fabiochiu/medium-articles huggingface dataset:
The Finer Side of Automated Security Testing
By: Mike Mackintosh
Tags: Docker, Security, Infosec, Ci, Automation

DevOps is all about speed. Remaining agile throughout the development, testing and deployment life-cycle is what delivers features to customers and that’s what makes a product successful. Only recently have we seen agility around security be evangelized within the DevOps culture, but security should never have been a speed bump to begin with. There are many ways you can automate simple security tasks that give you an immense amount of coverage at little to no cost without slowing down your product. One of these simple tasks includes effective perimeter and application testing.

Introduce Agility Into Your Testing

Testing from the same static sources can leave you jaded, ultimately flatlining your visibility. With automation, you can easily formulate methods to achieve new perspectives around your testing, which increases your rates of detecting an anomaly. To accomplish this goal, we created RandomHack, which runs a suite of tests through a randomly selected attack tool in the comfort of a Docker container.

Testing from the same static sources can leave you jaded, ultimately flatlining your visibility.

Wrapping everything within a Docker container allowed us to bundle in each of the attack tooling dependencies. This removed the headache and overhead nightmare around maintainability without needing to worry about dependency conflicts on each of the executing hosts. Utilizing Docker in this manner also creates a sense of test agility, allowing us to keep our test suites ephemeral. No more worrying about the need to manage multiple versions of RVM, Python, Perl, etc on specific nodes, and waiting for them to download, compile and install. This saves you both engineering and operational overhead.
Silent Breach Establishes Security Operating Center (SOC) in Singapore
By: Daniel Rhodes
Tags: Cybersecurity, Technology, News, Infosec, Singapore

Singapore City, Singapore, June 11, 2019 -(PR)- Silent Breach today announced that it has established a Security Operating Center (SOC) at their Singapore headquarters in SUNTEC Towers.



“Silent Breach is very excited to offer 24/7/365 cybersecurity monitoring to our APAC clients,” said Marc Castejon, CEO of Silent Breach. “We believe that cybersecurity is a holistic commitment that requires around-the-clock vigilance, and this new SOC will enable us to continue to grow our activities in the region while maintaining industry-leading standards and services.”

The SOC was created to handle increased demand from the APAC market, in particular from Hong Kong and Singapore. Notably, this expansion coincides with Silent Breach’s move to expand operations in the managed cybersecurity services sector, including Continuous Monitoring, Pro-Active Threat Detection, Intrusion Response, Access Management, among others.

“With the high demands and costs of a rigorous in-house IT team, our customers need a cybersecurity solution which is both cost efficient and incredibly responsive,” said Jin Diong, Managing Director APAC. “For many, Silent Breach’s comprehensive suite of Managed Cybersecurity Services is the perfect fit. With our new Singapore-based SOC, our clients can maintain the highest levels of security and responsiveness at a fraction of the price.”

Further information about the Security Operating Center and its activities, can be found at: https://silentbreach.com/Managed-security-services.php
Blind XSS to Admin Panel Dashboard
By: Aniruddha Khadse
Tags: Bug Bounty, Xss Attack, Cybersecurity, Infosec

Hello Everyone!

I’m Aniruddha Khadse, working as a Product Security Engineer and a part-time Bug Bounty Hunter. This blog is about my finding on a shopping website (private program), let's say it as target.com. Without wasting time let’s start.

Vulnerability description:

While registering on target.com, it asked for name, mobile no, and email id. As usual, a used <h1>Hacked</h1> in name, I got welcome mail with HTML injected successfully. Now its time to increase impact, I changed my first name from <h1>Hacked</h1> to <script>alert(1)</script> and I got popup after login on target.com. I immediately created a report and submit to target.com.

And again I started hunting on that website, I got an endpoint where you can apply for free membership (same as amazon prime and flipkart plus). There I got a form for apply membership with the name is already filled. Here I got an idea, what will happen if I changed my name with blind xss payload??

Photo by Júnior Ferreira on Unsplash

I opened https://xsshunter.com/, logged in with my credentials, copied the payload and paste it in my name field, and applied for membership. The very next day, I got a mail from xsshunter that your payload is fired up.

Photo by Gita Krishnamurti on Unsplash

I opened my xsshunter account and what I got is a screenshot of the admin’s dashboard with the user’s sensitive details like Name, phone no and address. Again I created a new report and submit to them.

Xsshunter’s dashboard

Admin’s Dashboard

Customer’s data leakage

There are lots of tools for finding blind XSS but xsshunter is my favorite because it is very easy to use.

Steps to reproduce:

1)Go to target.com and signup with xsshunter payload as a name.

2)Visit apply for a free membership and apply.

3)Wait for xsshunter mail.

I got a reply from them that my blind XSS is accepted and they will provide only swag.

If you have liked this article do click on the clap button and do follow me on Linkedin and Twitter.

Linkdein: https://www.linkedin.com/in/aniruddha-khadse-7852a6101/

Twitter: https://twitter.com/aakhadse29
How to Avoid a Data Breach
Tags: Cybersecurity, Data Security, Cyberattack, Infosec, Data Breach

How to Avoid a Data Breach Sennovate Follow Jun 17 · 2 min read

Government agencies are becoming prime targets for cyberattackers, they hold data for ransom. Whatever the rationale of the cyberattackers, it is imperative that government agencies need to pull up their socks to understand the gravity of the situation, Take the Baltimore data breach which occurred twice in less than a year. Large corporations and government agencies, US municipalities need to take a look at their existing IT infrastructure to avoid any future cyber-attacks and look to plug the holes soon.

A recent study by cybersecurity research firm Recorded Future finds surge in state and local government ransomware attacks targeting essential infrastructure and processes. The study revealed that reported attacks on state and local government skyrocketed by 39 percent in the US in 2018, and that many of these attacks were opportunistic: in most cases, attackers “stumbled” upon public-sector entities when looking for vulnerable targets.

Though there is no ideal solution, but few suggestive measures that can be considered to avoid a data breach:

Have a proper maintenance of perimeter security software and infrastructure and test it periodically.

Backup all critical data

Beware of phishing

Remove local admin privileges to contain and block attacks -have a combination of least privilege and application control policies on endpoints and servers as part of a larger Zero Trust approach, to mitigate the risk of attack

Latest versions of software with regular updates and systems must be in place

Plug holes in the existing legacy devices during transition to newer systems

Faster budgetary approvals to purchase security tools.

Look at providing a cloud-based service to avoid costs and increase security

Have a proper cyber insurance in place

Have a proper MSSP who can work provide end point detection and response, security information and event management (SIEM) and other managed services

Make that transformation change in IT systems and security polices

It is time that organizations and government agencies start getting educated on the risks of these data breaches and take appropriate measure to plug it, as these attacks and data breaches will be on the rise — agility and best security practices must be in place to avoid your next breach.
Part 2: Easy XSS On Mostly Educational Websites Via Moodle
Tags: Info Sec Writeups, Bug Bounty Tips, Xss Attack, Infosec, Bug Bounty

Part 2: Easy XSS On Mostly Educational Websites Via Moodle DarkLotus Jun 8·2 min read

Hello!! everyone, I had already created one on this topic using Shodan in Part-1 and now let's find this vulnerability again through Spyse.

Many educational websites are using Moodle which is vulnerable to RXSS and according to Spyse more than 84K domains and 41K IPs are using this technology. Moodle is a learning platform designed to provide educators, administrators, and learners with a single robust, secure and integrated system to create personalized learning environments. This was founded by @PewGrand

What is XSS?

Cross-site scripting is a type of security vulnerability typically found in web applications. XSS attacks enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same-origin policy.

Steps To Hunt For This Bug:

Navigate to https://spyse.com/ and click on “Advanced Search”

2. Click on the “Add Filter” option and select “Name” under the “Technology”

3. Type “Moodle” under the “Contains” option and hit the “Apply” button.

4. Select the target you want to test, Let's say mytarget.com

5. Now just add the vulnerable endpoint with XSS payload to the target.

6. Ex. https://mytarget.com/mod/lti/auth.php?redirect_uri=javascript:alert('DarkLotus')

7. If the website is vulnerable then you will see that XSS will pop up on your computer screen.

This blog credit goes to @SypseHQ @_markroze @mark_m0nk

Thank You so much for reading my blog and for more #bugbountytips follow me on Twitter @DarkLotusKDB

Happy Hacking ❤
Mass Hunting XSS — Moodle. Hello friends! In this article, We are…
Tags: Bugs, Google, Infosec, Shodan, Bug Bounty

Hello friends! In this article, We are going to see How to Identify, Mass hunt and Exploit Moodle.

What is Moodle?

Moodle is a free and open-source learning management system (LMS) written in PHP and distributed under the GNU General Public License. Developed on pedagogical principles, Moodle is used for blended learning, distance education, flipped classroom and other e-learning projects in schools, universities, workplaces and other sectors.

How to Identify Moodle?

Wappalyzer

Favicon Icon

Subdomain (moodle.target.com)

Example

Here you can see this target is perfect example. We can see Moodle’s Favicon, Wappalyzer and subdomain of target.com

Shodan:

Search query: http.component:Moodle

http.component:Moodle Favicon Base: http.favicon.hash:-438482901

Shodan CLI:

shodan search “http.component:Moodle” — fields ip_str,port — separator “ “ | awk ‘{print $1”:”$2}’ | tee -a moodlehunt.txt

shodan search “http.favicon.hash:-438482901” — fields ip_str,port — separator “ “ | awk ‘{print $1”:”$2}’ | tee -a moodlehunt.txt

Google Dork:

inurl:”/login/index.php”

Exploitation:
How to find that BadAss IDOR
Tags: Idor, Hackerone, Infosec, Web Hacking, Bug Bounty

Let’s talk about IDOR that i found,

So i was testing a private program, with lots of unique features & functionalities. And after testing for a while, i found couple of stored-xss which i won’t discuss here. And after month or so; I though i should look for IDORS; but at-first couldn’t find any 😞

Then after testing for a while i though of a scenario which goes like this:

i tried designing similar application/scenario since i cannot show ss here coz private program 😅

Suppose this is the application with lots of Tabs! And in one of them, i can create objects which is further used in creating another type of object;

Also as there are objects, then also must have unique identifiers (ID) also!

I tried IDOR on creating, deleting, updating etc… but noting works!

Now if you can focus on Object X-2's objects, you may see that it’s using objects of Object X-1

What if i change the ID of Object X-1's object that is pointed by Object X-2 object while editing the object of Object X-2 😁

So Objects X-2’s object is now pointing to the Object X-1's object which doesn’t belong to current project!

Well It worked 😸 and i was like

yeyey

scenario:

Malicious user can read/points to objects that belongs to other projects.

reward: $300

Takeaway:

Don’t just test in basic manners, because it’s already done before like 10000 times. Good Dollars requires good prospective 💰
$5000 Google IDOR Vulnerability Writeup
By: Raidh Ĥere
Tags: Bugs, Cybersecurity, Information Technology, Infosec, Bug Bounty

Hey amazing Hackers! its Raidh_Here

After many month, I decided to write writeups regarding my bounty from Google of worth $5000. So without wasting any time, lets begin the story!

The Story :

After getting many duplicates and N/A from H1 & Bugcrowd, I decided to write about my journey and started searching for VDP programs. I got many bugs and reported to them but till then no reply . Finally, I decided to start hunt on google.

Started searching google subdomains using Google dorks. I know its piece of a shit but never mind. I found few domains and nothing work for me. So finally, I decided to test on google cloud.

While scrolling down in the google cloud market place I found an interesting application called Dialogflow

again you need to clean up your mind raidh….

I started searching more about the application. Dialogflow is a natural language understanding platform used to design and integrate a conversational user interface into mobile apps, web applications, devices, bots, interactive voice response systems and related uses.

I started searching common bugs like xss,sqli,htmli.. etc.

But it didn’t work! :(

After doing a lot of search, I got an interesting Option

and started creating the phone gateway :)

It also has a delete option. I turned on my proxy and started intercepting the requests and I found a request like this .

its easy to create a wordlist for that random number of strings and able to do brutforce to exploit the vulnerability :)

How i did the wordlist for bruteforcing the random string ?

i send the request to burp intruder and added the points to some strings and created a-z character in the payload section. but it is very hard to get a hit. while checking the dialoglfow cx i saw the same Phone Gateway.

we can see there is a area code option to get specified phone numbers for that particular area.

i selected the area code 205 so i got the active list of numbers belongs to 205. we can select all available area codes and able to fetch the all active random strings to create a word list.

I sent the request to burp repeater and replace the phoneNumbers/<randomstring> to the victims <randomstring> and submit the request.

BHOOOOOOOM!. The victim number got deleted and created a poc and reported to Google. But they closed the report as intended Behavior. Then, I was like ??!!

intended Behavior

After explaining the attacking scenario and impact, they reopened and accepted the bug. Whooo hooo! and rewarded with $5000.

Timeline

May 4, 2021 06:28AM — Reported

May 4, 2021 04:19PM — Status: Won’t Fix (Not Reproducible)

May 7, 2021 06:30PM — Status: Won’t Fix (Intended Behavior)

May 12, 2021 09:10AM — Status: Accepted (reopened)

May 18, 2021 04:20PM — Rewarded $5000 bounty

Aug 28, 2021 01:29AM — fixed.
How I can take over any user’s account with their mobile number
By: Sushmitha Katikitala
Tags: Info Sec Writeups, Account Takeover, Infosec, Bug Bounty

How I can take over any user’s account with their mobile number Sushmitha Katikitala Sep 6·3 min read

Hi everyone! Hope you all are healthy and safe. This is my first write-up on one of the findings in a private program where I was able to completely take over any user’s account with their mobile number.‌

Before starting, guys please ignore if any grammatical mistakes.‌

Let assume the website to be redacted.com . Like every other bug bounty hunter, I started understanding how the website was working. And started testing for XSS on all the input fields of the website. But I didn't expect that I can get XSS vulnerability so easily in the search field. {payload :"><script>alert(document.domain)</script>} ‌

In redacted.com , there is a user registration page to create an account. I entered all the required fields and click on the submit.

User registration page

After clicking on the Submit button, it is redirecting to the page where we need to enter OTP which has been sent to the mobile number.

Here I tried to brute force a 6-digit OTP number using Burp intruder. But it didn’t work. So, I have checked the requests in burp history. In that POST request, one parameter caught my eye i.e. "action=otpreg" .

I thought that maybe the OTP is being generated in response to this request. When I saw the response to this request, it generating OTP in base64 format.

When I decoded the base64 OTP code, I got the same OTP number that I received on my mobile. Now I entered the decoded base64 OTP number and intercepted the request in burp to check the response. Here it is matching the "userotp" and "genreatedotp" for validation.

After forwarding the request, the account was successfully got registered.‌

What if the company is following the same process for the login page. So, I entered the registered mobile number and captured the request in the burp, and BOOMMMMMMMM!!!!!!! They are following the same process. Immediately I decoded the base64 code and entered OTP and submitted the request. I was successfully able to enter the account.‌

Using this, I can take over any user’s account using their mobile number.‌

Thanks for reading this !!.

Happy researching….
SQL injection in harvard subdomain
By: Brandon Roldan
Tags: Bug Bounty Writeup, Sql Injection, Infosec, Bug Bounty

Hi. In this writeup, i will show you a sqli that i found in harvard and also, a xss as a bonus

While looking through the subdomains of harvard, i found this one interesting subdomain https://schedule.med.harvard.edu/ . I fuzzed the directory using ffuf and found this one interesting endpoint availability.php

Visiting that endpoint only gave me this.

So i fuzzed the parameters using arjun and found an interesting parameter called users. I tried it again with the users parameter and saw this

This is the same error message as before. So i guessed i only have to provide a year parameter. I did that and it worked.

Again, its the same as before, i provided a month parameter and it worked.

It worked again, but now, its asking for a day parameter, i gave it and it showed me this

We can see that our input in users parameter is reflected so i tried to get an xss. And it worked

So we have an xss. I quickly reported it and tried testing the other parameters. I tried adding ‘ in the day parameter and it gave me an sql error.

So, i have an sqli injection here. Since i suck at sql injection, i just let sqlmap do the job for me and sqlmap worked.

I dumped the tables. I didnt go any further anymore and reported it to them.

The sqli got accepted but the xss does not. Apparently, harvard dont accept xss which sucks since i reported alot of xss to them

This is now fixed so i decided to publish it. Visiting the subdomain will show this

And visiting the endpoint https://schedule.med.harvard.edu/availability.php will throw a 404 error.

Thats the end of the writeup, thanks for reading.
Exposing Millions of IRCTC Passengers' ticket details.
Tags: Tickets, Web Application Security, Irctc, Infosec, Bug Bounty

Hi There,

Renganathan Here, I’m an Ethical Hacker & a Security researcher.

I’ve been acknowledged by LinkedIn, United Nations, BYJU’s, Nike, Lenovo, Upstox for reporting security vulnerabilities in their web applications.

What’s IRCTC?

IRCTC, India’s largest online ticketing operations site which runs one of the largest e-commerce sites, has around 30 million registered users with around 550,000 to 600,000 bookings every day makes it the world’s second-busiest travelling portal generating revenue of $20 million every year (Source: Wiki)

While I was booking a ticket as a normal human I suddenly got an idea to test for vulnerabilities.

Hacker Mode!

So the first vulnerability that came to my mind was IDOR. Here are the steps to reproduce.

Login to your IRCTC account Go to My account > My Transactions > Booked Ticket History.

3. So there were below tickets that gets expanded on click

I used burp suite, turned on the interception, and saw a below-get request.

I tried for IDOR and decreased the number of the transaction ID and forwarded the packet.

And Yeah! I got a random user’s transaction and ticket details like Train Number, Departure time, Duration of the journey, PNR number, Status of the ticket, Boarding station, Passenger's information like their names, seat details, gender & age.

Since the backend code is the same so It’s also vulnerable to Cancelling the ticket, Changing the boarding point, Ordering food, booking a hotel, tourist package, and even Book a bus.

I immediately recorded a POC & reported it to incident@cert-in.org.in

TimeLine:

Aug 30, 2021, 12:45pm: Reported

Aug 30, 2021, 1:30 pm: A ticket was assigned.

Sept 4, 2021: The issue was resolved (retested)

Sept 11, 2021: Acknowledged by IRCTC.

Acknowledgement from IRCTC

Thanks for reading :)

Stay Safe.

https://www.instagram.com/renganathanofficial

https://twitter.com/IamRenganathan
How I hacked worldwide Tiktok users
Tags: Cybersecurity, Tik Tok, Hacking, Security, Infosec

Hello everyone,

In this write up I am sharing a TikTok vulnerability reported via TikTok’s bug bounty program

While I was testing the Tiktok app to find a vulnerability I saw a part called family pairing and it’s let parents control account their younger users like turn off/on the search bar and turn off/on account to private/public and many more things like the direct message, comments, liked videos….

I thought it’s a good position for testing because these functions are complex in the backend app so I start testing in this part

I created 2 accounts 1 for parents 1 for children and then linked it, and I was turn on my burp suite to catch the requests,

In the parent account, I tried to change my children account from public to private so once I clicked the turn on button private I catch the request in the burp suite

Let’s see what’s happening in this request,

I saw there are some parameters each of them does different actions like

restriction_type and restriction_value and child_user_id

Type is for parts like

Number 1 for direct message

Number 2 for liked videos

Number 3 for comments

Number 4 for public/private account

And Value for if this turn on/off/noone

Like 1 or 2 or 3 or 0

And child_user_id for your children account id

So i thought what happens if i change the child_user_id to another user id so i changed it and i see BoOM it worked😱

Now I can change sensitive settings of any account just by user id of the account 😳

proof of content

impact

an attacker would have potentially been able to collect all users id of Tiktok and change all users from public to private accounts and stop all lives and videos on the ForYou page and all comments…etc

So I quickly reported it to Tiktok and they resolved the issue quickly.

Timeline: Reported — Aug 2nd Awarded $$$$— Aug 6th Resolved — Aug 13th Thank you for reading.

Twitter: @s3c_krd
PXUC (PIXIU coin)： The world’s only gold cryptocurrency backed by real gold mining areas!！
By: Pixiu Mining Corporation
Tags: Gold, Coins, Cryptocurrency, Mining

Pixiu Mining Corporation(PMC) utilize this meaning to issue PIXIU coin in the form of cryptocurrency, so that more people can make profits by holding stable gold assets. We have the faith that PIXIU coin will become the highest-valued gold cryptocurrency around the world within three years.

🔎Forty mining areas in Northern California→Located approximately 5 miles and 11 miles west of Quincy city in Plumas county. There are forty mining areas in total, which are divided into large and small parts with a total coverage of 769 acres, approximately 3.11 million square meters.

🔎Gold reserves assessment→ Stickel & Associates, an independent geological consultant company, visited mining areas and proposed a resources evaluation report based on the reference of government documents and reports of other geological experts. Meanwhile the test results showed the presence of platinum metal.

🔎Mine asset assessment→ KPMG to analyze the value of mining assets. KPMG LLP issued an analysis report after deducting the total mining cost of $3.335 billion. The estimated asset value is $ 5.447 billion, and the detailed appraisal report is shown in the appendix.

Look here👉 https://pixiumining.gold/dat/whitepaper_en.pdf

✔️Website👉 https://pixiumining.gold/en/

✔️Twitter👉https://twitter.com/Pixiu09958435

✔️Telegram👉 https://t.me/pxucofficalgroup

WELCOME to QUINCY
Gold against Euro Dollar (XAUEUR) Running to All-Time High
By: Elliott Wave Forecast
Tags: Gold, Elliottwave, Trading

IMF (International Monetary Fund) projects the European nations will experience a 7.5% GDP contraction this year. EU nations have been some of the hardest hit by Covid-19. Even before the pandemic, the European economy is already sluggish. The NIRP (Negative Interest Rate Policy) and ZIRP (Zero Interest Rate Policy) have not produced better results. These policies may have in fact weakened the condition of the European banking sector.

To soften the impact of the pandemic, European Central Bank (ECB) introduced new measures. The central bank promises to buy 750 billion euros ($815 billion USD) in sovereign bonds this year. The data however suggests that this measure can reach the limit by October this year assuming constant purchasing pace.

ECB might use another powerful tool such as helicopter money if current policy is inadequate. Helicopter money refers to a policy where central banks print additional money and gives it directly to the citizens. The goal is to boost consumer spending, speeding up economic recovery and preventing recession. This idea goes back to Milton Friedman who wrote about it in 1969. Ben Bernanke then revived the idea in 2002. The idea of helicopter money can potentially lead to inflationary consequences. If ECB really takes this step, Gold should find strong bids as a hedge against inflation.

Gold against Euro (XAUEUR) Elliott Wave Chart

Gold against the Euro dollar (XAUEUR) continues to make all-time high after breaking above October 2012 prior high at $1386.5. Structure of the rally from December 2013 low is unfolding as a 5 waves impulsive structure, favoring more upside. We prefer to continue buying any dips in 3, 7, or 11 swing against $1300.9 in the first degree.
Buy 24K Gold from home on PhonePe!
By: The Phonepe Team
Tags: Gold, Digital Gold, News

Mrs. Sharma, a 65-year-old retired teacher from Bhilai, used PhonePe and a little help from her grandson, to buy gold online for her daughter’s wedding, without leaving home.

In six steps, Mrs. Sharma discovered how easy it was to purchase 24K gold safely on PhonePe.

Millions of customers have bought gold on PhonePe with the assurance of purity and a trustworthy buying and delivering experience. Some started building their savings with small purchases worth Rs. 10, 100, 1,000 or more. Others invested in gold for their business or a family celebration. Whatever the reason, gold is within everyone’s reach with PhonePe.

Gold purchased on PhonePe is stored in a free bank-grade insured locker facility maintained by the providers, SafeGold and MMTC-PAMP India Pvt. Ltd. IDBI trusteeship ensures that the Gold cannot leave the locker facility without a proper audit. Your Gold can also be home delivered if you like!

Follow six easy steps given below to buy gold on the PhonePe app:

Step 1: Open the PhonePe app (New users need to download the app first)

Step 2: Click on “My Money”

Step 3: Under Investment → click on the Gold Icon

Step 4: Select Gold provider — SafeGold OR MMTC-PAMP

Step 5: Enter the amount of Gold you want to buy (in rupees or grams)

Gold prices are linked to real-time rates in the commercial bullion market and updated every 5 minutes by SafeGold and MMTC-PAMP. The price displayed on the app includes 3 percent GST with no additional charges for customers.

Step 6: Click on “Proceed To Payment”

Use your preferred payment method — UPI/Debit Card/Credit Card/Wallet to complete the transaction.

Congratulations! It’s that easy and safe to buy Gold on PhonePe.
How to Determine the Value of an Old Coin
Tags: Precious Metals, Coin, Gold, Silver, Collection

How to Determine the Value of an Old Coin, photo courtesy of Metals.com

Collecting old coins can be fun because they are so unique. Their designs are beautiful, and despite being hundreds or thousands of years old, they’re often surprisingly similar to the designs of coins today. When you hold an old coin in your hand, you feel like you’re connected to the past — and you are. But aside from their historical value, are they actually worth anything?

As with any collection, the value depends entirely on what you have. Old coins can actually be very profitable if you acquire rare ones, but, to the untrained eye, it may be challenging to distinguish rare from ordinary. Here are three simple steps to determine the potential value of your old coins.

Determine Its Authenticity

First and foremost, your old coin will only be worth anything if it is, in fact, a coin. There is always the possibility of finding a counterfeit coin, so you’ll want to ensure it is a real coin. The most important step you can take in ensuring you acquire only authentic coins is purchasing from reliable dealers such as Metals.com.

One of the easiest ways to determine the authenticity of the coin in question is to use a magnet — authentic gold and silver are not magnetic and, therefore, will not react to a magnet. Though, the magnet test is only one way to identify a counterfeit coin.

Quality of the Coin

The most significant impact on the quality of a coin was the degree to which it was circulated. It goes without saying that the less the coin was handled, the better the quality. “Mint condition” is clearly the highest value. Meanwhile, if you have a coin that looks old and worn, that same coin will be worth significantly less. That said, even an old coin in poor condition can be worth a considerable amount if the coin is rare.

Range of Value

Once you determine the authenticity and quality of the coin in question, you can look at a range of values chart for your specific old coins. Knowing the range will give you a better idea of whether you should bother insuring the coin, as well as what kind of price range you should negotiate in the event you choose to sell it.

It’s important to remember that the face value of a coin is not its actual value.

Where to Find Old Coins

As with any coin you’re looking to add to your collection, you must be diligent about purchasing from reputable dealers. Coins purchased from Metals.com, such as the 10 Guilder Gold Coin or the Gold World English Sovereign Queen Victoria Jubilee Coin from our World Coins collection, make great collector pieces and, as with all of our products, are protected by our 100% satisfaction guarantee.

The Metals.com Staff
Exploring the Goldfields Region Beyond Melbourne
By: William Shields, Southborough
Tags: Melbourne, Gold, Australia, History, Travel

William Shields of Southborough, Massachusetts is a commercial real estate specialist who is a member of Manulife’s Real Estate Finance Group. Passionate about travel, William Shields had the chance to visit Melbourne, Australia in 2018.

Similar to California in the United States, Australia had its own historic gold rush in Victoria in the 1850s. The allure of striking it rich by uncovering gold drew thousands of miners from near and far. At first, men from Australia and New Zealand flocked to the State of Victoria in search of gold. They were then followed by eager gold hunters from Europe, China and America.

At the height of the gold rush, Melbourne was packed with speculators and new towns, such as Bendigo and Ballarat, were seemingly created overnight due to the mass influx of miners. Advanced architecture soon replaced tents and other primitive structures to house the miners and the ancillary population that arose to support them.

Today, visitors can relive these times by visiting Sovereign Hill in Ballarat. This living museum features costumed actors that capture the spirit of the 1850s gold rush. Also, the National Museum of Australia features exhibits dedicated to both the domestic and foreign speculators that made the State of Victoria home during the gold rush.
NightZero APK Mod Hack For Gold and Gems
Tags: Nightzero Hack, Gold, Apple, iOS, Gems

Glorious day has begun. Finally our programmers has found hole in NightZero. Our users now are able to add Gold and Gems to theirs accounts completly for free.

It wasn’t easy, I would say it was horribly hard to wenty through all the security of this game but we wanted to do anything to make you happy. Whole proccess of hacking NightZero won’t take more than five minutes. Below you can find few word on how to use our tool. Go on. 995 tests was succesfull so you have big chance to succeed. Remember that you need active internet connection because hack won’t work without it.

How to use NightZero hack?

Enter your game name

- Pick your platform [Windows, iOS or Android]

- After getting connected choose quantity of Gold and Gems for generating

- Press NEXT [Now our generator will take some time to work]

- After processing your proposal it is necesery to fill up confirmation form. Instaling 2 applications, sending e-mail or subscription. It is simple, we have to make sure you’re not a bot.

- Ready!

Functions:

- Gold and Gems

- Testing on devices with Android, iOS, Windows oraz iPhone, iPad, iPod, iPad Mini

- Access 365 days

- Without downloading and instaling

- We update our hack with game updates

- No need to jailbreak or rooting your device

Go to the generator

https://techinfoapk.com/nightzero-apk-mod-hack-for-gold-and-gems/

tag:

NightZero Hack, NightZero apk, NightZero generator, how to NightZero hack, NightZero Gold and Gems, NightZero Mod
What to Know About Investing in Gold Bars
Tags: Precious Metal, Gold, Finance, Silver, Investing

What to Know About Investing in Gold Bars, photo courtesy of Metals.com

For people that understand the value of investing in precious metals, gold bars have proven to be a great option for the smart investor. There are a variety of gold bar options available to different investors with different objectives. Not only are they priced lower, per ounce, but compared to coins, they also come in different weights.

Mint

It’s worth knowing where the gold bar being considered for purchase was minted. There are several mints around the world that produce gold bars, including the Royal Canadian Mint, Perth Mint or PAMP Suisse. Different mints may have different designs that may play a role in its value and collectability.

Premium

While bars typically carry a smaller premium price compared to coins, the smaller the weight, the higher the premium price, percentage wise. The best bet is to purchase bars in as large a weight as makes sense in order to pay the smallest premium price over spot.

Weights

Gold bars come in weights measured by ounce or by gram. Within each class of gold bar, there are a variety of sizes, shapes and brands. An investor just getting into gold bars can purchase a gram or the veteran investor can purchase by the ounce.

When purchasing gold bars in grams, typical weights include the following:

1 Gram Bar. This is usually the smallest bar size an investor can purchase. The premium is higher than with other weights but is much more affordable, overall.

2.5 Gram Bar. This particular weight offers a slightly smaller premium over 1 gram, based on percentage, and is still an attractive option for any investor.

5 Gram Bar. For those looking to be a bit more aggressive, a gold bar at 5 grams still makes for a very good hedge against inflation and is still very affordable.

20 Gram Bar. Ideal for those who don’t yet wish to purchase an ounce of gold, the 20-gram gold bar is a good choice for those hoping to add volume to their investment. There are gold bar weights that rise to 50 grams and even 1 kilo for those looking to get into more weight.

1 Troy Ounce. This gold bar weight is what may come to mind for most people when they think about buying gold bars. This is the most common sized bar and is used for investments around the world in many countries.

10 Troy Ounce. This particular weight has significant heft to it. It carries the value 10 times the worth of the current spot price for gold and like all other precious metals, should be kept in secure, dry storage.

For those considering investing in gold bars in grams or ounces, a good place to start is Metals.com, where the spot price tracker helps investors follow the value of gold in addition to making purchasing and delivery easy.

The Metals.com Staff
Market Momentum Short-Term for 6/17/21
By: Ryan Brinks
Tags: Gold, Stock Market, Sp500, Investing, Stock Trading

Stocks accelerated their pullback on Wednesday, sparked by the afternoon press conference with the Federal Reserve chairman.

S&P 500

SPY (standard ETF) plunged 0.56% straight from green to orange, having broken slightly below neutral. It now remains negative below $422.45, though the high volatility could continue. Investors likely hit their stop loss and sold, and can now watch to see if it will rebound to retest its all-time high or continue to sell off. Those who think the former will play out could attempt to buy again if it recrosses above neutral.

SH (inverse ETF) briefly spike above neutral but finished the day right on that line. It remains barely negative below $15.65. Investors who think further selling is due could buy near neutral.

Gold plummeted on Wednesday.

Gold

GLD (standard ETF) lost 1.69% and turned sharply red. It remains negative, as it had been, below $175.45. Investors could continue to wait for a return to neutral.

Subscribe for free to get more analysis in a daily email.
Indian Tech Mogul Nandan Nilekani urged Lawmakers of India to Treat Cryptocurrencies as Gold and Real Estates
Tags: India, Gold, Bitcoin, Cryptocurrency, Crypto

Indian Tech Mogul Nandan Nilekani urged Lawmakers of India to Treat Cryptocurrencies as Gold and Real Estates NapBots Follow Jun 8 · 3 min read

Nandan Nilekani, co-founder and the non-executive chairman of information technology giant Infosys, has urged Indian lawmakers and regulators to embrace digital assets. He has warned against the pitfalls of prohibitive regulations as it could lead to significant missed opportunities for India.

Nilekani has made it clear that a more permissive approach towards digital assets could help India tap into the huge US$1.7 trillion digital asset market. He has urged the local lawmakers to let the Indian citizens speculate on cryptocurrency assets.

However, the technology mogul is not bullish on an unfettered crypto market for India. He has asserted that as a means of payment cryptos are too volatile and energy-intensive for usage. Instead, Nilekani believes that the Unified Payments Interface (UPI) of the Reserve Bank of India (RBI) offers a superior infrastructure for real-time payments.

The Infosys co-founder is of the view that the Indian traders and investors must be given an opportunity to access cryptocurrency assets for speculation as well as a store of value. During a discussion of a financial and business newspaper, Nandan Nilekani said:

“Just like you have some of your assets in gold or real estate, you can have some of your assets in crypto. I think there’s a role for crypto as a stored value but certainly not in a transactional sense.”

Nilekani’s statements on crypto assets are especially important and noteworthy both for investors and Indian lawmakers because he has worked closely with the Indian authorities in formulating policies on digital technologies, which includes the Aadhaar biometric identity program that was launched back in 2009.

He was a committee member in 2016 investigating how the Indian populace can successfully use digital payments. Nilekani also chaired a central bank committee on digital payments in 2019.

India could emerge as a global hub for crypto-asset adoption, especially because of the enormous tech sector of the country as well as the large unbanked population. However, the regulatory framework for cryptocurrencies remains unclear as the policymakers and the central bank continue to give conflicting signals.

The crypto industry in India is still operating in a gray area despite the massive momentum and sustained retail demand on cryptocurrency exchanges in recent months. Reports have indicated that the Indian government may be contemplating the idea of formulating a new regulatory panel dedicated to digital assets, which could pave the way towards more clarity in the regulatory aspects of cryptocurrencies.
Why trade commodities?
Tags: Commodities Trading, Smartfx, Gold, Commodities, Commodity Tips

Why trade commodities?

It is essential to add commodities to your trading portfolio as gold, silver, crude oil, natural gas and other basic goods tend to move in opposition to stocks, as well as offer you high amount of leverage and the opportunity to ride sustained bull or bear trends.

Precious Metals

Precious metals include gold, silver, copper, and more. During financial uncertainties like economic or financial crisis and pandemic crisis, which makes markets volatile, trader and investors turn to precious metals specifically gold because it’s sought out as a safe store of value. Metals are also preferred by investors as a portfolio diversifier and hedge against high inflation.

Energy

Energy commodities comprises of mainly crude oil (such as Brent Oil, WTI Oil, etc.) and natural gas. The prices of oil and other energy products fluctuate according to many factors including supply & demand and general confidence in the global economy. It is also majorly impacted by any shifts in production enforced by the Organization of the Petroleum Exporting Countries (OPEC).
Writ of Habeas Corpus
By: Sanskar Khatri
Tags: Legal, Law, Articles

· INDTRODUCTION

The Constitution of India is the fundamental law of the nation which lays down rules and regulations to safeguard the rights of people and impose obligations on them. This set of core principles is regarded as the guardian and protector of the people’s fundamental rights. Individuals have the right to WRITS, which is one of these rights. India’s constitutional provisions are backed up by legislation. As a result, the Judiciary has sole authority to issue writs in the essential matters. The purpose of writs is to enable for instant adjudication of a person’s rights and to assist that person in realizing the advantages of their rights.

There are two articles according to which the courts can issue writs. 1)Article 32(1) gives this power to Supreme Court and the SC can issue writ when the fundamental rights of an individual are infringed. 2)Article 226(2) gives this power to High Court and the HC can issue has a broader jurisdiction to issue a writ for violation of both the legal as well as fundamental rights.

· 5 KINDS OF WRITS PROVIDED BYTHE INDIAN CONSTITUTION

Ø Writ of Habeas Corpus

Ø Writ of Mandamus

Ø Writ of Certiorari

Ø Writ of Prohibition

Ø Writ of Quo Warranto

· Meaning Of The Writ Of Habeas Corpus

Habeas Corpus is the most valuable writ as it determines the right to freedom and personal liberty. It comes from a Latin phrase that means “to have a body.” After being held, a person can file a Habeas Corpus petition with the court.

The court’s order for the detaining authority to present the detained individual before it in order to determine whether or not the person was detained legitimately. If the Court is certain that the person is being held illegally, it might issue an order for his release. The principle of Habeas Corpus ensures that a prisoner can be released from incarceration without sufficient evidence or cause.

· Who Can Apply For The Writ Of Habeas Corpus?

Prerequisite for application of writ of Habeas Corpus:-

Ø The person who is unlawfully detained.

Ø The person who is acquainted with the benefit of the case.

The person who understands the facts and conditions of the case and voluntarily files for the application of the writ of Habeas Corpus under Article 32 or 226 of the Constitution of India.

· When Is The Writ Of Habeas Corpus Refused?

Ø Where the court has no territorial jurisdiction over the detainer.

Ø Where the detention of an individual is related to a court order.

Ø Where the detainee is already released.

Ø Where the detention of a person has been legalized by the removal of defects.

Ø Where the competent court rejects the petition based on the merits of the case.
Mickey Smiley 1935–2016
By: Trial Lawyer National Portrait Gallery
Tags: Justice, Legal, Criminal Justice, Law

“…If you want to be truly happy then devote yourself to the realization of someone else’s dreams.”

Smiley, Professor Mickey. 16" x 20". 2016. Collection of Estate of Mickey Smiley. Florida. Sponsored by Chris Searcy, West Palm Beach, FL.

Professor Smiley was associated with Stetson College of Law for over 40 years and retired in 2005 as the Senior Member of the Faculty of Law. His courses included the following subjects: Torts/ Consumer Protection/ Product Liability, Criminal Law, Evidence, Agency, Conflict of Laws, International Law, Medical Jurisprudence, Medical Malpractice and Advanced Civil Trial Skills.

He was the founder of the Stetson Society of Trial Advocacy in 1970, which was believed to be the oldest continuous Society, specifically devoted to the “Art of Trial Advocacy” among the members of the AALS. He has been recognized at ATLA’s Award’s ceremony as “Coach of the National Trial Advocacy’s Trial Team Champions” (Stetson Trial Teams established an ATLA record by winning the National Trial Competition — 1993 (Smiley’s Renegades) 1994, 1996 and 2nd place in 1997.
RUSS M. HERMAN
By: Trial Lawyer National Portrait Gallery
Tags: Legal, Law, Russ Herman

Russ M. Herman is one of the most brilliant speakers on the trial lawyer circuit today. A senior partner of Herman, Herman and Katz, LLC, in New Orleans,he is a top mass torts litigator who has taken lead roles in several multi-jurisdictional major suits. Herman, who has practiced law across the country for more than fifty years, was named as the 1977 Outstanding Lawyer by the Louisiana Trial Lawyers Association and has continued to receive local and national accolades since then.

Herman served as the President of the Louisiana Trial Lawyers Association from 190 -1981 and as well served as President of the Association of Trial Lawyers of America from 1989 to 1990. He is a diplomate of several advocacy groups. In 2001, Mr. Herman was selected for the Leonard M. Ring Champion of Justice Award, the highest honor bestowed by ATLA.​

In 2010, Russ Herman was admitted to the Trial Lawyers’ Hall of Fame which includes American trial lawyers such as President John Adams, Clarence Darrow, Fred Levin, Morris Dees among others.

Russ Herman served on the litigation committee for the State of Louisiana v. American Tobacco Company, Ellis v. RJ Reynolds Tobacco Company (representing the State of California) and Scott v. The American Tobacco Company where he was lead counsel on behalf of a class of Louisiana smokers who were awarded a landmark jury verdict of more than $591,000,000.00.

​He has authored over 200 articles, papers and books and has been published in numerous legal periodicals and text books.