then log in as a regular user, either with email (https://www.kitploit.com/search/label/Email) and password or with a mobile phone number. When logging (https://www.kitploit.com/search/label/Logging) in with a mobile phone number, complete the CAPTCHA before submitting your number. You then be prompted for an OTP from your SMS. Enter this without completing the CAPTCHA to finish logging in. Note that you can skip this step to test queries without authentication. Finally, you can use the query interface to submit queries to the application's Cloud (https://www.kitploit.com/search/label/Cloud) Firestore. Baserunner provides a number of template queries for common actions. Click on one of them to load it in the textbox, and replace the values that look ==LIKE THIS== with valid names of collections, IDs, fields, etc. As there is no way of getting a list of available collection using the Firebase JavaScript SDK, you will need to guess these, or source their names from the application's front-end JavaScript.
FAQ
How do I tell if an app is using Cloud Firestore or Realtime Database? Applications using Realtime Database will have a databaseURL key in their configuration objects. Applications without this key can be assumed to use Cloud Firestore. Note that it is possible for Firebase applications to use both datastores, so when in doubt, run both types of queries. I'm getting blocked by CORS! To function as intended, Baserunner expects applications to accept requests from localhost, which is enabled by default. Therefore, Baserunner cannot be used as a hosted application. Should requests from localhost be disallowed by the application you're testing, a version of Baserunner with a reduced featureset can still be run by opening dist/index.html in your browser. Note that this way of running Baserunner only supports email + password login and not phone login. How do I know what collections to query for? Cloud Firestore: For security reasons, Firebase's client-side JavaScript API does not provide a mechanism for listing collections. You will need to deduce these from looking at the target application's JavaScript code and making educated guesses. Realtime Database: As this datastore is represented as a JSON object, you can use the provided "[Realtime Database] Read datastore" query to attempt to view the entire thing. Note that this may fail depending on the rules configured. Can I see the results of previous queries? While only the latest query result is displayed on the Baserunner page, all results are logged to the browser console. When running Realtime Database queries, I get an error that says the client is offline. Try rerunning the query.

Download Baserunner (https://github.com/iosiro/baserunner)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Apple AirTag jailbroken already – hacked in rickroll attack

https://external-preview.redd.it/iMobgb6qZlk5NkMnqxUHyiCUZV78iqFHC_yuGburI0c.jpg?width=640&crop=smart&auto=webp&s=0bae6c7b350df0755e15edc439deb1996e20a75d submitted by /u/tyw7
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
PwnLnX : An Advanced Multi-Threaded, Multi-Client Python Reverse Shell For Hacking Linux Systems

PwnLnX is an advanced multi-threaded, multi-client python reverse shell for hacking Linux systems. There’s still more work to do so feel free to help out with the development. Disclaimer: This reverse shell should only be used in the lawful, remote administration of authorized systems. Accessing a computer network without authorization or permission is illegal. Getting Started Please follow these […]

The post PwnLnX : An Advanced Multi-Threaded, Multi-Client Python Reverse Shell For Hacking Linux Systems appeared first on Kali Linux Tutorials.

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
MeterPwrShell : Automated Tool That Generate The Perfect Powershell Payload

MeterPwrShell is a automated Tool That Generate A Powershell Oneliner That Can Create Meterpreter Shell On Metasploit, Bypass AMSI, Bypass Firewall, Bypass UAC and Bypass Any AVs. This tool is powered by Metasploit-Framework and amsi.fail Notes NEVER UPLOAD THE PAYLOAD THAT GENERATED BY THIS PROGRAM TO ANY ONLINE SCANNER. NEVER USE THIS PROGRAM FOR MALICIOUS PURPOSE. SPREADING THE […]

The post MeterPwrShell : Automated Tool That Generate The Perfect Powershell Payload appeared first on Kali Linux Tutorials.

___________________________
@hacking_Attack
@Hacking_Video