hacking: security in practice
Why do people implement SPF without DMARC?

I was under the impression that SPF records are useless without actually having a policy that actions failed verification?

But the more I look the more I see SPF records without anything else.

Am I missing something here? That would mean people can just spoof all they want?

submitted by /u/thehunter699
[link] [comments]

5 common Vulnerabilities in smart contracts

Smart contracts are self-executing contracts with the terms of the agreement between buyer and seller being directly written into code…Continue reading on Medium »
Read more...

What is a reentrancy attack?

Reentrancy attacks are a type of exploit that can be used to drain funds from smart contracts. They work by taking advantage of the fact…Continue reading on Medium »
Read more...

Hacking on Medium
Top 5 Benefits of Hacking Your WhatsApp Account

https://cdn-images-1.medium.com/max/1080/1*lfCLjF1wh8Lq5cjYv6nAew.png
WhatsApp is one of the most popular messaging apps in the world, used by millions of people every day. It’s an excellent platform for…

Continue reading on Medium »

Hacking on Medium
My Review of Hire a Hacker Pro

https://cdn-images-1.medium.com/max/620/1*i4dF3VLdIyaiSHNxgC1ceA.jpeg
Review of Tony Capo and Hire a Hacker Pro

Continue reading on Medium »

The Key to Successful Bug Bountying

Bug bounties are a way for ethical hackers to earn money by finding and reporting security vulnerabilities in websites, apps, and other…Continue reading on Medium »
Read more...

Bypassing the 2FA /MFA — An Easy win

Hello Readers, Today I am going to tell how was I was to bypass the 2FA protection for a product based company main login page. I hope…Continue reading on Medium »
Read more...

hacking: security in practice
Tesla Spotify Account

I’m looking for a way to capture network traffic from my Tesla when on wifi at home. Specifically I need to find out the log in credentials the car uses when connecting to Spotify. I want to be able to use this account outside the car but Tesla does not release the login details.

submitted by /u/KathryneMarville
[link] [comments]

Hacking on Medium
Identifying a phishing link in an email

Phishing emails are a common form of cyber attack in which an attacker tries to trick you into revealing personal information such as your…

Continue reading on Medium »

Hacking on Medium
CSTI vulnerabilities will get you $$$ and this is why

https://cdn-images-1.medium.com/max/893/1*KNDj1x1EFDEqDZBNmXFdcA.png
Hi everyone, today I want to talk about CSTI (Client-Side Template Injection) Vulnerabilities and how you can exploit those to execute…

Continue reading on Medium »

Hacking on Medium
SQL Injection

What is SQL injection?

Continue reading on Medium »

KitPloit - PenTest Tools!
Nmap-API - Uses Python3.10, Debian, python-Nmap, And Flask Framework To Create A Nmap API That Can Do Scans With A Good Speed Online And Is Easy To Deploy

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhDXdh_qCTiy0ll3nFeDhL9QB5rA1KiewKTl6MUHhNWs6q7awlz7FqQhvWCxUiTBk2b4Z2nYdyxMaGiUlspAZVNCh7ce0RXwKIWw1Kg3hYnxH2ty-6EwdQY_2v4sww2EfboVEvy1E8btqjo-3qvwMhZxpoZhf-ETAzPbKX_29kvGMgFoV_J2i4jrQiypg/w640-h424/nmap.png
Uses python3.10, Debian, python-Nmap, and flask framework to create a Nmap API that can do scans with a good speed online and is easy to deploy.

This is a implementation for our college PCL project which is still under development and constantly updating.
API Reference

Get all items

GET /api/p1/{username}:{password}/{target}
GET /api/p2/{username}:{password}/{target}
GET /api/p3/{username}:{password}/{target}
GET /api/p4/{username}:{password}/{target}
GET /api/p5/{username}:{password}/{target}
Parameter Type Description usernamestringRequired. username of the current user passwordstringRequired. current user password targetstringRequired. The target Hostname and IP
Get item

GET /api/p1/
GET /api/p2/
GET /api/p3/
GET /api/p4/
GET /api/p5/
Parameter Return data Description Nmap Command p1jsonEffective Scan -Pn -sV -T4 -O -Fp2jsonSimple Scan -Pn -T4 -A -vp3jsonLow Power Scan -Pn -sS -sU -T4 -A -vp4jsonPartial Intense Scan -Pn -p- -T4 -A -vp5jsonComplete Intense Scan -Pn -sS -sU -T4 -A -PE -PP -PS80,443 -PA3389 -PU40125 -PY -g 53 --script=vuln
Auth and User management

POST /adduser/{admin-username}:{admin-passwd}/{id}/{username}/{passwd}
POST /deluser/{admin-username}:{admin-passwd}/{t-username}/{t-userpass}
POST /altusername/{admin-username}:{admin-passwd}/{t-user-id}/{new-t-username}
POST /altuserid/{admin-username}:{admin-passwd}/{new-t-user-id}/{t-username}
POST /altpassword/{admin-username}:{admin-passwd}/{t-username}/{new-t-userpass}

* make sure you use the ADMIN CREDS MENTIONED BELOW
Parameter Type Description admin-usernameStringAdmin username admin-passwdStringAdmin password idStringId for newly added user usernameStringUsername of the newly added user passwdStringPassword of the newly added user t-usernameStringTarget username t-user-idStringTarget userID t-userpassStringTarget users password new-t-usernameStringNew username for the target new-t-user-idStringNew userID for the target new-t-userpassStringNew password for the target
DEFAULT CREDENTIALS

ADMINISTRATOR : zAp6_oO~t428)@,
Download Nmap-API

https://a.thumbs.redditmedia.com/ZFdQpRjS8-HekjYZnzVDQn0W9xIOjEy5uguAPuqUbq8.jpg submitted by /u/Weetbix13
[link] [comments]

hacking: security in practice
Certifications

Hey guys so I currently still am a Mechanical Engineering student and have been studying Cybersecurity as a hobby, now I have decided to do it “professionally” and wanted to ask what Certification you would recommend? Already did some research and currently cannot decide between the CompTia Security+ or the CompTia Pentest+, both seem to be recommended for beginners, but I am on a rather tight budget so for now I could only do one, so which one would you recommend for a beginner?

submitted by /u/Tickle_a_Dicktip
[link] [comments]