/r/hacking

Photograph via snooOG

A subreddit dedicated to hacking and hackers.

Constructive collaboration and learning about exploits, industry standards, grey and white hat hacking, new hardware and software hacking technology, sharing ideas and suggestions for small business and personal security.

A subreddit dedicated to hacking and hacking culture.

What we are about: quality and constructive discussion about the culture, profession and love of hacking.

This sub is aimed at those with an understanding of hacking - please visit /r/HowToHack for posting beginner links and tutorials; any beginner questions should be directed there as they will result in a ban here.

Guides and tutorials are welcome here as long as they are suitably complex and most importantly legal!

Bans are handed out at moderator discretion.

Another one got caught today, it's all over the papers. "Teenager Arrested in Computer Crime Scandal", "Hacker Arrested after Bank Tampering"...

Damn kids. They're all alike.


Rules:

  1. Keep it legal Hacking can be a grey area but keep it above board. Discussion around the legality of issues is ok, encouraging or aiding illegal activities is not

  2. We are not your personal army. This is not the place to try to find hackers to do your dirty work and you will be banned for trying. This includes:

  • Asking someone to hack for you
  • Trying to hire hackers
  • Asking for help with your DoS
  • Asking how to get into your "girlfriend's" instagram
  • Offering to do these things will also result in a ban
  • No "how do i start hacking?" posts. See /r/howtohack or the stickied post. Intermediate questions are welcomed - e.g. "How does HSTS prevent SSL stripping?" is a good question. "How do I hack wifi with Kali?" is bad.

  • No "I got hacked" posts unless it's an interesting post-mortem of a unique attack. Your nan being phished doesn't count.

  • Sharing of personal data is forbidden - no doxxing or IP dumping

  • Spam is strictly forbidden and will result in a ban. Professional promotion e.g. from security firms/pen testing companies is allowed within the confines of site-wide rules on self promotion found here, but will otherwise be considered spam.

  • Off-topic posts will be treated as spam.

  • Low-effort content will be removed at moderator discretion

  • We are not tech support, these posts should be kept on /r/techsupport

  • Don't be a dick. Play nice, support each other and encourage learning.


  • Recommended Subreddits:

    /r/hacking

    2,724,098 Subscribers

    0

    Curpsuite not opening in kali. Stuck on Splash screen

    I've run update, upgrade, and even dist upgrade. I'm running java 23-ea. I don't see any errors when running from terminal.

    https://preview.redd.it/8fz2x8pml09d1.png?width=1329&format=png&auto=webp&s=e9fd76c0f12c05239835e3f43ac0fa164c1fb9aa

    1 Comment
    2024/06/27
    01:11 UTC

    0

    Phone hacking?

    Okay so, not one of my usual inquires but…

    I need to know how (if it is possible) to decline an incoming call on a phone that isn’t my own phone. I have access to the phone which I need to do this to, so I could easily install something on it.

    Anyone have a solution for me? I’m not gonna explain my reasoning, but it harms no one I swear.

    4 Comments
    2024/06/26
    19:41 UTC

    1,726

    Which do you miss the most, if any?

    223 Comments
    2024/06/26
    15:54 UTC

    1

    Intercepting WPA2 Password from Walabot DIY 2?

    I am working on a project involving the Walabot, a device typically used for detecting structures within walls. My application, however, is a bit more complex—I create and stitch together heatmaps of objects through various materials using the Walabot. The original version of the device would tether over USB and didn't require any fancy interfacing.

    The newer, wireless model of Walabot I’m using generates its own Wi-Fi access point named "Walabot_40XXXXX2," but it's secured with a WPA2 Personal password, the app starts and finds said network and after a second or two begins to communicate and stream data the Walabot.

    The support team has been unclear or unable to understand my request, telling me its's "not open source" when asking for the WPA2 password. My thought is that it might unfortunately be using some type of rolling WPA code or that its generated per connection by making requests against some kind of backend.

    My first thought had been to try and intercept the communication with a wifi bridge running on a raspberry pi between the Walabot and the Phone with a pair of the RTL8821AU USB adapters I have and hopefully capture the password being transmitted, but I can't authenticate so that doesn't seem the workable.

    I know I am overthinking this, any software or hardware recommendations that could simplify this process?

    4 Comments
    2024/06/26
    04:50 UTC

    0

    Best phones for the job?

    Hi guys, what phones are best for changing their imei?

    If you have any affordable suggestions please let me know!

    Thanks in advance.

    9 Comments
    2024/06/26
    04:38 UTC

    1

    BloodHound CE refusing to work

    Hi All,

    Despite what has probably been days worth of attempts, I cannot seem to get BloodHound to work. The password that's supposed to generate never does. The only time it ever works is on a fresh install of both my Kali Linux VM and docker. Any ideas as to what could be causing this?

    This is what happens when I run the CE command for reference:

    curl -L https://ghst.ly/getbhce | docker compose -f - up
      % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                     Dload  Upload   Total   Spent    Left  Speed
    100   190  100   190    0     0    354      0 --:--:-- --:--:-- --:--:--   353
    100  3779  100  3779    0     0   3680      0  0:00:01  0:00:01 --:--:--  3680
    [+] Running 3/0
     ✔ Container kali-graph-db-1    Created                                                                                                                                                                                               0.0s 
     ✔ Container kali-app-db-1      Created                                                                                                                                                                                               0.0s 
     ✔ Container kali-bloodhound-1  Created                                                                                                                                                                                               0.0s 
    Attaching to app-db-1, bloodhound-1, graph-db-1
    app-db-1      | 
    app-db-1      | PostgreSQL Database directory appears to contain a database; Skipping initialization
    app-db-1      | 
    app-db-1      | 2024-06-24 22:17:37.835 UTC [1] LOG:  starting PostgreSQL 13.2 (Debian 13.2-1.pgdg100+1) on x86_64-pc-linux-gnu, compiled by gcc (Debian 8.3.0-6) 8.3.0, 64-bit
    app-db-1      | 2024-06-24 22:17:37.836 UTC [1] LOG:  listening on IPv4 address "0.0.0.0", port 5432
    app-db-1      | 2024-06-24 22:17:37.836 UTC [1] LOG:  listening on IPv6 address "::", port 5432
    app-db-1      | 2024-06-24 22:17:37.837 UTC [1] LOG:  listening on Unix socket "/var/run/postgresql/.s.PGSQL.5432"
    app-db-1      | 2024-06-24 22:17:37.842 UTC [26] LOG:  database system was shut down at 2024-06-24 01:09:16 UTC
    app-db-1      | 2024-06-24 22:17:37.848 UTC [1] LOG:  database system is ready to accept connections
    graph-db-1    | Changed password for user 'neo4j'. IMPORTANT: this change will only take effect if performed before the database is started for the first time.
    graph-db-1    | 2024-06-24 22:17:43.039+0000 INFO  Starting...
    graph-db-1    | 2024-06-24 22:17:43.483+0000 INFO  This instance is ServerId{a64e6864} (a64e6864-f5b4-4a80-9fd7-6b36fe107906)
    graph-db-1    | 2024-06-24 22:17:44.825+0000 INFO  ======== Neo4j 4.4.34 ========
    graph-db-1    | 2024-06-24 22:17:45.893+0000 INFO  Performing postInitialization step for component 'security-users' with version 3 and status CURRENT
    graph-db-1    | 2024-06-24 22:17:45.893+0000 INFO  Updating the initial password in component 'security-users'
    graph-db-1    | 2024-06-24 22:17:48.282+0000 INFO  Bolt enabled on [0:0:0:0:0:0:0:0%0]:7687.
    graph-db-1    | 2024-06-24 22:17:49.245+0000 INFO  Remote interface available at http://localhost:7474/
    graph-db-1    | 2024-06-24 22:17:49.250+0000 INFO  id: 963A3E4D8C908F6B217B1EC3AEC8FD6FE4332D96244BCE702E18C015C630C1F1
    graph-db-1    | 2024-06-24 22:17:49.250+0000 INFO  name: system
    graph-db-1    | 2024-06-24 22:17:49.251+0000 INFO  creationDate: 2024-06-13T16:48:45.929Z
    graph-db-1    | 2024-06-24 22:17:49.251+0000 INFO  Started.
    bloodhound-1  | {"level":"info","time":"2024-06-24T22:17:58.9828149Z","message":"Reading configuration found at /bloodhound.config.json"}
    bloodhound-1  | {"level":"info","time":"2024-06-24T22:17:58.990210847Z","message":"Logging configured"}
    bloodhound-1  | {"level":"info","time":"2024-06-24T22:17:59.09303125Z","message":"No database driver has been set for migration, using: neo4j"}
    bloodhound-1  | {"level":"info","time":"2024-06-24T22:17:59.093126633Z","message":"Connecting to graph using Neo4j"}
    bloodhound-1  | {"level":"info","time":"2024-06-24T22:17:59.112994306Z","message":"No new SQL migrations to run"}
    bloodhound-1  | {"level":"error","time":"2024-06-24T22:18:01.204519579Z","message":"Invalid neo4j configuration supplied; returning default values"}
    bloodhound-1  | {"level":"info","time":"2024-06-24T22:18:01.204731194Z","message":"Starting daemon API Daemon"}
    bloodhound-1  | {"level":"info","time":"2024-06-24T22:18:01.204741409Z","message":"Starting daemon Tools API"}
    bloodhound-1  | {"level":"info","time":"2024-06-24T22:18:01.204744621Z","message":"Starting daemon Data Pruning Daemon"}
    bloodhound-1  | {"level":"info","time":"2024-06-24T22:18:01.204747518Z","message":"Starting daemon Data Pipe Daemon"}
    bloodhound-1  | {"level":"info","time":"2024-06-24T22:18:01.20475059Z","message":"Server started successfully"}
    bloodhound-1  | {"level":"info","time":"2024-06-24T22:19:02.501916336Z","message":"Fetching group members for 10 AD nodes"}
    bloodhound-1  | {"level":"info","time":"2024-06-24T22:19:02.814084942Z","message":"Collected 5 group members"}
    bloodhound-1  | {"level":"info","time":"2024-06-24T22:19:03.94841676Z","message":"Expanding all AD group and local group memberships"}
    bloodhound-1  | {"level":"info","time":"2024-06-24T22:19:03.974732205Z","message":"Collected 52 groups to resolve"}
    bloodhound-1  | {"level":"info","time":"2024-06-24T22:19:04.700488023Z","message":"Finished post-processing 18 active directory computers"}
    bloodhound-1  | {"level":"info","time":"2024-06-24T22:19:04.853332373Z","message":"Finished building adcs cache"}
    bloodhound-1  | {"level":"info","time":"2024-06-24T22:19:05.23596484Z","message":"Started Data Quality Stats Collection"}
    bloodhound-1  | {"level":"info","time":"2024-06-24T22:19:05.555914546Z","message":"Cache successfully reset by datapipe daemon"}
    bloodhound-1  | {"level":"info","elapsed":4311.566385,"measurement_id":1,"time":"2024-06-24T22:19:05.556071505Z","message":"Graph Analysis"}
    1 Comment
    2024/06/26
    03:37 UTC

    1

    Is it normal for KOTH or challenges around getting root access to be so difficult

    I tried try hack me’s KOTH challenge and I made now progress, I honestly feel pretty terrible about it. I’m practicing a few ones on the platform as well as on rootme. But I’ve studying so much for such a long time and it stills feels like I know nothing.

    8 Comments
    2024/06/26
    02:40 UTC

    19

    How to avoid and prevent SIM Card swapping

    How to avoid and prevent SIM Card swapping

    My friend got his mobile number stolen essentially and is being used by someone else to get into his accounts(bank, credit cards, apple pay, etc.)

    Almost certain his mobile provider's support was social engineered into thinking it was him requesting a phone number transfer

    HOW DO WE PREPARE AGAINST THIS?? We can't stop social engineering, so what do we do for future?

    EDIT: Looks like the best things are: attempt to find a provider that will take seriously you saying "I want my account locked down tight, always require me to be there physically with ID before making changes or transferring my number", and don't rely on your mobile number for 2fa with everything

    Good luck finding a provider that takes your security concerns seriously though

    27 Comments
    2024/06/25
    23:10 UTC

    0

    Planet Fitness payment system.

    I noticed recently planet fitness doesn't allow their members to pay with credit card. Everything is dirctly with their bank accounts.

    I'm actually very surprised nobodys breached planet fitness appearing how lax they are on their security with the third party. Let alone breached third party.

    What do you think the outcome could be if somebody got a hold of direct bank account information?

    9 Comments
    2024/06/25
    23:05 UTC

    1

    Cellhawk/StingRay alternatives?

    Are there any phone number triangulation softwares that are not proprietary or reserved for law enforcement?

    4 Comments
    2024/06/25
    15:53 UTC

    13

    earlymoon v0.1.0 has been released

    Hellow gophers friends

    I just made a initial release (v0.1.0) of earlymooon.

    • A DNS query tool written in golang ✨
    • Not about the perfection, its about learning process:)

    🌟 Install it from:- https://github.com/codedsprit/earlymoon.git

    Feel free to contribute ❤️

    https://preview.redd.it/s7ehgnfhhq8d1.png?width=1366&format=png&auto=webp&s=38d1ae6e0bdd3d4babdae8c3eb62bf49c0e26d7a

    8 Comments
    2024/06/25
    15:11 UTC

    77

    Hack Apple Note hash

    UPDATE: the hash was cracked!! Thanks so much, we now got access to his bank account, I love you all.

    Trying to hack a secured note from a deceased friend, succeed to test all 4 characters password using hashcat on my 4080 Laptop GPU, took a good 7min, but alas, no password. trying higher char count obs increased the required time (12h for 5, 44days for 6 characters).
    Any other suggestions or reading about this subject?

    EDIT: Here is the hash: $ASN$*62*20000*bf5c2e2f4a2db130e5446b04cfce7b76*f271c4bab89a72be5925cf7f01a1721b3b568dc9e92f3b91
    I might try to setup an EC2 instance as well

    22 Comments
    2024/06/25
    15:10 UTC

    0

    O.MG cable experience?

    Has anyone here used the O.MG cable? I have several questions and desperately need help/guidance. Thank you!

    6 Comments
    2024/06/24
    17:52 UTC

    1,264

    Beware of the Dunning-Kruger effect 😂 Also beware of the ChatGPT “Hackers” 😂

    82 Comments
    2024/06/24
    14:26 UTC

    2,233

    Have anyone tried this before?

    Want to give it a try, my WiFi is slow. But it says it may take up to 30 days to start working. 🤣

    128 Comments
    2024/06/24
    02:04 UTC

    5

    RTL8188 monitor mode half-working

    I'm using an TP-Link TL-WN722N V2 adapter with the aircrack-ng modified driver for monitor mode on Arch Linux. However, the modified driver seems to work half of the time. It sometimes doesn't find devices and APs, sometimes packet injection doesn't work, and sometimes no devices appear in airodump-ng (and I get no packets in Wireshark on that interfave). I have the correct driver loaded, others are unloaded. Monitor mode starts fine and sometimes the adapter is working correctly. What could be the issue?

    0 Comments
    2024/06/24
    00:03 UTC

    5,309

    What kind of cyberattack would this be?

    604 Comments
    2024/06/23
    15:55 UTC

    139

    Brute Force in a Nutshell

    4 Comments
    2024/06/23
    02:17 UTC

    0

    How do you bypass a network blocking you off the internet

    I’ve tried changing my Mac Address through the registry but I didn’t work. I think the network is configured in a way that prevents me from bypassing it that way.

    Are there any other methods I can use, preferably without alerting the network administrator

    30 Comments
    2024/06/22
    22:25 UTC

    0

    How to make encoded .fbx files readable?

    I've got someone .fbx files I wanted to mess with in blender or Maya. I tried to open them, but got the "error these files might be damaged". Anyways, opened them up, and it's complete gibberish. How would I go about making them readable? They're not encrypted, other people have done it. I'm just not sure how to myself.

    6 Comments
    2024/06/22
    21:30 UTC

    6

    Is hamachi safe to use with friends that i trust but may have a infected system themselves?

    Any additional information I need to provide let me know

    As another alternative to hamachi me and friends could change the nat type to open, is that any safe? Thanks for reading

    34 Comments
    2024/06/22
    19:45 UTC

    9

    Degree requirement

    Hey there. I am really interested in hacking and cybersec and i was wondering which is best degree to do to end up being an ethical hacker for a company: CPE or CS?

    10 Comments
    2024/06/22
    19:43 UTC

    131

    Is SQL injection still a thing?

    Or is it now a thing of the past?

    77 Comments
    2024/06/22
    03:42 UTC

    0

    Apartment uses fobs for lock

    Apartment complex uses fob for front doors , entry doors and garage gates -- what if I have a flipper zero?

    8 Comments
    2024/06/22
    03:30 UTC

    Back To Top