hacking: security in practice
We Will Stop Mario! #stopmario

https://external-preview.redd.it/2wOsHbIkPz_ai3gsDglWu8b1DEC2hhob763D8o08xE0.jpg?width=108&crop=smart&auto=webp&s=384f7f5b7a033bd8aa5e334589c58c5f1dd59de0 submitted by /u/fluf201playz
[link] [comments]

hacking: security in practice
Getting stalker's IP address

Hi everyone I'm new on all of this but I'm requesting your help because my GF has been stalked by a person of her past. Let me explain myself, in the past she sent nudes to the people who had interests but now one of those subjects has been sharing her pictures on telegram groups and the people who are on that group are sending messages to her, but they don't speak. She opened a legal investigation but they can't do anything (I'm from Mexico, because of that) until she have the subject's name and she don't know who is that person. So, the plan is wait until someones send her a message, get the IP address of that person and threaten and thus he gives her the number of the person who is sharing her photos and information, the number and the telegram group.

So, that's why I want to know how can I get someone's IP direction.I hope that you can help me with that.

submitted by /u/Erchamiont
[link] [comments]

Hacking on Medium
Stabilizing a shell (Getting a fully functional TTY)

https://cdn-images-1.medium.com/max/664/0*xVMIvrX2_FeIIHsc
As a pentester, we often deal with reverse or bind shells on the target system but the default nc (netcat) shells are very unstable…

Continue reading on Medium »

Hacking on Medium
Remote File Inclusion(RFI) to RCE

Remote File Inclusion (RFI) is a type of web application vulnerability that allows attackers to remotely execute code on a vulnerable web…

Continue reading on Medium »

Hacking on Medium
Want to Lead? Time to Read

https://cdn-images-1.medium.com/max/640/1*GOVUI0LABERIEmeRcK6BYw.jpeg
Why are readers good leaders?

Continue reading on Medium »

Hacking on Medium
MetaTwo(HTB)

https://cdn-images-1.medium.com/max/881/1*KSYG-HEoS9K_EMt_RAAtDg.png
Target IP: 10.10.11.186

Continue reading on Medium »

Hacking on Medium
Guide on Searchsploit

https://cdn-images-1.medium.com/max/1200/1*qeFFQz-qVsqNwEyKLh90gw.png
Hey guys Ashish this side. In this write-up, I’m going to share some basic info about the Searchsploit tool, So let’s hop into it.

Continue reading on Medium »

Hacking on Medium
ow to get your first CVE

If you are a software developer or security researcher, you may be interested in registering your first CVE (Common Vulnerabilities and…

Continue reading on Medium »

Hacking on Medium
The Death of Online Privacy: How Governments Around the World are Monitoring People on the Internet

https://cdn-images-1.medium.com/max/2600/0*kcH6KajEs6V4UDps
The Rise of Online Surveillance and the Erosion of Freedom in the Digital Age

Continue reading on System Weakness »

SSTI (Server-side template injection) to RCE
https://aditya-chauhan17.medium.com/ssti-server-side-template-injection-to-rce-3f0a325a074e?source=rss------bug_bounty-5

Server-side template injection (SSTI) is a vulnerability that arises when untrusted user input is included in a server-side template.Continue reading on Medium » (https://aditya-chauhan17.medium.com/ssti-server-side-template-injection-to-rce-3f0a325a074e?source=rss------bug_bounty-5)

Web-Hacking-Playground - Web Application With Vulnerabilities Found In Real Cases, Both In Pentests And In Bug Bounty Programs
http://www.kitploit.com/2023/02/web-hacking-playground-web-application.html

Web Hacking Playground is a controlled web hacking environment. It consists of vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) found in real cases, both in pentests and in Bug Bounty programs. The objective is that users can practice with them, and learn to detect and exploit them. Other topics of interest will also be addressed, such as: bypassing filters by creating custom payloads, executing chained attacks exploiting various vulnerabilities, developing proof-of-concept scripts, among others.
Important The application source code is visible. However, the lab's approach is a black box one. Therefore, the code should not be reviewed to resolve the challenges. Additionally, it should be noted that fuzzing (both parameters and directories) and brute force attacks (https://www.kitploit.com/search/label/Brute%20Force%20Attacks) do not provide any advantage in this lab. Setup It is recommended to use Kali Linux (https://www.kali.org/get-kali/) to perform this lab. In case of using a virtual machine, it is advisable to use the VMware Workstation Player (https://www.vmware.com/products/workstation-player/workstation-player-evaluation.html) hypervisor. The environment is based on Docker and Docker Compose, so it is necessary to have both installed. To install Docker on Kali Linux, run the following commands: sudo apt update -y
sudo apt install -y docker.io
sudo systemctl enable docker --now
sudo usermod -aG docker $USER
To install Docker on other Debian-based distributions, run the following commands: curl -fsSL https://get.docker.com -o get-docker.sh
sudo sh get-docker.sh
sudo systemctl enable docker --now
sudo usermod -aG docker $USER
It is recommended to log out and log in again so that the user is recognized as belonging to the docker group. To install Docker Compose, run the following command: sudo apt install -y docker-compose
Note: In case of using M1 it is recommended to execute the following command before building the images: export DOCKER_DEFAULT_PLATFORM=linux/amd64
The next step is to clone the repository and build the Docker images: git clone https://github.com/takito1812/web-hacking-playground.git
cd web-hacking-playground
docker-compose build
Also, it is recommended to install the Foxy Proxy (https://addons.mozilla.org/en-US/firefox/addon/foxyproxy-standard/) browser extension, which allows you to easily change proxy settings, and Burp Suite (https://portswigger.net/burp/communitydownload), which we will use to intercept HTTP requests. We will create a new profile in Foxy Proxy to use Burp Suite as a proxy. To do this, we go to the Foxy Proxy options, and add a proxy with the following configuration: Proxy Type: HTTP Proxy IP address: 127.0.0.1 Port: 8080 Deployment Once everything you need is installed, you can deploy the environment with the following command: git clone https://github.com/takito1812/web-hacking-playground.git
cd web-hacking-playground
docker-compose up -d
This will create two containers of applications developed in Flask on port 80: The vulnerable web application (Socially): Simulates a social network. The exploit server: You should not try to hack it, since it does not have any vulnerabilities. Its objective is to simulate a victim's access to a malicious link. Important It is necessary to add the IP of the containers to the /etc/hosts file, so that they can be accessed by name and that the exploit server can communicate with the vulnerable web application. To do this, run the following commands: sudo sed -i '/whp-/d' /etc/hosts
echo "$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' whp-socially) whp-socially" | sudo tee -a /etc/hosts
echo "$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' whp-exploitserver) whp-exploitserver" | sudo tee -a /etc/hosts