/r/blackhat

Photograph via snooOG

Focused on the ongoing discussion and documentation of vulnerabilities and exploitation techniques. Please read the rules before posting here.

We seek to discuss vulnerability and exploitation theory and [evading] the countermeasures used to deter exploitation. This is also a place to discuss general blackhat rules, etiquette and culture. We welcome:

  • Writeups (not CTF or HTB)/talks detailing new vulnerabilities or techniques (there should be enough information to reproduce the exploit/technique)

  • Proof of concepts of old vulnerabilities or techniques

  • Projects

  • Hypothetical questions

 

Rules:

  • Be excellent to each other.

  • No Solicitation

  • Stay on topic.

  • Avoid self-incriminating posts.

  • Pick a good title.

  • Do not post non-technical articles.

  • Ideally, the content should be original, we don't care about your crappy ARP poisoner or Kaspersky's latest scam.

  • No pay / signup walls.

  • No coin miners

  • No "Please hack X" posts

  • Well thought out and researched questions / answers only.

  • If your project is not free / open source it does not belong.

  • Please limit your posts (we don't want to read your blog three times a week).

  • If you want to submit a video, no one wants to listen to your cyberpunk music while you copy/paste commands into kali terminals.

The mods are ban-happy, you have been warned.

 

Other helpful links:

/r/blackhat

91,085 Subscribers

4

hypothetically if you found a bug that allows you upgrade seats for a flight, how would you exploit or make profit from it?

11 Comments
2024/06/28
01:16 UTC

0

Have a list with 1000 emails - which mailing software allows me to send them emails without their approval?

Title says it all. Tried to use mailchimp, and they banned me (and rightly so). Are there any mailing softwares that are a bit less exact?

Honestly, I don't mind too much if 900 of them get flagged as spam, as soon as some come through.

1 Comment
2024/06/27
10:40 UTC

0

black hat github ?

i’m looking for a more ’unmoderated‘ version of github . a website that has open source code and scripts that would otherwise be filtered by websites like github .

1 Comment
2024/06/27
10:39 UTC

1

Gathering information

If I hypothetically wanted to gather information on an individual who was blackmailing an underage friend of mine, How would some of you guys go about doing that?

Edit: In my hypothetical situation I’ve discovered that it’s a bunch of Nigerians in a centre- but thank you all for your advice

5 Comments
2024/06/25
08:38 UTC

0

Road to becoming a pentester

0 Comments
2024/06/22
10:03 UTC

21

How to be good at hacking/pentesting?

I'm not talking about how to learn hacking or what roadmap should i try for hacking.

I want to know what makes a hacker, good hacker. Is it just bunch of crammed knowledge about systems?
or is it having resources to buy zero days? or do i need to have higher iq to actually be good so that i can find my own multiple zero days for any system? Do i just need to stay at my room for 7 days straight testing buffer overflows and debuging?

Im confused here, i did eCPPTv3 INE course and few learning path on THM. Im preping for my exam. im doing HTB machines every day.

How can i be good? What do i not know that others might?

8 Comments
2024/06/22
07:54 UTC

0

password cracking and brute forcing

so i’m working on a project rn and long story short i need to brute force a password . what luck do you have with brute forcing passwords ? have wordlists and munging ever given you success ? and if not what would be a more effective way ?

11 Comments
2024/06/22
00:57 UTC

3

Malware

Hi all!

Apologies if this isn't the correct community!

I have developed a services that I would love to have a few testers try out for me. It's a malware scanning service. Simply send the file to an endpoint and await the result.

I've used 'theZoo' repo to test it, but wondered if anyone would like to give it a test. Happy to give out via inbox a few free API keys in return for some feedback and some legit malware to be tested to see if my service catches it or not.

3 Comments
2024/06/21
21:29 UTC

0

Bat script vs Powershell for obfuscation

This might be an overly short post but I was just curious to know if anyone has some experience in comparison to what type of scripts are more likely to invoke triggering windows defender when run on a remote system. I'm currently programming a script that automatically makes a hidden directory, downloads, unzips and autoconfigures a .conf file for monero mining then runs the .exe in the taskbar only, and that can be run on a remote system. I was curious to know if I'm better off scrapping the bat script I've already written and doing it in PowerShell for evasion reasons, or if it's better off I just keep it as a batch script? Sorry if this is a stupid post but I can't find any info online on what is more quiet when it comes to execution.

1 Comment
2024/06/21
02:35 UTC

0

How would I sell corporate information?

I'm a developer with access to sensitive information for a very big financial corporation, I have access to production data. Anyone has any idea how to do this?

14 Comments
2024/06/20
16:25 UTC

5

Youtube automation stations (discussion)

So I've been doing some fuckery with AI and python, I made a program that you give it a prompt like "make a 8 minute video about a youtuber that hates ai" and it generates a fully fledged 8 minute video with audio and images and visual effects

I was using APIs until now, openai GPT4o for chat completions to generate the entire story from the prompt

Then I'd split the story into paragraphs using new line as a delimiter

Now for each paragraph:

Use gpt again to turn the paragraph into a prompt for a visual image that matches the paragraph, and pass this on to DALLE3 to generate 6 images.

Now it uses the paragraph text to generate a audio.mp3 file for each paragraph using ElevenLabs natural language AI

Now it will create a video segment! With PyMovie. Or moviepy i forget lol. Using the audio it begins adding photographs it generated for 8 seconds each, until the end of the audio the last image only shows for X seconds left of the audio

When adding images to the video segments, I added code to add a fade animation. I do alternating of fading from 100-150% then 150-100% on the next one. The last image in a video segment fades to black

Now it stitches all the video segments together and overlays a random backing track from a list at 20% volume so there isn't ever silence when the ai doesn't talk

It can generate and render a 720p video in like 10 minutes!

The problem? Open ai is Hella expensive!! I spent $80 on the first day just coding the software and buggering around with it. I had thought I'd be scaling it running it all day but no! Heart sank

BUT then I realized a week later I can run models myself!

So now past few days I set up Ollama to run my own LLM locally, now I use "dolphin-llama3:8b" I think that's the name of the model. It's good enough for my use case and it's INSANELY FAST on my 4070 super with only 12 gigs vram. It hallucinates a lot but if you supply it with your own data while prompting then it's Hella good

Also to make images I'm using PonyDiffusionXL and PonyRealXL it's models from civitai , you get AI models as well as LORAs there (to control the style of the image)

Now I can generate an image locally in 10 seconds, with perfect hands and face etc, I can generate it in 720p and then use a hirez upscaler (like R-ESRGAN I think or similar name) to make the image 2K quality and the details just get better and more crisp when you do this

So right now I'm trying to combine my local models with my script that generates videos. Took a break and found this sub thought I'd share here.

Anyone wanna comment any twists they'd do? Shorts also do very well with this.

I'm also working on a way to get videos out of stable Diffusion by using the upscaler to generate very similar "frames" I think it's going to look very cool follow my profile for updates

And yes all the recent furry porn on my profile is ai generated lol I'm tryna hit all the niches

1 Comment
2024/06/20
16:06 UTC

0

What's the starter way to becoming a black hat?

I know there are coding lessons, youtube, udemy etc etc.. but i just don't know where to start. Linux is very important for cybersecurity and i'm trying to get my way around linux by using mint, (i've tried both ubuntu and mint based on ubuntu, but mint is better for me. [cinnamon]). I want to change my distro to a higher level distro as soon as i get some experience by using mint. Like arch specifically. I don't want to protect myself from attackers, i want to become the attacker.

(Sorry if this seems like a skid question lol)

67 Comments
2024/06/19
22:24 UTC

0

why doesn’t anyone wanna mentor ??

i’m (slightly) new to cybersecurity and would like to learn the unconventional and more practical ways of hacking alongside the traditional ‘penetration testing’ and ‘ethical hacking’ standard procedure of doing things . i get why they do it , but id like to learn the more niche and untapped into methods of doing things along with some relatively black hat methods that they’re not allowed to teach in ethical hacking courses . i’ll be a serious trainee , student , apprentice , whatever you wanna call it . and if you don’t like it or you don’t think i have what it takes then you can stop training me . but i seriously wanna be in a place where i can actually do things, make money , etc . Even if you have currently existing projects that i can maybe help you out on and learn along the way id be open to that .

if youre interested in something like this feel free to dm me .

11 Comments
2024/06/19
03:26 UTC

0

bypassing security measures

after obtaining credential how would one be able to use the information while simultaneously remains anonymous and bypassing various potential security methods such as 2 factor authentication and verification emails ? Dms are open if that’s what you prefer

i’m asking out of genuine curiosity , i haven’t obtained any credentials legally or illegally . it just had me wondering after hearing so many stories of how this happens pretty much daily

3 Comments
2024/06/19
03:17 UTC

0

ultimate anonymous setup

i’ve seen a lot of tutorials saying “how to be fully anonymous on the internet” and then they begin to say well it’s not actually FULLY anonymous . so what tools and techniques can i use to provide full anonymity ? assuming i even buy a whole new laptop for this specific purpose . would a bootable tails drive be my best bet ?

17 Comments
2024/06/18
16:49 UTC

0

Best RAT options to use on Ipad

I am new to cyber sec and would like to know more. For starters, I am trying to tinker with iPad ( which isn't jail-broken), and since it's my iPad but many of my houseemates also use it I want to keep monitoring what they are using and make sure they don't go through my stuff. ( Note : I can change my password but my parents forebayed it) . what are the best optons, spywhere app's I can use without being detected in my IPad, if not what can I do to keep an eye. I have a secret android phone and my Iphone which will be the best phone to access

3 Comments
2024/06/18
15:44 UTC

0

Where do I begin?

I would like to learn how to hack computers, phones, games, etc without being a script kiddie like I’ve been… where do I start to learn? Thank you :)

9 Comments
2024/06/17
07:50 UTC

0

DID Cause

4 Comments
2024/06/16
05:30 UTC

0

How to spoof my GPS location?

I need help spoofing my gps for dating apps There are some "Fake GPS" apps on play store that work for some minor dating apps but not the major ones (bumble/tinder) that have the most user base. My phone for dating is a android galaxy a1.

12 Comments
2024/06/14
00:21 UTC

0

I need help guys

I got approached by someone online trying to sell me a software which can take 1 video and make small minor changes (repurposing) the video so that I can post it across another 10 social media accounts.

I was hoping someone knew something about this as I would like to get involved.

I can pay too.

Thanks!

4 Comments
2024/06/13
19:03 UTC

0

I need help Guys

I need Antidetect 7 or 8 browser I searched a lot on internet but I can't find. Plz help me where can I find it.

2 Comments
2024/06/11
06:59 UTC

7

Not doing this but curious

What happens if I were to put an infected file in the cloud where other documents are placed? I was thinking of doing a transfer but not wanting to screw myself over by accident.

10 Comments
2024/06/09
13:49 UTC

0

Is ProtonVPN Safe in 2024?

9 Comments
2024/06/07
14:12 UTC

0

Next level scam baiting

So long story short, I'm sick of scammers trying to make a quick buck. While I'm mostly aware of most of the scams out there I believe not everyone is so if I can scare a scammer enough to even get them to stop trying to scam people for a couple days then that's a win.

I recently discovered r/scambaiting and found a lot of people just wasting scammers time which is great but I wanted more.

The main bit: I came across a site called grabify which basically tracks the person's (scammer's) info if they click in the link. I'm sure most of you will know more about how that works than me.

I want to be able to get more info than just a country and device (which I'm not even sure is accurate, I don't know). Naturally I don't want to break any laws or anything but if information is publicly available and can be used to perhaps find an address of a scammer or something else that they may think the authorities could use to track them down then that would be great.

I'm not unfamiliar with tech but would mostly be using a non-rooted android phone when dealing with the scammers so please keep that in mind. Some useful websites to get more information as described above would be much appreciated.

Thanks

8 Comments
2024/06/07
11:33 UTC

4

Wireshark tutorials

Any recommendations?

3 Comments
2024/06/06
19:15 UTC

0

Ways to get multiple cards to pay for ads on multiple Facebook accounts?

I am trying to create ads for my job. My boss wants to have a system were they have multiple Facebook ad accounts to keep posting ads consistently even if another account gets taken down. I have most of the system created, all I'm missing is a way to have multiple payment methods on each facebook account so its harder to get detected. My question is, is there a website that would sell empty paypal accounts? Or are the other strategies you guys recommend to have multiple credit cards per account or payment methods etc. Thanks again

1 Comment
2024/06/04
18:56 UTC

8

MSc Project on Cybersecurity Recommendations?

I'm beginning to do my final project for my master's degree and so far I'm having a hard time thinking of topics. One of my professors before suggested integration of malware analysis on IDP systems and while I only have three months to do this, I'm not that confident enough to actually achieve this, so I'm scouting around for more topics that I can choose from as my final project. I would really appreciate any ideas anyone can suggest. Thank you

5 Comments
2024/06/04
18:53 UTC

0

Accidentally tapped a link from a scam

So I accidentally tapped a link in my text in my phone from a scam. I suspect this is phishing. What are the chances I downloaded a virus and what can I do? It redirected me to a webpage warning me that my connection is not secure and ask if I wish to proceed.

Edit: Android phone, samsung browser that pop up.

Assume it does not have knox as I want a full understanding.

11 Comments
2024/06/02
12:48 UTC

Back To Top