Dark Reading: Attacks/Breaches
.NET Devs Targeted With Malicious NuGet Packages

In a possible first for the NuGet repository, more than a dozen components in the .NET code repository run a malicious script upon installation, with no warning or alert.

Dark Reading: Attacks/Breaches
Renowned Researcher Kelly Lum Passes Away

The application security expert, who went by "@aloria," is being remembered for her brilliance and generosity, as tributes start to pour in honoring her life.

Dark Reading: Attacks/Breaches
Research Highlights Cyber Security's Underestimated Role As a Business and Revenue Enabler

Global study reveals boards still undervalue cyber's role.

Dark Reading: Attacks/Breaches
Zero-Day Bug Allows Crypto Hackers to Drain $1.6M From Bitcoin ATMs

After its second cyberattack in under a year, General Bytes urges customers to up the security on their personal accounts to prevent losses from hackers.

Hacking on Medium
Earn Money Quick Via Cashapp Paypal Bank Western Union Secure Transfer Get Cloned Atm and…

HOT DEALS!!!!! WhatsApp:+1(202) 503–9187? HOT DEALS!!I 
 CASH TEAM
 ALBERT’S CASH TEAM SERVICE WORLDWIDE(GET RICH NOW/SOLVE ALL PROBLEM…

Continue reading on Medium »

Hacking on Medium
PASSWORD HACKING

https://cdn-images-1.medium.com/max/2600/0*cx-Zx6WymPZU_Niy
In this article, I will show you the ways that hackers get passwords and what can be done to keep your passwords safe.

Continue reading on Medium »

hacking: security in practice
Subdomain takeover via dns wildcard?

I get how ordinary subdomain takeovers work, when an attacker registers an expired/forgotten Subdomain or something, but I’m confused about the method described by the hacktricks link I posted below. If a wildcard CNAME record points to a legitimate domain, then shouldn’t an attacker created subdomain just load the legitimate domain?

“For example, if *.testing.com is wilcarded to 1.1.1.1. Then, not-existent.testing.com will be pointing to 1.1.1.1.

However, if instead of pointing to an IP address, the sysadmin point it to a third party service via CNAME, like a github subdomain for example (sohomdatta1.github.io). An attacker could create his own third party page (in Gihub in this case) and say that something.testing.com is pointing there. Because, the CNAME wildcard will agree the attacker will be able to generate arbitrary subdomains for the domain of the victim pointing to his pages.”

Does this make sense to anyone? I’ve spent all day researching this, and I’m still pretty lost. Thanks for your time!

https://book.hacktricks.xyz/pentesting-web/domain-subdomain-takeover#subdomain-takeover-generation-via-dns-wildcard

submitted by /u/Agent-BTZ
[link] [comments]

hacking: security in practice
Best job to go for while getting Cybersecurity degree?

I am a father of 2 and married, currently working in the mechanics field, but because of my education I would like to start working on a job while I get my bachelors. Do you all have any suggestions for what type of jobs I could look for?

submitted by /u/Gottster1129
[link] [comments]

hacking: security in practice
Explain it to someone who doesn't understand cybersecurity

Let's say that Joe has it's credentials stolen, maybe with a phishing campaign.

Joe has a work computer and he connects via VPN to work. He has access to the software he needs to do his job only, he's not an admin.

How do you hackers use his credentials to exploit the company's network?

Remember you're explaining it to someone without experience or security background.

TIA

submitted by /u/Original-Prompt4285
[link] [comments]

hacking: security in practice
Discussion: Are we entering the golden age of hacking, where software written by language models that "looks correct" to the lazy human operator is used despite being full of vulnerabilities?

Assisted by large language model code generators, people will "write" software they don't understand, and deploy it.

If so, can you provide examples in the wild?

If not, why not?

submitted by /u/BUGFIX-66
[link] [comments]

Top 10 cybersecurity tools for bug bounty hunters :

Bug bounty hunters use various cybersecurity tools to find vulnerabilities and bugs in software systems. Here are the top 10 cybersecurity…Continue reading on Medium »
Read more...

Hacking on Medium
Tryhackme -SteelMountain (CTF)

https://cdn-images-1.medium.com/max/700/1*aLgfxELwVK0ZEkMWx_ewqQ.png
Hack into a Mr. Robot themed Windows machine. Use metasploit for initial access, utilize powershell for Windows privilege escalation …

Continue reading on Medium »