Hacking on Medium
3 Traits of a Good Ethical Hacker

https://cdn-images-1.medium.com/max/2600/1*wM7qHRz14k95BGZk769zIw.jpeg
In this article, we are going to discuss 3 important traits of any ethical hacker, bug bounty hunter, or penetration tester.

Continue reading on The Startup »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
4 Steps To Mitigate Data Breach And Insider Threats

https://cdn-images-1.medium.com/max/2600/1*T0PVrYssrEliibVEowVPfA.jpeg
Cybersecurity plans traditionally secure the business network against outsider interference. However, because a fresh wave of information…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Finding my first XSS
https://anupam-makum.medium.com/finding-my-first-xss-25cc4819a55?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello hunters. Hope you and your family are doing well amid this pandemic. This story is about the approach I took to find a Reflected XSS…Continue reading on Medium » (https://anupam-makum.medium.com/finding-my-first-xss-25cc4819a55?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Sovryn Loan Vulnerability Postmortem
https://medium.com/immunefi/sovryn-loan-vulnerability-postmortem-ffaf4d1d688f?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

SummaryContinue reading on Immunefi » (https://medium.com/immunefi/sovryn-loan-vulnerability-postmortem-ffaf4d1d688f?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Story of my hacking Dutch Government
https://tuhin1729.medium.com/story-of-my-hacking-dutch-government-46b7a3c8b75a?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello guys! My name is Tuhin Bose (@tuhin1729). I am currently working as a Chief Technology Officer at Virtual Cyber Labs. In this…Continue reading on Medium » (https://tuhin1729.medium.com/story-of-my-hacking-dutch-government-46b7a3c8b75a?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Baserunner - A Tool For Exploring Firebase Datastores

https://1.bp.blogspot.com/-QAHBJb-xF7A/YJgTVOhNsAI/AAAAAAAAWHA/P6gLYIUftp4nfn18_8dE9SPksiStCNmtgCNcBGAsYHQ/w640-h198/baserunner_1_baserunner-logo.png A tool for exploring and exploiting Firebase datastores. Set up1. git clone https://github.com/iosiro/baserunner.git2. cd baserunner3. npm install4. npm run build5. npm start6. Go to http://localhost:3000 in your browser. UsageThe Baserunner interface looks like this: https://1.bp.blogspot.com/-fgEzCaX5em8/YJgUZMxUohI/AAAAAAAAWHQ/UGFyGt4ok_QKcbj6aice_ft9OQ3-h5vngCNcBGAsYHQ/w640-h326/baserunner_2_baserunner.png First, use the configuration textbox to load a Firebase configuration JSON structure from the app you'd like to test. It looks like this: {
"apiKey": "API_KEY",
"authDomain": "PROJECT_ID.firebaseapp.com",
"databaseURL": "https://PROJECT_ID.firebaseio.com",
"projectId": "PROJECT_ID",
"storageBucket": "PROJECT_ID.appspot.com",
"messagingSenderId": "SENDER_ID",
"appId": "APP_ID",
"measurementId": "G-MEASUREMENT_ID",
"databaseURL": "https://PROJECT_ID.firebasedatabase.app/"
}Then log in as a regular user, either with email and password or with a mobile phone number. When logging in with a mobile phone number, complete the CAPTCHA before submitting your number. You then be prompted for an OTP from your SMS. Enter this without completing the CAPTCHA to finish logging in. Note that you can skip this step to test queries without authentication.

Finally, you can use the query interface to submit queries to the application's Cloud Firestore. Baserunner provides a number of template queries for common actions. Click on one of them to load it in the textbox, and replace the values that look ==LIKE THIS==with valid names of collections, IDs, fields, etc.

As there is no way of getting a list of available collection using the Firebase JavaScript SDK, you will need to guess these, or source their names from the application's front-end JavaScript. FAQHow do I tell if an app is using Cloud Firestore or Realtime Database?

Applications using Realtime Database will have a databaseURLkey in their configuration objects. Applications without this key can be assumed to use Cloud Firestore. Note that it is possible for Firebase applications to use both datastores, so when in doubt, run both types of queries.

I'm getting blocked by CORS!

To function as intended, Baserunner expects applications to accept requests from localhost, which is enabled by default. Therefore, Baserunner cannot be used as a hosted application.

Should requests from localhost be disallowed by the application you're testing, a version of Baserunner with a reduced featureset can still be run by opening dist/index.htmlin your browser. Note that this way of running Baserunner only supports email + password login and not phone login.

How do I know what collections to query for?

Cloud Firestore: For security reasons, Firebase's client-side JavaScript API does not provide a mechanism for listing collections. You will need to deduce these from looking at the target application's JavaScript code and making educated guesses.

Realtime Database: As this datastore is represented as a JSON object, you can use the provided "[Realtime Database] Read datastore" query to attempt to view the entire thing. Note that this may fail depending on the rules configured.

Can I see the results of previous queries?

While only the latest query result is displayed on the Baserunner page, all results are logged to the browser console.

When running Realtime Database queries, I get an error that says the client is offline.

Try rerunning the query. Download Baserunner

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
Browser

What is your most recommended browser, that is really keeping your ip hidden, I want to use it for other reasons, especially not dark web.

submitted by /u/elitelwarrior
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
Are there sites where you can discover who has a number?

Someone called me and idk them. I would like to know who they are without messaging them. What can I do ? Can I code something ?

Also same problem with private numbers.

submitted by /u/VenUs_buddy809
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
Hmm..

submitted by /u/Iamjacksgoldlungs
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Critical Infrastructure Under Attack

Several recent cyber incidents targeting critical infrastructure prove that no open society is immune to attacks by cybercriminals. The recent shutdown of key US energy pipeline marks just the tip of the iceberg.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Simulating Apple "Find My" API requests to programmatically track AirTags

I've recently picked up a few AirTags, and the low-cost item tracking functionality seems hugely valuable. But a few key features (such as history, location sharing) are missing. I'd love to build a web app to make these features possible by collecting & relaying location information.

The main obstacle in this project is the API access. It would be trivial to simulate "Find My" device location requests, given that Apple's icloud.com interface does provide this information. But it seems that the only way to get AirTag location information is via the iOS or MacOS native apps.

Does anyone have experience reverse engineering these APIs (potentially via sniffing the network requests)?

submitted by /u/tsrk
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
are there any good alternatives to NMAP for Python?

Hopefully this is a good subreddit to ask this - if not please do let me know!

I'm on break and have had a lot of time lol, so I've been playing around with remote host data collection with Python but NMAP doesn't work when I'm using a VPN. :( Are there any decent alternatives for NMAP that can be used with Python?

submitted by /u/famous_raccoon2995
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video