Pool on the roof – January 16, 2023

Have a no0b question? New to hacking? Looking for a script? Need help with your github project? Something wrong with your payload? Stuck on a CTF or bug bounty?

This is a weekly recurring post to make friends with other hackers, ask questions, and get any type of help you may need.

Make sure to read our wiki as it’s full of resources for you.

Keep all beginner questions in this weekly stickied post.

submitted by /u/AutoModerator
[link] [comments]

T95 Android TV Box sold on Amazon hides sophisticated malware

Expert discovered that the T95 Android TV box, available for sale on Amazon and AliExpress, came with sophisticated pre-installed malware. Security researcher, Daniel Milisic, discovered that the T95 Android TV box he purchased on Amazon was infected with sophisticated pre-installed malware. This Android TV box model is available on Amazon and AliExpress for as low […]

The post T95 Android TV Box sold on Amazon hides sophisticated malware appeared first on Security Affairs.

how to find someone by website?

Im 15 and i wanna find this dude and humiliate him he said this on omegle "M here, looking for a 13+ F submissive who loves to please her master with her nudes. (no males). If you are interested, you can send me a selfie snap" and the snap id…

Europol arrested cryptocurrency scammers that stole millions from victims

An international police operation led by Europol led to the arrest of cryptocurrency scammers targeting users all over the world. An international law enforcement operation conducted by authorities from Bulgaria, Cyprus, Germany and Serbia, supported by Europol and Eurojust, has dismantled a cybercrime ring involved in online investment fraud. The European police have supported this […]

The post Europol arrested cryptocurrency scammers that stole millions from victims appeared first on Security Affairs.

N64 game compatibility

If I play the US version of an N64 game, can I load it’s save files on the UK, Japanese or Latin American versions? I’m asking because my goal is to start collecting Spanish-language games for practice (it’s my second language) and I don’t want to lose…

Malware source code to investigate

Hello, as a student preparing to apply for college, I would like to try to read source (or just a compiled one) of a malware example and make sense of it. Is there a recommended way to find one? Thanks in advance and have a nice day! submitted b…

Comprehensive password guessing order for unthrottled online attack

Hello,

I am learning about online attack using Hydra. I have Hydra installed and already tried running some example password lists on my machine. Now, how to generate a password list?

The zxcvbn password strength estimator estimates that a password such as ‘helenxing’ takes 10 hours to attack at 10 guesses/hr (https://lowe.github.io/tryzxcvbn/) for unthrottled online attack. However, there is obviously no existing password list with the password ‘helenxing’. So how should I go about launching the attack?

How can I combine functionalities of HashCat (which takes different dictionaries and combines and mutates them) and functionalities of Hydra? And how can I combine the generated word list with lists like rockyou.txt? The final password list should ideally have the most frequent passwords first.

submitted by /u/jq5q
[link] [comments]

XSS in hidden fields via “accesskey” attribute

One of Portswigger Academy’s XSS lessons involves triggering a JS payload when a user presses a key combo, but it doesn’t seem very practical to me. Is there any use case that I’m missing or a better way to do this? For example, if you’re using chrome …