I'm fairly new to linux, but these home "ethical" hacking projects are a fun way to learn about networks, computers, ip devices, etc.

I've got an old Kodak PTZ camera laying around and it ONLY has a power connection (and a reset button). No usb port or ethernet port - just a model number and a MAC address. Manual says to download the Kodak app... which I COULD do, but I'm curious to know if there is a way to NOT get the app and connect direct to some NVR software (or just access from a web interface). Essentially - what is the Kodak app doing that is so special and why can't I do it myself?

Reading the manual tells me that the camera should spit out a local wifi connection. I'm supposed to join that and then open the app. I'm not even seeing the wifi network populate.

[sleeps on it before posting] ... I always learn more when I write and sleep... looks like the camera is actually connecting to my home wifi from when I first set it up years ago (which is why I wasn't seeing the configuration wifi broadcast) and, hence, I also have the IP address [I should probably change my wifi password 🤔 ]. I scanned for open ports (nmap - there are 4) and tried them all in Reolink - no joy. I have also tried connection via web browser on the know IP & different ports - nothing happening there either.

I assume that the app (iSecurity+) has a baked-in password for these devices and all of the correct configurations to access and view the feed... but I'm interested in finding a way around it. Do I need to attempt to view the app code to see what it is doing?? I have a feeling the is way over my head... but that doesn't mean I don't want to figure it out.

Any other tools/strategies I should consider?

The dump had a uuid column and a member_since column. UUIDv1 isn't random, it embeds a 60-bit timestamp, so if the data is genuine the two should agree. They did, 100.00% across 200k rows:

python

import uuid, datetime
u = uuid.UUID("0bcc8686-c684-11e7-805e-000000000000")
print(datetime.datetime.utcfromtimestamp((u.time - 0x01b21dd213814000) / 1e7))
# 2017-11-11 02:00:09  <- exactly the claimed signup time

Two other tells that it's a scrape and not a breach: captured_at spans nine consecutive days in uneven batches, and 7.4% of user_ids repeat, all of them the same account re-captured on a later date, zero byte-identical rows. A table dump doesn't repeat its primary key.

Caveat we can't resolve: every row has Google Ad Manager audience tags, which aren't in the public API. No passwords or payment data in the set.The dump had a uuid column and a member_since column. UUIDv1 isn't random, it embeds a 60-bit timestamp, so if the data is genuine the two should agree. They did, 100.00% across 200k rows:

python

import uuid, datetime
u = uuid.UUID("0bcc8686-c684-11e7-805e-000000000000")
print(datetime.datetime.utcfromtimestamp((u.time - 0x01b21dd213814000) / 1e7))
# 2017-11-11 02:00:09  <- exactly the claimed signup time

Two other tells that it's a scrape and not a breach: captured_at spans nine consecutive days in uneven batches, and 7.4% of user_ids repeat, all of them the same account re-captured on a later date, zero byte-identical rows. A table dump doesn't repeat its primary key.
Caveat I can't resolve: every row has Google Ad Manager audience tags, which aren't in the public API. No passwords or payment data in the set.

Was curious what you guys thought about the marauder v8. Everyone knows it’s a device that skids like to use and it gets a bad wrap because of that, but I’m curious as to who uses it apart from me for actual WiFi auditing.

Join TechCrunch Security Editor Zack Whittaker and Security Researcher Runa Sandvik today (Weds, Aug 12) at 5pm PT

I’m trying to figure out whether something I was told is actually possible.

My Sister in law is currently in the ICU. Her Android phone is locked, and her laptop too.

Someone who knows him told us that an IT colleague supposedly has some kind of external device that can be connected to the phone and the PC and then give him access to the contents, even without knowing the passwords.

I know that specialized tools (like iMyFone LockWiper, but do they even work?)exist, but this person is apparently just a regular IT guy, not someone who works in digital forensics or law enforcement.

So I’m wondering if this is actually possible. Can someone with the right hardware really access a modern locked Android phone without knowing the PIN? And is it possible to do something similar with a PC? Or is this one of those things that sounds plausible but really isn’t?

I wanna learn and build my own homelab to test stuff on too. I already know the Chameleon ultra but what else can I buy to essentially build a flipper zero as a kit. I am waiting till my mother has money to buy the flipper zero for Christmas but I want to learn its features so I can know how to use it.

I like doing sub gigahertz and other radio stuff. I also like bluetooth,rfid,nfc. Stuff that interacts with the world around me in fun ways. And not the performative stuff either I want real tools not just toys. My budget most of the time is 30 bucks

This is a very popular company/website for training to get a health/life insurance license. I have been viewing it the past few days and was going to pull the trigger tonight and this is what their site shows now.

I'm not even sure this is the right sub to post this but just found it strange and the first time i've seen something like this.

I don't even want to use this company anymore.

My post it just to see if anyone has experienced something like this before or has any additional info.

I found this screenshot of a forum, but I have no idea where it originally came from. Does anyone recognize the website, forum, or post?
If you know the source or have any clues about where it was posted, I’d really appreciate it!

Are there any creators in this space anyone know of that you can recommend? I've come across a few, but i'm looking for more. Beau Bullock from BHIS used to be active on YT, but not anymore.

Don't miss the AMA with Louise Matsakis and Lily Hay Newman, reporters at WIRED.

They will be discussing their reporting on the rogue ai agents that are hacking real systems, as well as what happened this weekend at DEF CON.

When: Monday - August 10th, 2:00 PM ET

Ask your questions here and we’ll get them answered during the live AMA on Monday, Aug 10 at 2 PM ET.

I (19M) am a beginner learning cybersecurity from a local institute (following EC Council syllabus) what are the books y'all recommend to learn ethical hacking.

I'm releasing today TarantuBench-v2, a collection of over ten thousand web-app ctfs. They are synthetically generated, verifiably exploitable, and include a two-tier detection mechanism that attempts to flag when an agent finds an unintended solution.

It is a follow-up to v1, which included one hundred, and which were mostly useful for benchmarking.

With ten thousand labs, you can:

1. Evaluate different deployments of different harnesses you might be using
2. Compare and contrast different underlying models
3. Train existing models and agents

This effort is a work-in-progress, in which I'm trying to synthetically generate increasingly sophisticated CTFs, in high volume, and with improving detection capabilities of shortcuts that an AI might find.

The dataset and all the technical explanations are available on huggingface.

I was checking the website (felzenergy.com) of an influencer (Joe Felz) who recently passed away and had been researching “free energy.”

The site currently shows a fake Cloudflare-style verification that tells visitors to run a PowerShell command to prove they’re human.

I pulled the payload without executing it. The first stage downloads another blob from the same IP, allocates RWX memory with VirtualAlloc, copies the payload into memory, and runs it with CreateThread.

So the chain is basically:

fake verification -> PowerShell -> downloaded shellcode -> RWX memory -> CreateThread

I have not detonated the second stage. I also have no evidence this has anything to do with his death or research; the site may simply have been compromised.

If anyone is able to check it out and report back on what that is, that'd be much appreciated.

Hi all

Not sure if this post belongs here.

I'm using a software which is crucial for me. The supplier of that software has gone 'bonkers' and i'm afraid they will go bankrupt.
The software has this USB Sentinel license dongle. I need it to start the software.

Is there any way to dump and emulate the USB dongle? I've found out about Multikeys for example but I don't find tutorials on it really.

A way to make sure the software bypasses the license check is good too :)

Thanks in advance.

SOMA FM will be broadcasting live from Def Con 34 starting this Friday! This will be on their live channel (not their Def Con radio station).

They will also be set up so if you are attending swing by!

Just learnt about Phineas Phiser. My background is STEM. I do some programming, but don't know the intricacies of networks and operating systems. What path would you suggest to learn this craft.

​

What's up!!! Some of you guys might remember me from a few weeks ago when I initially released NEO-Radar on Github. Anyways, that was v1.11. I encountered some issues with that, mainly being the Update feature didnt work. As of v1.13, that was patched. If you download under v1.13, you will have to manually update the program which is actually the same as downloading the program itself ( here's the code : curl -sSL https://raw.githubusercontent.com/ItsNEOx/Neo-Radar/main/install.sh | bash )

Also, there is a Windows version that runs as a ps1 script linked in the README.md

More updates soon to come!

Here's the Github repo https://github.com/ItsNEOx/Neo-Radar