Deep Web
Could you theorectically have a dark web in your LAN?

Could you theoretically speaking host a dark web(tor network) in a LAN? I don't actually want to do this, i am just curious.

So lets say you have 10 computers in a LAN without any internet connection. 8 of the computers are set up as tor nodes. 1 computer is hosting a tor hidden service and the last computer has the tor browser. Could this work out of the box? Or is there some kind of DHT that tor would have to contact and thus prevent this from working? Could i host my own DHT and then setup an 11th computer to act as such and then setup all the other computers to use this DHT?

Please use technical terms so that i can research what i don't know or understand. I have been using linux for about 8 years now. I am mentioning this so that you know i understand networking and so on, and that you don't have to "Dumb it down" for me. I want to understand how this all works on a deeper level that just what you get at face value.

submitted by /u/el3ctro0yte
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
GitHub Prepares to Move Beyond Passwords

https://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg GitHub Prepares to Move Beyond PasswordsPost Views: 66
Reading Time: 1 Minute
GitHub adds support for FIDO2 security keys for Git over SSH to fend off account hijacking and further its plan to stick a fork in the security bane of passwords.
GitHub, the ubiquitous host for software development and version control (and unfortunate target of a steady pitter-patter of attacks targeting the same), is now supporting security keys when using Git over SSH.

In a post on Monday, GitHub security engineer Kevin Jones said that this is the next step when it comes to increasing security and usability. These portable FIDO2 fobs are used for SSH authentication to secure Git operations and to forestall the misery that unfurls when private keys accidentally get lost or pilfered, or when malware tries to initiate requests without user approval. Just one example: In 2019, the TrickBot info-stealing malware got a makeover that enabled its password grabber to target data from OpenSSH applications.

These security keys, which include YubiKey, Thetis Fido U2F Security Key and Google Titan Security Keys, are easy to pop into your pocket and cart around between machines, with most connecting via USB, NFC or Bluetooth. They provide an alternative to the one-time passwords provided by applications or sent via SMS. As it is, SMS SSH codes sent via text can be and have been intercepted.
See Also: Wormable Windows Bug Opens Door to DoS, RCE
In contrast, as Jones pointed out, much of the data on a security key is protected from external access and modification, meaning that the key keeps its secrets tucked away and out of reach. While the devices store a private key on your computer, those on-computer keys are simply a reference to the physical security key: in other words, they’re useless to anybody who doesn’t have the actual device in hand.

Given that the keys are one of the factors in multi-factor authentication (MFA), users should safeguard the devices just like they would any other credential. If you’re the only one who can get at your security key, you can, in fact, leave it plugged in. “When using SSH with a security key, none of the sensitive information ever leaves the physical security key device,” Jones added. “If you’re the only person with physical access to your security key, it’s safe to leave plugged in at all times.”

Neither malware nor accidental private-key exposure can give away your credentials when you use a security key, he said: “As long as you retain access to the security key, you can be confident that it can’t be used by anyone else for any other purpose.” Existing Security Keys Can Still Be Used for Git“Once generated, you add these new keys to your account just like any other SSH key,” Jones said. “You’ll still create a public- and private-key pair, but secret bits are generated and stored in the security key, with the public part stored on your machine like any other SSH public key.”

A security key requires you to perform a gesture such as tapping in order to let it know you’re about to use the device to authenticate: an action that indicates “user presence,” he said, adding that users can also utilize the same security key for both web and SSH authentication, given that they’re not limited to a single application. As well, using a security key means that users don’t need to use 2FA when authenticating to Git as you would with web authentication.
See Also: Offensive Security Tool: EyeWitness Users can also check all those authentication boxes, Jones said: “As always, we recommend using a strong password, enrolling in two-facto[...]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
GitHub Prepares to Move Beyond Passwords

___________________________
@hacking_Attack
@Hacking_Video

Upgrading XSS Hunter with a basic reverse JavaScript shell
https://infosecwriteups.com/upgrading-xss-hunter-with-a-basic-reverse-javascript-shell-db00172e32f9?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Before you start reading this article, please keep in mind that this is a very basic reverse shell, and still needs a lot of work to get…Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/upgrading-xss-hunter-with-a-basic-reverse-javascript-shell-db00172e32f9?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Upgrading XSS Hunter with a basic reverse JavaScript shell

Before you start reading this article, please keep in mind that this is a very basic reverse shell, and still needs a lot of work to get…Continue reading on InfoSec Write-ups »
Read more...

Upgrading XSS Hunter with a basic reverse JavaScript shell

Before you start reading this article, please keep in mind that this is a very basic reverse shell, and still needs a lot of work to get…Continue reading on InfoSec Write-ups »
Read more...

My bug bounty journey. The mind of a middle-class boy who wanted everything for free.

Hello everyone,
Read more...

hacking: security in practice
Have I been hacked?

Recently something strange has been happening. I was on google and left my computer for a moment, and when I came back, Google searched for something I didn't search for. Later a site zoomed to 125% without me doing it. Have I been hacked or hijacked, or am I being paranoid?

submitted by /u/Mike-Compatriot
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
The Sony Hack - 2014

https://external-preview.redd.it/7y895EF0wVI0KovZNcMaDg_LWMErsrz2iYkCYQqJYig.jpg?width=640&crop=smart&auto=webp&s=6c05fd1fc59a5d93a5bb10744ddee7b3f17fa4a8 submitted by /u/admiralarjun
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
netdiscover doesn't find any client?

I'm running Kali ( just one guest OS ) on VMware configured in NAT mode. Since NAT creates a private LAN network between all guest OS, it makes sense as to why i'm not getting any clients when i run netdiscover. Then i plugged in a wireless adapter, disconnected from the LAN network and connected to my wifi, i was expecting to see all the clients connected to my wifi. To my surprise i couldn't see any clients.
i couldn't find any reasons online, why am i not able to see any clients when i run netdiscover after connecting to my wifi ?

submitted by /u/WinterFondant
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hack The Box — Jeeves: Walkthrough (without Metasploit)

https://cdn-images-1.medium.com/max/600/1*E7xdbDJkzb9BF1XB-6KK5g.png
Hack The Box — Jeeves: Walkthrough (without Metasploit) | Windows Medium Level | Road to OSCP | Jenkins RCE | Leaked Credential | dir /r

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Enumerating and Exploiting NFS

https://cdn-images-1.medium.com/max/1156/1*kfNysiVdleVaxPSE9twbmg.jpeg
NFS-Common

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Miss Diya’s Free Fire ID, K/D Ratios and Stats in may 2021

https://cdn-images-1.medium.com/max/800/1*BcpyZwpEMBBhBBkJcxvCbw.jpeg
Diya Hazarika is also known as Miss Diya is a popular Free Fire streamer and player.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Snuffleupagus - Security Module For Php7 And Php8 - Killing Bugclasses And Virtual-Patching The Rest!

Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest! Snuffleupagus is a PHP 7+ and 8+ module designed to drastically raise the cost of attacks against websites, by killing entire bug classes. It also provides a powerful virtual-patching system, allowing administrator to fix specific vulnerabilities and audit suspicious behaviours without having to touch the PHP code.Key Features No noticeable performance impact Powerful yet simple to write virtual-patching rules Killing several classes of vulnerabilities Unserialize-based code execution mail-based code execution Cookie-stealing XSS File-upload based code execution Weak PRNG XXE Several hardening features Automatic secure and samesite flag for cookies Bundled set of rules to detect post-compromissions behaviours Global strict mode and type-juggling prevention Whitelisting of stream wrappers Preventing writeable files execution Whitelist/blacklist for eval Enforcing TLS certificate validation when using curl Request dumping capability A relatively sane code base: A comprehensive test suite close to 100% coverage Every commit is tested on several distributions An clang-format-enforced code style A comprehensive documentation Usage of coverity Download We've got a download page, where you can find packages for your distribution, but you can of course just git clone this repo, or check the releases on github. Examples We're providing various example rules, that are looking like this: # Harden the `chmod` functionsp.disable_function.function("chmod").param("mode").value_r("^0-9{2}67$").drop();# Mitigate command injection in `system`sp.disable_function.function("system").param("command").value_r("$|;&\`\\n").drop(); Upon violation of a rule, you should see lines like this in your logs: snuffleupagus0.0.0.0disabled\_functiondrop The execution has been aborted in /var/www/index.php:2, because the return value (0) of the function 'strpos' matched a rule. Documentation We've got a comprehensive website with all the documentation that you could possibly wish for. You can of course build it yourself. Thanks Many thanks to the Suhosin project for being a huge source of inspiration, and to all our contributors. Download Snuffleupagus
Read more...

___________________________
@hacking_Attack
@Hacking_Video