/r/blackhat
Focused on the ongoing discussion and documentation of vulnerabilities and exploitation techniques. Please read the rules before posting here.
We seek to discuss vulnerability and exploitation theory and [evading] the countermeasures used to deter exploitation. This is also a place to discuss general blackhat rules, etiquette and culture. We welcome:
Writeups (not CTF or HTB)/talks detailing new vulnerabilities or techniques (there should be enough information to reproduce the exploit/technique)
Proof of concepts of old vulnerabilities or techniques
Projects
Hypothetical questions
Rules:
Be excellent to each other.
No Solicitation
Stay on topic.
Avoid self-incriminating posts.
Pick a good title.
Do not post non-technical articles.
Ideally, the content should be original, we don't care about your crappy ARP poisoner or Kaspersky's latest scam.
No pay / signup walls.
No coin miners
No "Please hack X" posts
Well thought out and researched questions / answers only.
If your project is not free / open source it does not belong.
Please limit your posts (we don't want to read your blog three times a week).
If you want to submit a video, no one wants to listen to your cyberpunk music while you copy/paste commands into kali terminals.
The mods are ban-happy, you have been warned.
Other helpful links:
/r/blackhat
I have blocked them many times but they keep coming back with new accounts. I guess because they have my phone number, changing my username doesn't stop them from coming back. I guess at this point I have to change my personal phone number. Any suggestions?
Scouting locations, if you know how apps work then you know. Women won't give a chance if you're far away. And they won't work in one week convos.
From Match to date it takes on average 2-3 weeks.
I'm not spending 2-3 weeks in a hotel room lonely af.
I'm scouting locations in advance
How to scrap data from site, Like if someone fills out a form on a site, How can we get that information? Realtime whenever someone fills the form we get the information? From any website.
Does anyone have a good strategy for finding who’s behind a string of spoofed SMS messages? I used to have a website with analytics that I wish I still had so we could respond with a link and see what IP address clicks the link. Any similiar/better strategy or service like that? Backstory: Lately a bunch of my coworkers are getting harassing text messages, all from spoofed numbers (sometimes the numbers appear to come from one coworker to another, but it is definitely some third party sending everything). The person is digging up old social media posts, digging into family members accounts, sending creepy “I know everything about you” messages, with birthdays and other doxxing info. Nothing is technically illegal, so it doesn’t seem like the police would get involved. Figured the black hat community might have some tips. P.s. lock down your social media
Unlike telegram, It seems they don't recognize numbers from anything other than actual SIM cards. I tried Google voice, Skype, sly number, none are accepted. Any app or online service like the ones mentioned above that actually work for WhatsApp?
Looking for a group of hackers as I believe there's strength in numbers so if Ur in then please message me also if this post isn't allowed delete it as I'm not to sure if it is
Someone tries to scam us with a airbnb phoshinh site. I have some knowledge of kali and the tools but not enough. Is there Someone willing to help?
Should I be worried that I've already been hacked and he knows what a class guy I am? What kind of software could he have installed on my girlfriends phone/laptop to allow for spying on our conversations?
e.g. He has full access to his sisters laptop, what malware/spyware/rootkit can he install on her laptop??
I know this post is about Black Hat, but it seems like the BH everyone is discussing here is different from the affiliate BH on BHW. Is this mainly a hacker tech forum?
Someone at 3AM activated their eSIM with my number through spectrum 🥲 luckily I woke up around 4:30 today so they didn’t have much time to do much but they did change my bank password (they got locked out after trying to log in with new password they made because I had log in pins required that couldn’t be changed by them) and my Amazon account. Oh and obviously my spectrum account. When I called spectrum to deactivate my number (off my currently offline phone 😂) I wasn’t able to call them because it wouldn’t ring since I didn’t have service on my phone. It’s 4am and I was just waking up so be gentle on me. But I tried again from my girlfriends phone and the first person said they couldn’t do anything about it and sent me to tech support who told me they could transfer my number back to my eSIM if I could verify it was me by sending me an OTP to my number 😂 which obviously I wouldn’t be able to give him if he texts my number. But he then canceled my number and when I asked how this was possible he told me he doesn’t know but it’s been happening a lot. Anyways deleted my number off all my accounts including email which they never got into (if it were me that would be the first password I change) and changed passwords. Just curious how yall think this happened.
TLDR: Someone stole my number and started changing my passwords. Spectrum rep said it’s happening a lot. How?
Where can i find Terravision breach (2023-02-01) ? . I can't find it anywhere
How do I give myself admin privileges on a limited access pc?
Hi, I am at work and wanted to use an unused pc to try out hacking and stuff as I am trying to get into the cyber Security branch of where I work, and besides having some fun, I wanted to exercise accessing a PC with just the PC at my disposal without external media devices, I tried asking on r/hacking about how to do this particular task, but I was met with negative response about this being illegal and unethical (its neither, pc is empty and only used to access a local area website to write reports) and that I would be fired (no, I work in a place where I won't be held accountable for fiddling with some PC about to be replaced anyways, besides that I am automatically hired for reasons I won't go into, and am encouraged to show my prowess in different areas of security(cyber or otherwise) so I can get sent to more suit able Department etc etc...)
So, after this wall of text, what should I do? Keeping in mind that I don't necessarily have access to external media.
I am an iPhone user and the suspect is an android user. I saw a text notification on my Home Screen that android had reacted to their own text. I thought maybe they were trying to copy & paste and didn’t bother to check it out. Today, android is stating I was the one who reacted and it does show my name under the reaction. Which I promise I only react other iPhone users.
Google told me that you can spoof reactions to text to make it look like someone else liked or disliked your text. Wanted to see how easy it would be to do something like this.
Edit to add: found out we are both iPhone but they are using 3rd party app to text me from (unsure what the app is). I am using the normal green messages app for iPhone. Basically want to make sure it can’t happen again or that they can’t hack my phone.
All I know is DNS history and censys are all possible ways, are there any other potentially better ways?
*Not fully confirmed yet
According to the website which was discovered through Redline related Telegram channels, law enforcement was able to hack the infrastructure of Redline and Meta Infostealers and obtain critical data
With the message being that more information is to come.
Find more information here – https://www.operation-magnus.com/
Hi i was wondering if there is a tool on Linux that is free and can help me manage my IPhone like installing firmware and manufacturing software restore and more...
thanks for the help
Hello there, there's this game called Fun Run 4 and I've been you could say "data mining" for unreleased characters, powerups and more. I've been doing this for about 6 months now and I've been posting the leaks into a Discord server meant for Fun Run 4.
I simply used my Android to install a app and with that app I open the game directory and open the configuration within the JSON reader app. That's how I started off with getting unreleased characters etc.
I decided to go a bit deeper and that I did. I decided to start using my PC to my advantage, so I installed a software called "AssetStudio" and "AssetRipper". With those I was able to see the character models/meshes and I discovered a SHA1 hash key. So I got my friend to decrypt it for me. So he did, but we got another hashed key which I'm waiting for him to decrypt once he's available.
With all of that said, I simply wanted to post this to see if any of y'all experienced human beings would help me into digging deeper into this game. Our goal is to either get access to the API of the game or simply create a mod menu.
Keep in mind, I am not doing this to actually harm the developers or the game but simply for ethical purposes. If anyone is willing to give a helping hand, please let me know in the comments.
So i came across this youtube video which is somehow tricking YouTube's preview system and it also bypassed the copyright detection engine.
Now it's definitely using two or more streams (multiple streams),but i can't understand what else they have done.
I tried to make a multiple stream mp4 with modified metadata and uploaded it to youtube but it doesn't seem to work.
Edit: Since the original video got made private here's a another similar one,see the video previews after around the 2 hour mark.