Ⱥղօղվʍօմʂ Ꭰ€ѵìꝈ

Hacker'z home 2.o: Ok lets start with OWASP and OWASP top 10 ⚠️ ➖➖➖➖➖➖➖➖➖➖➖➖➖➖ 🔵 What is OWASP? ✳️ The Open Web Application Security Project (OWASP) is a non-profit organization founded in 2001, with the goal of helping website owners and security experts protect web applications from cyber attacks.  🔵 The OWASP Top 10 ✳️ OWASP Top 10 is a widely accepted document that prioritizes the most important security risks affecting web applications. Although there are many more than ten security risks, the idea behind the OWASP Top 10 is to make security professionals keenly aware of at least the most critical security risks, and learn how to defend against them. ✳️ OWASP periodically evaluates important types of cyber attacks by four criteria: ease of exploitability, prevalence, detectability, and business impact, and selects the top 10 attacks. The OWASP Top 10 was first published in 2003 and has since been updated in 2004, 2007, 2010, 2013, 2017 and 2019. ✳️ What we will do is, using those top 10 vulnerabilities we will pen-test the websites. If we found any of the vulnerability in that site then we can do two things 👉 EXPLOITING THE SITE 👉 REPORT THE BUG 🔵 Exploiting the site ✳️ Once we found the bug, we can create a payload and exploit the site. Result of this will be like website/admin panel take overs, data breach (stealing sensitive info's), crashing the website etc etc.. but this is totally illegal. 🔵 Reporting bug ✳️ And the other option is, reporting the bug to the creater. We can report the bug that we found on their site. If they found our report as a valid one then they will reward us with $💰💸 . This is what is called as "bug bounty" and its totally legal 🔴 Now, know what are The Top 10 OWASP vulnerabilities in 2020 : 🔹Injection 🔹Broken Authentication 🔹Sensitive Data Exposure 🔹XML External Entities (XXE) 🔹Broken Access control 🔹Security misconfigurations 🔹Cross Site Scripting (XSS) 🔹Insecure Deserialization 🔹Using Components with known vulnerabilities 🔹Insufficient logging and monitoring ==== @Hackers_Blackhat ====

✳️ How to Recover Data From Corrupted OS ➖➖➖➖➖➖➖➖➖➖➖➖➖ ⚜ We are going to use EaseUS data recovery to recover data from a crashed operating system. The software is mainly designed for data recovery cases of any operating system crash. 🔹Step 1: First of all, launch EaseUS data recovery on a working computer. Select ‘USB Drive’ from the list and click on ‘Proceed’. Wait for few minutes until EaseUS data recovery creates a WinPE bootable disk. 🔹Step 2: Once done, connect the bootable disk to the PC with the corrupted Windows system files. Restart the PC and press F2 during the start. This will run the EaseUS data recovery on the startup. 🔹Step 3: Now it will show you the disk partitions. Select the disk where you want to recover data and then click on the ‘Scan’ button. 🔹Step 4: Now, wait for a few minutes until the tool scans for the available data. Once done, it will list all file types that can be recovered. 🔹Step 5: You can either choose to preview or click on the ‘Recover’ button to save the file. Make sure to choose a different drive or different USB to save the file. ✅ That’s it, you are done! This is how you can use EaseUS data recovery to recover data from a Crashed operating system. Keep supporting us❤️ ➖ @Hackers_Blackhat ➖

#requested 🌐 Complete web development Bootcamp for Beginners -2020 🔹 Rating: 4.0 out of 5 🔹 Duration: 18.5 hours 🔹 Description: Learn all the programming language required for web developement includes HTML, PHP, CSS, JavaScript etc 🔹 Enroll for free 🔈Link: https://www.udemy.com/course/the-web-developer-bootcamp-x/?Join-@UdemyFree4You&couponCode=MY_STUDENTS ➖ @Hackers_Blackhat ➖

❇️ How to Enable Password Breach Alerts in Microsoft Edge Browser ➖➖➖➖➖➖➖➖➖➖➖➖➖ ⚠️Note: As of now, the feature is available only on Microsoft Edge Dev Channel. So, make sure to use Microsoft Edge (Dev Channel) to enable the new feature. 🔹Step 1: First of all, open Microsft Edge Dev on your PC. 🔹Step 2: Next, click on the ‘Menu‘ button. 🔹Step 3: Next, click on the ‘Settings‘ from the drop-down menu. 🔹Step 4: On the Settings, click on the ‘Passwords.’ 🔹Step 5: Under the password, you need to find the option ‘Show alerts when passwords are found in an online leak.’ 🔹Step 6: Just use the toggle button to enable the feature. ✅ That’s it! You are done. Now, whenever your password appears in a breach, the Edge browser will notify you. Keep supporting us❤️ ➖ @Hackers_Blackhat ➖

Hacker'z home 2.o: Continuation of OWASP TOP 10 ✳️ Broken Authentication ➖➖➖➖➖➖➖➖➖➖➖➖➖➖ 💠 A broken authentication vulnerability can allow an attacker to use manual and/or automatic methods to try to gain control over any account they want in a system – or even worse – to gain complete control over the system. 💠 Websites with broken authentication vulnerabilities are very common on the web. Broken authentication usually refers to logic issues that occur on the application authentication’s mechanism, like bad session management prone to username enumeration – when a malicious actor uses brute-force techniques to either guess or confirm valid users in a system. 💠To minimize broken authentication risks avoid leaving the login page for admins publicly accessible to all visitors of the website: 🔹/administrator on Joomla!, 🔹 /wp-admin/ on WordPress, 🔹 /index.php/admin on Magento, 🔹 /user/login on Drupal. 💠 The second most common form of this flaw is allowing users to brute force username/password combination against those pages. ✳️ Types of Broken Authentication Vulnerabilities 💠 According to the OWASP Top 10, these vulnerabilities can come in many forms. A web application contains a broken authentication vulnerability if it: 🔹Permits automated attacks such as credential stuffing, where the attacker has a list of valid usernames and passwords. 🔹 Permits brute force or other automated attacks. 🔹 Permits default, weak, or well-known passwords, such as”Password1″ or “admin/admin.″ 🔹 Uses weak or ineffective credential recovery and forgot-password processes, such as “knowledge-based answers,” which cannot be made safe. 🔹 Uses plain text, encrypted, or weakly hashed passwords. 🔹 Has missing or ineffective multi-factor authentication. 🔹 Exposes session IDs in the URL (e.g., URL rewriting). 🔹 Does not rotate session IDs after successful login. 🔹 Does not properly invalidate session IDs. User sessions or authentication tokens (particularly single sign-on (SSO) tokens aren’t properly invalidated during logout or a period of inactivity. ✳️ Writing insecure software results in most of these vulnerabilities. They can be attributed to many factors, such as lack of experience from the developers. It can also be the consequence of more institutionalized failures such as lack of security requirements or organizations rushing software releases, in other words, choosing working software over secure software. ✳️ How do you prevent broken authentication vulnerabilities? 💠 In order to avoid broken authentication vulnerabilities, make sure the developers apply to the best practices of website security. Support them by providing access to external security audits and enough time to properly test the code before deploying to production. 💠 OWASP’s technical recommendations are the following: 🔹 Where possible, implement multi-factor authentication to prevent automated, credential stuffing, brute force, and stolen credential reuse attacks. 🔹 Do not ship or deploy with any default credentials, particularly for admin users. 🔹 Implement weak-password checks, such as testing new or changed passwords against a list of the top 10,000 worst passwords. 🔹 Align password length, complexity and rotation policies with NIST 800-63 B’s guidelines in section 5.1.1 for Memorized Secrets or other modern, evidence-based password policies. 🔹 Ensure registration, credential recovery, and API pathways are hardened against account enumeration attacks by using the same messages for all outcomes. 🔹 Limit or increasingly delay failed login attempts. Log all failures and alert administrators when credential stuffing, brute force, or other attacks are detected. 🔹Use a server-side, secure, built-in session manager that generates a new random session ID with high entropy after login. Session IDs should not be in the URL. Ids should also be securely stored and invalidated after logout, idle, and absolute timeouts. Will continue the other vulns. shortly.. stay tuned ➖➖➖➖➖➖➖➖➖➖➖➖➖➖ Keep supporting us❤️ @Hackers_Blackhat

Hacker'z home 2.o: 🔴 HACK ANDROID DEVICES WITH IP ADDRSS USING GHOST FRAMEWORK 🔴 ➖➖➖➖➖➖➖➖➖➖➖➖➖➖ ✳️ Ghost Framework is an Android post-exploitation framework that exploits the Android Debug Bridge to remotely access an Android device. Ghost Framework gives you the power and convenience of remote Android device administration. ✳️ We can use this framework to control old Android devices which have turn on the debug bridge in the "Developer options". ✳️ Now this becomes very harmful because an attacker gets the full admin control on the vulnerable Android device. But we need access to victims mobile and need to be in same network as attacker or use port forwarding. Ok lets start ✳️Procedure: ➖➖➖➖➖➖➖➖➖➖➖➖➖➖ 💠 Step 1:- Open a terminal and then Install the ADB using the following command 🔹 Sudo apt-get update 🔹 Sudo apt-get install android-tools-adb 🔹 Sudo apt-get install android-tools-fastboot (Just use sudo for the first command then u can ignore the sudo for the rest) ✳️ Step 2:- Clone the Ghost Framework from GitHub by using following command: 👉 git clone https://github.com/entynetproject/ghost Wait untill it gets download. 💠 Step 3:- Then we go the ghost directory by using cd command: 🔹 Cd ghost 💠 Step 4:- Now we need to install it using the installer script. Before that we give the permission to the installer script by applying following command: 🔹 Sudo chmod +× install.sh 💠 Step 5:- Now we can run the installer script using following command: 🔹 Sudo ./install.sh 🔹 Then wit will start installing the dependencies and this process will take some time depending on your internet speed. 🔥⚠️ Now Everything is installed Lets Start exploiting 💠 Step 1:- Go to "about phone" in settings and then tap 7 times on Build Number. 💠 Step 2:- go back to the setting and now you can see, there will be an Option called "developer options". click on that and then Enable USB Debugging. 🔹 Now connect the Android device via USB cable and allow the USB Debbuging when prompt. To verify the connection is successful or not, execute the following command 🔹 adb devices (It will shows the list of device attached) 🔹 Now You Can Remove USB cable and give back the victim's Mobile. 💠 Step 4:- Now we can run Ghost Framework from any where in our terminal by only the ghost command: 🔹 ghost And the ghost will appear with its main menu as the following screenshot 💠 Step 5:- Now type the following command to connect with victim mobile 🔹 Ex: Connect 192.168.1.25 💠 here connect is a command and IP address is victim mobile's ip.. 💠 Stpe 6:- once u get connected., Exploit as u like😁.. type help to get all commands. ⚠️ Note: There are lots of exploits here you can do with that Android device. This is just one of the method which need victims mobile.. we can also do without touching the victims mobile.. i will teach that later just stay tuned 🔹 If you want to use PhoneSploit Over WAN just use Port Forwarding ➖➖➖➖➖➖➖➖➖➖➖➖➖➖ Keep supporting us❤️ @Hackers_Blackhat

💠 Top 3 methods of Cracking Passwords Techniques Used By Hackers (intermediate) ➖➖➖➖➖➖➖➖➖➖➖➖➖ 🔹 Dictionary Attack 👉 A dictionary attack is a technique used by most regular hackers to determine the passphrase by trying their luck many times. Unlike its name, it works like a dictionary consisting of usual words that many people use as their password. On Dictionary attacks, hackers attempt to crack your passwords by making random guesses. 🔹 Brute Force Attack 👉 Well, Brute-Force is an advanced version of Dictionary attack. In this attack, the hacker submits many passwords or passphrases with the hope of eventually guessing correctly. The attacker’s role is to systematically check all possible passwords and passphrases until the correct one is found. 🔹 Rainbow Table Attack 👉 Well, Rainbow Table is usually a large dictionary that contains loads of pre-calculated hashes and the passwords from which they were calculated. The major difference between Rainbow and other dictionary attacks is the Rainbow table is specially optimized for hashes and passwords ✅ Thats it for intermediate hackers, I hope you got to know something about password cracking techniques Keep supporting us❤️, ➖ @Hackers_Blackhat ➖

✳️ How to Exclude Files & Folders From Windows Defender ➖➖➖➖➖➖➖➖➖➖➖➖➖ ⚜we are going to share a detailed guide on how to exclude files and folders from the Windows defender for crackers. So, let’s check out. 🔹Step 1: First of all, click on the Start button and select ‘Settings’ 🔹Step 2: On the Settings page, click on the ‘Update & Security’ option. 🔹Step 3: From the left-hand side pane, click on the ‘Virus & threat protection’ 🔹Step 4: Now click on the ‘Manage settings’ under ‘Virus & threat protection settings’ 🔹Step 5: Now scroll down to the ‘Exclusions’ section. There click on the ‘Add or remove exclusions’ 🔹Step 6: You will now see a screen like below. Here you need to click on the ‘Add an exclusion’ option. It will show you four different options – 👉 File: Pick File if you want to exclude a specific file. 👉Folder: Use this option if you want to exclude an entire folder. 👉File Type: If you want to exclude file extensions like .pdf, .mp3, .exe, etc., then pick this one. 👉Process: Select this one if you want to add background tasks and processes. 🔹Step 7: For example, we have chosen to exclude a folder. Just locate the folder which you want to add to the exclusion list. 🔹Step 8: Once done, the folder will be added to the exclusion list. 🔹Step 9: Similarly, you can exclude file, file type, & process as well. 🔹Step 10: If for any reason, you want to remove a file or folder from the exclusion list, then click on the entry and click on ‘Remove’ ✅ That’s it! You are done. This is how you can exclude files and folders from the Windows defender. Share and support us❤️ ➖ @Hackers_Blackhat ➖

22 Muhammad Faizan 3740583591411 03102496617 faizanaltaf958@gmail.com 392 520 728 1100 Software Electrical Delete 22 21 Muhammad Faizan 3740583591411 03102496617 faizanaltaf958@gmail.com 392 520 728 1100 Software Electrical Delete 21 20 Muhammad Faizan 3740583591411 03102496617 faizanaltaf958@gmail.com 392 520 728 1100 Software Electrical Delete 20 19 Muhammad Faizan 3740583591411 03102496617 faizanaltaf958@gmail.com 392 520 728 1100 Software Electrical Delete 19 18 IMAD 1560251099263 03469091747 imadrahim67@gmail.com 400 550 811 1100 Electrical Software Delete 18 17 Muhammad Haris 3660105291957 03360195263 harisaslam256@gmail.com 349 520 765 1100 Electrical Electrical Delete 17 16 Arslan 3710339312697 03111539073 arslankiyani946@gmail.com 681 1050 2512 3500 Electrical Software Delete 16 15 Zaheer ullah 1110134514517 03319232341 zub9999100@gmail.com 794 1100 687 1100 Software Electrical Delete 15 14 Muhammad 8220367663655 03129455525 Atimughal662@gmail.com 620 1100 2464 3350 Electrical Software Delete 14 13 ABRAR 1560148779631 03332363333 zahirmatta@gmail.com 436 550 851 1100 Electrical Software Delete 13 12 BASIT 1430157777713 03061334456 basitfarhan4@gmail.com 397 550 764 1100 Software Delete 12 11 hamza 3230412532367 03463802800 hamza.khan2578@gmail.com 4343 4343 322 3232 Software Electrical Delete 11 10 hamza 3120278133903 03463802800 hamza.khan2578@gmail.com 3443 4343 43343 4343 Electrical Software Delete 10 9 j 3333333333333 33333333333 ujh@hj.com 233 32 23 32 Electrical Software Delete 9 8 Hamza 3120278133903 03463802800 hamza.khan2578@gmail.com 434 543 322 654 Electrical Electrical Delete 8 7 Test 1234566778890 03333333333 a@b.cc 444 467 566 777 Electrical Software Delete 7 6 SHAHRUKH 3720141332203 03365720777 shahrukhshahzad444@gmail.com 455 520 0 1100 Software Software Delete 6 5 noor 1540207871661 03429018895 noorzaman034290188@gmail.com 1150 849 3500 2500 Electrical Software Delete 5 4 GAUHAR 2140223292827 03469099196 gauhariqbal5588@gmail.com 364 550 712 1100 Electrical Software Delete 4 3 jh 3833333333333 87023232323 hk@jhk.com 9 89 89 89 Software Software Delete 3 2 Hamid 3756433456659 03244534534 hamid.awan@bims.edu.pk 444 666 444 666 Electrical Software Delete 2 1 Test 1234566778890 03333333333 a@b.cc 444 467 566 777 Electrical Software Delete 1 We are not responsible for any illegal activity Only for educational purposes Enjoy:) ---------------------------------------------------

*#FREE PAKISTAN IDENTITY LEAK DATA*  ` Admission NO first Name CNIC Number Student Phone Number Student Email First Year Marks Total Marks FSC Total Obtain Marks FSC Total Marks First Priority and Second Priority Modify 182 Muhammad 3740554990963 03336272363 muazsaleem303@gmail.com 373 520 819 1100 Software Delete 182 181 Muhammad 3740554990963 03336272363 muazsaleem303@gmail.com 373 520 819 1100 Software Delete 181 180 muhammad AWAIS 3820163734937 03235103466 awais165@gmail.com 556 1100 597 1100 Software Software Delete 180 179 muhammad AWAIS 3820163734937 03235103466 awais165@gmail.com 556 1100 597 1100 Software Software Delete 179 178 Muqaddas 3710431373148 03435683062 muqaddasashraf269@gmail.com 361 520 361 520 Software Software Delete 178 177 NADEEM ANJUM 3810153048319 03110751975 hameedofficial07@gmail.com 790 1100 777 1100 Software Software Delete 177 176 Muhammad 1620133156199 03162116418 asifsalar2005@gmail.com 330 550 345 550 Software Software Delete 176 175 farakh 3540337076581 03476474556 farakh.shabbirs3@gmail.com 886 1100 2839 3550 Electrical Software Delete 175 174 farakh 3540337076581 03476474556 farakh.shabbirs3@gmail.com 886 1100 2839 3550 Electrical Software Delete 174 173 farakh 3540337076581 03476474556 farakh.shabbirs3@gmail.com 886 1100 2839 3550 Electrical Software Delete 173 172 farakh 3540337076581 03476474556 farakh.shabbirs3@gmail.com 886 1100 2839 3550 Electrical Software Delete 172 171 farakh 3540337076581 03476474556 farakh.shabbirs3@gmail.com 886 1100 2839 3550 Electrical Software Delete 171 170 farakh 3540337076581 03476474556 farakh.shabbirs3@gmail.com 886 1100 2839 3550 Electrical Software Delete 170 169 Hassan 3740552766065 03230503267 hzia44330@gmail.com 286 505 425 595 Electrical Software Delete 169 168 Hassan 3740552766065 03230503267 hzia44330@gmail.com 505 286 595 425 Electrical Software Delete 168 167 Abdullah 3460317688905 03418952068 saeedabdullah0002@gmail.com 334 520 623 1100 Software Electrical Delete 167 166 Abdullah 3460317688905 03418952068 saeedabdullah0002@gmail.com 334 520 623 1100 Software Electrical Delete 166 165 Abdullah 3460317688905 03418952068 saeedabdullah0002@gmail.com 334 520 623 1100 Software Electrical Delete 165 164 Abdullah 3460317688905 03418952068 saeedabdullah0002@gmail.com 334 520 623 1100 Software Electrical Delete 164 163 Amanullah 6110165949989 03144900388 amanullahqureshi@gmail.com 2009 3150 2009 3150 Electrical Electrical Delete 33 32 Nasir 3740548484841 03355616115 nk021058@gmail.com 353 520 762 1100 Electrical Software Delete 32 31 Nasir 3740548484841 03355616115 nk021058@gmail.com 353 520 762 1100 Electrical Software Delete 31 30 Zeeshan 3520243244623 03055511581 zeeshanmustfa7@gmail.com 961 1100 746 1100 Software Electrical Delete 30 29 Awais 3610406478223 03012743690 immoni867@gmail.com 386 520 867 1100 Electrical Software Delete 29 28 Ammad 1330238118023 03168494581 Ammadawan168@gmail.com 409 520 892 1100 Software Electrical Delete 28 27 usman 3830209974801 03351893129 PAKISTAN41324@GMAIL.COM 422 520 886 1100 Software Electrical Delete 27 26 Muhammad Awais 1310117563415 03161501608 youthabbasi234@gmail.com 333 520 664 1100 Electrical Software Delete 26 25 Abdullah 3740591365345 03115769217 abdullahhafeez852@gmail.com 265 550 666 1100 Software Electrical Delete 25 24 usman 3830209974801 03351893129 USMAN41324@GMAIL.COM 422 520 886 1100 Software Delete 24 23 usman 3830209974801 03351893129 USMAN41324@GMAIL.COM 422 520 886 1100 Software Delete 23