๐ฆYou've probably heard of JWT - Json Web Tokens.
It is a format designed to securely transfer information between two parties, so it is mainly used to authenticate and transmit information in an encrypted way by using different algorithms when it consists of three parts (Header, Payload, and Signature).
I recently visited a website that manages couriers since I myself am waiting for delivery. He is vulnerable, he is not secure, he is "weak." A weakness that I was able to locate was expressed in the fact that the server stores information about couriers (scheduling) for that courier in JWT format. The information inside is by "x" (identifier) and "y" (shipping). There is no defense mechanism in place, which leads to security weakness and damage to credibility.
It turns out (unfortunately) that anyone can edit the payload content (change a shipping ID to data belonging to another user), and without verifying the signature, the server will receive the edited token as valid, which leads to data tampering, exposing details, and also Rxss because it turns out that there is no filtering on user input.
What's more, it's not normal!
The problem with the JWT header is that it contains information such as id and num, for example, while it does not store information about the encryption type (alg) and the type of token (typ) at all. Using a header to store such data is a security weakness because the header is both unsigned and can be easily modified.
Platforms like Portswigger have modules that focus on attacks on jwt that can also be used to learn about secure development
JWT (Algorithm confusion, Header Injections, etc.)
Ref: Adam Kahlon
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
It is a format designed to securely transfer information between two parties, so it is mainly used to authenticate and transmit information in an encrypted way by using different algorithms when it consists of three parts (Header, Payload, and Signature).
I recently visited a website that manages couriers since I myself am waiting for delivery. He is vulnerable, he is not secure, he is "weak." A weakness that I was able to locate was expressed in the fact that the server stores information about couriers (scheduling) for that courier in JWT format. The information inside is by "x" (identifier) and "y" (shipping). There is no defense mechanism in place, which leads to security weakness and damage to credibility.
It turns out (unfortunately) that anyone can edit the payload content (change a shipping ID to data belonging to another user), and without verifying the signature, the server will receive the edited token as valid, which leads to data tampering, exposing details, and also Rxss because it turns out that there is no filtering on user input.
What's more, it's not normal!
The problem with the JWT header is that it contains information such as id and num, for example, while it does not store information about the encryption type (alg) and the type of token (typ) at all. Using a header to store such data is a security weakness because the header is both unsigned and can be easily modified.
Platforms like Portswigger have modules that focus on attacks on jwt that can also be used to learn about secure development
JWT (Algorithm confusion, Header Injections, etc.)
Ref: Adam Kahlon
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆAWS Cloud #tips : The Backbone of Modern Technology!๐
๐ What is AWS (Amazon Web Services)?
AWS is the worldโs most comprehensive and widely adopted cloud platform, offering 200+ fully featured services across compute, storage, databases, networking, AI, IoT, and more. Trusted by millions, AWS enables businesses of all sizes to innovate faster and scale effortlessly.
๐ Why AWS Stands Out:
1๏ธโฃ Global Infrastructure:
โข Operates across 31 geographic regions and 99 Availability Zones, ensuring low latency, reliability, and scalability.
โข Plans for 15 more regions are underway, making AWS one of the largest global networks.
2๏ธโฃ Cost Optimization:
โข AWS follows a pay-as-you-go model, meaning you only pay for what you use.
โข Tools like AWS Cost Explorer and Savings Plans help optimize your cloud spend.
3๏ธโฃ Unmatched Security:
โข Industry-leading security protocols, compliance with over 140 global standards, and data encryption ensure peace of mind.
โข AWS also provides IAM (Identity and Access Management) for granular security control.
4๏ธโฃ Innovation-Driven:
โข AWS offers cutting-edge tools for AI/ML (SageMaker), Big Data (EMR), and Serverless Computing (Lambda).
โข Pioneering advancements in Edge Computing with services like AWS Outposts and Wavelength.
5๏ธโฃ Ease of Use for Developers:
โข A user-friendly console, SDKs, APIs, and CLI make building and managing applications seamless.
โข Offers templates via CloudFormation for infrastructure automation.
๐ป Most Popular AWS Services
โข EC2: Scalable compute power for running applications.
โข S3: Highly durable object storage for backups, data lakes, and archives.
โข RDS & DynamoDB: Managed relational and NoSQL databases.
โข CloudFront: Fast and secure content delivery network.
โข Lambda: Event-driven serverless computing without infrastructure management.
๐ AWS Certification Pathway
AWS certifications validate your skills and open doors to career opportunities. Popular certifications include:
โข AWS Certified Solutions Architect (Associate)
โข AWS Certified Cloud Practitioner
โข AWS Certified DevOps Engineer
๐ Who Uses AWS?
โข Startups: Accelerate development with low upfront costs.
โข Enterprises: Achieve agility and scale globally.
โข Developers & IT Professionals: Innovate and build cutting-edge solutions.
๐ Getting Started:
โข Try AWS Free Tier to explore its services risk-free.
โข Explore AWS tutorials, documentation, and online courses to boost your skills.
Ref: Mahesh GirheMahesh Girhe
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ What is AWS (Amazon Web Services)?
AWS is the worldโs most comprehensive and widely adopted cloud platform, offering 200+ fully featured services across compute, storage, databases, networking, AI, IoT, and more. Trusted by millions, AWS enables businesses of all sizes to innovate faster and scale effortlessly.
๐ Why AWS Stands Out:
1๏ธโฃ Global Infrastructure:
โข Operates across 31 geographic regions and 99 Availability Zones, ensuring low latency, reliability, and scalability.
โข Plans for 15 more regions are underway, making AWS one of the largest global networks.
2๏ธโฃ Cost Optimization:
โข AWS follows a pay-as-you-go model, meaning you only pay for what you use.
โข Tools like AWS Cost Explorer and Savings Plans help optimize your cloud spend.
3๏ธโฃ Unmatched Security:
โข Industry-leading security protocols, compliance with over 140 global standards, and data encryption ensure peace of mind.
โข AWS also provides IAM (Identity and Access Management) for granular security control.
4๏ธโฃ Innovation-Driven:
โข AWS offers cutting-edge tools for AI/ML (SageMaker), Big Data (EMR), and Serverless Computing (Lambda).
โข Pioneering advancements in Edge Computing with services like AWS Outposts and Wavelength.
5๏ธโฃ Ease of Use for Developers:
โข A user-friendly console, SDKs, APIs, and CLI make building and managing applications seamless.
โข Offers templates via CloudFormation for infrastructure automation.
๐ป Most Popular AWS Services
โข EC2: Scalable compute power for running applications.
โข S3: Highly durable object storage for backups, data lakes, and archives.
โข RDS & DynamoDB: Managed relational and NoSQL databases.
โข CloudFront: Fast and secure content delivery network.
โข Lambda: Event-driven serverless computing without infrastructure management.
๐ AWS Certification Pathway
AWS certifications validate your skills and open doors to career opportunities. Popular certifications include:
โข AWS Certified Solutions Architect (Associate)
โข AWS Certified Cloud Practitioner
โข AWS Certified DevOps Engineer
๐ Who Uses AWS?
โข Startups: Accelerate development with low upfront costs.
โข Enterprises: Achieve agility and scale globally.
โข Developers & IT Professionals: Innovate and build cutting-edge solutions.
๐ Getting Started:
โข Try AWS Free Tier to explore its services risk-free.
โข Explore AWS tutorials, documentation, and online courses to boost your skills.
Ref: Mahesh GirheMahesh Girhe
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
Forwarded from Exploiting Crew (Pr1vAt3)
๐ฆProtect Your Inbox Like a Pro! ๐
Your email is a goldmine for cybercriminals, containing personal, professional, and financial information. But fear notโhereโs how to safeguard it effectively:
๐ก๏ธ Top Email Security Tips:
1๏ธโฃ Enable Multi-Factor Authentication (MFA): A strong password isnโt enough. MFA adds an extra layer of security.
2๏ธโฃ Beware of Phishing Emails: Donโt click on suspicious links or attachments. Verify the sender before taking action.
3๏ธโฃ Use Strong Passwords: Avoid predictable passwords like โpassword123.โ Use a combination of upper/lowercase letters, numbers, and symbols.
4๏ธโฃ Encrypt Your Emails: Protect sensitive information by using email encryption tools.
5๏ธโฃ Keep Software Updated: Ensure your email client and antivirus software are always up-to-date.
6๏ธโฃ Educate Yourself and Your Team: Awareness is your first line of defense. Share best practices with colleagues.
๐จ Common Email Security Threats:
๐ธ Phishing: Fake emails designed to steal your information.
๐ธ Spoofing: Attackers pretending to be trusted contacts.
๐ธ Ransomware: Malicious attachments locking you out of your data.
๐ธ BEC (Business Email Compromise): Fraudulent emails targeting businesses.
๐ Remember: A secure inbox equals a secure life. Take action now to protect your data and privacy!
Ref: Mahech Girhe
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
Your email is a goldmine for cybercriminals, containing personal, professional, and financial information. But fear notโhereโs how to safeguard it effectively:
๐ก๏ธ Top Email Security Tips:
1๏ธโฃ Enable Multi-Factor Authentication (MFA): A strong password isnโt enough. MFA adds an extra layer of security.
2๏ธโฃ Beware of Phishing Emails: Donโt click on suspicious links or attachments. Verify the sender before taking action.
3๏ธโฃ Use Strong Passwords: Avoid predictable passwords like โpassword123.โ Use a combination of upper/lowercase letters, numbers, and symbols.
4๏ธโฃ Encrypt Your Emails: Protect sensitive information by using email encryption tools.
5๏ธโฃ Keep Software Updated: Ensure your email client and antivirus software are always up-to-date.
6๏ธโฃ Educate Yourself and Your Team: Awareness is your first line of defense. Share best practices with colleagues.
๐จ Common Email Security Threats:
๐ธ Phishing: Fake emails designed to steal your information.
๐ธ Spoofing: Attackers pretending to be trusted contacts.
๐ธ Ransomware: Malicious attachments locking you out of your data.
๐ธ BEC (Business Email Compromise): Fraudulent emails targeting businesses.
๐ Remember: A secure inbox equals a secure life. Take action now to protect your data and privacy!
Ref: Mahech Girhe
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆDetection of teams convoC2 Mainly used by Red Teamers recent days.
Basically it causes out bound requests to C2 Server, exfiltrates command outputs from Adaptive Cards images URLs and inserting data into hidden span tags in Microsoft teams conservations.
The fact that the victim only sends http queries to Microsoft servers and the antivirus doesn't examine MS teams log files and in absence of direct connection between the victim and attacker in this case its very difficult to detect.
Here is the custom KQL to Detect.
CloudAppEvents
| where Timestamp > ago(1h)
| where Application contains "Microsoft Teams"
| where ActionType contains "AppInstalled"
| where parse_json(RawEventData)["AddOnName"] == 'Workflows'
Ref: Kintali Sai Dinesh
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
Basically it causes out bound requests to C2 Server, exfiltrates command outputs from Adaptive Cards images URLs and inserting data into hidden span tags in Microsoft teams conservations.
The fact that the victim only sends http queries to Microsoft servers and the antivirus doesn't examine MS teams log files and in absence of direct connection between the victim and attacker in this case its very difficult to detect.
Here is the custom KQL to Detect.
CloudAppEvents
| where Timestamp > ago(1h)
| where Application contains "Microsoft Teams"
| where ActionType contains "AppInstalled"
| where parse_json(RawEventData)["AddOnName"] == 'Workflows'
Ref: Kintali Sai Dinesh
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
Forwarded from Exploiting Crew (Pr1vAt3)
๐ฆ18 Must-Have Free Tools for Cybersecurity Enthusiasts ๐ก๏ธ
As a cybersecurity professional, staying ahead of the curve requires constant learning and hands-on practice. The good news? You donโt need to break the bank to access industry-leading tools. Here's a curated list of 18 free cybersecurity tools to elevate your skillsโwhether you're a beginner or a seasoned expert!
๐ต 1. Kali Linux
The ultimate penetration testing operating system for ethical hackers.
๐ต 2. Wireshark
A network protocol analyzer that lets you capture and inspect data in real time.
๐ต 3. Burp Suite Community Edition
Perfect for web application security testing and vulnerability assessments.
๐ต 4. Gophish
An open-source phishing toolkit for creating realistic phishing campaigns.
๐ต 5. Aircrack-ng
Specializes in cracking WEP/WPA Wi-Fi passwords.
๐ต 6. Have I Been Pwned?
Check if your email or accounts have been compromised in data breaches.
๐ต 7. Metasploit Framework
A penetration testing powerhouse for exploiting vulnerabilities.
๐ต 8. Nikto
Scans web servers for dangerous files, outdated software, and misconfigurations.
๐ต 9. HackTheBox
An interactive training platform to sharpen your hacking skills.
๐ต 10. pfSense
A firewall and router solution for network protection.
๐ต 11. CyberChef
A versatile tool for analyzing, encrypting, and decoding data.
๐ต 12. Ghidra
An open-source reverse engineering tool by the NSA.
๐ต 13. Deshashed
Enhance email security by detecting exposed credentials.
๐ต 14. OpenVAS
A comprehensive vulnerability scanner for systems and networks.
๐ต 15. OSSEC
Monitor and prevent intrusions in your environment with this HIDS tool.
๐ต 16. SQLmap
Automatically detect and exploit SQL injection vulnerabilities.
๐ต 17. REMnux
Reverse engineering and malware analysis made accessible.
๐ต 18. Zed Attack Proxy (ZAP)
A web application security scanner for discovering vulnerabilities.
๐ Why Use These Tools?
- Cost-Effective: Free but highly efficient.
- Industry Standard: Frequently used by professionals worldwide.
- Skill Development: Master critical areas like penetration testing, vulnerability analysis, and data protection.
Ref: Arun KL
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
As a cybersecurity professional, staying ahead of the curve requires constant learning and hands-on practice. The good news? You donโt need to break the bank to access industry-leading tools. Here's a curated list of 18 free cybersecurity tools to elevate your skillsโwhether you're a beginner or a seasoned expert!
๐ต 1. Kali Linux
The ultimate penetration testing operating system for ethical hackers.
๐ต 2. Wireshark
A network protocol analyzer that lets you capture and inspect data in real time.
๐ต 3. Burp Suite Community Edition
Perfect for web application security testing and vulnerability assessments.
๐ต 4. Gophish
An open-source phishing toolkit for creating realistic phishing campaigns.
๐ต 5. Aircrack-ng
Specializes in cracking WEP/WPA Wi-Fi passwords.
๐ต 6. Have I Been Pwned?
Check if your email or accounts have been compromised in data breaches.
๐ต 7. Metasploit Framework
A penetration testing powerhouse for exploiting vulnerabilities.
๐ต 8. Nikto
Scans web servers for dangerous files, outdated software, and misconfigurations.
๐ต 9. HackTheBox
An interactive training platform to sharpen your hacking skills.
๐ต 10. pfSense
A firewall and router solution for network protection.
๐ต 11. CyberChef
A versatile tool for analyzing, encrypting, and decoding data.
๐ต 12. Ghidra
An open-source reverse engineering tool by the NSA.
๐ต 13. Deshashed
Enhance email security by detecting exposed credentials.
๐ต 14. OpenVAS
A comprehensive vulnerability scanner for systems and networks.
๐ต 15. OSSEC
Monitor and prevent intrusions in your environment with this HIDS tool.
๐ต 16. SQLmap
Automatically detect and exploit SQL injection vulnerabilities.
๐ต 17. REMnux
Reverse engineering and malware analysis made accessible.
๐ต 18. Zed Attack Proxy (ZAP)
A web application security scanner for discovering vulnerabilities.
๐ Why Use These Tools?
- Cost-Effective: Free but highly efficient.
- Industry Standard: Frequently used by professionals worldwide.
- Skill Development: Master critical areas like penetration testing, vulnerability analysis, and data protection.
Ref: Arun KL
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆ๐ฃ๐ผ๐๐ฒ๐ฟ๐ฆ๐ต๐ฒ๐น๐น ๐ฆ๐ฒ๐น๐ณ-๐ฃ๐๐ป ๐๐ฒ๐๐ฒ๐ฐ๐๐ถ๐ผ๐ป
The Proofpoint blog outlines a social engineering tactic where threat actors deceive users into copying and pasting malicious PowerShell scripts, causing malware infections. Groups like TA571 use fake error messages to prompt script execution, delivering malware such as DarkGate and NetSupport. Despite needing significant user interaction, the attack's success hinges on sophisticated social engineering. I have developed a custom detection PowerShell Self-Pwn KQL to identify such scenarios and assist SecOps in isolating affected devices.
Ref: Steven Lim
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
The Proofpoint blog outlines a social engineering tactic where threat actors deceive users into copying and pasting malicious PowerShell scripts, causing malware infections. Groups like TA571 use fake error messages to prompt script execution, delivering malware such as DarkGate and NetSupport. Despite needing significant user interaction, the attack's success hinges on sophisticated social engineering. I have developed a custom detection PowerShell Self-Pwn KQL to identify such scenarios and assist SecOps in isolating affected devices.
Ref: Steven Lim
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
Forwarded from Exploiting Crew (Pr1vAt3)
๐ฆSecurity collection for pro:
โ Worm Infection: https://lnkd.in/ez-kq98Y
โ Social Engineering: https://lnkd.in/e_FJbxDP
โ Information Leakage: https://lnkd.in/eeN8KX8g
โ Insider Abuse: https://lnkd.in/ep4p_THk
โ Customer Phishing: https://lnkd.in/ekTfY7vz
โ Scam: https://lnkd.in/eUHwG3fF
โ Trademark infringement: https://lnkd.in/e3P3xfeb
โ Phishing: https://lnkd.in/eYTi3RQ8
โ Ransomware: https://lnkd.in/eRkctdQn
โ Large_scale_compromise: https://lnkd.in/eYFF43b4
โ 3rd-party_compromise: https://lnkd.in/e8SAu5MT
โ Windows Intrusion: https://lnkd.in/eXCpcx9V
โ Unix Linux lntrusionDetection: https://lnkd.in/eHkm6MMe
โ DDOS: https://lnkd.in/eQ7zZzVt
โ MaliciousNetworkBehaviour: https://lnkd.in/ewVZy2cs
โ Website-Defacement: https://lnkd.in/eraNiHcH
โ WindowsMalwareDetection: https://lnkd.in/ewEx_C6Y
โ Blackmail: https://lnkd.in/eW3zGcPs
โ SmartphoneMalware.pdf: https://lnkd.in/ezjyY4G9
Ref: Mohamad Hamadi
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
โ Worm Infection: https://lnkd.in/ez-kq98Y
โ Social Engineering: https://lnkd.in/e_FJbxDP
โ Information Leakage: https://lnkd.in/eeN8KX8g
โ Insider Abuse: https://lnkd.in/ep4p_THk
โ Customer Phishing: https://lnkd.in/ekTfY7vz
โ Scam: https://lnkd.in/eUHwG3fF
โ Trademark infringement: https://lnkd.in/e3P3xfeb
โ Phishing: https://lnkd.in/eYTi3RQ8
โ Ransomware: https://lnkd.in/eRkctdQn
โ Large_scale_compromise: https://lnkd.in/eYFF43b4
โ 3rd-party_compromise: https://lnkd.in/e8SAu5MT
โ Windows Intrusion: https://lnkd.in/eXCpcx9V
โ Unix Linux lntrusionDetection: https://lnkd.in/eHkm6MMe
โ DDOS: https://lnkd.in/eQ7zZzVt
โ MaliciousNetworkBehaviour: https://lnkd.in/ewVZy2cs
โ Website-Defacement: https://lnkd.in/eraNiHcH
โ WindowsMalwareDetection: https://lnkd.in/ewEx_C6Y
โ Blackmail: https://lnkd.in/eW3zGcPs
โ SmartphoneMalware.pdf: https://lnkd.in/ezjyY4G9
Ref: Mohamad Hamadi
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
lnkd.in
LinkedIn
This link will take you to a page thatโs not on LinkedIn
Media is too big
VIEW IN TELEGRAM
๐ฆTakeover poc Video dem:
Password Reset Link not expiring after changing the email Leads To Account Takeover poc ๐จ
๐ Description:
In this video, Iโll demonstrate a critical vulnerability where a password reset link remains active even after changing the registered email, leading to a potential account takeover exploit. This live PoC showcases the risk and offers insights into preventing such flaws.
Password Reset Link not expiring after changing the email Leads To Account Takeover poc ๐จ
๐ Description:
In this video, Iโll demonstrate a critical vulnerability where a password reset link remains active even after changing the registered email, leading to a potential account takeover exploit. This live PoC showcases the risk and offers insights into preventing such flaws.
๐ฆTop Free Java Projects:
1. Airline Reservation System:
- https://lnkd.in/dRFK2vPh
2. Data Visualization Software:
- https://lnkd.in/dVWVU8xn
3. Electricity Billing System:
- https://lnkd.in/dekycNXQ
4. E-Healthcare Management System:
- https://lnkd.in/dEkE2raN
5. Email Client Software:
- https://lnkd.in/d_qz7U9E
6. Library Management System:
- https://lnkd.in/dY7bDjFn
7. Network Packet Sniffer:
- https://lnkd.in/dXPtyzz4
8. Online Bank Management System:
- https://lnkd.in/d4Qzy8fN
9. Online Medical Management System:
- https://lnkd.in/dHciHGGz
10. Online Quiz Management System:
- https://lnkd.in/djKs3DJq
11. Online Survey System:
- https://lnkd.in/dw9Cmhix
12. RSS Feed Reader:
- https://lnkd.in/dupDQPnG
13. Smart City Project:
- https://lnkd.in/d3YT36aJ
14. Stock Management System:
- https://lnkd.in/dTb3hikj
15. Supply Chain Management System:
- https://lnkd.in/dAzJthMQ
16. Virtual Private Network:
- https://lnkd.in/dyEcgrFC
Ref: Rajat Gajbhiye
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
1. Airline Reservation System:
- https://lnkd.in/dRFK2vPh
2. Data Visualization Software:
- https://lnkd.in/dVWVU8xn
3. Electricity Billing System:
- https://lnkd.in/dekycNXQ
4. E-Healthcare Management System:
- https://lnkd.in/dEkE2raN
5. Email Client Software:
- https://lnkd.in/d_qz7U9E
6. Library Management System:
- https://lnkd.in/dY7bDjFn
7. Network Packet Sniffer:
- https://lnkd.in/dXPtyzz4
8. Online Bank Management System:
- https://lnkd.in/d4Qzy8fN
9. Online Medical Management System:
- https://lnkd.in/dHciHGGz
10. Online Quiz Management System:
- https://lnkd.in/djKs3DJq
11. Online Survey System:
- https://lnkd.in/dw9Cmhix
12. RSS Feed Reader:
- https://lnkd.in/dupDQPnG
13. Smart City Project:
- https://lnkd.in/d3YT36aJ
14. Stock Management System:
- https://lnkd.in/dTb3hikj
15. Supply Chain Management System:
- https://lnkd.in/dAzJthMQ
16. Virtual Private Network:
- https://lnkd.in/dyEcgrFC
Ref: Rajat Gajbhiye
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
lnkd.in
LinkedIn
This link will take you to a page thatโs not on LinkedIn
Forwarded from Exploiting Crew (Pr1vAt3)
๐ฆHow Was the TOR Attacker Caught? ๐ต๏ธโ๏ธ
๐ The Dark Web often seems like an untraceable haven for anonymity. But even in the world of TOR (The Onion Router), attackers can be caught! Hereโs how:
1๏ธโฃ Human Error: Attackers often make small mistakes, like logging in from a non-TOR connection or revealing identifying details in their communications. Even a single misstep can be critical.
2๏ธโฃ Traffic Analysis: TOR masks your identity by routing traffic through multiple nodes. However, law enforcement can use advanced traffic correlation techniques to identify entry and exit points, especially when they control some TOR nodes.
3๏ธโฃ Compromised Nodes: Investigators may run malicious TOR nodes to intercept traffic. They analyze the data flowing through them, narrowing down potential suspects.
4๏ธโฃ Exploits: Vulnerabilities in TOR or the userโs device/browser can be exploited to reveal real IP addresses. For example, Operation Onymous used malware to expose hidden server locations.
5๏ธโฃ Metadata Tracking: Even encrypted communications leave traces. Authorities piece together patterns, times, and behaviors to zero in on suspects.
๐ก Key Takeaway: No system is 100% secure. Cybercriminals often underestimate the combination of technical expertise and human ingenuity behind modern investigations.
Ref: Mahesh Girhe
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ The Dark Web often seems like an untraceable haven for anonymity. But even in the world of TOR (The Onion Router), attackers can be caught! Hereโs how:
1๏ธโฃ Human Error: Attackers often make small mistakes, like logging in from a non-TOR connection or revealing identifying details in their communications. Even a single misstep can be critical.
2๏ธโฃ Traffic Analysis: TOR masks your identity by routing traffic through multiple nodes. However, law enforcement can use advanced traffic correlation techniques to identify entry and exit points, especially when they control some TOR nodes.
3๏ธโฃ Compromised Nodes: Investigators may run malicious TOR nodes to intercept traffic. They analyze the data flowing through them, narrowing down potential suspects.
4๏ธโฃ Exploits: Vulnerabilities in TOR or the userโs device/browser can be exploited to reveal real IP addresses. For example, Operation Onymous used malware to expose hidden server locations.
5๏ธโฃ Metadata Tracking: Even encrypted communications leave traces. Authorities piece together patterns, times, and behaviors to zero in on suspects.
๐ก Key Takeaway: No system is 100% secure. Cybercriminals often underestimate the combination of technical expertise and human ingenuity behind modern investigations.
Ref: Mahesh Girhe
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
Forwarded from Exploiting Crew (Pr1vAt3)
๐ฆ๐๐จ๐ฆ๐ฉ๐๐ง๐ฒ ๐๐ข๐ฌ๐ ๐๐๐ ๐๐ง๐ญ๐๐ซ๐ฏ๐ข๐๐ฐ ๐๐ฎ๐๐ฌ๐ญ๐ข๐จ๐ง๐ฌ
Here , I have listed out all SQL interview questions for your easy reference.
1. Amazon SQL Interview Question for Data Analyst Position [2-3 Year Of Experience ] | Data Analytics
https://lnkd.in/g2RzsKdq
2. Airbnb SQL Interview Question | Convert Comma Separated Values into Rows | Data Analytics
https://lnkd.in/gpMbU-dF
3. Adobe Interesting SQL Interview Question | Solving Using 2 Approaches | Data Analytics
https://lnkd.in/g_-_9ymd
4. Spotify SQL Interview Problem | Top 5 Artists | Aggregation and Window Functions in SQL
https://lnkd.in/gtfaugd3
5. L&T Technology Services SQL Interview Problem | Print Highest and Lowest Salary Employees in Each Department
https://lnkd.in/ggY82FJW
6. Ameriprise Financial Services, LLCSQL Interview Problem | Data Analytics
https://lnkd.in/gS_Yqq6c
7. Tiger Analytics SQL Interview Question for Data Engineering Position
https://lnkd.in/ghjE_CXp
8. PwC SQL Interview Question | BIG 4 |Normal vs Mentos Life ๐
https://lnkd.in/g9SkkX9x
9. Honeywell SQL Interview Question | Print Movie Stars (โญ โญ โญ โญโญ) For best movie in each Genre
https://lnkd.in/gSDgB9Me
10. Angel One Easy-Peasy SQL Interview Question for a Data Science Position
https://lnkd.in/geaU3we7
11. Practice FAANG SQL Interview Questions For Free | Ace The SQL Interview | Data Analytics
https://lnkd.in/g4AFgen3
12. Accenture SQL Interview Question | Database Case Sensitivity vs Insensitivity
https://lnkd.in/gR6F_8zf
13. American Express SQL Interview Question and Solution | Page Recommendation
https://lnkd.in/g_sMN26m
14. Fractal Analytics SQL Interview Question (Game of Thrones Database) | SQL for Data Engineer
https://lnkd.in/gGcsBms5
15. Netflix Data Cleaning and Analysis Project | End to End Data Engineering Project (SQL + Python)
https://lnkd.in/gS8mT7Fn
16. Swiggy Data Analyst SQL Interview Question and Answer
https://lnkd.in/gSyhmmhd
17. Cracked Myntra as Data Analyst with 1 Year Experience
https://lnkd.in/gekpAit8
18. PwC SQL Interview Question for a Data Analyst Position | SQL For Analytics
https://lnkd.in/gyD5Pjny
19. PayPal Data Engineer SQL Interview Question (and a secret time saving trick)
https://lnkd.in/gAJ_Ug79
20. Adobe Interesting SQL Interview Question | Solving Using 2 Approaches | Data Analytics
https://lnkd.in/gEEAfi8j
21. Walmart Labs SQL Interview Question for Senior Data Analyst Position | Data Analytics
https://lnkd.in/gRBPb-ms
22. PayPal SQL Interview Problem (Level Hard) | Advanced SQL Problem
https://lnkd.in/gGZaYt6N
Ref: Abhisek Sahu
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
Here , I have listed out all SQL interview questions for your easy reference.
1. Amazon SQL Interview Question for Data Analyst Position [2-3 Year Of Experience ] | Data Analytics
https://lnkd.in/g2RzsKdq
2. Airbnb SQL Interview Question | Convert Comma Separated Values into Rows | Data Analytics
https://lnkd.in/gpMbU-dF
3. Adobe Interesting SQL Interview Question | Solving Using 2 Approaches | Data Analytics
https://lnkd.in/g_-_9ymd
4. Spotify SQL Interview Problem | Top 5 Artists | Aggregation and Window Functions in SQL
https://lnkd.in/gtfaugd3
5. L&T Technology Services SQL Interview Problem | Print Highest and Lowest Salary Employees in Each Department
https://lnkd.in/ggY82FJW
6. Ameriprise Financial Services, LLCSQL Interview Problem | Data Analytics
https://lnkd.in/gS_Yqq6c
7. Tiger Analytics SQL Interview Question for Data Engineering Position
https://lnkd.in/ghjE_CXp
8. PwC SQL Interview Question | BIG 4 |Normal vs Mentos Life ๐
https://lnkd.in/g9SkkX9x
9. Honeywell SQL Interview Question | Print Movie Stars (โญ โญ โญ โญโญ) For best movie in each Genre
https://lnkd.in/gSDgB9Me
10. Angel One Easy-Peasy SQL Interview Question for a Data Science Position
https://lnkd.in/geaU3we7
11. Practice FAANG SQL Interview Questions For Free | Ace The SQL Interview | Data Analytics
https://lnkd.in/g4AFgen3
12. Accenture SQL Interview Question | Database Case Sensitivity vs Insensitivity
https://lnkd.in/gR6F_8zf
13. American Express SQL Interview Question and Solution | Page Recommendation
https://lnkd.in/g_sMN26m
14. Fractal Analytics SQL Interview Question (Game of Thrones Database) | SQL for Data Engineer
https://lnkd.in/gGcsBms5
15. Netflix Data Cleaning and Analysis Project | End to End Data Engineering Project (SQL + Python)
https://lnkd.in/gS8mT7Fn
16. Swiggy Data Analyst SQL Interview Question and Answer
https://lnkd.in/gSyhmmhd
17. Cracked Myntra as Data Analyst with 1 Year Experience
https://lnkd.in/gekpAit8
18. PwC SQL Interview Question for a Data Analyst Position | SQL For Analytics
https://lnkd.in/gyD5Pjny
19. PayPal Data Engineer SQL Interview Question (and a secret time saving trick)
https://lnkd.in/gAJ_Ug79
20. Adobe Interesting SQL Interview Question | Solving Using 2 Approaches | Data Analytics
https://lnkd.in/gEEAfi8j
21. Walmart Labs SQL Interview Question for Senior Data Analyst Position | Data Analytics
https://lnkd.in/gRBPb-ms
22. PayPal SQL Interview Problem (Level Hard) | Advanced SQL Problem
https://lnkd.in/gGZaYt6N
Ref: Abhisek Sahu
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
lnkd.in
LinkedIn
This link will take you to a page thatโs not on LinkedIn