The HAQ.NEWS podcast is brought to you by Jared & Gracie Folkins. It is a daily blog post of information security [tradecraft] tooling news. It's grown into Gracie Folkins reading the [news] daily while Jared Folkins chats with Hackers of all type in the industry, via phone, and with permission he shares the recordings of their conversations.
Head over to https://haq.news to learn more!
Hey!
The other day I gave my good friend HackerFantastic call. We chatted a bit about his family and he also dropped a sweet war story. You should give it a listen!
https://twitter.com/hackerfantastic
https://hacker.house/
ps don't forget my daughter & I created a fun challenge where you can win a laptop.
details -> https://haq.news/2024/04/12/
12 Apr 2024TRANSCRIPT
2024-04-11 : Daily : Gracie Folkins
A cybersecurity researcher, k0shl, discussed methods for exploiting a Windows telephony service issue, which could control memory wrongly. A malware called Nitrogen tricks users into downloading fake apps leading to ransomware but can be prevented with various strategies. On Reddit, there’s talk about the dangers of batch files in Windows due to argument escaping issues. The C2 Cloud project lets testers control compromised systems efficiently. A Proof of Concept showed a flaw in Jasmin Ransomware’s web panel, allowing unauthorized file access. Carlos Polop’s guide covers penetration testing extensively. Use Countik, an online tool, for analyzing TikTok accounts. An article guides on OSINT for map investigations. Shortemall v3.0, released on April 5, 2024, scans for hidden content in short URLs.
11 Apr 2024TRANSCRIPT
2024-04-10 : Daily : Gracie Folkins
A cybersecurity researcher shares techniques for crafting XSS payloads through JavaScript event handlers and HTML entities to bypass WAFs. The SiCat tool hunts for security exploits using sources including databases like Exploit-DB. There’s a case study of a hacked Confluence server outlining the intruder’s steps, utilizing Unix logs and SSH brute force tactics. Shortemall automates finding content behind Short URLs, while Damn Vulnerable RESTaurant exists for training on API vulnerabilities. Techniques for XSS attacks by modifying code to evade filters are discussed. OSINT helps in phishing scams prevention and probes. Linux by Vikku offers resources for bug bounty hunters. A SQL injection flaw in WordPress LayerSlider plugin is exposed with given detection tools. Tactics to set up rogue access points for Wi-Fi tests using Fluxion are shared. A study plan for AWS security mastery is outlined. Chimera is a PowerShell obfuscation tool to avoid AMSI and antivirus detection. A-poc/RedTeam-Tools repository features red team tools and tips. The personal security checklist advises on digital life security in various aspects. APKHunt checks Android apps against OWASP MASVS. Scanners Box offers a kit of infosec scanning tools. OpenCodeInterpreter rivals GPT-4 in code abilities, topping the BigCode leaderboard. Map Developers and Google Maps Scraper aid in business data collection. Keyhole carries out social media analytics. HAR files help analyze network issues. creepyCrawler is an OSINT tool for site reconnaissance. PretendoNetwork’s SSSL patches Nintendo CA - G3. KDMapper uses Intel driver to load non-signed drivers. GhostMapperUM maps an unsigned driver into memory. GMER handles Windows kernel rootkits. EDRSandblast evades EDR systems. Plandex offers an AI coding engine aiding in software tasks. Memory dump emulation tools like Bochs assist in crash analysis and forensics. wtf is a Windows snapshot-based fuzzer by Axel Souchet. Using Ghidra for analyzing ARM firmware in KatWalk C2 treadmill is elaborated. The KAT Walk C2 VR Treadmill’s set-up and usage are described. Constructing an 8-bit computer with 74xx ICs and an Ethernet adapter for networking. Ivan builds a discrete logic CPU and programming language. Upgrading a discrete logic ALU for improved computer performance. Reverst serves as a reverse-tunnel library using QUIC and HTTP/3 for restricted network services.
Inside a recent episode
2024-04-18 : Dial-Up : Matthew Hickey
Published 18 Apr 2024 · Transcript excerpt
[…] And kind of let people know what it took to get to this point. So I've been a professional penetration tester, ethical hacker, working freelance for various companies over the years. One of the first gigs that we ever did when we set up Hacker House. Now when we first started Hacker House, we were very focused on kind of red teaming, doing kind of black team assessments, and real world simulations of risk. The essentially used cyber as a means to affect geographic areas. But one of the first clients that we got was a US -based client who invited us over and was kind of like hit us with everything you've got, right? […]
Pod Engine is an independent podcast discovery and analytics service and is not affiliated with or endorsed by this podcast. Artwork and show content belong to their owners. Full legal notice.
Explore this show Podcast research with Pod Engine
