Hãçkêrs Unite

This was done on Windows 10 specifically

✳️ How to Prevent Users from Changing Proxy Settings on Windows ➖➖➖➖➖➖➖➖➖➖➖➖➖    💠 To disable proxy changing, we are going to use the Local Group Policy editor. The process might look complicated, but it’s super easy if you follow it step-by-step. 🔹Step 1: First of all, click on the Start button and search for ‘gpedit.msc’ 🔹Step 2: Now click on the Edit Group Policy from the list options. 🔹Step 3: On the Local Group Policy Editor, head to the following path: User Configuration > Administrative Templates > Windows Components > Internet Explorer 🔹Step 4: On the right pane, double click on the ‘Prevent Changing Proxy settings’ 🔹Step 5: In the new Window that opens, select the ‘Enabled’ option. Once done, click on the ‘Ok’ button to apply the changes.    ✅ That’s it! You are done. Now the option to change the proxy settings will no longer be available for users. Keep supporting us❤️,             ➖@hackersworldunited ➖

Are you available ? 🤔

✳️ NETWORKING BASICS: part-1 ✳️ ➖➖➖➖➖➖➖➖➖➖➖➖➖➖ 🔴 IP Addresses 💠 Internet Protocol address is the abbreviation of IP address. 💠 Each digital device (computer, laptop, phone, tablet, etc.) is assigned an IP address, and this is what enables us to communicate and connect with devices. Imagine an IP address as similar to your house address. Without that address, no one could find you or send you snail mail. 💠 The IP address system we are presently using is known as IP version 4, or IPv4.  It is made up of 32 bits of four octets, or four groups of 8 bits (on/off switches). 💠For instance, 192.168.1.101. Each of the numbers between the periods (.) is the decimal equivalent of 8 bits. This means that we calculate the base 2 number that computers use represented by the 8 bits and convert them to decimal numbers that humans are more accustomed to working with. Each one of the octets (8 bits) is capable of representing numbers within the range 0 through 255 (2 to the 8th power). ✳️ Classes of IP Addresses: 💠 IP addresses are generally put into three classes, and the ranges are: 🔹Class A: 0.0.0.0 - 127.255.255.255 🔹 Class B: 128.0.0.0 - 191.255.255.255 🔹 Class C: 192.0.0.0 - 223.255.255.255 💠 Later, we will address subnetting and subnet masks that vary with these different IP classes. ✳️ Public vs. Private IP Addresses 💠 It's important to note that our IP address system has its limitations. The biggest limitation is that there are not enough IP addresses to cover all of the devices that need to connect to the internet. The IPv4 system that we are working with now has only 4.3 billion IP addresses. With 7.3 billion people on the planet and far more devices, that certainly is not enough. 💠 As a result, a system was developed to reuse a group of IP addresses to be used within a LAN—and are not usable over the internet. These addresses can be used over and over again within each local area network, but not over the internet, thereby conserving the number of IP addresses necessary to keep the world going 'round. ✅ These private addresses include: 🔹192.168.0.0 - 192.168.255.255 🔹10.0.0.0 - 10.255.255.255 🔹172.16-.0.0 - 172.16.255.255 ✅ You have probably seen the private IP addresses beginning with 192.168.xxx.xxx or 10.xxx.xxx.xxx on your Kali system when you type ifconfig. 💠 This is your private IP that is only usable on the local area network. To communicate over the internet, it must be translated to a public IP by a NAT device (will see NAT in the next post.. stay tuned). ➖➖➖➖➖➖➖➖➖➖➖➖➖➖ Keep supporting us❤️ @hackersworldunited

✳️ How do you prevent broken authentication vulnerabilities? 💠 In order to avoid broken authentication vulnerabilities, make sure the developers apply to the best practices of website security. Support them by providing access to external security audits and enough time to properly test the code before deploying to production. 💠 OWASP’s technical recommendations are the following: 🔹 Where possible, implement multi-factor authentication to prevent automated, credential stuffing, brute force, and stolen credential reuse attacks. 🔹 Do not ship or deploy with any default credentials, particularly for admin users. 🔹 Implement weak-password checks, such as testing new or changed passwords against a list of the top 10,000 worst passwords. 🔹 Align password length, complexity and rotation policies with NIST 800-63 B’s guidelines in section 5.1.1 for Memorized Secrets or other modern, evidence-based password policies. 🔹 Ensure registration, credential recovery, and API pathways are hardened against account enumeration attacks by using the same messages for all outcomes. 🔹 Limit or increasingly delay failed login attempts. Log all failures and alert administrators when credential stuffing, brute force, or other attacks are detected. 🔹Use a server-side, secure, built-in session manager that generates a new random session ID with high entropy after login. Session IDs should not be in the URL. Ids should also be securely stored and invalidated after logout, idle, and absolute timeouts. Will continue the other vulns. shortly.. stay tuned ➖➖➖➖➖➖➖➖➖➖➖➖➖➖ Keep supporting us❤️ @hackersworldunited

✳️ Types of Broken Authentication Vulnerabilities 💠 According to the OWASP Top 10, these vulnerabilities can come in many forms. A web application contains a broken authentication vulnerability if it: 🔹Permits automated attacks such as credential stuffing, where the attacker has a list of valid usernames and passwords. 🔹 Permits brute force or other automated attacks. 🔹 Permits default, weak, or well-known passwords, such as”Password1″ or “admin/admin.″ 🔹 Uses weak or ineffective credential recovery and forgot-password processes, such as “knowledge-based answers,” which cannot be made safe. 🔹 Uses plain text, encrypted, or weakly hashed passwords. 🔹 Has missing or ineffective multi-factor authentication. 🔹 Exposes session IDs in the URL (e.g., URL rewriting). 🔹 Does not rotate session IDs after successful login. 🔹 Does not properly invalidate session IDs. User sessions or authentication tokens (particularly single sign-on (SSO) tokens aren’t properly invalidated during logout or a period of inactivity. ✳️ Writing insecure software results in most of these vulnerabilities. They can be attributed to many factors, such as lack of experience from the developers. It can also be the consequence of more institutionalized failures such as lack of security requirements or organizations rushing software releases, in other words, choosing working software over secure software.

✳️ Broken Authentication ➖➖➖➖➖➖➖➖➖➖➖➖➖➖ 💠 A broken authentication vulnerability can allow an attacker to use manual and/or automatic methods to try to gain control over any account they want in a system – or even worse – to gain complete control over the system. 💠 Websites with broken authentication vulnerabilities are very common on the web. Broken authentication usually refers to logic issues that occur on the application authentication’s mechanism, like bad session management prone to username enumeration – when a malicious actor uses brute-force techniques to either guess or confirm valid users in a system. 💠To minimize broken authentication risks avoid leaving the login page for admins publicly accessible to all visitors of the website: 🔹/administrator on Joomla!, 🔹 /wp-admin/ on WordPress, 🔹 /index.php/admin on Magento, 🔹 /user/login on Drupal. 💠 The second most common form of this flaw is allowing users to brute force username/password combination against those pages.