Penetration Testing Books for Programmers Similar to "The Art of Exploitation"
https://www.reddit.com/r/Pentesting/comments/nadzzn/penetration_testing_books_for_programmers_similar/

<!-- SC_OFF -->Hey guys. Hope all is doing well. I was wondering what do you recommend a Computer Scientist/Programmer to read in order to learn more about Penetration Testing. Recently, I read the book "Hacking: The Art of Exploitation". This was a great book for me because it gave me a lot of insights about how hacking works at a low level. I started reading other books but none are able to keep my attention as much as the above book because they fail to reach the same level of depth and generally assume that the reader has close to no technical knowledge in the field of computing. Do you guys recommend any books in particular for someone who needs to understand things at a low level? Something like "Hacking: The Art of Exploitation"? <!-- SC_ON --> submitted by /u/bilouge (https://www.reddit.com/user/bilouge)
[link] (https://www.reddit.com/r/Pentesting/comments/nadzzn/penetration_testing_books_for_programmers_similar/) [comments] (https://www.reddit.com/r/Pentesting/comments/nadzzn/penetration_testing_books_for_programmers_similar/)

Furucombo Bug Bounty Program
https://medium.com/furucombo/furucombo-bug-bounty-program-60bd4e02a56e?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Program OverviewContinue reading on FURUCOMBO » (https://medium.com/furucombo/furucombo-bug-bounty-program-60bd4e02a56e?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Short story about Clubhouse user scraping and social graphs

https://1.bp.blogspot.com/-3_fybsgeY0Y/YJs1HhD0tcI/AAAAAAAAWMM/hLf9Iao26eQWXD86bRvGR-sPh12SOp3zgCNcBGAsYHQ/s16000/image001.png TL;DRDuring this RedTeam testing, Hexway team used Clubhouse as a social engineering tool to find out more about their client’s employees. UPDATE:While Hexway were preparing this article for publication, cybernews.com reported: 1.3 million scraped user records leaked online for free In this research, Hexway didn’t attack Clubhouse users and didn’t exploit any Clubhouse vulnerabilitieshttps://1.bp.blogspot.com/-EDPbVbBpKnY/YJs0SoJvl_I/AAAAAAAAWL8/WO8suOS-g8QKyq-zsmxjnCODHx26kXVJwCNcBGAsYHQ/s16000/728x90%25402x.jpg IntroHi!

RedTeam projects have become routine for many pentest companies quite a long time ago. In Hexway, we don’t do them a lot only because our main focus is our collaborative pentesting platform, Hive. But in this case, we couldn’t resist - the project seemed to be very interesting.

We won’t go into detail on the project itself but rather focus on one of its parts. So, in this ReadTeam testing, our goal was to compromise the computer of the CTO of a large financial organization, X corp. To achieve that, we needed the CTO to open a docx file with our payload. Naturally, the question was: what’s the best way to deliver that file?

Here are some obvious options: - Corporate email - LinkedIn - Facebook

Instead, we wanted to try something new. And that’s where Clubhouse comes in. Clubhouse? What?!Clubhouse is a voice-based social network. It was popular for a couple of weeks in February 2021.

At that time, Clubhouse offered us a few advantages: - Huge popularity - Users mostly sign up with their real names, photos, and links to other social media - It’s quite easy to get into a room with interesting people, who are often hard to reach through traditional channels like email, LinkedIn, etc. - Our experience tells us that people are suspicious of cold emails with attachments and don’t open them. But in the context of an informal social platform, they seem to be less alert, which is good for RedTeam.
* Here’s the plan:
* Sign up in Clubhouse
* Find our target in Clubhouse
* Wait until they participate in a room as a speaker
* Join the room
* Try to engage them in a conversation. Get them interested and move the conversation over to email
* Send them an email with the attachment and payload
* The target opens our docx
* Profit! First problemsFirst, we registered in Clubhouse. That was easy! We’re looking for our target … and find nothing. We couldn’t find them by their name or nicknames on other platforms. Unfortunately, you can’t search users by profile description or Twitter/Instagram accounts. So, they are not on Clubhouse? Maybe they have an Android? (when this article is written, 06.04.21, Clubhouse is officially available only for iOS)? This is the way!Okay, chin up. Our target could be using a fake name not to reveal themselves and participate in rooms dedicated to non-work-related topics. It’s time to find out. Let’s try to use the power of social graphs.

Here’s the new plan: - Find any X corp employee - Get their list of followers and their accounts - Get the list of users they follow and their accounts - Get the lists of users of the clubs these accounts are in - Filter all these users by “X corp” in the About profile section - Make social graphs to find our target in someone’s connections + invitation chains (down to the first Clubhouse users) + “following” connections + “follower” connections

To do all that, we have to parse Clubhouse. There’s no official API, so we used an unofficial API (thanks to stypr)!)

The library clubhouse-py is pretty easy to use, and we could set up a parser script in no time. Clubhouse [...]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Short story about Clubhouse user scraping and social graphs

___________________________
@hacking_Attack
@Hacking_Video

https://b.thumbs.redditmedia.com/Ql-JsUg8MrlOSuiCtgLcEuly4ooRhSLf34MEsi23lrA.jpg Does this look familiar? Yes, it's an ESP8266-based Wifi Deauther. I must say it works like a charm for the last 5 years. However, its range is limited to about 32 feet (10 meters), and it no longer works against WPA2 (correct me if I'm wrong). I want to know whether there is a better version of this device on the market right now that would provide longer range and support WPA2. Please advise. Thank you for your help.

​

https://preview.redd.it/b3g5pybytly61.jpg?width=1280&format=pjpg&auto=webp&s=3872ef17daac6380e484ca77342d9dd2473c4ed8

submitted by /u/HandsomeHoney
[link] [comments]

hacking: security in practice
Hackers Say Negotiations With D.C. Over Stolen Police Data At ‘Dead End,’ Threaten Public Release

https://external-preview.redd.it/vb_iYlPL3G9JsD8MK04bYmAESkH1E7tNTAjbWLf_Qv4.jpg?width=640&crop=smart&auto=webp&s=93d297a34882b55874265ac99ebaa94ccc5557ff submitted by /u/radiationkills
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
YouTube does what it wants

How can you block this video?

"How to install Zenmap ( nmap gui ) on Kali Linux"

https://www.youtube.com/watch?v=QnVYNMlp2Zo

submitted by /u/gebutcher
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Trust thieves to tell it like it is

https://cdn-images-1.medium.com/max/2600/1*DnxUL9Kw0moxw3Zpdrp9AA.jpeg
What corporations can learn from a group of professional hackers

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Advanced Persistent Threats

https://cdn-images-1.medium.com/max/600/0*2lx1xfi7zIhscPfB.jpg
Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Troll 1: Walkthrough

https://cdn-images-1.medium.com/max/800/0*kjjEbt6fvCxHrqIL.png
Description :Tr0ll was inspired by the constant trolling of the machines within the OSCP labs.
 
 The goal is simple, gain root.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Podcast privacy: why RSS sub-domains are bad

https://cdn-images-1.medium.com/max/2592/1*fDtkGP5pRtSIyLouKIxmxQ.jpeg
Some podcast hosts give podcasters a sub-domain for their RSS feed. Here’s why that’s a bad thing.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Wormable Windows Bug Opens Door to DoS, RCE

https://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Wormable Windows Bug Opens Door to DoS, RCEPost Views: 89
Reading Time: 2 Minutes
Microsoft’s May 2021 Patch Tuesday updates include fixes for four critical security vulnerabilities, including a patch for a concerning wormable vulnerability found in the Windows OS.
The good news is that none of the vulnerabilities are being actively exploited in the wild, according to Microsoft, though three are listed as publicly known. The fixes address security flaws across Microsoft Windows, .NET Core and Visual Studio, Internet Explorer (IE), Microsoft Office, SharePoint Server, Open-Source Software, Hyper-V, Skype for Business and Microsoft Lync, and Exchange Server. Besides the four critical bugs, 50 are rated “important” and one is moderate in severity. Critical Microsoft Security Patches for May 2021The critical bugs in this month’s Patch Tuesday release are:

* CVE-2021-31166: A wormable HTTP protocol-stack issue in Windows 10 and some versions of Windows Server allowing remote code-execution (RCE)
* CVE-2021-26419: A scripting-engine memory corruption vulnerability in Internet Explorer 11 and 9 allowing RCE
* CVE-2021-31194: An RCE bug in the Microsoft Windows Object Linking and Embedding (OLE) Automation
* CVE-2021-28476: An RCE vulnerability in Microsoft Windows Hyper-V CVE-2021-31166 – WormableThis most concerning critical bug for researchers is an HTTP protocol-stack issue that would allow RCE with kernel privileges or a denial-of-service (DoS) attack. The HTTP protocol stack enables Windows and applications to communicate with other devices; it can be run standalone or in conjunction with Internet Information Services (IIS).

“If exploited, this vulnerability could enable an unauthenticated attacker to send a specially crafted packet to a targeted server utilizing the HTTP protocol stack (http.sys) to process packets and ultimately, execute arbitrary code, and take control of the affected system,” Eric Feldman, cybersecurity researcher with Automox, wrote in an analysis.
See Also: Lemon Duck Cryptojacking Botnet Changes Up Tactics Worse, Microsoft noted that the bug is wormable, so that it could be used to self-replicate across the internal network and affect internal services that may not have been exposed.

“The vulnerability announced has the potential to be both directly impactful and is also exceptionally simple to exploit, leading to a remote and unauthenticated DoS (Blue Screen of Death) for affected products,” Steve Povolny, head of advanced threat research and principle engineer at McAfee, said via email. “While this vulnerability has the potential to lead to code execution in the Windows kernel, this type of weaponization is a much higher bar for exploitation. However, if RCE can be achieved, cybercriminals would likely have the capability to create a worm, leading to self-propagation of the vulnerability across networks and the internet.”

“For ransomware operators, this kind of vulnerability is a prime target for exploitation,” Kevin Breen, director of cyber-threat research at Immersive Labs, told Threatpost. “Wormable exploits should always be a high priority, especially if they are for services that are designed to be public facing. As this specific exploit would not require any form of authentication, it’s even more appealing for attackers, and any organization using HTTP.sys protocol stack should prioritize this patch.”

Dustin Childs, researcher with Trend Micro’s Zero Day Initiative (ZDI), noted in a blog, “Before you pass this aside, Windows 10 can also be configured as a web server, so it [...]

___________________________
@hacking_Attack
@Hacking_Video