hacking: security in practice
WordPress Login Flooder (DDoS) python script I used on a client to test Fastly VCL misconfig

Recently, I was pentesting a client site and discovered they had a misconfig'd Fastly VCL. As such, it allowed spoofing, which meant all access logging in BigQuery and GCP log viewer were nearly irrelevant as you couldn't trust whether or not it listed true origin IP.

To simulate the need to fix this issue, I wrote a simple Python script for spoofing with a DDoS. Unlike most "DDoS" scripts you'll find in a repo (which don't utilize zombies and therefore only sends requests from your own machine, aka just a DoS), I included mine to cycle through various proxies for obfuscation.

If the client hadn't corrected the VCL config, they were susceptible to a potential unstoppable DDoS, as they had no rate-limiting enabled nor could have discovered the true IP if it were spoofed.

Nevertheless, check the script on GitHub and feel free to submit PRs or fork and use it for your own legal purposes.

submitted by /u/n4bb
[link] [comments]

hacking: security in practice
is there anything like the Flipper Zero but for kali linux?

I've been wanting one for awhile but don't have the money so I was wondering if there's anything in kali I can set up that would do the same thing

submitted by /u/Last-Ad-1437
[link] [comments]

https://b.thumbs.redditmedia.com/2hJs3y61vt0cHyk_2QxjMwwg9u97KwfxZLZCftvgSds.jpg i'm trying to use bettercap for arp spoof attack. When i started the attack, arp spoof is working normal. But ip forwarding is not working so my internet connection is lost. How can i solve this problem? If anyone knows the solution and can help me, I'd appreciate it.

normally it should be like this

but this is what i have on my device

submitted by /u/Flashy-Remote6891
[link] [comments]

Hacking on Medium
Basic Malware RE | TryHackMe

https://cdn-images-1.medium.com/max/1366/1*2tKp3IAvcUsuSxqLb7UQAg.png
Tools Required

Continue reading on Medium »

Hacking my way into a US school and becoming an international student.

Hello beautiful people, this story is quite interesting as it triggered the importance of having necessary security configurations…Continue reading on Medium »
Read more...

7 mistakes by bug hunters as a beginner

Bug hunting refers to the process of identifying and reporting security vulnerabilities or bugs in software applications, operating…Continue reading on Medium »
Read more...

Hacking my way into a US school and becoming an international student.
https://greyhatcybersolutions.medium.com/hacking-my-way-into-a-us-school-and-becoming-an-international-student-8ee27fb167af?source=rss------bug_bounty-5

Hello beautiful people, this story is quite interesting as it triggered the importance of having necessary security configurations…Continue reading on Medium » (https://greyhatcybersolutions.medium.com/hacking-my-way-into-a-us-school-and-becoming-an-international-student-8ee27fb167af?source=rss------bug_bounty-5)

7 mistakes by bug hunters as a beginner
https://1337mickey.medium.com/7-mistakes-by-bug-hunters-as-a-beginner-7fda55c33f3a?source=rss------bug_bounty-5

Bug hunting refers to the process of identifying and reporting security vulnerabilities or bugs in software applications, operating…Continue reading on Medium » (https://1337mickey.medium.com/7-mistakes-by-bug-hunters-as-a-beginner-7fda55c33f3a?source=rss------bug_bounty-5)

hacking: security in practice
Are the chinese balloons related to their recent claims of being able to use their quantum computer to crack RSA?

https://techmonitor.ai/hardware/quantum-encryption-rsa-cryptography

China claims that they have broken the quantum security barrier and can now crack symmetric-keys. This seems to me to be the best explanation on what they were doing with a balloon that they couldn't do with a spy satellite.

submitted by /u/gabefair
[link] [comments]

hacking: security in practice
Metasploit works on Attackbox, but not on my system

I'm using their tut and free machines to try out CLI msf

Same lines worked on Attackbox, but in my terminal:

When it uses the auxiliary scanner for the exploit (smb ms17-010-eternalblue) I get a Rex: connection timeout

My guess is it's my vpn, can i tunnel to fix this?

submitted by /u/tiffanyglock
[link] [comments]

hacking: security in practice
Do you learn how to secure your software by hacking them?

I'm an CS student and wanted to create an app which communicates with my server. Now, I'm worried about when this app goes live, that due to my lake of knowledge about cybersecurity, my servers won't stay online for long.

That's why I asked my self if it makes sense for me to learn some hacking and hack my own servers to see where potential intruders can do something I don't want them to do or if it's just better to sign up for an cybersecurity class.

Thanks in advance for taking your time.

submitted by /u/Tobero-me
[link] [comments]