Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
A story that related to hacking
https://cdn-images-1.medium.com/max/720/1*0UV266TAHFtQvJnNfN_QUg.jpeg
Once upon a time, there was a young man named Alex who was passionate about computer science. He was always looking for new challenges to…
Continue reading on Medium »
A story that related to hacking
https://cdn-images-1.medium.com/max/720/1*0UV266TAHFtQvJnNfN_QUg.jpeg
Once upon a time, there was a young man named Alex who was passionate about computer science. He was always looking for new challenges to…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Software developer to hacker
Hello hacking community, my question is how hard is the transition from programmer to hacker. How quickly can a programmer make the transition. What aspect of hacking can I most easily transition into(malware programming etc…)Thanks
submitted by /u/SnooRecipes9557
[link] [comments]
Software developer to hacker
Hello hacking community, my question is how hard is the transition from programmer to hacker. How quickly can a programmer make the transition. What aspect of hacking can I most easily transition into(malware programming etc…)Thanks
submitted by /u/SnooRecipes9557
[link] [comments]
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Is it entirely possible to get my account unblocked by a certain user?
Legitimately or illegitimately, any answer is welcome.
submitted by /u/Hwarrior12
[link] [comments]
Is it entirely possible to get my account unblocked by a certain user?
Legitimately or illegitimately, any answer is welcome.
submitted by /u/Hwarrior12
[link] [comments]
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
GitHub (or any website) page with good scripts for social media tools
Do you guys know any GitHub or anu other page/forum with good scripts to run and analize?
submitted by /u/NidoxX
[link] [comments]
GitHub (or any website) page with good scripts for social media tools
Do you guys know any GitHub or anu other page/forum with good scripts to run and analize?
submitted by /u/NidoxX
[link] [comments]
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
studing Theoretical course
hello everyone, I am wondering what is the best way to study a theoretical course (security+)? It is only videos and I do not have the money to buy labs, So should I just take notes?
submitted by /u/username72_
[link] [comments]
studing Theoretical course
hello everyone, I am wondering what is the best way to study a theoretical course (security+)? It is only videos and I do not have the money to buy labs, So should I just take notes?
submitted by /u/username72_
[link] [comments]
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
A friend got hacked. What's the best advice?
So here's a little back story to the hacking. A friend of mine had his email hacked about 5 years ago. They quickly got into his Facebook account and stopped his access by changing the password. They hacker was messaging people as my friend asking for money/saying he was in trouble etc etc. My friend sets up a new account, adds all his old friends spreads the word that he is in fact fine and well and lots of people report the old account, facebook do nothing about it and the old account dissappears probably deactivated because the hacker had not much success. Cut to 5 years later and the account reappears. Updates profile pics, cover photos, adds new friends and tries the same tactics as last time. In spite of lots of people reporting this page again Facebook have still decided to do nothing. The difference this time being my friend has recently been diagnosed with cancer. It's a pretty rare form, he's a young guy and as such has recieved a lot of attention through newspapers, media etc. So when the hacker is messaging people they're even more ready to help him. The hacker has been messaging me and even held a video call with me but didn't show their face obviously. I've been acting as though I know nothing about the hacking in the conversations with the hacker but it seems there's very little to be gained. So my question is what can we do? Facebook aren't supportive in spite of many reports. Is there any way to get them out of the email account and regain control?
submitted by /u/davec553
[link] [comments]
A friend got hacked. What's the best advice?
So here's a little back story to the hacking. A friend of mine had his email hacked about 5 years ago. They quickly got into his Facebook account and stopped his access by changing the password. They hacker was messaging people as my friend asking for money/saying he was in trouble etc etc. My friend sets up a new account, adds all his old friends spreads the word that he is in fact fine and well and lots of people report the old account, facebook do nothing about it and the old account dissappears probably deactivated because the hacker had not much success. Cut to 5 years later and the account reappears. Updates profile pics, cover photos, adds new friends and tries the same tactics as last time. In spite of lots of people reporting this page again Facebook have still decided to do nothing. The difference this time being my friend has recently been diagnosed with cancer. It's a pretty rare form, he's a young guy and as such has recieved a lot of attention through newspapers, media etc. So when the hacker is messaging people they're even more ready to help him. The hacker has been messaging me and even held a video call with me but didn't show their face obviously. I've been acting as though I know nothing about the hacking in the conversations with the hacker but it seems there's very little to be gained. So my question is what can we do? Facebook aren't supportive in spite of many reports. Is there any way to get them out of the email account and regain control?
submitted by /u/davec553
[link] [comments]
Stripe’s Two-Factor Authentication (2FA) Bypass
Hello Everyone,Continue reading on InfoSec Write-ups »
Read more...
Hello Everyone,Continue reading on InfoSec Write-ups »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
KitPloit - PenTest Tools!
Ator - Authentication Token Obtain and Replace Extender
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiSfXQYf0okK438HwSZLkDzfbu8q8y1qW9uctfIAqwiEyY8s1fIbJW64QDADhW2Jv1RMJY1bjEk8xkOMADc8crGh8ip-HKWlOiCzfr76XX0bXWbLyTU-8WkRrTiFHF99c1qVJRFn3FoNeUfqncbIIVOYtd70FbZRQV4Waf7jEaDkAJ1ZnsTWKeytdR9ng/w640-h404/ator.png The plugin is created to help automated scanning using Burp in the following scenarios:
1. Access/Refresh token
2. Token replacement in XML,JSON body
3. Token replacement in cookies
The above can be achieved using complex macro, session rules or Custom Extender in some scenarios. The rules become tricky and do not work in scenarios where the replacement text is either JSON, XML.
Key advantages:
1. We have also achieved in-memory token replacement to avoid duplicate login requests like in both custom extender, macros/session rules.
2. Easy UX to help obtain data (from response) and replace data (in requests) using regex. This helps achieve complex scenarios where response body is JSON, XML and the request text is also JSON, XML, form data etc.
3. Scan speed - the scan speed increases considerably because there are no extra login requests. There is something called the "Trigger Request" which is the error condition (also includes regex) when the login requests are triggered. The error condition can include (response code = 401 and body contains "Unauthorized request")
The inspiration for the plugin is from ExtendedMacro plugin: https://github.com/FrUh/ExtendedMacro Blogs1. Authentication Token Obtain and Replace (ATOR) Burp Plugin - Part1 - Single step login sequence and single token extraction
2. Authentication Token Obtain and Replace (ATOR) Burp Plugin - Part2 - Multi step login sequence and multiple extraction Getting Started1. Install Java and Maven
2. Clone the repository
3. Run the "mvn clean install" command in cloned repo of where pom.xml is present
4. Take the generated jar with dependencies from the target folder Prerequisites1. Make sure java environment is setup in your machine.
2. Confgure the Burp Suite to listen the Proxy traffic
3. Configure the java environment from extender tab of BURP
For usage with test application (Install this testing application (Tiredful application) from https://github.com/payatu/Tiredful-API) Steps1. Identify the request which provides the error
2. Identify the Error Pattern (details in section below)
3. Obtain the data from the response using regex (see sample regex values)
4. Replace this data on the request (use same regex as step 3 along with the variable name) Error Pattern:Totally there are 4 different ways you can specify the error condition.
1. Status Code: 401, 400
2. Error in Body: give any text from the body content (Example: Access token expired)
3. Error in Header: give any text from header(Example: Unauthorized)
4. Free Form: use this to give multiple condition (st=400 && bd=Access token expired || hd=Unauthorized) Regex with samples1. Use Authorization: Bearer \w* to match Authorization: Bearer AXXFFPPNSUSSUSSNSUSN
2. Use Authorization: Bearer ([\w+_-.]*) to match Authorization: Bearer AXX-F+FPPNS.USSUSSNSUSN Break down into end to end tests1. Finding the Invalid request:
* http://HOST:PORT/api/v1/exams/MQ==/ with invalid Bearer token.
2. Identifying Error Pattern:
* The above request will give you 401, here error condition is Status Code = 401
3. Match regex with request data
* Authorization: Bearer \w* - this regex will match access token which is passed.
4. Replacement - How to replace
* Replace the matched text(step 3 regex) with extracted value (Extraction configuration discussed in below, say varibale name is "token")
* Authorization: Bearer token - extracted token will be replaced. Usage with test applicationIdea : Record the Tiredful application request in BURP, [...]
Ator - Authentication Token Obtain and Replace Extender
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiSfXQYf0okK438HwSZLkDzfbu8q8y1qW9uctfIAqwiEyY8s1fIbJW64QDADhW2Jv1RMJY1bjEk8xkOMADc8crGh8ip-HKWlOiCzfr76XX0bXWbLyTU-8WkRrTiFHF99c1qVJRFn3FoNeUfqncbIIVOYtd70FbZRQV4Waf7jEaDkAJ1ZnsTWKeytdR9ng/w640-h404/ator.png The plugin is created to help automated scanning using Burp in the following scenarios:
1. Access/Refresh token
2. Token replacement in XML,JSON body
3. Token replacement in cookies
The above can be achieved using complex macro, session rules or Custom Extender in some scenarios. The rules become tricky and do not work in scenarios where the replacement text is either JSON, XML.
Key advantages:
1. We have also achieved in-memory token replacement to avoid duplicate login requests like in both custom extender, macros/session rules.
2. Easy UX to help obtain data (from response) and replace data (in requests) using regex. This helps achieve complex scenarios where response body is JSON, XML and the request text is also JSON, XML, form data etc.
3. Scan speed - the scan speed increases considerably because there are no extra login requests. There is something called the "Trigger Request" which is the error condition (also includes regex) when the login requests are triggered. The error condition can include (response code = 401 and body contains "Unauthorized request")
The inspiration for the plugin is from ExtendedMacro plugin: https://github.com/FrUh/ExtendedMacro Blogs1. Authentication Token Obtain and Replace (ATOR) Burp Plugin - Part1 - Single step login sequence and single token extraction
2. Authentication Token Obtain and Replace (ATOR) Burp Plugin - Part2 - Multi step login sequence and multiple extraction Getting Started1. Install Java and Maven
2. Clone the repository
3. Run the "mvn clean install" command in cloned repo of where pom.xml is present
4. Take the generated jar with dependencies from the target folder Prerequisites1. Make sure java environment is setup in your machine.
2. Confgure the Burp Suite to listen the Proxy traffic
3. Configure the java environment from extender tab of BURP
For usage with test application (Install this testing application (Tiredful application) from https://github.com/payatu/Tiredful-API) Steps1. Identify the request which provides the error
2. Identify the Error Pattern (details in section below)
3. Obtain the data from the response using regex (see sample regex values)
4. Replace this data on the request (use same regex as step 3 along with the variable name) Error Pattern:Totally there are 4 different ways you can specify the error condition.
1. Status Code: 401, 400
2. Error in Body: give any text from the body content (Example: Access token expired)
3. Error in Header: give any text from header(Example: Unauthorized)
4. Free Form: use this to give multiple condition (st=400 && bd=Access token expired || hd=Unauthorized) Regex with samples1. Use Authorization: Bearer \w* to match Authorization: Bearer AXXFFPPNSUSSUSSNSUSN
2. Use Authorization: Bearer ([\w+_-.]*) to match Authorization: Bearer AXX-F+FPPNS.USSUSSNSUSN Break down into end to end tests1. Finding the Invalid request:
* http://HOST:PORT/api/v1/exams/MQ==/ with invalid Bearer token.
2. Identifying Error Pattern:
* The above request will give you 401, here error condition is Status Code = 401
3. Match regex with request data
* Authorization: Bearer \w* - this regex will match access token which is passed.
4. Replacement - How to replace
* Replace the matched text(step 3 regex) with extracted value (Extraction configuration discussed in below, say varibale name is "token")
* Authorization: Bearer token - extracted token will be replaced. Usage with test applicationIdea : Record the Tiredful application request in BURP, [...]