White Hackers

Perusing the  release notes  for the latest Linksys WRT120N firmware, one of the more interesting comments reads: Firmware 1.0.07 (Build 01) - Encrypts the configuration file. Having previously  reversed  their firmware obfuscation and  patched  their code to re-enable JTAG debugging, I thought that surely I would be able to use this access to reverse the new encryption algorithm used to secure their backup configuration files. Boy was I giving them way too much credit. Here’s a diff of two backup configuration files from the WRT120N. The only change made between backups was that the administrator password was changed from “admin” in backup_config_1.bin to “aa” in backup_config_2.bin: OFFSET backup_config_1.bin backup_config_2.bin ---------------------------------------------------------------------------------------- 0x00001468 9E 9B 92 96 91 FF FF FF |........| / 9E 9E FF FF FF FF FF FF |........| Two ...

I have discovered  another  security flaw in Samsung Android phones. It is possible to completely disable the lock screen and get access to any app - even when the phone is "securely" locked with a pattern, PIN, password, or face detection. Unlike another recently released flaw, this doesn't rely quite so heavily on ultra-precise timing. Video . Of course, if you are unable to download a screen unlocker, this security vulnerability still allows you to  dial any phone number and run any app ! HOWTO From the lock screen, hit the emergency call button. Dial a non-existent emergency services number - e.g. 0. Press the green dial icon. Dismiss the error message. Press the phone's back button. The app's screen will be briefly displayed. This is just about long enough to interact with the app. Using this, you can run and interact with any app / widget / settings menu. You can also use this to launch the dialler. From there, you can dial any phone...

# March 13, 2013 # FULL-DISCLOSURE Exclusive - Vielen Dank John! # # VULNERABILITY SUMMARY # --------------------- # A confirmed security vulnerability has been identified with 30 high traffic web # sites owned by QuinStreet.   Vendor stores database IDs in cookies which are # easily spoofed (USERID_COOKIE), allowing all user information to be accessed.  # Seven million users are reportedly in the database: # http://www.itbusinessedge.com/about-itbe # # Web sites include: # # Ziff Davis # ---------- # http://www.eweek.com/ # http://www.baselinemag.com/ # http://www.cioinsight.com/ # http://www.channelinsider.com/ # http://www.eseminarslive.com/ # # Developer.com Network # --------------------- # http://www.developer.com/ # http://www.devx.com/ # http://www.codeguru.com/ # http://www.htmlgoodies.com/ # # IT Business Edge Network # ------------------------ # http://www.itbusinessedge.com/ # http://www.datamation.com/ # http://www.smallbusinesscomputing.com/ ...

just to clarify there is no need for any installed apps on the victim's account, Even if the victim has never allowed any application in his Facebook account I could still get full permission on his account via Facebook Messenger app_id (This bug works on any browser), Also, It's important to mention that there is a special regex protection in Facebook Messenger app_id (app_id=220764691281998), I was able to bypass it.   Bug 1: Reported this bug at 6/03/2013, Facebook Security Team Fixed it immediately , Also reported more OAuth bugs at 26/02/2013, Facebook Security Team Fixed it very quickly Regarding Facebook OAuth Double URL Encoding (Firefox), Reported at 6/02/2013, Fixed it very quickly Details: So after the first OAuth Vulnerability discovery  http://www.nirgoldshlager.com/ 2013/02/how-i-hacked-facebook- oauth-to-get-full.html Facebook Security was trying to protect OAuth Token Hijacking attacks by using  Regex Protecti...

Hacking is definitely not as easy as shown in various movies, still there are thousands of newbies who wants to learn hacking for one or another reason but don’t know where to start from. So, below is a list of some website to start your journey. list of various Ethical hacking Sites Backtrack : Rating (5/5) No need to introduce this software. If you have a little bit of experience in hacking then you must have heard about Backtrack. This website provide many hacking tutorials using Backtrack. Have there own Training programs, blog and large community. Backtrack is highly popular among Security Professional and many top certifications like CEH use backtrack for teaching penetration testing. If you are a Backtrack beginner then you must bookmark this website. Hell bound hackers : Rating (4.5/5) Hellbound Hackers is a security training website which covers large number of security topics like programming, Encryption, Cracking etc. HellBound is one of largest hacking teachi...