- 10/3/19, APISecurity.IO (UMV: 1,510): Issue 51: Gartner Releases Full Report on API Security
- 10/2/19, ADT Magazine (UMV: 117,500): API Security Project Identifies Top 10 Vulnerabilities
- 9/26/19, Dark Reading (UMV: 57,800): Why You Need to Think About API Security
- 9/24/19, The Daily Swig (UMV: 30,500): OWASP Reveals Top 10 Security Threats Facing API Ecosystem
- 9/20/19, Security Boulevard (UMV: 29,100): New OWASP List Highlights API Security Holes
- 9/13/19, Security Boulevard (UMV: 29,100): Why You Need to Be Thinking About API Security
- 9/13/19, CyberWire (UMV: 49,380): Daily Briefing: OWASP API Security Project
- 9/12/19, Dark Reading (UMV: 57,800): APIs Get Their Own Top 10 Security list
- Also included in Dark Reading's weekly newsletter on 9/19/19
Friday, June 5, 2020
OWASP API Security Project Media Coverage
Thursday, June 4, 2020
Wafw00F: The Web Application Firewall Fingerprinting Tool
To do its magic, WAFW00F does the following steps:
- Sends a normal HTTP request and analyses the response; this identifies a number of WAF solutions.
- If that is not successful, wafw00f sends a number of (potentially malicious) HTTP requests and uses simple logic to deduce which WAF it is.
- If that is also not successful, wafw00f analyses the responses previously returned and uses another simple algorithm to guess if a WAF or security solution is actively responding to wafw00f's attacks.
For further details, check out the source code on EnableSecurity's main repository.
What does it detect? WAFW00F can detect a number of firewalls, a list of which is as below:
wafw00f's installation
If you're using Debian-based distro, enter this commands to install wafw00f:
sudo apt update && sudo apt install wafw00fBut if you're using another Linux distro, enter these commands to install wafw00f:
How to use wafw00f?
The basic usage is to pass an URL as an argument. Example:
Final Words to you
Questions? Pull up an issue on GitHub Issue Tracker or contact to EnableSecurity.
Pull requests, ideas and issues are highly welcome. If you wish to see how WAFW00F is being developed, check out the development board.
Some useful links:
Presently being developed and maintained by:
- Sandro Gauci (@SandroGauci)
- Pinaki Mondal (@0xInfection)
Related word
Linux Command Line Hackery Series - Part 5

Welcome back to the Linux Command Line Hackery series, this is Part-V of the series. Today we are going to learn how to monitor and control processes on our Linux box, so wrap your sleeves up and let's get started.
Command: ps
Syntax: ps [options]
Description: ps displays information about the currently running processes. Some of the common flags of ps are described briefly below
Flags:
-A or -e -> select all processes
-a -> select all processes except both session leaders and processes not associated with a terminal.
T -> select all processes associated with current terminal
-u <username or id> -> select all processes of a given user or userlist
Open up a terminal and type ps:
ps
what you'll see is a list of processes currently running in your terminal. One important thing to notice in the output is what's called as PID which stands for process ID. It is the number that uniquely identifies a process. Just keep that PID concept in mind we'll use it soon.
OK I know that's not really what you want to see rather you want to see all the processes that are currently running on your box. Don't worry we have flags to rescue, in order to see all the processes you can use the -e flag like this:
ps -e
Boom! you get a long list of processes currently running on your machine (don't stare at me like that, you asked and I gave you that). If you want to see processes of a particular user you can type the following command in your terminal:
ps -u bob
here "bob" is a username. This command will list all processes of the user with effective user name of bob.
You can do a full-format listing of the processes using the -f flag like this:
ps -fu bob
But the output of the ps command is a snapshot not really a live preview of what is going on in your box. I know your next question is going to be something like this, Isn't there a command in Linux that gives me a live updating information of the processes? Yes, there is a command called top that we'll learn about next.
Command: top
Syntax: top [options]
Description: top gives a dynamic real-time view of a running system. That is, it gives the up-to-date information about all the processes running on your Linux box (sounds fun!). Besides giving information about current processes and threads top also provides a brief system summary.
To start top just type this command:
top
and you'll get a nice and cute looking ugly display :). Well what the heck is going on here you might ask, right? What you get is information about what is going on with your computer. To see what more can you do with top just type <h> within the program window and you'll be given list of options that you can play with.
OK looking at what processes are going on in your box is cool but what if you want to terminate (or close) a process, is there a command line utility for that? Yes, there is and that's what we are going to look at next.
Command: kill
Syntax: kill [options] <pid> [...]
Description: kill is used to send a signal to process which by default is a TERM signal meaning kill by default sends a signal of termination to process (Cruel guy). To list the available signals we can use the -l or -L flag of the kill command.
To simply terminate a process we provide kill command a PID (process ID) and it will send the TERM signal to the process. So to kill a process first we'll list the running processes and then we'll keep the PID of the process in mind that we want to terminate. After that we'll issue the kill command with the PID that we just found.
ps -ax
kill 1153
the above command will send a TERM signal to the process whose PID is 1153, as simple as that.
We can also use our already learned skills to refine the output of ps command. Say we have a xterm terminal running on our box and we want to terminate it. By using ps command all alone we'll get a long listing of all processes running on our box. But we can limit the output of ps command to just those processes that we're interested in by piping ps command with the grep command like this:
ps -ax | grep xterm
wow! that's amazing, we're able to pull out only those results from the ps command that contained xterm in them. Isn't that a cool trick? But what is that vertical bar ( | ) doing in the middle, you may be thinking, right? Remember we learned about the input and output re-directors previously, the vertical bar (pipe in geeky terms) is another re-director whose task is to redirect the output of one command as input to another command. Here the pipe redirects the output of ps -ax command as input to grep command and of-course from the previous article you know that grep is used to search for a PATTERN in the given input. That means the above command searches for the xterm word in the output of ps -ax command and then displays just those lines of ps -ax command which contain xterm. Now get that PID and kill that process.
That's it for today, try these commands up on your own box and remember practice is gonna make you master the Linux command line. :)
Secret Hack Codes For Android Mobile Phones
Secrete Hack codes for Android Mobile phones
Secret hack codes are usually hidden from users to prevent misuse and exploit. Android is a very new platform so there aren't many hack codes for Androids available. Today I will share all of the hack codes of Android cellphones that I know. I have tested these codes on my Samsung Galaxy with the Android OS version 2.2. I am sure these will work on all previous versions.
Secret Hack Codes for Android Mobile Phones:
1. Complete Information About Your Phone
*#*#4636#*#*
This code can be used to get some interesting information about your phone and battery. It shows the following 4 menus on the screen:
- Phone information
- Battery information (How to maximize or boost battery life in android phones)
- Battery history
- Usage statistics
2. Factory data reset
*#*#7780#*#*
This code can be used for a factory data reset. It'll remove the following things:
- Google account settings stored in your phone
- System and application data and settings
- Downloaded applications
It will NOT remove:
- Current system software and bundled application
- SD card files e.g. photos, music files, etc.
Note: Once you give this code, you will get a prompt screen asking you to click on the "Reset phone" button, giving you the chance to cancel your operation.
3. Format Android Phone
*2767*3855#
Think before you input this code. This code is used for factory formatting. It will remove all files and settings, including the internal memory storage. It will also reinstall the phone firmware.
Note: Once you give this code, there is no way to cancel the operation unless you remove the battery from the phone.
4. Phone Camera Update
*#*#34971539#*#*
This code is used to get information about phone camera. It shows following 4 menus:
- Update camera firmware in image (Don't try this option)
- Update camera firmware in SD card
- Get camera firmware version
- Get firmware update count
WARNING: NEVER use the first option. Your phone camera will stop working and you will need to take your phone to a service center to reinstall camera firmware.
5. End Call/Power
*#*#7594#*#*
This one is my favorite. This code can be used to change the action of the "End Call/Power" button. Be default, if you hold the button down for a long time, it shows a screen asking you to select between silent mode, airplane mode, and power off.
Using this code, you can enable this button to power off without having to select an option, saving you some time.
6. File Copy for Creating Backup
*#*#273283*255*663282*#*#*
This code opens a file copy screen where you can backup your media files e.g. images, sound, video and voice memo.
7. Service Mode
*#*#197328640#*#*
This code can be used to enter into service mode. In service mode, you can run various tests and change settings.
8. WLAN, GPS and Bluetooth Secret Hack Codes for Android:
*#*#232339#*#* OR *#*#526#*#* OR *#*#528#*#* – WLAN test (Use "Menu" button to start various tests)
*#*#232338#*#* – Shows WiFi MAC address
*#*#1472365#*#* – GPS test
*#*#1575#*#* – Another GPS test
*#*#232331#*#* – Bluetooth test
*#*#232337#*# – Shows Bluetooth device address
9. Codes to get Firmware version information:
*#*#4986*2650468#*#* – PDA, Phone, H/W, RFCallDate
*#*#1234#*#* – PDA and Phone
*#*#1111#*#* – FTA SW Version
*#*#2222#*#* – FTA HW Version
*#*#44336#*#* – PDA, Phone, CSC, Build Time, Changelist number
10. Codes to launch various Factory Tests:
*#*#0283#*#* – Packet Loopback
*#*#0*#*#* – LCD test
*#*#0673#*#* OR *#*#0289#*#* – Melody test
*#*#0842#*#* – Device test (Vibration test and BackLight test)
*#*#2663#*#* – Touch screen version
*#*#2664#*#* – Touch screen test
*#*#0588#*#* – Proximity sensor test
*#*#3264#*#* – RAM version
@EVERYTHING NT
More info
- Pentest Windows
- Pentest Wordpress
- Pentest Documentation
- Pentest Software
- Pentest Methodology
- Pentest+ Vs Ceh
- Pentestmonkey Sql Injection
- Pentest Tutorial
- Pentest Iso
- Hacking The System
- Pentestmonkey Cheat Sheet
- Pentest Firewall
- Pentest Report Generator
- Pentest Training
- Pentest Uk
- Pentest Cyber Security
Wednesday, June 3, 2020
BASIC OF CAND C++ PRograming Langauage
BASIC OF C AND C++ PROGRAMMING LANGUAGE
BASIC OF C AND C++ PROGRAMMING LANGUAGE
Related word
Tuesday, June 2, 2020
Router-Exploit-Shovel: An Automated Application Generator For Stack Overflow Types On Wireless Routers
Router-Exploit-Shovel is an automated application generation for Stack Overflow types on Wireless Routers.
Router exploits shovel is an automated application generation tool for stack overflow types on wireless routers. The tool implements the key functions of exploits, it can adapt to the length of the data padding on the stack, generate the ROP chain, generate the encoded shellcode, and finally assemble them into a complete attack code. The user only needs to attach the attack code to the overflow location of the POC to complete the Exploit of the remote code execution.
The tool supports MIPSel and MIPSeb.Run on Ubuntu 16.04 64bit.
Router-Exploit-Shovel's Installation
Open your Terminal and enter these commands:
Usage
Example:
python3 Router_Exploit_Shovel.py -b test_binaries/mipseb-httpd -l test_binaries/libuClibc-0.9.30.so -o 0x00478584Router-Exploit-Shovel's screenshot
Code structure
ROP chain generation
This tool uses pattern to generate ROP chains. Extract patterns from common ROP exploitation procedure. Use regex matching to find available gadgets to fill up chain strings. Base64 encoding is to avoid duplicate character escapes. For example:
Attackblocks
You can get attackblocks generated in results/attackBlocks.txt. Such as:
You might like these similar tools:
- eXpliot - Internet Of Things Exploitation Framework
- RouterSploit: Exploitation Framework for Embedded Devices



