fabiochiu/medium-articles huggingface dataset:
Moving and Other Disruptions.
By: Jordan Noeding
Tags: Selfpubishing, Book Cover Design, Disruption, Authors, Books

Moving and Other Disruptions.

The view during our hike at Acadia National Park, ME 2019. Photo taken by Anthony Burden

The first book is ready to be sent to a professional editor who will, no doubt, find plenty to say. I am excited this step is so close. It feels like the light at the end of a very long tunnel. However, there is some other news that has disrupted this process, we are moving to Maine. The timing during a pandemic is not ideal but the opportunity was something we couldn’t pass on. My husband and I have fallen in love with the state on several occasions and are excited to call it our home soon.

I feel like updates about the book have been very few lately. It is because up until this point I had been spending most of my time editing and then transferring those edits onto the digital manuscript. Not very newsworthy. I have continued to write notes for the other books in the series. Although my work has stalled on the second book’s manuscript in order to focus my attention on the first, I continue to constantly think about it. It is amazing how much I think about this series on a regular basis. Mental, really.

I really do feel bad about my radio silence these past months and so, I would like to present a little project I have been working on … the book cover. I know the book won’t be released until likely summer 2021, but I can’t help but design when I’m not writing. The website for the series is fully designed and the plan is to build it when the editor is tearing apart my manuscript. Anyways, enjoy the little taste of what the cover will look like and I hope the few of you that bother reading these posts, like it.

Book cover for The Silent Are Rising. Designed and Illustrated by: Jordan Noeding 2020

As a general warning: it is likely there may be another month or so of silence from me as we pack our house and move our lives to a different state. My Instagram is easier to update more frequently and so is my Facebook page. Unfortunately for my starving audience, the blog will probably be neglected for a bit …
One Mental Trick To Beat Perfectionism For Writers
Tags: Psychology, Writer, Life Lessons, Perfectionism, Authors

Perfectionism is the tendency to try and do everything “perfectly”.

Are you or anyone you know perfectionistic?

I’ve certainly suffered from perfectionism from time to time. Partly, it’s brought on by the school. I’m finishing up my last year of study and will be graduating in about half a year.

Throughout my time in school, perfectionism fades in and out and sometimes it can be debilitating as it prevents me from starting or finishing an assignment. Do you experience the same thing too?

I didn’t use to be like this as grades weren’t something that I thought I needed to get me further in life. Then, I got to high school and all of a sudden, grades matter. It would mean the difference between a good university or not. A good university could mean a better job prospect and thus higher income. Furthermore, the hope of getting into a grad school was almost solely determined by grades alone. In shorts, I had to get really high grades and it brought out the perfectionistic trait I never thought I would have.

We plan and plan and we contemplate. It may take us a long time to start and in certain scenarios, we never do start. Perfectionism takes over all areas of life. From writing, body image, sport, to relationship.

It’s okay to not be “perfect” all the time. Perfection is subjective. What is perfect for you may look imperfect to me. What is imperfect to you may be perfect for me.

If you are like me and you are sick of being a perfectionist, or you would like to know how to deal with it better, here is a little trick I would like to share.

“Don’t overthink, just do it”.

Whatever you are working on, just do it. If you are a writer and you are struggling to start on that “perfect” article, don’t try to make it “perfect”, just write. No one will see the draft until you give them permission to. Once you have something down, you can start editing it. Don’t edit before you are done. Seeking perfectionism may mean sitting too long on the idea. Sometimes it’s best to let your intuition do the work.

There are many times in which I decided to write an article with a specific word count in mind. “It’s not going to take too long, just a short 500-word piece”. I ended up with way more word count in the end because once I started, the words started flowing.

You are always practicing and enhancing your craft. Your best piece may not be the one you’re writing now and it doesn't have to be. Why should it be? You got your whole life in front of you to keep trying. One day you may look back and realized how far you’ve come. If you have never taken that first few steps of trials and errors, you would never get to where you are now. You would never get as good as now.

Perfection is an illusion. Don’t strive to be perfect. Try to just be natural. What’s natural may change with the amount of practice and experience you have.

Let your creative juices flow. Don’t be a perfectionist, let your default network take control.
“Get Up! It is not over, yet.”
By: Odinaka Ugwuozor
Tags: Action, Motivation, Beginning, Authors, Startup

16.12.2020

This means it has been approximately 350 days since you reeled off a list of 'promises' (in our annual 'new resolutions' ritual).

The dreadful reality is that you possibly have not crossed as many t’s nor dotted many i’s as hoped. The frustration might have succeeded in sending a storm of worry and anxiety through your pores.

A casual peep through your fingers reveals a damning list of plans that never took off. Many, you forgot were made in the first place.

You probably planned to (and been planning to) read a book every week this year and have not touched one, yet. It is still not late to pick a book TODAY and read a CHAPTER.

It might not qualify as a book but you would've at the very least read part of a BOOK (emphasis with intent).

The point I'm trying to make: don't write this year off as waste, yet. You can still perform a miracle by doing ONE thing with INTENT.

Did you want to complete 10 online courses, particularly at the outset of the COVID-19-induced lockdowns across several Countries? (Who didn’t?! I legit registered for over 20 courses. Kindly do not ask how many I walked over the finish line. Thank you.)

Well, you could pick one, anyone, and simply take the first module. Forget the scope of the course and focus on diligently and patiently getting to the end.

If December 31, 2020, catches up with you while still on it, don't fret. Remember your development will not be reset on account of calendar changes. Thank you.

Take this attitude across several other decisions you’ve been struggling to tackle and start nibbling. It’s never too late.

This is what I’m doing now...PUBLISHING my first 'Medium' article (several years after I pledged to do so).

*gets up and pours me a drink*
Introducing Me: Tirza Schaefer
By: Tirza Schaefer
Tags: Tirza Schaefer, Author, Romance Novels, Books, Spiritual Coach

I thought for my very first post here, I should introduce myself and tell you a little bit about me.

My name is Tirza Schaefer (for real, not a pen name), author of 30 books, mainly steamy romance, but also of a variety of spiritual subjects. I love both aspects of my work and both cross over into each other at times as well.

From childhood, I have been a fan of fictional characters who were heroic, chivalrous and loyal. I loved those who were warriors of a kind, not easily subdued but fought for justice and treated others with kindness. They would not shirk self-imposed responsibility and thus, as I grew into adulthood, I wrote, read and watched many romance stories. It took a long time for me to come out of the closet, but in 2015, I published my first books and, notwithstanding the fact that I lost almost two years to health issues, I have now published 30 books of which one anthology that was compiled together with some other authors has been unpublished again. The story I contributed will be available in spring next year in an extended version.

I have been on a spiritual quest since childhood which took me all the way from institutionalised religion to self-empowered spiritual coaching. I love working with archetypes and help others to get to know themselves better and step more into their own innate power with my teachings on Goddesses, Gods, Power Animals, etc.​ in my Divine Library.

Click on this link to visit my website and explore to your heart’s content.

As a person, I am a German exophone author who has lived in the UK for a number of years before returning once again to Germany and working and writing in English, my favourite language in the world. I have three amazing children, two of whom are grown ( son, 21, daughter 18) and have already left home. and my youngest (daughter, 13, also referenced as “Little Buddha” by those who know her) is still at home. Together with our super cute cat, we make a great team, like to sing and dance through the house and crack jokes, laugh, giggle, or hold deep conversations, learn from each other or just do our own thing. I am exceedingly proud of and deeply love all my children.

If you would like to read my official bio, you can do so on the About page on my website.
https://ivmpodcasts.com/paperback-episode-list/2020/12/16/ep-72-publishing-infinity
By: Satyajit Roy
Tags: Publishing, Book Recommendations, Authors, Podcast, Books

https://ivmpodcasts.com/paperback-episode-list/2020/12/16/ep-72-publishing-infinity

'Paperback' is back!

On this very special episode we talk about our journey hosting 'Paperback', and how coversations with authors brought to our notice the issues that they face in the Publishing Industry, as it exists today.

Our conversations turned into learnings when we launched our own publishing house, and to that effect we have launched Publishing Infinity, a new age, digital first, publishing house, where we publish dynamic and interactive e-books called 'PI Books'.

We discuss how we are different from traditional publishers.

- Offer Royalty starting from 30% (goes upto 70% for 'Pi Books')

- Sales Reports every month with real time dashboard for authors

- Offer Print on Demand for physical books

- Digital Integration across your social platforms (images, audio, video, social media websites etc)

- Linking back to the authors page so you never lose a reader

If you are an author, or creator, ready to share their work with the world, get in touch with us, and well help you get a bigger slice of the Pi(e) 😉!

If you are a Publisher, we offer our platform as a service, do reach out, we look forward to working with you'll!
Security Expert and Author Decides to “Speak On It!”
By: Leumas Publishing Llc
Tags: Security, Interview, Authors, Podcast, Books

https://player.vimeo.com/video/490907900

Speak On It! Podcast: Security Expert and Author Samuel Griffin III

from Tigerlily Communications on Vimeo.

“You cannot let anyone else determine what your outcome is going to be in your life,” said Leumas Security Services Founder Samuel Griffin III during his conversation with Speak On It! Podcast host Felicia Hodges. Click to hear the full interview [16:46]

Griffin spoke with Hodges about why he wrote his new book Rent-A-Cop Reboot, how he built a private security career, and how the book can help others do the same thing.

About the book’s title, Griffin said, “Security guards are not rent-a-cops. They’re security professionals. In some states they have the same authority” as law enforcement.

He also talked about how “the book is more of a workbook” that the reader can use to help set and reach whatever goals they want to achieve. The book “helps motivate you to stay on track to become a security officer.”

The COVID-19 pandemic also came up during the discussion, and the book itself talks about the impact of the early months of the pandemic on Griffin’s business. However, Griffin hasn’t let the pandemic change his true bottom line: helping and motivating people.

“Whenever I do something I want to see what I can do to help others,” Griffin said.
The Great Essay-Writing Machine
By: Donald J. Robertson
Tags: Writers On Writing, Creativity, Writing, Authors, Books

The Great Essay-Writing Machine

Photo by hannah grace on Unsplash

I’m a writer. I was known for enjoying writing in my youth, as a schoolboy, but it was never my intention to do it for a living. Still, here we are... I’m the author of about six books and counting. I’m just finishing a graphic novel for one major publishing house, and about to start a biography for another. It seems like all I do these days is, well, write.

I find that sometimes writing comes easily. Usually that’s at about 3am in the morning, unfortunately, when normal people are asleep. Years and years ago, when I was stuck working on an essay, I decided to write down some questions and make myself answer them in order to get unstuck. I found it helped.

I still use the same questions when I’m writing nonfiction books and articles. Sometimes when my friends have told me that they’re stuck trying to write an essay or book chapter, I’ve shared my questions with them. They’re tough questions so it can be a bit annoying. If you’ve got the patience for it, though, they often seem to help. So here they are…

Essay-Writing Machine
Elegy
By: Authorpædia, The Authors' Encyclopedia
Tags: Poems On Medium, Poem, Poetry On Medium, Poetry, Authors

By Chris Douglas (C.S. Douglas)

If I could hold your hand once more, a little more,

As when we first have met so many years ago…

Ours would be the youth, for age shall never flow

As we’d forever stop the time into eternal yore.

If I could kiss you again the way I once have done

To when we first have kissed with tremor in our lashes

Ours would be the history — lest pages turned to ashes,

As we’d rewrite its chapters as if Time just begun.

If I could turn the clock the way my memory runs

To where there is no age, no fear, and no pain;

Ours would be Eternity — and ‘midst the gods we’d reign

As we would own the Universe with billions of its Suns.

If I were born a God from nothing born before

To where I could design a Universe anew

Ours would be the future and our children’s, too;

As we would doom no end upon life — evermore.
You Should Be Reading JG Ballard in These Dystopian Times
By: Jason Ward
Tags: Dystopian Fiction, Authors, Books, Reading, Ballard

You Should Be Reading JG Ballard in These Dystopian Times

Photo by Florencia Viadana on Unsplash

JG Ballard was an English writer who died in 2009. He wrote several books, short stories, and essays and is one of my favourite authors. His writing is best described as ‘genre-bending’. They can be science fiction, modern-dystopian, surreal, weird or controversial. Or all those things at the same time.

In fact, his work is so distinctive it even became an official adjective. The Collins English Dictionary defined ‘Ballardian’ as work:

Resembling or suggestive of the conditions described in Ballard’s novels and stories, esp dystopian modernity, bleak man-made landscapes, and the psychological effects of technological, social or environmental developments.

While certain themes, such as man-made dystopia, are prevalent in his work, the stories themselves are incredibly different. Ballard was originally associated with the New Wave of science fiction but that changed as he developed and tried new things out.

Ballard simply described his writing as ‘speculative fiction’.

Some of his work was experimental, such as The Atrocity Archives while others were more controversial, such as Crash — which later became a controversial movie by David Cronenberg.

A Ballardian novel or short story is distinctive. It can be dream-like and surreal. His prose can suck you in and immerse you in his strangely believable worlds. Some are pretty hard to get into but others are short, interesting and enjoyable. No matter the topic or scenario, he was a superb writer.

In case you don’t know his work, here I’ll give you a random sample. It would be hard to give a ‘best of’ due to the huge variety of his output. What appeals to one Ballard fan may be disliked by another.

Here are six JG Ballard books in case you feel like giving him a go. I have tried to keep the selection varied but they all deal with humanity and dystopian scenarios brought about by our actions. Perfect reading for the end of 2020 and the world we find ourselves in.
Question
By: Authorpædia, The Authors' Encyclopedia
Tags: Poems On Medium, Poem, Authors, Poetry

By Chris Douglas (C.S. Douglas)

Did anyone ask me

Before I was born

If I wished to live

Or to reborn?

They threw my name

On a worthless paper

And hand it

To my Mother.

Why was I given

A Birth Certificate

Instead of a

Death Certificate?

A certificate

Stating,

“HERE LIES

ANOTHER”
She was a hacker. He was a botnet.
By: All You Need Is Code
Tags: Dating App, Phishing, Cybersecurity, Dating, Hacking

When we arrived to the cabin, the weather was beyond perfect. We swam, we cook, we hiked, we read and we slept. Around 7 pm we started to fill the chills of an autmnish dutch evening and we decided it was moment to jump in our pajamas, get some martinis and start to swipe right. We knew that we promised no guys, but technically they were not there. At least that is what we thought.

It was around 9:00 pm when this astonishingly good looking guy started a conversation with my friend. He was less than 1 km away, so we thought that if things were going right, we may break one rule. Or two:

-Hey beautiful neighbor! How is the wild life treating you? -Life here is good thanks. This weather suits me very well. -Wow! Quite a revelation for a lady coming from Sao Paulo.

Our brains froze a little. How this guy knew my friend was coming from Sao Paulo? She was always very careful disclosing her personal information in dating apps. Thanks to our pen-tester jobs, we knew that social media was the perfect place for future social engineering attacks.

-How did you know I come from Sao Paulo? -Well… I may be honest, and maybe I stalked you a little bit on Facebook. -Well, that is even weirder because I don’t have Facebook.

There was a long pause when he didn’t answer. We were hyperventilating, not knowing if this guy was going to answer again and astonishingly worried by the fact that according to Tinder, he was less than 1 km away.

And then, after 10 min he answered:
Building a Smart Socket
By: Atanda Abdulsemiu
Tags: Arduino Uno, Smart Home, Sparkfun, Electronics, Hacking

Prototyping

It’s common practice in Engineering to not immediately build out the finished product but rather build a test that you can play with and correct features as needed and for that you’ll need the following

Breadboard

Jumper cables

2 LEDs

2 560ohm resistors

Once you have all the items listed above, you can start getting some code together. Open your Arduino IDE and paste in the code below

Web controllers relay switches program

After pasting the code above in your Arduino IDE, create an arduino_secrets header file to hold required variables about your home network SSID, password and secret request authentication token.

Prototype with two relays controlling two LEDs

Assembling the prototype above is pretty straightforward. However, if you are not familiar with how to use a breadboard, you might want to check out this tutorial from Sparkfun.
CryptoRhythm: Analyzing and disrupting a PayPal scam (with love and toucans!)
By: Wyatt Tauber
Tags: PayPal, Penetration Testing, Cybersecurity, Scam, Hacking

Dear customer. Your Account Has Been Blocked. Please check your account information by clicking the link below.

At this point, we’re all used to receiving a few (if not tens or hundreds of) scam emails a week. Modern email services do an outstanding job of keeping these messages relegated to the spam folder through SPF, DKIM, and DMARC authentication. Still, a message or two will slip through on occasion. Such was the case when I found the following email in my inbox about a week ago.

A PayPal scam email sent from hello@mynumerology(dot)in

Disclaimer: I don’t recommend clicking on spam links, even to pentest the website. If you choose to do so, be sure to use a VPN.

Initial contact

As one of the world’s largest online payment systems, PayPal is an obvious target for hackers and scammers. Groups on the dark web frequently sell compromised accounts on the site for as little as $200. Like the one above, these emails will attempt to draw out various sensitive details from users like account passwords, payment information, social security numbers, images of government IDs, and information PayPal itself doesn’t even collect, such as debit card PINs.

While purporting to be sent from the official PayPal email service@paypal.com, this email is actually from hello@mynumerology(dot)in using an account named ‘service@paypal.com’. This technique is usually easy to spot because most email services show the sender's name and email in the message header.

I decided to do a bit more reconnaissance before proceeding to the scam website. mynumerology(dot)in indeed does not provide SPF or DMARC records that authenticate email sent from its domain, allowing scammers to spoof email from it.
CYBERTALENTS CTF : “This is Sparta” write up.
By: Avinash Pratap Singh
Tags: Challenge, Capture The Flag, Cybersecurity, Hacking, Ctf Writeup

As you can see that there is some suspicious code inside <script> tags.

So let’s analyse these encoded lines. On searching for the format that they are encoded in for example \x76 or \x61 etc. I found a web tool http://ddecode.com/hexdecoder that can decode our code and give us some useful one so that we can understand it.

The code that we want to analyse is :

“var _0xae5b=[“\x76\x61\x6C\x75\x65”,”\x75\x73\x65\x72",”\x67\x65\x74\x45\x6C\x65\x6D\x65\x6E\x74\x42\x79\x49\x64",”\x70\x61\x73\x73",”\x43\x79\x62\x65\x72\x2d\x54\x61\x6c\x65\x6e\x74",”\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x43\x6F\x6E\x67\x72\x61\x74\x7A\x20\x0A\x0A”,”\x77\x72\x6F\x6E\x67\x20\x50\x61\x73\x73\x77\x6F\x72\x64"];function check(){var _0xeb80x2=document[_0xae5b[2]](_0xae5b[1])[_0xae5b[0]];var _0xeb80x3=document[_0xae5b[2]](_0xae5b[3])[_0xae5b[0]];if(_0xeb80x2==_0xae5b[4]&&_0xeb80x3==_0xae5b[4]){alert(_0xae5b[5]);} else {alert(_0xae5b[6]);}}”

Decoded Results

So we found the code that was encoded under the <script> tag.

Let’s analyse what the code says.

Decoded results of that code:

“var _0xae5b=[“value” , ”user” , ”getElementById” , ”pass” , ”Cyber-Talent” , ” Congratz“ , ”wrong Password”];

function check() { var _0xeb80x2=document[_0xae5b[2]](_0xae5b[1])[_0xae5b[0]];var _0xeb80x3=document[_0xae5b[2]](_0xae5b[3])[_0xae5b[0]];if(_0xeb80x2==_0xae5b[4]&&_0xeb80x3==_0xae5b[4]){alert(_0xae5b[5]);} else {alert(_0xae5b[6]);}}”

Decoded Results Explanation

var _0xeb80x2=document[_0xae5b[2]](_0xae5b[1])[_0xae5b[0]];

If we further decode this code says “_0xeb80x2” variable stands for :

“document[getElementById](user)[value]”

if we see the source code then, it corresponds to the username input tag

so _0xeb80x2 = username.

Similarly analyse the others. Lets come to the main conclusion.

We have an array with 7 elements, and I have explained in the above diagram that focus on the if condition, is the “if conditions” turns out true it displays “Congratz”. So it might give us something important or may we we can get logged in. So for the if condition to be true we can see in the above diagram we have to input our username and password both to “Cyber-Talent” and hit enter.

flag popup window

As you can see on entering the credentials as mentioned and explained above we got the flag in a pop up alert dialog box.

Thank you for reading this story.

Follow me for more updates and stories on CyberSecurity.

Avinash Pratap Singh

LinkedIn , Twitter

My Instagram Page for regular updates: hackersdad_

Thank you. See you next time.
Account Takeover via login with OTP 🏆
By: Suraj Bhosale
Tags: Account Takeover, Bug Bounty, Ato, Hacking, Brute Force Attack

Hello Guys, I am Suraj Bhosale from Maharashtra, India. It’s my first bug bounty write-up which allowed a malicious user to takeover any account on the target site. This bug was discovered on a private bug bounty programs so I’m not allowed to reveal the name.

Introduction

Most of ATO I found was actually a logical flaw which didn’t really require much technical skills. Basically, it was just thinking a little bit out of the box.

The Vulnerability

Let’s assume the vulnerable web-application was redacted.com

There were 2 ways for a user to login to the application, either with username and password or with a mobile number and otp received on that number.

I decided to test the otp functionality. If you are an experienced hacker you might know there are many ways to bypass otp. Here I will be discussing the simplest way to bypass OTP i.e by brute forcing the otp.

when login with mobile, I entered my number and submitted the request. I captured this request in burp suite and sent that to the intruder for brute forcing. I observed after 5 incorrect otp attempts, got an error otp has expired please generate a new otp. I generated the new otp, again after 5 attempts it gave me the same error. I followed this process multiple times and I was able to generate new otp ’n’ number of times.

By now your hacker mind should tell you what is the exact problem here? If you are not able to guess then lets proceed further with the exploitation.

The flaw here is, it has rate limitation when we enter the otp but it does not have rate limitation when we generate the new otp.

What the heck how can I make use of this?

Exploitation

As it was using 4-digit otp, it was very easy to brute-force.

Lets write a python exploit which will automate everything which we have discussed earlier.

In our exploit, I have hardcoded 5 random OTP’s i.e 1000, 1001, 1002, 1003 and 1004.

There are 10,000 possible combinations that the digits 0–9 can be arranged into to form a four-digit code. At some point of time, we will get the correct otp out of those 5 otp’s which we have hard-coded.

When we run the below script it will sent 2 POST requests i.e one to generate the otp and the other one to enter the otp 5 times. So until and unless our script hits the correct otp it will keep on executing the script.

I just need to know victims mobile number which I can use for exploitation using the below script.

Please Note: In above script, You will need to modify the header’s and POST body parameters according to your target.

You can follow me on Twitter https://twitter.com/c0nqu3ror or Linkedin https://www.linkedin.com/in/suraj-bhosale-876b2937/ where I share bugbounty related content. Till next time, happy hunting!
hacking devices
By: The Hackerzspot
Tags: Hacking Tools, Hacking

Hello everyone, Welcomes to The Hackerzspot. Hacking devices are a device which was scripted by hackers to hack and extract data/information from victim web applications, computer systems, and phones. they are many types of hacking devices used by hackers for a different purpose. I am listing some of the hacking devices for you.

NOTE:-This is only for educational purposes. Don’t use this for any illegal activities.

1.Lan turtle

A Lan turtle is a hacking device used for administrative purposes mainly in offices namely IT companies to watch/surveillance the employee’s computer systems and also act as a penetration testing tool providing stealth remote access, network intelligence gathering, and man-in-the-middle surveillance capabilities through a simple graphic shell.

2.Raspberry pi

4.Ubertooth one

Ubertooth one is a hacking device it is an open-source Bluetooth test tool.we can able to a man-in-the-middle attack by using this Ubertooth one. when there are 2 devices sharing their data through Bluetooth, then hackers easily steal the data with Ubertooth one device with a man-in-the-middle attack.

5.Hardware keylogger

A hardware keylogger is a hacking device that similar to a rubber ducky USB. But the major difference between both is rubber ducky USB is scripted by a hacker for various purposes of hacking and the hardware keylogger is works for only one purpose keystroke logging. It is used to capture data that have we typed in our computer systems namely usernames, passwords, and confidential data.

I hope this post is helpful to you. If you facing any trouble comment below and also try all these hacking devices. thanks for visiting💓
Make A Admin Panel Brute Force Easily [PYTHON]
By: Paiwand Kawa Ahmed
Tags: Ethical Hacking, Python, Cybersecurity, Bug Bounty, Hacking

You need a import some module in a Python to make this brute force

1-Requests

2-Sys

3-OS

4-WebBrowser

PoC:

This Is Module We Use It For This Brute Force

import requests import sys import os import webbrowser

Q/Why We Need A Requests ?

A/Because we send a GET requests to check links if link available or not we can use a urllib.requests but requests better than

After that we make a variable and in variable we make a input function to input a website link (Thats Beginners method but if you can use argparse or optparse thats no problem but we use a input better for beginners)

url = input("Input A WebSite:") if "http://" or "https://" not in url: x = "http://" + url + "/" else: x = url

I Think you have a question how if works in url ?

Answer:this if statement working if you input a website without http:// or https:// this if statement add automatically a https:// but if your input have a https:// or http:// this only change a url variable to x

Why We Change Url To X ?

Answer:In first if statement we gave a x in else again we gave x again

After that we add a admin links in a python

This Is admin link in Python

https://pastebin.com/raw/MBz30btZ

After that we add a admin links and gave a variable , variable name is ad

after that we change ad to passe and we use a loop to check links

in the picture we use a for hani in passe: hani exactly is a variable like x = 1+1

After that we make a variable called a curl this curl work add a website link and admin panel links

For Example:

x = https://www.google.com/

hani = admin links ex:admin.php

curl = https://www.google.com/admin.php

for hani in passe: curl = x+hani

After that we use a try, Why Try ?

Answer:Because we need a hide a error code and we gave a error type

and we gave a variable url1 this url1 working a send requests to website

Focus a requests.get(curl).status_code , this method is test a responsfe if responsfe equal 200 this website is work but responfe equal 404 this website is not work

for this method we gave a if statement in area

if url1 == 200: print("Url IS OK >> " + curl ) elif url1 == 404: print("URL IS NOT WORKING " + url1)

after we add a if statement we add except KeyboardInterrupt:

this KeyboardInterrupt works a if you use ctrl+c in A Tool this tool automatically close a tool and gave you a print

i hope this method is useful for beginners Thanks For Reading This

Goodbye .
Full Address Bar Spoofing On Opera Mini Android
By: Piyush Raj
Tags: Security, Cybersecurity, Vulnerability, Bug Bounty, Hacking

I found a race condition flaw which caused browser to preserve the address bar and to load the content from the spoofed page. Address bar spoofing allows for attacks where a malicious page can spoof the identify of another site.

Summary

During my testing, it was observed that the browser allowed JavaScript to update the address bar while the page was still loading. Upon requesting data from a non-existent port the address was preserved and hence a due to race condition over a resource requested from non-existent port combined with the delay induced by setInterval function managed to trigger address bar spoofing. It causes browser to preserve the address bar and to load the content from the spoofed page.

Impact

Opera Mini Android is installed on more than 500,000,000+ devices. The vulnerability gives attackers the ability to steal data using phishing or spread misinformation using legitimate domains.

Most Address Bar Spoofing vulnerabilities are not very practical but this vulnerability not only spoofs the address bar, but also makes the spoofed web-page completely responsive so the attack becomes practical.

Expected behavior

The browser should handle load events in expected order when JS redirects page before sub-resource load finishes.

[1] https://bugs.webkit.org/show_bug.cgi?id=194131

[2] https://bugs.webkit.org/show_bug.cgi?id=194208

Reproducibility

1) Visit the following link for the vulnerable browser — https://0x48piraj.com/--REDACTED--/operafabs.html

2) You will notice that the URL is pointing to https://www.opera.com:8080/, however the content is hosted on 0x48piraj.com.

The Great Plot

So, it all started when I got a reply from Opera Software saying,
Russian crypto-exchange Livecoin hacked after it lost control of its servers
Tags: Livecoin, Cryptocurrency, News, Bitcoin, Hacking

Hackers gained access to the Livecoin portal and modified exchange rates to 10–15 times their normal values.

Russian cryptocurrency exchange Livecoin posted on message on its official website on Christmas Eve claiming it was hacked and lost control of some of its servers, warning customers to stop using its services.

According to posts on social media, the attack seems to have happened on the night between December 23 and December 24.

Hackers appear to have taken control of the Livecoin infrastructure and then proceeded to modify the exchange rates to gigantic and unrealistic values.

Before Livecoin admins managed to gain back access to some of their systems during late December 24, the Bitcoin exchange rate had ballooned from the regular $23,000/BTC to more than $450,000/BTC, Ether grew from $600/ETH to $15,000, and Ripple price increased from $0.27/XRP to more than $17/XRP.

Once the exchange rates were modified, the mysterious attackers began cashing out accounts, generating gigantic profits.

In the message posted on its website, Livecoin admins described the incident as a “carefully planned attack, which has been prepared, as we assume, over the last few months.”

“We lost control of all of our servers, backend and nodes.

Thus, we were not able to stop our service in time.

Our news channels were compromised as well,” the company said.
Let’s shut down the Internet
By: Punit Gupta
Tags: Internet, Hacking, Sunrise

I have been talking about the Internet for over a decade now and even amongst the IT crowd, people often miss the fact that even before a web request hits the intended web server, a DNS query has to be made to a DNS server to determine the IP of the webserver. To the uninitiated, DNS stands for Domain Name System and it is like the phonebook on your cell phone.

Comparing Contact entry to a DNS entry

Every domain name, like, google.com has 1 or more entries like the IP addresses of the server and IP address or hostname of the servers handling the mails.

There are thousands of DNS servers worldwide. At least every ISP has one and they provide it to you when setting up the Internet connection for you. The address of the DNS server can be specified at the Router level or on each device. In most cases, the Router is responsible for providing the DNS server address to all the devices that connect to it. One of the most popular DNS servers is 8.8.8.8, which is managed by Google.

If you lose access to the DNS server, your devices will not be able to figure out how to access any website.

Brainstorming in progress!

Here is the plan in brief:

Hack and connect to the WiFi router. Bypass the authentication for the router configuration page. Change/remove the DNS entry. Force the devices to reconnect to the Router for the new changes to take effect.

It wasn’t really that hard to execute this. We found an excellent article to execute step 1 — How to Hack WPA/WPA2 WiFi with Reaver.

Step 2 was easier than we thought. Mr. X had a D-link router, specifically, DSL-2888A router which has a known Insufficient Authentication (CVE-2020–24579) issue.

Here is the Proof-of-concept video: https://player.vimeo.com/video/491824274

Once inside, changing the DNS to something invalid, ie, step 3 was easy.

DNS Settings in DSL Router

Unexpectedly, step 4 was the toughest part as we had to get out of the house to execute it. To force the devices to connect, either Mr. X had to go out of his house (or outside the range of the Wi-Fi router) or we had to restart the router. Given the lockdown due to the COVID-19 pandemic, the former was unlikely. The most athletic guy in our group is the birthday boy — CSS. He jumped across the common wall and flipped the MCB switch, forcing all electronic devices connected to a power source to restart, which included the WiFi router.
How To Find Out Which Cybersecurity Career Is Right for You?
By: Nishu Jain
Tags: Penetration Testing, Cybersecurity, Technology, Careers, Hacking

The Art of Finding the Right Career

It is sometimes a huge struggle to find the perfect job or career that aligns perfectly with your skillset and capabilities. However, this does not have to be the case every time. There are ways by which you can analyze and identify if a certain type of job position or career area is right for you or not.

Below is a three-step highly effective method by which you can instantly figure out if whether a certain career choice is right for you or not.

What’s more? You can apply this method not just for finding suitable cybersecurity careers, you can use this method for identifying suitable careers in any other industry too.

Let’s get started!

Step 1: Note down your education & professional skills

The first step in finding your perfect job or career choice is that you make a list of your professional skills along with your education. In that list, mention all your technical, personal, and interpersonal skills that you possess. Likewise, list your educational background details, including any certifications and degrees.

Step 2: Studying Job descriptions and requirements

After you have compiled your list containing your skills and education details. Make a cup of tea or coffee, whatever that you prefer, turn on your laptop, and start studying at Indeed, Monster, and Ziprecruiter to view different cybersecurity and technology-related jobs.

Cybersecurity job descriptions differ for different job positions and types. By studying them, you can easily understand what companies expect from a professional in certain job positions.

Similarly, you can compare the skills that are required by companies to the list of skills that you have. This will help you instantly figure out if you have the right skill set that is required by companies or not.

Step 3: Make an educated decision

After you have carefully researched and studied the job descriptions of various positions and careers of your interest, it's time that you make a decision.

If your interests, skills, and education align with the job requirements of companies, then pursue a career in that particular area. However, in case your skills and abilities mismatch the job requirements, then explore other types of similar roles and figure out which job position requires the skills and education that you have, and go in that direction.

In case, there are no jobs that match your level of skills or education, then you have to upgrade your arsenal by studying more, like acquiring highly demanded cybersecurity training certifications.

On that note, let’s explore some of the most popular and entry to mid-level job positions that you can get started in easier as compared to other job titles.
Defend The Web — JavaScript CTF Write-Up
By: H Shtalk
Tags: Hacking, JavaScript, Ctf, Ctf Writeup

Defend The Web is a website for solving Capture The Flag challenges. It provides a variety of challenges with different difficulty levels and covers several domains.

Intro 3

The problem: A blank password prompt given.

The solution: Opened inspect element and looked through the java script code. At the bottom, there was a keyword which was the solution to the challenge.

Intro 10

The problem: Password prompt asking you to enter a password.

The solution: After inspecting the page source, in the java script of the code there was a password, hex encoded: \x39\x32\x30\x61\x61\x30\x34\x36\x63\x38. Decoded this to text, using this tool: http://www.unit-conversion.info/texttools/hexadecimal/, and got the password: 920aa046c8

Intro 11

Problem: Password prompt where password is required.

Solution: Initially when clicking on the link to the challenge the URL is https://defendtheweb.net/playground/intro11?input. What can take your attention is that there is a question mark in the URL. So what does that mean?

A question mark in the URL represents the start of a query string, which is a set of key-pair values that are used by the server hosting the website. For example, if we have a website such as https://animal-pictures.org/animals, we would expect this search to return a page with a list of animals, however if the URL is https://animal-pictures.org/animals?location=CA, then this page would also show us a list of animals, but that list would be filtered and showing us only pictures of animals that were taken in Canada. However, the website should be developed in a way that it expects these parameters and can act upon them when they are received.

So, knowing this, having the url and inspecting the source code as such, doesn’t return anything significant since it doesn’t hold the information we need when it renders the page with ?input at the end of the URL.

However, if we try and delete the ?input and then type

view-source:https://defendtheweb.net/playground/intro11

, we can see the password hidden in the source code.
How to set up a Raspberry Pi and make it up Running.
By: Abdul Rehman Kalsekar
Tags: Hacking, Raspberry Pi 4, Raspberry Pi

Alright, Now our Hardware is all set and Now we want to Set up our Software. For this you will need a Laptop or any other PC. If you dont have one Just go to your nearby Cyber-Cafe and use theirs.

1 . First insert your SD Card into your adapter and then your adapter into your PC.

2. Now Download the Official Raspbian OS from their Website. You can Download Raspbian from https://www.raspberrypi.org/software/

3. Now Format your SD with an SD Card Formatter.

4. Now run the Software you recently installed from Raspberry Pi Website and Flash it to your SD Card.
CyberPeace Institute Calls for Accountability of Intrusion as a Service Sector
By: The Cyberpeace Institute
Tags: Cyberspace, Iaas, Cybersecurity, Cyber Peace, Hacking

Marietje Schaake, President of the CyberPeace Institute argues that commercially available hacking, intrusion and exfiltration systems are making cyberspace unstable and unsafe for the people connected to it.

The CyberPeace Institute joins leading civil society organizations and UN Special Rapporteur David Kaye in opposing intrusion as a service (IaaS), given its deeply harmful impact on achieving peace in cyberspace. The updated EU laws are a step in the right direction but fall short of addressing the systematic problems we identify.

We express grave concern with the impact on vulnerable populations and individuals that are often the prime targets of systems designed, marketed and sold to cause harm.

Without stronger prevention and accountability, this sector will grow further out of control. A moratorium can bridge the time between now and the moment rules are adopted to protect people from the escalation and proliferation of IaaS technologies.

Short of laws and international agreements limiting the development and trade in hacking and surveillance systems, corporates are now battling it out in court. When it comes to where company liability should lie for companies that sell intrusion as a service, WhatsApp was recently joined by Google, Microsoft and others in ensuring NSO Group and other companies do not operate with immunity and thus impunity.

The harms of intrusion as a service have global, public interest reverberations. Particularly vulnerable populations including human rights defenders, journalists and dissidents are targeted.

There are both human rights and security concerns to be addressed, including the proliferation which is widespread and leads to a lack of control and oversight of the most aggressive technological systems.

Commercially available hacking, intrusion and exfiltration systems are making cyberspace less stable and the people connected to it unsafe. Prevention of harms and accountability of those responsible for facilitating human rights abuses are long overdue.

***

The CyberPeace Institute is an independent, non-profit organization with the mission to enhance the stability of cyberspace. It does so by supporting vulnerable communities, analysing attacks collaboratively, and advancing responsible behaviour in cyberspace.

Web|Twitter|Facebook|LinkedIn
Day 23 | Advent of Cyber 2
Tags: Hackathons, Cybersecurity, Tryhackme, Hacking, Ctf Writeup

Day 23 | Advent of Cyber 2

As the day draws near the Grinch is desperate. He used his secret weapon and launched a ransomware attack crippling the endpoints. Understand what is VSS and how it is used to recover files on the endpoint. tocto Follow Dec 23, 2020 · 3 min read

Hi! In this room the files of the elves have been encrypted and we have to recover their previous versions!

Decrypt the fake ‘bitcoin address’ within the ransom note. What is the plain text value?

We see that the string in the notepad ends with “==”, this means that it is encoded with base64, if we do not know, the web page used yesterday also tells us!

bm9tb3JlYmVzdGZlc3RpdmFsY29tcGFueQ==:nomorebestfestivalcompany

At times ransomware changes the file extensions of the encrypted files. What is the file extension for each of the encrypted files?

if we move a bit through the file system we get to the documents and we see that the elves’ files have been encrypted!

What is the name of the suspicious scheduled task?

Get into the task manager and look for something different from the rest, maybe the objective task is launched when we log into the system:

At log on ELFSTATION\Administrator

Inspect the properties of the scheduled task. What is the location of the executable that is run at login?

if we double click on the task found, its propertires are opened

There is another scheduled task that is related to VSS. What is the ShadowCopyVolume ID?

the task we are looking for contains the string “VSS”!

Assign the hidden partition a letter. What is the name of the hidden folder?

Assign it a letter and open it in the File Explorer

Right-click and inspect the properties for the hidden folder. Use the ‘Previous Versions’ tab to restore the encrypted file that is within this hidden folder to the previous version. What is the password within the file?

If we restore the file that appears, inside we find a text file with a password!
‘The SolarWinds Hack’
Tags: Hacker, Cybersecurity, Cyberattack, Hacking, Solarwinds

A look into one of the biggest cyberattacks in the U.S. called the SolarWinds Hack that has said to have targeted U.S. government agencies and private companies. What is it and what we know so far as per various news reports?