Top Hat Hacking

I'm interested in hacking, medicine, world news and technology.

believer in only 2 genders, equality through struggle, and pro constitution

[Cyber_Racheal @CyberRacheal]

How DNS works

[Top Hat Hacking @TopHatHacking]

@elonmusk Money worth all comes back to supply of earth metals/resources.

AI cant create that.

[Elorm Daniel @elormkdaniel]

18 Linux commands every cybersecurity professional and enthusiasts should know.

[Abdulkadir | Cybersecurity @cyber_razz]

PYTHON PROJECTS FOR HACKING

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

Top 10 Bug Bounty Tools (Semi-Manual Hunts)
1.Burp Suite Professional
2.Browser DevTools (Chrome / Firefox) + FoxyProxy or pwnfox
3.ffuf
4.Amass
5.waybackurls / gau
6.autorize
https://t.co/OTnibQmHZM Dorking
8.Interactsh / Burp Collaborator
9.@KN0X55 / XSStrike / Dalfox
10.curl / httpie / jq

Manual in a sense of you determining exactly what Params to throw into tools like @KN0X55 instead of blindly chucking shit at the wall. I will still use tools like this if I have a hunch!

[Cyber Security News @The_Cyber_News]

⚠️ HikvisionExploiter – An Automated Exploitation Toolkit Targeting Hikvision IP Cameras

Read more: https://t.co/wHEJJ3IR8w

A new open-source tool called HikvisionExploiter has emerged, designed to automate attacks on vulnerable Hikvision IP cameras.

This Python-based utility targets unauthenticated endpoints in cameras running outdated firmware, such as version 3.1.3.150324.

It streamlines reconnaissance and exploitation, highlighting how easily exposed devices can be compromised for surveillance hijacking or credential theft. HikvisionExploiter performs a series of automated checks, starting with verifying access to the /onvif-http/snapshot endpoint to capture live images without authentication.

To Get Daily Security Updates, add Cyber Security News ® as your preferred source on Google -> https://t.co/N1wthFjc7B

#cybersecuritynews

[Top Hat Hacking @TopHatHacking]

@_winter_wonders Linux Lite

[Top Hat Hacking @TopHatHacking]

@Benathon @danielmakelley Blue team is where failed hackers go to get a paycheck.

[Security Trybe @SecurityTrybe]

Cybersecurity Tools by Category

[Bernie Sanders @BernieSanders]

This year, Trump’s Big Beautiful Bill gave:

Google an $18 billion tax break.

Amazon a $16 billion tax break.

Microsoft a $12 billion tax break.

Facebook an $11 billion tax break.

Now, they’re writing checks to Trump for his $300 million ballroom.

Gee, I wonder why?

[Thomas Roccia 🤘 @fr0gger_]

Even a decade later, this is still one of the best references on malware analysis. I remember spending an entire summer studying this book religiously. I owe the start of my career to it. Waiting for the update @nostarch 🤓

[Tech with Mak @techNmak]

[ Microservices - Authentication Mechanisms ] Give it a read 👇

Pro tip => These Authentication Mechanisms/Types are not limited just to microservices.

[1.] 𝐀𝐏𝐈 𝐊𝐞𝐲𝐬
◾ Simple, unique identifiers assigned to each client or service.
◾ Sent as a header or query parameter with each request.
◾ Best suited for internal services, less sensitive APIs, or for granting access to specific features.
◾ Easy to implement and manage.
◾ Not as secure as token-based methods. Keys can be easily leaked or stolen.

[2.] 𝐁𝐚𝐬𝐢𝐜 𝐀𝐮𝐭𝐡𝐞𝐧𝐭𝐢𝐜𝐚𝐭𝐢𝐨𝐧
◾ Username and password are sent in the Authorization header as base64 encoded string.
◾ Simple to implement but requires HTTPS to be secure.
◾ Suitable for simple scenarios with low-security requirements.
◾ Widely supported and easy to understand.
◾ Vulnerable to man-in-the-middle attacks if not used with HTTPS.
◾ Passwords are sent in cleartext (even when encoded).

[3.] 𝐉𝐒𝐎𝐍 𝐖𝐞𝐛 𝐓𝐨𝐤𝐞𝐧𝐬 (𝐉𝐖𝐓)
◾ Self-contained tokens that carry user information and claims in a JSON payload.
◾ Issued by an authentication server after successful login, then sent by the client in the Authorization header.
◾ Widely used for stateless authentication in microservices, single sign-on (SSO) and authorization.
◾ Stateless, secure, compact and can contain additional claims.
◾ Requires proper key management for signing and verification.

[4.] 𝐎𝐀𝐮𝐭𝐡 2.0
◾ An authorization framework allowing third-party applications to obtain limited access to resources on behalf of the resource owner (user) without sharing credentials.
◾ Uses various grant types (authorization code, implicit, client credentials, etc.) to obtain access tokens and refresh tokens.
◾ Widely used for user authorization and delegated access to APIs.
◾ Provides a standardized way to secure access to resources without sharing credentials.
◾ Can be complex to implement and requires careful consideration of security vulnerabilities.

[5.] 𝐎𝐩𝐞𝐧𝐈𝐃 𝐂𝐨𝐧𝐧𝐞𝐜𝐭 (𝐎𝐈𝐃𝐂)
◾ An identity layer on top of OAuth 2.0 that provides user authentication and profile information.
◾ Uses an ID token along with the access token to provide user identity information.
◾ Used for authentication in conjunction with OAuth 2.0 for authorization.
◾ Simplifies authentication by providing a standardized way to obtain user information.
◾ Requires integration with an OIDC provider (e.g., Google, Okta).

[6.] 𝐌𝐮𝐭𝐮𝐚𝐥 𝐓𝐋𝐒 (𝐦𝐓𝐋𝐒)
◾ Both client and server authenticate each other using X.509 certificates.
◾ Requires a certificate authority (CA) to issue and manage certificates.
◾ Best suited for securing communication between internal services or highly sensitive APIs.
◾ Strong security due to mutual authentication and encryption.
◾ More complex to set up and manage compared to other mechanisms.

_____

Follow - @techNmak

[Interesting STEM @InterestingSTEM]

Jaw correction surgery

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

I have 18!!! Hours of free bug bounty content out dude

https://t.co/8ES0KyhsQr

What are you waiting for? Get them crits!

[Top Hat Hacking @TopHatHacking]

@cyber_razz What is a ping?

[CTRLPew @CtrlPew2]

Todays Assigned Reading:
File Drop: The FMDA DD17.2 3D Printable Pistol Frame
Learn a skill.
Make a thing.
https://t.co/BrHkEkOmL7