hacking: security in practice
Someone is trying to extort me, I have the cellphone, what can I do?
Today someone wrote me and said personal data of me and a treat in Indian, it seems like a noob but it makes me feel uneasy because he knows my direction and family names, what can I do? I just have the cellphone
submitted by /u/Intelligent-Emu-4740
[link] [comments]
Someone is trying to extort me, I have the cellphone, what can I do?
Today someone wrote me and said personal data of me and a treat in Indian, it seems like a noob but it makes me feel uneasy because he knows my direction and family names, what can I do? I just have the cellphone
submitted by /u/Intelligent-Emu-4740
[link] [comments]
Reddit
r/hacking on Reddit: Someone is trying to extort me, I have the cellphone, what can I do?
Posted by u/Intelligent-Emu-4740 - No votes and no comments
hacking: security in practice
Login attempts maximum has been reached
Recently I noticed a plethora of Ip addresses in my network. Ranging from Japan, to right down the street.
My question is why or how can my cpu continue to state maximum “login attempts reached” when I literally just booted up my cpu. At first I thought it was my child who was keyboard mashing. But this is not the case. This is like the third of fourth time I walk away from my cpu and then return to sign in and boom! Maximum login attempts reach please enter A1B2C3. Thoughts and advice will be greatly appreciated.
submitted by /u/MadScientist2023
[link] [comments]
Login attempts maximum has been reached
Recently I noticed a plethora of Ip addresses in my network. Ranging from Japan, to right down the street.
My question is why or how can my cpu continue to state maximum “login attempts reached” when I literally just booted up my cpu. At first I thought it was my child who was keyboard mashing. But this is not the case. This is like the third of fourth time I walk away from my cpu and then return to sign in and boom! Maximum login attempts reach please enter A1B2C3. Thoughts and advice will be greatly appreciated.
submitted by /u/MadScientist2023
[link] [comments]
Reddit
r/hacking on Reddit: Login attempts maximum has been reached
Posted by u/MadScientist2023 - No votes and no comments
Unveiling the Secrets: My Journey of Hacking Google’s OSS
- August 22, 2022Continue reading on InfoSec Write-ups »
Read more...
- August 22, 2022Continue reading on InfoSec Write-ups »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
DDOS Attack on Karachi & Lahore Airport Websites
https://cdn-images-1.medium.com/max/1080/1*hEsCwydYUfusPreXrrAYiA.png
DDoS (Distributed Denial of Service) can be very dangerous as they make an online service, network resource or host machine unavailable to…
Continue reading on Medium »
DDOS Attack on Karachi & Lahore Airport Websites
https://cdn-images-1.medium.com/max/1080/1*hEsCwydYUfusPreXrrAYiA.png
DDoS (Distributed Denial of Service) can be very dangerous as they make an online service, network resource or host machine unavailable to…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Beware of Ransomware, a real threat to your online security
https://cdn-images-1.medium.com/max/1280/1*43nvpvXBQYRCFX60L9ET-g.jpeg
Ransomware is serious business, and you should do all in your power to protect yourself and your organization against this type of cyber…
Continue reading on Medium »
Beware of Ransomware, a real threat to your online security
https://cdn-images-1.medium.com/max/1280/1*43nvpvXBQYRCFX60L9ET-g.jpeg
Ransomware is serious business, and you should do all in your power to protect yourself and your organization against this type of cyber…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
The Great Router Heist: My Journey to Pwn2Own Tokyo
https://cdn-images-1.medium.com/max/1060/1*1vJEFBeFwdghqx0cuqtuYQ.png
Whattup hackers, gather ‘round and let me regale you with the thrilling tale of my journey to one day compete at the embedded security leg…
Continue reading on Medium »
The Great Router Heist: My Journey to Pwn2Own Tokyo
https://cdn-images-1.medium.com/max/1060/1*1vJEFBeFwdghqx0cuqtuYQ.png
Whattup hackers, gather ‘round and let me regale you with the thrilling tale of my journey to one day compete at the embedded security leg…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
10 Windows Tricks You Can’t Live Without
https://cdn-images-1.medium.com/max/2600/0*8LDZ_Cr7Z2LnyN_r
Opening and Managing files/folders with CMD
Continue reading on Medium »
10 Windows Tricks You Can’t Live Without
https://cdn-images-1.medium.com/max/2600/0*8LDZ_Cr7Z2LnyN_r
Opening and Managing files/folders with CMD
Continue reading on Medium »
The Great Router Heist: My Journey to Pwn2Own Tokyo
Whattup hackers, gather ‘round and let me regale you with the thrilling tale of my journey to one day compete at the embedded security leg…Continue reading on Medium »
Read more...
Whattup hackers, gather ‘round and let me regale you with the thrilling tale of my journey to one day compete at the embedded security leg…Continue reading on Medium »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Black Hat Ethical Hacking
Microsoft’s Misconfigured Application Allowed for Real-Time Breach Attempts on Bing.com
Microsoft’s Misconfigured Application Allowed for Real-Time Breach Attempts on Bing.comPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes BingBang FlawMicrosoft has fixed a security flaw that could have allowed malicious actors to modify Bing.com search results and potentially breach the accounts of Office 365 users. The flaw was discovered by Wiz Research, which dubbed the attack “BingBang.”
According to Wiz researchers, the security issue arose due to a misconfigured Microsoft application that allowed users to log in and make modifications in real-time. The researchers found that when creating an application in Azure App Services and Azure Functions, it could be mistakenly configured to allow users from any Microsoft tenant, including public users, to log in to the application.
This configuration setting is called ‘Support account types’ and lets developers specify if a specific tenant multi-tenant, personal accounts, or a mix of multi and personal accounts should be allowed to access the application.
This configuration option is offered for legitimate cases where developers must make their apps available across organizational boundaries. However, if a developer mistakenly assigns looser permissions, it could cause unwanted access to the application and its features.
https://www.bleepstatic.com/images/news/u/1220909/2023/Security/14/configuration.png Azure AD user access configuration options (Wiz)
See Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses
Wiz researchers also found a misconfigured “Bing Trivia” app that allowed anyone to log in to the application and access its CMS (Content Management System). The app was directly linked to Bing.com, allowing the researchers to modify the live content shown in Bing search results. They succeeded in modifying search results for the “best soundtracks” search term, adding arbitrary results to the top carousel. XSS attacksNext, the analysts tested if they could inject a payload into the Bing search results using this same CMS and found they could execute a cross-site scripting (XSS) attack on Bing.com.
https://www.bleepstatic.com/images/news/security/attacks/bing-xss-attack.jpg Bing.com XSS attack (Wiz)
After confirming that the XSS was possible, Wiz reported its findings to Microsoft and worked with the software company to determine the exact impact of this second attack. A test XSS showed that it was possible to compromise the Office 365 token of any Bing user that saw the carousel in the search results, giving them full access to the searchers’ accounts, including access to Outlook emails, calendar data, messages on Teams, SharePoint documents, and OneDrive files.
Trending: Exploit XSS Injections in a one-line powerful Technique
Trending: Offensive Security Tool: OpenRediWrecked Microsoft issues a fixMicrosoft downplayed the issue, saying that the misconfiguration that allowed external parties read and write access impacted only a small number of internal applications and was corrected immediately. Microsoft added that it has introduced security enhancements that will prevent Azure AD misconfiguration issues from becoming a problem again.
Microsoft has also stopped issuing access tokens to clients not registered in the resource tenants, limiting access only to properly registered clients. “This functionality has been disabled for more than 99% of customer applications,” reads Microsoft’s advisory. “For the remainder of multi-tenant r[...]
Microsoft’s Misconfigured Application Allowed for Real-Time Breach Attempts on Bing.com
Microsoft’s Misconfigured Application Allowed for Real-Time Breach Attempts on Bing.comPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes BingBang FlawMicrosoft has fixed a security flaw that could have allowed malicious actors to modify Bing.com search results and potentially breach the accounts of Office 365 users. The flaw was discovered by Wiz Research, which dubbed the attack “BingBang.”
According to Wiz researchers, the security issue arose due to a misconfigured Microsoft application that allowed users to log in and make modifications in real-time. The researchers found that when creating an application in Azure App Services and Azure Functions, it could be mistakenly configured to allow users from any Microsoft tenant, including public users, to log in to the application.
This configuration setting is called ‘Support account types’ and lets developers specify if a specific tenant multi-tenant, personal accounts, or a mix of multi and personal accounts should be allowed to access the application.
This configuration option is offered for legitimate cases where developers must make their apps available across organizational boundaries. However, if a developer mistakenly assigns looser permissions, it could cause unwanted access to the application and its features.
https://www.bleepstatic.com/images/news/u/1220909/2023/Security/14/configuration.png Azure AD user access configuration options (Wiz)
See Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses
Wiz researchers also found a misconfigured “Bing Trivia” app that allowed anyone to log in to the application and access its CMS (Content Management System). The app was directly linked to Bing.com, allowing the researchers to modify the live content shown in Bing search results. They succeeded in modifying search results for the “best soundtracks” search term, adding arbitrary results to the top carousel. XSS attacksNext, the analysts tested if they could inject a payload into the Bing search results using this same CMS and found they could execute a cross-site scripting (XSS) attack on Bing.com.
https://www.bleepstatic.com/images/news/security/attacks/bing-xss-attack.jpg Bing.com XSS attack (Wiz)
After confirming that the XSS was possible, Wiz reported its findings to Microsoft and worked with the software company to determine the exact impact of this second attack. A test XSS showed that it was possible to compromise the Office 365 token of any Bing user that saw the carousel in the search results, giving them full access to the searchers’ accounts, including access to Outlook emails, calendar data, messages on Teams, SharePoint documents, and OneDrive files.
Trending: Exploit XSS Injections in a one-line powerful Technique
Trending: Offensive Security Tool: OpenRediWrecked Microsoft issues a fixMicrosoft downplayed the issue, saying that the misconfiguration that allowed external parties read and write access impacted only a small number of internal applications and was corrected immediately. Microsoft added that it has introduced security enhancements that will prevent Azure AD misconfiguration issues from becoming a problem again.
Microsoft has also stopped issuing access tokens to clients not registered in the resource tenants, limiting access only to properly registered clients. “This functionality has been disabled for more than 99% of customer applications,” reads Microsoft’s advisory. “For the remainder of multi-tenant r[...]